====================================================== WARNING: possible circular locking dependency detected 4.14.0-next-20171124+ #51 Not tainted ------------------------------------------------------ syz-executor0/24300 is trying to acquire lock: (console_lock){+.+.}, at: [] vcs_write+0x14d/0xca0 drivers/tty/vt/vc_screen.c:397 but task is already holding lock: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x56/0x70 fs/pipe.c:75 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&pipe->mutex/1){+.+.}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 pipe_lock_nested fs/pipe.c:67 [inline] pipe_lock+0x56/0x70 fs/pipe.c:75 iter_file_splice_write+0x264/0xf30 fs/splice.c:699 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x7d5/0x1630 fs/splice.c:1382 entry_SYSCALL_64_fastpath+0x1f/0x96 -> #2 (sb_writers){.+.+}: complete+0x18/0x80 kernel/sched/completion.c:35 -> #1 ((completion)&req.done){+.+.}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 complete_acquire include/linux/completion.h:40 [inline] __wait_for_common kernel/sched/completion.c:109 [inline] wait_for_common kernel/sched/completion.c:123 [inline] wait_for_completion+0xcb/0x7b0 kernel/sched/completion.c:144 devtmpfs_create_node+0x32b/0x4a0 drivers/base/devtmpfs.c:115 device_add+0x120f/0x1640 drivers/base/core.c:1824 device_create_groups_vargs+0x1f3/0x250 drivers/base/core.c:2430 device_create_vargs drivers/base/core.c:2470 [inline] device_create+0xda/0x110 drivers/base/core.c:2506 vcs_make_sysfs+0x35/0x60 drivers/tty/vt/vc_screen.c:629 vc_allocate+0x4b7/0x6b0 drivers/tty/vt/vt.c:797 con_install+0x52/0x440 drivers/tty/vt/vt.c:2876 tty_driver_install_tty drivers/tty/tty_io.c:1215 [inline] tty_init_dev+0xf6/0x4a0 drivers/tty/tty_io.c:1315 tty_open_by_driver drivers/tty/tty_io.c:1942 [inline] tty_open+0x608/0xab0 drivers/tty/tty_io.c:1990 chrdev_open+0x257/0x730 fs/char_dev.c:417 do_dentry_open+0x682/0xd70 fs/open.c:752 vfs_open+0x107/0x230 fs/open.c:866 do_last fs/namei.c:3388 [inline] path_openat+0x1157/0x3530 fs/namei.c:3528 do_filp_open+0x25b/0x3b0 fs/namei.c:3563 do_sys_open+0x502/0x6d0 fs/open.c:1059 SYSC_open fs/open.c:1077 [inline] SyS_open+0x2d/0x40 fs/open.c:1072 entry_SYSCALL_64_fastpath+0x1f/0x96 -> #0 (console_lock){+.+.}: check_prevs_add kernel/locking/lockdep.c:2031 [inline] validate_chain kernel/locking/lockdep.c:2473 [inline] __lock_acquire+0x3498/0x47f0 kernel/locking/lockdep.c:3500 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 console_lock+0x4b/0x80 kernel/printk/printk.c:2047 vcs_write+0x14d/0xca0 drivers/tty/vt/vc_screen.c:397 __vfs_write+0xef/0x970 fs/read_write.c:480 __kernel_write+0xfe/0x350 fs/read_write.c:501 write_pipe_buf+0x175/0x220 fs/splice.c:797 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x328/0x730 fs/splice.c:626 splice_from_pipe+0x1e9/0x330 fs/splice.c:661 default_file_splice_write+0x40/0x90 fs/splice.c:809 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x7d5/0x1630 fs/splice.c:1382 entry_SYSCALL_64_fastpath+0x1f/0x96 other info that might help us debug this: Chain exists of: console_lock --> sb_writers --> &pipe->mutex/1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(sb_writers); lock(&pipe->mutex/1); lock(console_lock); *** DEADLOCK *** 1 lock held by syz-executor0/24300: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x56/0x70 fs/pipe.c:75 stack backtrace: CPU: 0 PID: 24300 Comm: syz-executor0 Not tainted 4.14.0-next-20171124+ #51 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_circular_bug+0x42d/0x610 kernel/locking/lockdep.c:1271 check_prev_add+0x666/0x15f0 kernel/locking/lockdep.c:1914 check_prevs_add kernel/locking/lockdep.c:2031 [inline] validate_chain kernel/locking/lockdep.c:2473 [inline] __lock_acquire+0x3498/0x47f0 kernel/locking/lockdep.c:3500 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004 console_lock+0x4b/0x80 kernel/printk/printk.c:2047 vcs_write+0x14d/0xca0 drivers/tty/vt/vc_screen.c:397 __vfs_write+0xef/0x970 fs/read_write.c:480 __kernel_write+0xfe/0x350 fs/read_write.c:501 write_pipe_buf+0x175/0x220 fs/splice.c:797 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x328/0x730 fs/splice.c:626 splice_from_pipe+0x1e9/0x330 fs/splice.c:661 default_file_splice_write+0x40/0x90 fs/splice.c:809 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x7d5/0x1630 fs/splice.c:1382 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x452879 RSP: 002b:00007f0d6f597be8 EFLAGS: 00000212 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452879 RDX: 0000000000000013 RSI: 0000000000000000 RDI: 0000000000000014 RBP: 0000000000000086 R08: 00000000fffff5fc R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f2608 R13: 00000000ffffffff R14: 00007f0d6f5986d4 R15: 0000000000000000 ICMPv6: NA: bb:bb:bb:bb:bb:05 advertised our address fe80::5aa on syz5! kauditd_printk_skb: 183 callbacks suppressed audit: type=1326 audit(1511546653.085:4985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.085:4986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=29 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.086:4987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.086:4988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=16 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.086:4989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.086:4990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=277 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.086:4991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.086:4992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=9 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.087:4993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452879 code=0x7ffc0000 audit: type=1326 audit(1511546653.087:4994): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=24335 comm="syz-executor3" exe="/root/syz-executor3" sig=0 arch=c000003e syscall=2 compat=0 ip=0x452879 code=0x7ffc0000 nla_parse: 7 callbacks suppressed netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 9 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 9 bytes leftover after parsing attributes in process `syz-executor5'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=24410 comm=syz-executor1 A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=24424 comm=syz-executor1 netlink: 9 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 9 bytes leftover after parsing attributes in process `syz-executor4'. A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. device lo entered promiscuous mode device eql entered promiscuous mode netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 9 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 9 bytes leftover after parsing attributes in process `syz-executor5'. sctp: [Deprecated]: syz-executor4 (pid 24666) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead RDS: rds_bind could not find a transport for 172.20.0.170, load rds_tcp or rds_rdma? sctp: [Deprecated]: syz-executor4 (pid 24666) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 could not allocate digest TFM handle ecb(camellia) could not allocate digest TFM handle ecb(camellia) sctp: [Deprecated]: syz-executor6 (pid 24838) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor6 (pid 24838) Use of int in maxseg socket option. Use struct sctp_assoc_value instead sctp: [Deprecated]: syz-executor6 (pid 24858) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead device gre0 entered promiscuous mode sctp: [Deprecated]: syz-executor6 (pid 24838) Use of int in maxseg socket option. Use struct sctp_assoc_value instead could not allocate digest TFM handle @ނMZBڛxQ\: 29¾:r could not allocate digest TFM handle @ނMZBڛxQ\: 29¾:r rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled