======================================================
WARNING: possible circular locking dependency detected
4.14.0+ #183 Not tainted
------------------------------------------------------
syz-executor0/10545 is trying to acquire lock:
 (console_lock){+.+.}, at: [<ffffffff82879ad9>] vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219

but task is already holding lock:
 (&pipe->mutex/1){+.+.}, at: [<ffffffff81afef26>] pipe_lock_nested fs/pipe.c:67 [inline]
 (&pipe->mutex/1){+.+.}, at: [<ffffffff81afef26>] pipe_lock+0x56/0x70 fs/pipe.c:75

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&pipe->mutex/1){+.+.}:
       lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893
       mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
       pipe_lock_nested fs/pipe.c:67 [inline]
       pipe_lock+0x56/0x70 fs/pipe.c:75
       iter_file_splice_write+0x264/0xf30 fs/splice.c:699
       do_splice_from fs/splice.c:851 [inline]
       do_splice fs/splice.c:1147 [inline]
       SYSC_splice fs/splice.c:1402 [inline]
       SyS_splice+0x7d5/0x1630 fs/splice.c:1382
       entry_SYSCALL_64_fastpath+0x1f/0x96

-> #2 (sb_writers){.+.+}:
       spin_lock include/linux/spinlock.h:315 [inline]
       fast_dput fs/dcache.c:687 [inline]
       dput.part.23+0x492/0x830 fs/dcache.c:794

-> #1 ((completion)&req.done){+.+.}:
       lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004
       complete_acquire include/linux/completion.h:40 [inline]
       __wait_for_common kernel/sched/completion.c:109 [inline]
       wait_for_common kernel/sched/completion.c:123 [inline]
       wait_for_completion+0xcb/0x7b0 kernel/sched/completion.c:144
       devtmpfs_create_node+0x32b/0x4a0 drivers/base/devtmpfs.c:115
       device_add+0x120f/0x1640 drivers/base/core.c:1824
       device_create_groups_vargs+0x1f3/0x250 drivers/base/core.c:2430
       device_create_vargs drivers/base/core.c:2470 [inline]
       device_create+0xda/0x110 drivers/base/core.c:2506
       vcs_make_sysfs+0x35/0x60 drivers/tty/vt/vc_screen.c:629
       vc_allocate+0x4b7/0x6b0 drivers/tty/vt/vt.c:797
       con_install+0x52/0x440 drivers/tty/vt/vt.c:2876
       tty_driver_install_tty drivers/tty/tty_io.c:1215 [inline]
       tty_init_dev+0xf6/0x4a0 drivers/tty/tty_io.c:1315
       tty_open_by_driver drivers/tty/tty_io.c:1942 [inline]
       tty_open+0x608/0xab0 drivers/tty/tty_io.c:1990
       chrdev_open+0x257/0x730 fs/char_dev.c:417
       do_dentry_open+0x682/0xd70 fs/open.c:752
       vfs_open+0x107/0x230 fs/open.c:866
       do_last fs/namei.c:3388 [inline]
       path_openat+0x1157/0x3530 fs/namei.c:3528
       do_filp_open+0x25b/0x3b0 fs/namei.c:3563
       do_sys_open+0x502/0x6d0 fs/open.c:1059
       SYSC_open fs/open.c:1077 [inline]
       SyS_open+0x2d/0x40 fs/open.c:1072
       entry_SYSCALL_64_fastpath+0x1f/0x96

-> #0 (console_lock){+.+.}:
       check_prevs_add kernel/locking/lockdep.c:2031 [inline]
       validate_chain kernel/locking/lockdep.c:2473 [inline]
       __lock_acquire+0x3498/0x47f0 kernel/locking/lockdep.c:3500
       lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004
       console_lock+0x4b/0x80 kernel/printk/printk.c:2047
       vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219
       do_loop_readv_writev fs/read_write.c:673 [inline]
       do_iter_read+0x3db/0x5b0 fs/read_write.c:897
       vfs_readv+0x121/0x1c0 fs/read_write.c:959
       kernel_readv fs/splice.c:361 [inline]
       default_file_splice_read+0x508/0xae0 fs/splice.c:416
       do_splice_to+0x110/0x170 fs/splice.c:880
       do_splice fs/splice.c:1173 [inline]
       SYSC_splice fs/splice.c:1402 [inline]
       SyS_splice+0x11a8/0x1630 fs/splice.c:1382
       entry_SYSCALL_64_fastpath+0x1f/0x96

other info that might help us debug this:

Chain exists of:
  console_lock --> sb_writers --> &pipe->mutex/1

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&pipe->mutex/1);
                               lock(sb_writers);
                               lock(&pipe->mutex/1);
  lock(console_lock);

 *** DEADLOCK ***

1 lock held by syz-executor0/10545:
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff81afef26>] pipe_lock_nested fs/pipe.c:67 [inline]
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff81afef26>] pipe_lock+0x56/0x70 fs/pipe.c:75

stack backtrace:
CPU: 1 PID: 10545 Comm: syz-executor0 Not tainted 4.14.0+ #183
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 print_circular_bug+0x42d/0x610 kernel/locking/lockdep.c:1271
 check_prev_add+0x666/0x15f0 kernel/locking/lockdep.c:1914
 check_prevs_add kernel/locking/lockdep.c:2031 [inline]
 validate_chain kernel/locking/lockdep.c:2473 [inline]
 __lock_acquire+0x3498/0x47f0 kernel/locking/lockdep.c:3500
 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004
 console_lock+0x4b/0x80 kernel/printk/printk.c:2047
 vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219
 do_loop_readv_writev fs/read_write.c:673 [inline]
 do_iter_read+0x3db/0x5b0 fs/read_write.c:897
 vfs_readv+0x121/0x1c0 fs/read_write.c:959
 kernel_readv fs/splice.c:361 [inline]
 default_file_splice_read+0x508/0xae0 fs/splice.c:416
 do_splice_to+0x110/0x170 fs/splice.c:880
 do_splice fs/splice.c:1173 [inline]
 SYSC_splice fs/splice.c:1402 [inline]
 SyS_splice+0x11a8/0x1630 fs/splice.c:1382
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x452879
RSP: 002b:00007f7a3595ebe8 EFLAGS: 00000212 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452879
RDX: 0000000000000017 RSI: 0000000000000000 RDI: 0000000000000013
RBP: 0000000000000086 R08: 0000000000000003 R09: 0000000000000008
R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f4d68
R13: 00000000ffffffff R14: 00007f7a3595f6d4 R15: 0000000000000000
kvm pmu: pin control bit is ignored
kvm_pmu: event creation failed -2
QAT: Invalid ioctl
QAT: Invalid ioctl
syz3: renamed from lo
QAT: Invalid ioctl
device eql entered promiscuous mode
QAT: Invalid ioctl
nla_parse: 7 callbacks suppressed
netlink: 6 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 6 bytes leftover after parsing attributes in process `syz-executor3'.
QAT: Invalid ioctl
QAT: Invalid ioctl
kauditd_printk_skb: 148 callbacks suppressed
audit: type=1326 audit(1511003675.455:5740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11145 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x0
audit: type=1326 audit(1511003675.519:5741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11145 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x0
could not allocate digest TFM handle ctr
erpent)
could not allocate digest TFM handle ctr
erpent)
sctp: [Deprecated]: syz-executor1 (pid 11378) Use of int in max_burst socket option deprecated.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor1 (pid 11409) Use of int in max_burst socket option deprecated.
Use struct sctp_assoc_value instead
8021q: VLANs not supported on syz3
8021q: VLANs not supported on syz3
netlink: 10 bytes leftover after parsing attributes in process `syz-executor1'.
netlink: 10 bytes leftover after parsing attributes in process `syz-executor1'.
audit: type=1326 audit(1511003676.613:5742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11526 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0xffff0000
audit: type=1326 audit(1511003676.762:5743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11526 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0xffff0000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 0 PID: 11654 Comm: syz-executor7 Not tainted 4.14.0+ #183
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail+0x8c0/0xa40 lib/fault-inject.c:149
 should_failslab+0xec/0x120 mm/failslab.c:32
 slab_pre_alloc_hook mm/slab.h:421 [inline]
 slab_alloc mm/slab.c:3371 [inline]
 __do_kmalloc mm/slab.c:3709 [inline]
 __kmalloc+0x63/0x760 mm/slab.c:3720
 kmalloc include/linux/slab.h:504 [inline]
 kzalloc include/linux/slab.h:688 [inline]
 rds_message_alloc+0xb1/0x330 net/rds/message.c:202
 rds_sendmsg+0xb52/0x1f90 net/rds/send.c:1086
 sock_sendmsg_nosec net/socket.c:632 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:642
 SYSC_sendto+0x358/0x5a0 net/socket.c:1749
 SyS_sendto+0x40/0x50 net/socket.c:1717
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x452879
RSP: 002b:00007fad31b28be8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000007580d8 RCX: 0000000000452879
RDX: 0000000000000002 RSI: 0000000020fbffff RDI: 0000000000000013
RBP: 00007fad31b28a20 R08: 0000000020fc9000 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004b757e
R13: 00007fad31b28b58 R14: 00000000004b758e R15: 0000000000000000
audit: type=1326 audit(1511003677.051:5744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11658 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0xffff0000
audit: type=1326 audit(1511003677.197:5745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11658 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0xffff0000
sock: process `syz-executor1' is using obsolete setsockopt SO_BSDCOMPAT
QAT: Invalid ioctl
QAT: Invalid ioctl
netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 2 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 2 bytes leftover after parsing attributes in process `syz-executor2'.
device gre0 entered promiscuous mode
audit: type=1326 audit(1511003677.909:5746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11832 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x0
device gre0 entered promiscuous mode
device gre0 entered promiscuous mode
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
QAT: Invalid ioctl
audit: type=1326 audit(1511003677.934:5747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=11832 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x0
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11968 comm=syz-executor5
kvm_hv_set_msr: 12 callbacks suppressed
kvm [11974]: vcpu0, guest rIP: 0x0 Hyper-V uhandled wrmsr: 0x40000087 data 0x10000001000
kvm [11974]: vcpu0, guest rIP: 0xf Hyper-V uhandled wrmsr: 0x40000087 data 0x10000001000
kvm [12036]: vcpu0, guest rIP: 0x0 Hyper-V uhandled wrmsr: 0x40000087 data 0x10000001000
kvm [12039]: vcpu0, guest rIP: 0x0 Hyper-V uhandled wrmsr: 0x40000087 data 0x10000001000
kvm [12036]: vcpu0, guest rIP: 0x0 Hyper-V uhandled wrmsr: 0x40000087 data 0x10000001000
kvm [12039]: vcpu0, guest rIP: 0x0 Hyper-V uhandled wrmsr: 0x40000087 data 0x10000001000
QAT: Invalid ioctl
rfkill: input handler disabled
QAT: Invalid ioctl
dccp_invalid_packet: pskb_may_pull failed
rfkill: input handler enabled
dccp_invalid_packet: pskb_may_pull failed
RDS: rds_bind could not find a transport for 224.0.0.2, load rds_tcp or rds_rdma?
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pig=12235 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pig=12242 comm=syz-executor6
audit: type=1326 audit(1511003680.073:5748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=12284 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0xffff0000
audit: type=1326 audit(1511003680.179:5749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=12284 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0xffff0000
device eql entered promiscuous mode
nla_parse: 3 callbacks suppressed
netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008f
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008e
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008d
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008c
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008b
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x4000008a
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000089
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000088
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000087
kvm [12498]: vcpu0, guest rIP: 0x9135 Hyper-V unhandled rdmsr: 0x40000086
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
tmpfs: Bad mount option �peUѐ�%0���1D�#	0t�Pe�����?�9�(B��ڐg8)����W<k�
tmpfs: Bad mount option �peUѐ�%0���1D�#	0t�Pe�����?�9�(B��ڐg8)����W<k�
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
device gre0 entered promiscuous mode
QAT: Invalid ioctl
QAT: Invalid ioctl
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 12835 Comm: syz-executor4 Not tainted 4.14.0+ #183
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 handle_userfault+0x12fa/0x24c0 fs/userfaultfd.c:427
 do_anonymous_page mm/memory.c:3121 [inline]
 handle_pte_fault mm/memory.c:3934 [inline]
 __handle_mm_fault+0x2e8c/0x3ad0 mm/memory.c:4060
 handle_mm_fault+0x334/0x8d0 mm/memory.c:4097
 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1429
 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1504
 page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1088
RIP: 0010:fault_in_pages_readable include/linux/pagemap.h:601 [inline]
RIP: 0010:iov_iter_fault_in_readable+0x1a7/0x410 lib/iov_iter.c:421
RSP: 0018:ffff8801c1b3f928 EFLAGS: 00010246
RAX: 0000000000010000 RBX: 0000000020011fd2 RCX: ffffffff824fba11
RDX: 00000000000000c0 RSI: ffffc90002151000 RDI: ffff8801c1b3fd28
RBP: ffff8801c1b3fa08 R08: 1ffff100389d84ca R09: 1ffff10038367f1a
R10: ffff8801c15621c0 R11: ffff8801c15621c0 R12: 1ffff10038367f28
R13: ffff8801c1b3f9e0 R14: 0000000000000000 R15: ffff8801c1b3fd20
 generic_perform_write+0x200/0x600 mm/filemap.c:3129
 __generic_file_write_iter+0x366/0x5b0 mm/filemap.c:3264
 generic_file_write_iter+0x399/0x7a0 mm/filemap.c:3292
 call_write_iter include/linux/fs.h:1772 [inline]
 new_sync_write fs/read_write.c:469 [inline]
 __vfs_write+0x68a/0x970 fs/read_write.c:482
 vfs_write+0x18f/0x510 fs/read_write.c:544
 SYSC_write fs/read_write.c:589 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:581
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x452879
RSP: 002b:00007f193060fbe8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452879
RDX: 0000000000000030 RSI: 0000000020011fd2 RDI: 0000000000000015
RBP: 0000000000000390 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f2620
R13: 00000000ffffffff R14: 00007f19306106d4 R15: 0000000000000000
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 12835 Comm: syz-executor4 Not tainted 4.14.0+ #183
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 handle_userfault+0x12fa/0x24c0 fs/userfaultfd.c:427
 do_anonymous_page mm/memory.c:3121 [inline]
 handle_pte_fault mm/memory.c:3934 [inline]
 __handle_mm_fault+0x2e8c/0x3ad0 mm/memory.c:4060
 handle_mm_fault+0x334/0x8d0 mm/memory.c:4097
 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1429
 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1504
 page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1088
RIP: 0010:fault_in_pages_readable include/linux/pagemap.h:601 [inline]
RIP: 0010:iov_iter_fault_in_readable+0x1a7/0x410 lib/iov_iter.c:421
RSP: 0018:ffff8801c1b3f928 EFLAGS: 00010246
RAX: 0000000000010000 RBX: 0000000020011fd2 RCX: ffffffff824fba11
RDX: 00000000000000fc RSI: ffffc90002151000 RDI: ffff8801c1b3fd28
RBP: ffff8801c1b3fa08 R08: ffff8801c78e34b8 R09: 1ffff10038367edf