FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 1 ====================================================== WARNING: possible circular locking dependency detected 6.11.0-rc2-syzkaller-00011-geb5e56d14912 #0 Not tainted ------------------------------------------------------ syz.3.1291/13389 is trying to acquire lock: ffffffff8dcc3440 (console_owner){....}-{0:0}, at: console_lock_spinning_enable kernel/printk/printk.c:1873 [inline] ffffffff8dcc3440 (console_owner){....}-{0:0}, at: console_emit_next_record kernel/printk/printk.c:2977 [inline] ffffffff8dcc3440 (console_owner){....}-{0:0}, at: console_flush_all+0x4ff/0xd70 kernel/printk/printk.c:3049 but task is already holding lock: ffff8880b923edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:568 [inline] ffff8880b923edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:553 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560 raw_spin_rq_lock kernel/sched/sched.h:1415 [inline] rq_lock kernel/sched/sched.h:1714 [inline] task_fork_fair+0x73/0x250 kernel/sched/fair.c:12710 sched_cgroup_fork+0x3cf/0x510 kernel/sched/core.c:4633 copy_process+0x43a1/0x8de0 kernel/fork.c:2483 kernel_clone+0xfd/0x980 kernel/fork.c:2781 user_mode_thread+0xb4/0xf0 kernel/fork.c:2859 rest_init+0x23/0x2b0 init/main.c:712 start_kernel+0x3df/0x4c0 init/main.c:1103 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 -> #3 (&p->pi_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4051 __wake_up_common+0x131/0x1e0 kernel/sched/wait.c:89 __wake_up_common_lock kernel/sched/wait.c:106 [inline] __wake_up+0x31/0x60 kernel/sched/wait.c:127 tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69 serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1821 serial8250_handle_irq+0x5d3/0x780 drivers/tty/serial/8250/8250_port.c:1929 serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1949 serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:247 [inline] call_irq_handler arch/x86/kernel/irq.c:259 [inline] __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:111 acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:702 cpuidle_enter_state+0x85/0x500 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:388 cpuidle_idle_call kernel/sched/idle.c:230 [inline] do_idle+0x313/0x3f0 kernel/sched/idle.c:326 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424 start_secondary+0x220/0x2b0 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x148 -> #2 (&tty->write_wait){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:105 [inline] __wake_up+0x1c/0x60 kernel/sched/wait.c:127 tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69 serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1821 serial8250_handle_irq+0x5d3/0x780 drivers/tty/serial/8250/8250_port.c:1929 serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1949 serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:247 [inline] call_irq_handler arch/x86/kernel/irq.c:259 [inline] __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:111 acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:702 cpuidle_enter_state+0x85/0x500 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:388 cpuidle_idle_call kernel/sched/idle.c:230 [inline] do_idle+0x313/0x3f0 kernel/sched/idle.c:326 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:424 start_secondary+0x220/0x2b0 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x148 -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 uart_port_lock_irqsave include/linux/serial_core.h:618 [inline] serial8250_console_write+0xaa6/0x1090 drivers/tty/serial/8250/8250_port.c:3352 console_emit_next_record kernel/printk/printk.c:2983 [inline] console_flush_all+0x53f/0xd70 kernel/printk/printk.c:3049 console_unlock+0xae/0x290 kernel/printk/printk.c:3118 vprintk_emit kernel/printk/printk.c:2348 [inline] vprintk_emit+0x11a/0x5a0 kernel/printk/printk.c:2303 vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45 _printk+0xc8/0x100 kernel/printk/printk.c:2373 register_console+0xaa2/0x10a0 kernel/printk/printk.c:3654 univ8250_console_init+0x5f/0x90 drivers/tty/serial/8250/8250_core.c:513 console_init+0xcc/0x680 kernel/printk/printk.c:3800 start_kernel+0x295/0x4c0 init/main.c:1038 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x148 -> #0 (console_owner){....}-{0:0}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142 lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 console_lock_spinning_enable kernel/printk/printk.c:1873 [inline] console_emit_next_record kernel/printk/printk.c:2977 [inline] console_flush_all+0x514/0xd70 kernel/printk/printk.c:3049 console_unlock+0xae/0x290 kernel/printk/printk.c:3118 vprintk_emit kernel/printk/printk.c:2348 [inline] vprintk_emit+0x11a/0x5a0 kernel/printk/printk.c:2303 vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45 _printk+0xc8/0x100 kernel/printk/printk.c:2373 fail_dump lib/fault-inject.c:45 [inline] should_fail_ex+0x46c/0x5b0 lib/fault-inject.c:153 strncpy_from_user+0x38/0x320 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:186 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:216 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:311 [inline] bpf_probe_read_compat_str+0xf1/0x170 kernel/trace/bpf_trace.c:307 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2010 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2251 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2449 __bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222 trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x17cf/0x5490 kernel/sched/core.c:6526 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6708 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194 rcu_preempt_deferred_qs_irqrestore+0x505/0xb80 kernel/rcu/tree_plugin.h:569 rcu_read_unlock_special kernel/rcu/tree_plugin.h:691 [inline] __rcu_read_unlock+0x2b4/0x580 kernel/rcu/tree_plugin.h:436 rcu_read_unlock include/linux/rcupdate.h:871 [inline] get_pid_task+0x106/0x250 kernel/pid.c:468 get_proc_task fs/proc/internal.h:131 [inline] proc_fail_nth_read+0xd2/0x290 fs/proc/base.c:1419 vfs_read+0x1d4/0xbd0 fs/read_write.c:474 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: console_owner --> &p->pi_lock --> &rq->__lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rq->__lock); lock(&p->pi_lock); lock(&rq->__lock); lock(console_owner); *** DEADLOCK *** 5 locks held by syz.3.1291/13389: #0: ffff88806dc70348 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xeb/0x180 fs/file.c:1191 #1: ffff8880b923edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:568 [inline] #1: ffff8880b923edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:553 #2: ffffffff8ddb5ca0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #2: ffffffff8ddb5ca0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #2: ffffffff8ddb5ca0 (rcu_read_lock){....}-{1:2}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2405 [inline] #2: ffffffff8ddb5ca0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0x1d6/0x5a0 kernel/trace/bpf_trace.c:2449 #3: ffffffff8dda3880 (console_lock){+.+.}-{0:0}, at: vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45 #4: ffffffff8dda38f0 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:331 [inline] #4: ffffffff8dda38f0 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:267 [inline] #4: ffffffff8dda38f0 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:286 [inline] #4: ffffffff8dda38f0 (console_srcu){....}-{0:0}, at: console_flush_all+0x12d/0xd70 kernel/printk/printk.c:3041 stack backtrace: CPU: 1 UID: 0 PID: 13389 Comm: syz.3.1291 Not tainted 6.11.0-rc2-syzkaller-00011-geb5e56d14912 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142 lock_acquire kernel/locking/lockdep.c:5759 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724 console_lock_spinning_enable kernel/printk/printk.c:1873 [inline] console_emit_next_record kernel/printk/printk.c:2977 [inline] console_flush_all+0x514/0xd70 kernel/printk/printk.c:3049 console_unlock+0xae/0x290 kernel/printk/printk.c:3118 vprintk_emit kernel/printk/printk.c:2348 [inline] vprintk_emit+0x11a/0x5a0 kernel/printk/printk.c:2303 vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45 _printk+0xc8/0x100 kernel/printk/printk.c:2373 fail_dump lib/fault-inject.c:45 [inline] should_fail_ex+0x46c/0x5b0 lib/fault-inject.c:153 strncpy_from_user+0x38/0x320 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:186 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:216 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:311 [inline] bpf_probe_read_compat_str+0xf1/0x170 kernel/trace/bpf_trace.c:307 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2010 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2251 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2449 __bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222 trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x17cf/0x5490 kernel/sched/core.c:6526 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6708 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194 rcu_preempt_deferred_qs_irqrestore+0x505/0xb80 kernel/rcu/tree_plugin.h:569 rcu_read_unlock_special kernel/rcu/tree_plugin.h:691 [inline] __rcu_read_unlock+0x2b4/0x580 kernel/rcu/tree_plugin.h:436 rcu_read_unlock include/linux/rcupdate.h:871 [inline] get_pid_task+0x106/0x250 kernel/pid.c:468 get_proc_task fs/proc/internal.h:131 [inline] proc_fail_nth_read+0xd2/0x290 fs/proc/base.c:1419 vfs_read+0x1d4/0xbd0 fs/read_write.c:474 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f361537643c Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 69 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 bf 8d 02 00 48 RSP: 002b:00007f36160b8040 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f3615506058 RCX: 00007f361537643c RDX: 000000000000000f RSI: 00007f36160b80b0 RDI: 0000000000000005 RBP: 00007f36160b80a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 000000000000006e R14: 00007f3615506058 R15: 00007fff00e05d98 CPU: 1 UID: 0 PID: 13389 Comm: syz.3.1291 Not tainted 6.11.0-rc2-syzkaller-00011-geb5e56d14912 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 fail_dump lib/fault-inject.c:52 [inline] should_fail_ex+0x497/0x5b0 lib/fault-inject.c:153 strncpy_from_user+0x38/0x320 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:186 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:216 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:311 [inline] bpf_probe_read_compat_str+0xf1/0x170 kernel/trace/bpf_trace.c:307 ___bpf_prog_run+0x3e51/0xabd0 kernel/bpf/core.c:2010 __bpf_prog_run32+0xc1/0x100 kernel/bpf/core.c:2251 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline] __bpf_prog_run include/linux/filter.h:691 [inline] bpf_prog_run include/linux/filter.h:698 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline] bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2449 __bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222 trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x17cf/0x5490 kernel/sched/core.c:6526 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6708 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x61/0x80 kernel/locking/spinlock.c:194 rcu_preempt_deferred_qs_irqrestore+0x505/0xb80 kernel/rcu/tree_plugin.h:569 rcu_read_unlock_special kernel/rcu/tree_plugin.h:691 [inline] __rcu_read_unlock+0x2b4/0x580 kernel/rcu/tree_plugin.h:436 rcu_read_unlock include/linux/rcupdate.h:871 [inline] get_pid_task+0x106/0x250 kernel/pid.c:468 get_proc_task fs/proc/internal.h:131 [inline] proc_fail_nth_read+0xd2/0x290 fs/proc/base.c:1419 vfs_read+0x1d4/0xbd0 fs/read_write.c:474 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f361537643c Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 69 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 bf 8d 02 00 48 RSP: 002b:00007f36160b8040 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f3615506058 RCX: 00007f361537643c RDX: 000000000000000f RSI: 00007f36160b80b0 RDI: 0000000000000005 RBP: 00007f36160b80a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 000000000000006e R14: 00007f3615506058 R15: 00007fff00e05d98