FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 0 ====================================================== WARNING: possible circular locking dependency detected 6.1.139-syzkaller #0 Not tainted ------------------------------------------------------ syz.2.3622/14930 is trying to acquire lock: ffffffff8c91ecc0 (console_owner){-...}-{0:0}, at: console_lock_spinning_enable kernel/printk/printk.c:1818 [inline] ffffffff8c91ecc0 (console_owner){-...}-{0:0}, at: console_emit_next_record+0x82d/0xc90 kernel/printk/printk.c:2774 but task is already holding lock: ffff8880b8e3aa58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0x2e/0x40 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537 raw_spin_rq_lock kernel/sched/sched.h:1355 [inline] rq_lock kernel/sched/sched.h:1645 [inline] task_fork_fair+0x5c/0x350 kernel/sched/fair.c:11888 sched_cgroup_fork+0x32c/0x3c0 kernel/sched/core.c:4685 copy_process+0x248b/0x4060 kernel/fork.c:2383 kernel_clone+0x225/0x8b0 kernel/fork.c:2681 user_mode_thread+0xda/0x130 kernel/fork.c:2757 rest_init+0x23/0x300 init/main.c:698 start_kernel+0x0/0x539 init/main.c:893 start_kernel+0x490/0x539 init/main.c:1140 secondary_startup_64_no_verify+0xcf/0xdb -> #3 (&p->pi_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162 try_to_wake_up+0x5c/0x1080 kernel/sched/core.c:4111 __wake_up_common+0x2a4/0x4e0 kernel/sched/wait.c:107 __wake_up_common_lock kernel/sched/wait.c:138 [inline] __wake_up+0x10e/0x190 kernel/sched/wait.c:160 tty_port_default_wakeup+0x9e/0xf0 drivers/tty/tty_port.c:71 serial8250_tx_chars+0x629/0x830 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq+0x516/0x6d0 drivers/tty/serial/8250/8250_port.c:1961 serial8250_default_handle_irq+0xb4/0x1a0 drivers/tty/serial/8250/8250_port.c:1981 serial8250_interrupt+0x9b/0x1c0 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x298/0xa30 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0x87/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x243/0xb20 kernel/irq/chip.c:819 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:233 [inline] __common_interrupt+0xd7/0x1e0 arch/x86/kernel/irq.c:252 common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:242 asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:682 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] default_idle+0xb/0x10 arch/x86/kernel/process.c:735 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x1fc/0x570 kernel/sched/idle.c:303 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:401 rest_init+0x2dc/0x300 init/main.c:733 start_kernel+0x0/0x539 init/main.c:893 start_kernel+0x490/0x539 init/main.c:1140 secondary_startup_64_no_verify+0xcf/0xdb -> #2 (&tty->write_wait){-...}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:137 [inline] __wake_up+0xf4/0x190 kernel/sched/wait.c:160 tty_port_default_wakeup+0x9e/0xf0 drivers/tty/tty_port.c:71 serial8250_tx_chars+0x629/0x830 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq+0x516/0x6d0 drivers/tty/serial/8250/8250_port.c:1961 serial8250_default_handle_irq+0xb4/0x1a0 drivers/tty/serial/8250/8250_port.c:1981 serial8250_interrupt+0x9b/0x1c0 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x298/0xa30 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0x87/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x243/0xb20 kernel/irq/chip.c:819 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:233 [inline] __common_interrupt+0xd7/0x1e0 arch/x86/kernel/irq.c:252 common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:242 asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:682 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] default_idle+0xb/0x10 arch/x86/kernel/process.c:735 default_idle_call+0x84/0xc0 kernel/sched/idle.c:109 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x1fc/0x570 kernel/sched/idle.c:303 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:401 rest_init+0x2dc/0x300 init/main.c:733 start_kernel+0x0/0x539 init/main.c:893 start_kernel+0x490/0x539 init/main.c:1140 secondary_startup_64_no_verify+0xcf/0xdb -> #1 (&port_lock_key){-...}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa4/0xf0 kernel/locking/spinlock.c:162 serial8250_console_write+0x169/0x17a0 drivers/tty/serial/8250/8250_port.c:3433 call_console_driver kernel/printk/printk.c:1977 [inline] console_emit_next_record+0x947/0xc90 kernel/printk/printk.c:2777 console_flush_all kernel/printk/printk.c:-1 [inline] console_unlock+0x223/0x630 kernel/printk/printk.c:2906 vprintk_emit+0x489/0x680 kernel/printk/printk.c:2303 _printk+0xcc/0x110 kernel/printk/printk.c:2328 register_console+0x6c6/0x9c0 kernel/printk/printk.c:3269 univ8250_console_init+0x41/0x43 drivers/tty/serial/8250/8250_core.c:687 console_init+0x1bc/0x78e kernel/printk/printk.c:3359 start_kernel+0x303/0x539 init/main.c:1076 secondary_startup_64_no_verify+0xcf/0xdb -> #0 (console_owner){-...}-{0:0}: check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662 console_lock_spinning_enable kernel/printk/printk.c:1818 [inline] console_emit_next_record+0x84c/0xc90 kernel/printk/printk.c:2774 console_flush_all kernel/printk/printk.c:-1 [inline] console_unlock+0x223/0x630 kernel/printk/printk.c:2906 vprintk_emit+0x489/0x680 kernel/printk/printk.c:2303 _printk+0xcc/0x110 kernel/printk/printk.c:2328 fail_dump lib/fault-inject.c:45 [inline] should_fail_ex+0x37a/0x4d0 lib/fault-inject.c:147 strncpy_from_user+0x32/0x350 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x6d/0x140 mm/maccess.c:186 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:204 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline] bpf_probe_read_compat_str+0xdd/0x170 kernel/trace/bpf_trace.c:306 bpf_prog_c1796171ffc7efef+0x35/0x37 bpf_dispatcher_nop_func include/linux/bpf.h:1001 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline] bpf_trace_run4+0x1f5/0x420 kernel/trace/bpf_trace.c:2326 __traceiter_sched_switch+0x8f/0xc0 include/trace/events/sched.h:222 trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x1d32/0x40d0 kernel/sched/core.c:6558 preempt_schedule_irq+0xb1/0x150 kernel/sched/core.c:6873 irqentry_exit+0x63/0x70 kernel/entry/common.c:439 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 exit_to_user_mode_loop+0x40/0x110 kernel/entry/common.c:164 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:316 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 other info that might help us debug this: Chain exists of: console_owner --> &p->pi_lock --> &rq->__lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rq->__lock); lock(&p->pi_lock); lock(&rq->__lock); lock(console_owner); *** DEADLOCK *** 3 locks held by syz.2.3622/14930: #0: ffff8880b8e3aa58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537 #1: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #1: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #1: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2284 [inline] #1: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0xf9/0x420 kernel/trace/bpf_trace.c:2326 #2: ffffffff8c91eda0 (console_lock){+.+.}-{0:0}, at: _printk+0xcc/0x110 kernel/printk/printk.c:2328 stack backtrace: CPU: 0 PID: 14930 Comm: syz.2.3622 Not tainted 6.1.139-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2170 check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662 console_lock_spinning_enable kernel/printk/printk.c:1818 [inline] console_emit_next_record+0x84c/0xc90 kernel/printk/printk.c:2774 console_flush_all kernel/printk/printk.c:-1 [inline] console_unlock+0x223/0x630 kernel/printk/printk.c:2906 vprintk_emit+0x489/0x680 kernel/printk/printk.c:2303 _printk+0xcc/0x110 kernel/printk/printk.c:2328 fail_dump lib/fault-inject.c:45 [inline] should_fail_ex+0x37a/0x4d0 lib/fault-inject.c:147 strncpy_from_user+0x32/0x350 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x6d/0x140 mm/maccess.c:186 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:204 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline] bpf_probe_read_compat_str+0xdd/0x170 kernel/trace/bpf_trace.c:306 bpf_prog_c1796171ffc7efef+0x35/0x37 bpf_dispatcher_nop_func include/linux/bpf.h:1001 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline] bpf_trace_run4+0x1f5/0x420 kernel/trace/bpf_trace.c:2326 __traceiter_sched_switch+0x8f/0xc0 include/trace/events/sched.h:222 trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x1d32/0x40d0 kernel/sched/core.c:6558 preempt_schedule_irq+0xb1/0x150 kernel/sched/core.c:6873 irqentry_exit+0x63/0x70 kernel/entry/common.c:439 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:exit_to_user_mode_loop+0x40/0x110 kernel/entry/common.c:164 Code: fb eb 1d e8 82 65 a1 08 65 48 8b 05 4a 9f 94 7e 4c 8b 30 41 f7 c6 0e 30 02 00 0f 84 c4 00 00 00 e8 e5 62 19 00 fb 41 f6 c6 08 <74> 05 e8 99 df a9 08 41 f7 c6 00 10 00 00 74 08 48 89 df e8 98 a9 RSP: 0000:ffffc90003c37f10 EFLAGS: 00000202 RAX: aad9bd211480f200 RBX: ffffc90003c37f58 RCX: aad9bd211480f200 RDX: dffffc0000000000 RSI: ffffffff8a6c0000 RDI: ffffffff8abf1020 RBP: 0000000000000000 R08: ffffffff8f7cd008 R09: ffffffff8f7cd018 R10: ffffffff8f7cd010 R11: ffffffff8f7cd003 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000008 R15: ffff888036f4d940 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:316 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0033:0x7f6a26655c6d Code: 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 3d 8d fa e8 00 00 0f 84 9b 00 00 00 53 48 89 fb 48 85 ff 74 1a 80 3d 4b c4 35 00 00 <75> 33 48 8b 43 10 48 c7 00 00 00 00 00 c6 43 38 00 5b c3 64 48 8b RSP: 002b:00007f6a27590050 EFLAGS: 00000246 RAX: 00007f6a269b5fa0 RBX: 00007f6a269b6038 RCX: 0000000000000000 RDX: 00007f6a27590090 RSI: 00007f6a27590090 RDI: 00007f6a269b6038 RBP: 00007f6a27590090 R08: 0000000000000000 R09: 00007f6a2758fdf7 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 R13: 0000000000000000 R14: 00007f6a269b5fa0 R15: 00007ffccc3dae48 CPU: 0 PID: 14930 Comm: syz.2.3622 Not tainted 6.1.139-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 fail_dump lib/fault-inject.c:52 [inline] should_fail_ex+0x399/0x4d0 lib/fault-inject.c:147 strncpy_from_user+0x32/0x350 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x6d/0x140 mm/maccess.c:186 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:204 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline] bpf_probe_read_compat_str+0xdd/0x170 kernel/trace/bpf_trace.c:306 bpf_prog_c1796171ffc7efef+0x35/0x37 bpf_dispatcher_nop_func include/linux/bpf.h:1001 [inline] __bpf_prog_run include/linux/filter.h:603 [inline] bpf_prog_run include/linux/filter.h:610 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2285 [inline] bpf_trace_run4+0x1f5/0x420 kernel/trace/bpf_trace.c:2326 __traceiter_sched_switch+0x8f/0xc0 include/trace/events/sched.h:222 trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x1d32/0x40d0 kernel/sched/core.c:6558 preempt_schedule_irq+0xb1/0x150 kernel/sched/core.c:6873 irqentry_exit+0x63/0x70 kernel/entry/common.c:439 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:exit_to_user_mode_loop+0x40/0x110 kernel/entry/common.c:164 Code: fb eb 1d e8 82 65 a1 08 65 48 8b 05 4a 9f 94 7e 4c 8b 30 41 f7 c6 0e 30 02 00 0f 84 c4 00 00 00 e8 e5 62 19 00 fb 41 f6 c6 08 <74> 05 e8 99 df a9 08 41 f7 c6 00 10 00 00 74 08 48 89 df e8 98 a9 RSP: 0000:ffffc90003c37f10 EFLAGS: 00000202 RAX: aad9bd211480f200 RBX: ffffc90003c37f58 RCX: aad9bd211480f200 RDX: dffffc0000000000 RSI: ffffffff8a6c0000 RDI: ffffffff8abf1020 RBP: 0000000000000000 R08: ffffffff8f7cd008 R09: ffffffff8f7cd018 R10: ffffffff8f7cd010 R11: ffffffff8f7cd003 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000008 R15: ffff888036f4d940 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:316 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0033:0x7f6a26655c6d Code: 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 3d 8d fa e8 00 00 0f 84 9b 00 00 00 53 48 89 fb 48 85 ff 74 1a 80 3d 4b c4 35 00 00 <75> 33 48 8b 43 10 48 c7 00 00 00 00 00 c6 43 38 00 5b c3 64 48 8b RSP: 002b:00007f6a27590050 EFLAGS: 00000246 RAX: 00007f6a269b5fa0 RBX: 00007f6a269b6038 RCX: 0000000000000000 RDX: 00007f6a27590090 RSI: 00007f6a27590090 RDI: 00007f6a269b6038 RBP: 00007f6a27590090 R08: 0000000000000000 R09: 00007f6a2758fdf7 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 R13: 0000000000000000 R14: 00007f6a269b5fa0 R15: 00007ffccc3dae48 ---------------- Code disassembly (best guess): 0: fb sti 1: eb 1d jmp 0x20 3: e8 82 65 a1 08 call 0x8a1658a 8: 65 48 8b 05 4a 9f 94 mov %gs:0x7e949f4a(%rip),%rax # 0x7e949f5a f: 7e 10: 4c 8b 30 mov (%rax),%r14 13: 41 f7 c6 0e 30 02 00 test $0x2300e,%r14d 1a: 0f 84 c4 00 00 00 je 0xe4 20: e8 e5 62 19 00 call 0x19630a 25: fb sti 26: 41 f6 c6 08 test $0x8,%r14b * 2a: 74 05 je 0x31 <-- trapping instruction 2c: e8 99 df a9 08 call 0x8a9dfca 31: 41 f7 c6 00 10 00 00 test $0x1000,%r14d 38: 74 08 je 0x42 3a: 48 89 df mov %rbx,%rdi 3d: e8 .byte 0xe8 3e: 98 cwtl 3f: a9 .byte 0xa9