====================================================== WARNING: possible circular locking dependency detected 4.14.0+ #86 Not tainted ------------------------------------------------------ syz-executor0/20500 is trying to acquire lock: (console_lock){+.+.}, at: [] vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219 but task is already holding lock: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x56/0x70 fs/pipe.c:75 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&pipe->mutex/1){+.+.}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4007 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 pipe_lock_nested fs/pipe.c:67 [inline] pipe_lock+0x56/0x70 fs/pipe.c:75 iter_file_splice_write+0x264/0xf30 fs/splice.c:699 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x7d5/0x1630 fs/splice.c:1382 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125 -> #2 (sb_writers){.+.+}: fs_reclaim_acquire.part.85+0x0/0x30 mm/page_alloc.c:488 -> #1 ((completion)&req.done){+.+.}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4007 complete_acquire include/linux/completion.h:40 [inline] __wait_for_common kernel/sched/completion.c:109 [inline] wait_for_common kernel/sched/completion.c:123 [inline] wait_for_completion+0xcb/0x7b0 kernel/sched/completion.c:144 devtmpfs_create_node+0x32b/0x4a0 drivers/base/devtmpfs.c:115 device_add+0x120f/0x1640 drivers/base/core.c:1824 device_create_groups_vargs+0x1f3/0x250 drivers/base/core.c:2430 device_create_vargs drivers/base/core.c:2470 [inline] device_create+0xda/0x110 drivers/base/core.c:2506 vcs_make_sysfs+0x35/0x60 drivers/tty/vt/vc_screen.c:629 vc_allocate+0x4b7/0x6b0 drivers/tty/vt/vt.c:795 con_install+0x52/0x440 drivers/tty/vt/vt.c:2876 tty_driver_install_tty drivers/tty/tty_io.c:1214 [inline] tty_init_dev+0xf6/0x4a0 drivers/tty/tty_io.c:1314 tty_open_by_driver drivers/tty/tty_io.c:1941 [inline] tty_open+0x608/0xab0 drivers/tty/tty_io.c:1989 chrdev_open+0x257/0x730 fs/char_dev.c:417 do_dentry_open+0x682/0xd70 fs/open.c:752 vfs_open+0x107/0x230 fs/open.c:866 do_last fs/namei.c:3388 [inline] path_openat+0x1157/0x3530 fs/namei.c:3528 do_filp_open+0x25b/0x3b0 fs/namei.c:3563 do_sys_open+0x502/0x6d0 fs/open.c:1059 SYSC_open fs/open.c:1077 [inline] SyS_open+0x2d/0x40 fs/open.c:1072 entry_SYSCALL_64_fastpath+0x1f/0x96 -> #0 (console_lock){+.+.}: check_prevs_add kernel/locking/lockdep.c:2032 [inline] validate_chain kernel/locking/lockdep.c:2474 [inline] __lock_acquire+0x33ad/0x4840 kernel/locking/lockdep.c:3503 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4007 console_lock+0x4b/0x80 kernel/printk/printk.c:2047 vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219 do_loop_readv_writev fs/read_write.c:694 [inline] do_iter_read+0x3db/0x5b0 fs/read_write.c:918 vfs_readv+0x121/0x1c0 fs/read_write.c:980 kernel_readv fs/splice.c:361 [inline] default_file_splice_read+0x508/0xae0 fs/splice.c:416 do_splice_to+0x110/0x170 fs/splice.c:880 do_splice fs/splice.c:1173 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x11a8/0x1630 fs/splice.c:1382 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125 other info that might help us debug this: Chain exists of: console_lock --> sb_writers --> &pipe->mutex/1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(sb_writers); lock(&pipe->mutex/1); lock(console_lock); *** DEADLOCK *** 1 lock held by syz-executor0/20500: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x56/0x70 fs/pipe.c:75 stack backtrace: CPU: 1 PID: 20500 Comm: syz-executor0 Not tainted 4.14.0+ #86 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_circular_bug+0x42d/0x610 kernel/locking/lockdep.c:1272 check_prev_add+0x8b1/0x1580 kernel/locking/lockdep.c:1915 check_prevs_add kernel/locking/lockdep.c:2032 [inline] validate_chain kernel/locking/lockdep.c:2474 [inline] __lock_acquire+0x33ad/0x4840 kernel/locking/lockdep.c:3503 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4007 console_lock+0x4b/0x80 kernel/printk/printk.c:2047 vcs_read+0x129/0xae0 drivers/tty/vt/vc_screen.c:219 do_loop_readv_writev fs/read_write.c:694 [inline] do_iter_read+0x3db/0x5b0 fs/read_write.c:918 vfs_readv+0x121/0x1c0 fs/read_write.c:980 kernel_readv fs/splice.c:361 [inline] default_file_splice_read+0x508/0xae0 fs/splice.c:416 do_splice_to+0x110/0x170 fs/splice.c:880 do_splice fs/splice.c:1173 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x11a8/0x1630 fs/splice.c:1382 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7f04c79 RSP: 002b:00000000f76df01c EFLAGS: 00000296 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000014 RCX: 0000000000000000 RDX: 0000000000000017 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 syz3: Invalid MTU 16777220 requested, hw max 65535 syz3: Invalid MTU 16777220 requested, hw max 65535 could not allocate digest TFM handle deflate could not allocate digest TFM handle deflate could not allocate digest TFM handle deflate could not allocate digest TFM handle deflate device lo entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready device gre0 entered promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl