============================================ WARNING: possible recursive locking detected 4.19.211-syzkaller #0 Not tainted -------------------------------------------- syz-executor.3/18454 is trying to acquire lock: 000000000d6a83f1 (&port_lock_key){-.-.}, at: uart_write+0x1ce/0x6f0 drivers/tty/serial/serial_core.c:591 but task is already holding lock: 000000000d6a83f1 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1876 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&port_lock_key); lock(&port_lock_key); *** DEADLOCK *** May be due to missing lock nesting notation 7 locks held by syz-executor.3/18454: #0: 000000004ef6f1d3 (sk_lock-AF_INET6){+.+.}, at: lock_sock include/net/sock.h:1512 [inline] #0: 000000004ef6f1d3 (sk_lock-AF_INET6){+.+.}, at: sctp_connect net/sctp/socket.c:4529 [inline] #0: 000000004ef6f1d3 (sk_lock-AF_INET6){+.+.}, at: sctp_inet_connect+0xa9/0x200 net/sctp/socket.c:4552 #1: 00000000aed0c6fc (rcu_read_lock){....}, at: sctp_copy_local_addr_list+0x0/0x4e0 net/sctp/protocol.c:376 #2: 00000000aed0c6fc (rcu_read_lock){....}, at: ieee80211_iterate_active_interfaces_atomic+0x0/0x170 net/mac80211/util.c:637 #3: 00000000aed0c6fc (rcu_read_lock){....}, at: __ieee80211_beacon_get+0x0/0x1a30 include/linux/compiler.h:263 #4: 000000005429514e (&(&i->lock)->rlock){-.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] #4: 000000005429514e (&(&i->lock)->rlock){-.-.}, at: serial8250_interrupt+0x3a/0x240 drivers/tty/serial/8250/8250_core.c:115 #5: 000000000d6a83f1 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1876 #6: 0000000017c43aed (&tty->ldisc_sem){++++}, at: tty_ldisc_ref+0x1d/0x80 drivers/tty/tty_ldisc.c:293 stack backtrace: CPU: 1 PID: 18454 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_deadlock_bug kernel/locking/lockdep.c:1764 [inline] check_deadlock kernel/locking/lockdep.c:1808 [inline] validate_chain kernel/locking/lockdep.c:2404 [inline] __lock_acquire.cold+0x121/0x57e kernel/locking/lockdep.c:3416 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152 uart_write+0x1ce/0x6f0 drivers/tty/serial/serial_core.c:591 n_hdlc_send_frames+0x278/0x470 drivers/tty/n_hdlc.c:403 n_hdlc_tty_wakeup+0xa0/0xc0 drivers/tty/n_hdlc.c:479 tty_wakeup+0xd4/0x110 drivers/tty/tty_io.c:534 tty_port_default_wakeup+0x26/0x40 drivers/tty/tty_port.c:50 serial8250_tx_chars+0x490/0xaf0 drivers/tty/serial/8250/8250_port.c:1813 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1900 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1873 [inline] serial8250_default_handle_irq+0xae/0x220 drivers/tty/serial/8250/8250_port.c:1916 serial8250_interrupt+0x101/0x240 drivers/tty/serial/8250/8250_core.c:125 __handle_irq_event_percpu+0x27e/0x8e0 kernel/irq/handle.c:149 handle_irq_event_percpu kernel/irq/handle.c:189 [inline] handle_irq_event+0x102/0x290 kernel/irq/handle.c:206 handle_edge_irq+0x260/0xcf0 kernel/irq/chip.c:800 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x93/0x1c0 arch/x86/kernel/irq.c:246 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 RIP: 0010:unwind_next_frame+0xe5f/0x1400 arch/x86/kernel/unwind_orc.c:572 Code: 4c 89 f2 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e a0 03 00 00 41 39 2e 0f 85 8f 00 00 00 48 b8 00 00 00 00 00 fc ff df <48> 8b 14 24 48 c1 ea 03 80 3c 02 00 0f 85 22 03 00 00 49 8d 7e 08 RSP: 0018:ffff8880ba107750 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffd5 RAX: dffffc0000000000 RBX: 1ffff11017420ef3 RCX: 0000000000000000 RDX: 1ffff11017420f10 RSI: ffff8880ba1076e0 RDI: ffff8880ba107b38 RBP: 0000000000000002 R08: 0000000000000001 R09: 0000000000000001 R10: ffff8880ba1078df R11: 0000000000074071 R12: ffff8880ba107b68 R13: ffff8880ba1078b5 R14: ffff8880ba107880 R15: ffffffff8b99dea0 __save_stack_trace+0xd6/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3689 [inline] __kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3703 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0xae/0x560 net/core/skbuff.c:205 __netdev_alloc_skb+0x76/0x460 net/core/skbuff.c:407 netdev_alloc_skb include/linux/skbuff.h:2680 [inline] dev_alloc_skb include/linux/skbuff.h:2693 [inline] __ieee80211_beacon_get+0xc7d/0x1a30 net/mac80211/tx.c:4352 ieee80211_beacon_get_tim+0x88/0x890 net/mac80211/tx.c:4463 ieee80211_beacon_get include/net/mac80211.h:4484 [inline] mac80211_hwsim_beacon_tx+0xff/0x680 drivers/net/wireless/mac80211_hwsim.c:1577 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__should_failslab+0x0/0x180 mm/failslab.c:18 Code: ff 48 8b 44 24 18 65 48 2b 04 25 28 00 00 00 75 09 48 83 c4 20 5b 5d 41 5c c3 e8 ab 2c 9f ff 90 90 90 90 90 90 90 90 90 90 90 <41> 54 55 89 f5 53 48 89 fb e8 02 0c ca ff 48 c7 c0 60 1c 25 8d 48 RSP: 0018:ffff888055d0fa38 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000007 RBX: 0000000000488020 RCX: ffffc90008886000 RDX: 0000000000000000 RSI: 0000000000488020 RDI: ffff88813bff0340 RBP: 0000000000488020 R08: 0000000000480020 R09: 0000000000000000 R10: 0000000000000005 R11: 00000000bb193be9 R12: 0000000000000000 R13: ffff88813bff0340 R14: 0000000000000040 R15: 0000000000488020 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc_trace+0x46/0x380 mm/slab.c:3623 kmalloc include/linux/slab.h:515 [inline] kzalloc include/linux/slab.h:709 [inline] sctp_add_bind_addr+0x77/0x370 net/sctp/bind_addr.c:159 sctp_copy_local_addr_list+0x33e/0x4e0 net/sctp/protocol.c:180 sctp_copy_one_addr net/sctp/bind_addr.c:452 [inline] sctp_bind_addr_copy+0xde/0x470 net/sctp/bind_addr.c:71 __sctp_connect+0x739/0xd00 net/sctp/socket.c:1228 sctp_connect net/sctp/socket.c:4537 [inline] sctp_inet_connect+0x15e/0x200 net/sctp/socket.c:4552 __sys_connect+0x265/0x2c0 net/socket.c:1775 __do_sys_connect net/socket.c:1786 [inline] __se_sys_connect net/socket.c:1783 [inline] __x64_sys_connect+0x6f/0xb0 net/socket.c:1783 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f95627fa5a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f956116e168 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f956291bf80 RCX: 00007f95627fa5a9 RDX: 000000000000001c RSI: 0000000020000000 RDI: 0000000000000004 RBP: 00007f9562855580 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc6c396eff R14: 00007f956116e300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 4c 89 f2 mov %r14,%rdx 3: 48 c1 ea 03 shr $0x3,%rdx 7: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax b: 84 c0 test %al,%al d: 74 08 je 0x17 f: 3c 03 cmp $0x3,%al 11: 0f 8e a0 03 00 00 jle 0x3b7 17: 41 39 2e cmp %ebp,(%r14) 1a: 0f 85 8f 00 00 00 jne 0xaf 20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 27: fc ff df * 2a: 48 8b 14 24 mov (%rsp),%rdx <-- trapping instruction 2e: 48 c1 ea 03 shr $0x3,%rdx 32: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 36: 0f 85 22 03 00 00 jne 0x35e 3c: 49 8d 7e 08 lea 0x8(%r14),%rdi