RDX: 0000000000000004 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007fb565b471d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffdee9857ff R14: 00007fb565b47300 R15: 0000000000022000 ====================================================== WARNING: possible circular locking dependency detected 4.14.302-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.0/785 is trying to acquire lock: (console_owner){....}, at: [] log_next kernel/printk/printk.c:495 [inline] (console_owner){....}, at: [] console_unlock+0x307/0xf20 kernel/printk/printk.c:2396 but task is already holding lock: (&(&port->lock)->rlock){-.-.}, at: [] tty_insert_flip_string_and_push_buffer+0x2b/0x160 drivers/tty/tty_buffer.c:569 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&(&port->lock)->rlock){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 tty_port_tty_get+0x1d/0x80 drivers/tty/tty_port.c:288 tty_port_default_wakeup+0x11/0x40 drivers/tty/tty_port.c:46 serial8250_tx_chars+0x3fe/0xc70 drivers/tty/serial/8250/8250_port.c:1828 serial8250_handle_irq.part.0+0x2c7/0x390 drivers/tty/serial/8250/8250_port.c:1918 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1891 [inline] serial8250_default_handle_irq+0x8a/0x1f0 drivers/tty/serial/8250/8250_port.c:1934 serial8250_interrupt+0xf3/0x210 drivers/tty/serial/8250/8250_core.c:129 __handle_irq_event_percpu+0xee/0x7f0 kernel/irq/handle.c:147 handle_irq_event_percpu kernel/irq/handle.c:187 [inline] handle_irq_event+0xed/0x240 kernel/irq/handle.c:204 handle_edge_irq+0x224/0xc40 kernel/irq/chip.c:770 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x93/0x1d0 arch/x86/kernel/irq.c:230 ret_from_intr+0x0/0x1e native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x47/0x370 arch/x86/kernel/process.c:558 cpuidle_idle_call kernel/sched/idle.c:156 [inline] do_idle+0x250/0x3c0 kernel/sched/idle.c:246 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:351 start_kernel+0x743/0x763 init/main.c:712 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 -> #1 (&port_lock_key){-.-.}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 serial8250_console_write+0x8cb/0xb40 drivers/tty/serial/8250/8250_port.c:3281 call_console_drivers kernel/printk/printk.c:1727 [inline] console_unlock+0x99d/0xf20 kernel/printk/printk.c:2409 vprintk_emit+0x224/0x620 kernel/printk/printk.c:1925 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1998 register_console+0x6f4/0xad0 kernel/printk/printk.c:2728 univ8250_console_init+0x2f/0x3a drivers/tty/serial/8250/8250_core.c:691 console_init+0x46/0x53 kernel/printk/printk.c:2809 start_kernel+0x521/0x763 init/main.c:638 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 -> #0 (console_owner){....}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_lock_spinning_enable kernel/printk/printk.c:1590 [inline] console_unlock+0x36f/0xf20 kernel/printk/printk.c:2406 vprintk_emit+0x224/0x620 kernel/printk/printk.c:1925 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1998 fail_dump lib/fault-inject.c:44 [inline] should_fail.cold+0xdf/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x6d/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] tty_buffer_alloc+0xc0/0x270 drivers/tty/tty_buffer.c:169 __tty_buffer_request_room+0x12c/0x290 drivers/tty/tty_buffer.c:268 tty_insert_flip_string_fixed_flag+0x8b/0x210 drivers/tty/tty_buffer.c:313 tty_insert_flip_string include/linux/tty_flip.h:36 [inline] tty_insert_flip_string_and_push_buffer+0x3e/0x160 drivers/tty/tty_buffer.c:570 pty_write+0xc3/0xf0 drivers/tty/pty.c:118 n_tty_write+0x85e/0xda0 drivers/tty/n_tty.c:2356 do_tty_write drivers/tty/tty_io.c:959 [inline] tty_write+0x410/0x740 drivers/tty/tty_io.c:1043 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &(&port->lock)->rlock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(&port->lock)->rlock); lock(&port_lock_key); lock(&(&port->lock)->rlock); lock(console_owner); *** DEADLOCK *** 6 locks held by syz-executor.0/785: #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284 #1: (&tty->atomic_write_lock){+.+.}, at: [] tty_write_lock drivers/tty/tty_io.c:885 [inline] #1: (&tty->atomic_write_lock){+.+.}, at: [] do_tty_write drivers/tty/tty_io.c:908 [inline] #1: (&tty->atomic_write_lock){+.+.}, at: [] tty_write+0x22d/0x740 drivers/tty/tty_io.c:1043 #2: (&tty->termios_rwsem){++++}, at: [] n_tty_write+0x18a/0xda0 drivers/tty/n_tty.c:2316 #3: (&ldata->output_lock){+.+.}, at: [] n_tty_write+0x82b/0xda0 drivers/tty/n_tty.c:2355 #4: (&(&port->lock)->rlock){-.-.}, at: [] tty_insert_flip_string_and_push_buffer+0x2b/0x160 drivers/tty/tty_buffer.c:569 #5: (console_lock){+.+.}, at: [] vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 stack backtrace: CPU: 1 PID: 785 Comm: syz-executor.0 Not tainted 4.14.302-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_lock_spinning_enable kernel/printk/printk.c:1590 [inline] console_unlock+0x36f/0xf20 kernel/printk/printk.c:2406 vprintk_emit+0x224/0x620 kernel/printk/printk.c:1925 vprintk_func+0x58/0x160 kernel/printk/printk_safe.c:409 printk+0x9e/0xbc kernel/printk/printk.c:1998 fail_dump lib/fault-inject.c:44 [inline] should_fail.cold+0xdf/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x6d/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] tty_buffer_alloc+0xc0/0x270 drivers/tty/tty_buffer.c:169 __tty_buffer_request_room+0x12c/0x290 drivers/tty/tty_buffer.c:268 tty_insert_flip_string_fixed_flag+0x8b/0x210 drivers/tty/tty_buffer.c:313 tty_insert_flip_string include/linux/tty_flip.h:36 [inline] tty_insert_flip_string_and_push_buffer+0x3e/0x160 drivers/tty/tty_buffer.c:570 pty_write+0xc3/0xf0 drivers/tty/pty.c:118 n_tty_write+0x85e/0xda0 drivers/tty/n_tty.c:2356 do_tty_write drivers/tty/tty_io.c:959 [inline] tty_write+0x410/0x740 drivers/tty/tty_io.c:1043 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7fb5675d50d9 RSP: 002b:00007fb565b47168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fb5676f4f80 RCX: 00007fb5675d50d9 RDX: 0000000000000004 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007fb565b471d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffdee9857ff R14: 00007fb565b47300 R15: 0000000000022000 rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -2146954638 rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -2146954638 rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -2146954638 rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2144840638 Unknown ioctl -2144840638 rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2144840638 rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2144840638 rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -1072131209 rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -1072131209 rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -1072131209 rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -1072131209 rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2133043935 rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2133043935 rfkill: input handler disabled Unknown ioctl -2133043935 rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -2133043935 rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -2133043935 rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -2133043935 rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2133043935 rfkill: input handler disabled Unknown ioctl -2133043935 rfkill: input handler enabled Unknown ioctl -2133043935 Unknown ioctl -2133043935 rfkill: input handler disabled Unknown ioctl 20993 Unknown ioctl -2133043935 rfkill: input handler enabled rfkill: input handler disabled Unknown ioctl -2133043935 Unknown ioctl 20993 Unknown ioctl -2133043935 rfkill: input handler enabled Unknown ioctl -2133043935 rfkill: input handler disabled Unknown ioctl 20993 rfkill: input handler enabled Unknown ioctl -2133043935 rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2133043935 rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2133043935 rfkill: input handler disabled Unknown ioctl -2133043935 rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl -2133043935 Unknown ioctl -1072131204 Unknown ioctl -1072131204 Unknown ioctl -1072131204 Unknown ioctl -1072131204 rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled rfkill: input handler disabled rfkill: input handler enabled Unknown ioctl 1074022656 Unknown ioctl -993503981 Unknown ioctl 1074022656 Unknown ioctl -993503981 Unknown ioctl -993503981 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl -993503981 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656 Unknown ioctl 1074022656