FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
======================================================
WARNING: possible circular locking dependency detected
5.15.149-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/15118 is trying to acquire lock:
ffffffff8c7fbf78 ((console_sem).lock){-.-.}-{2:2}, at: down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
but task is already holding lock:
ffff8880b9a39718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&rq->__lock){-.-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:368
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
raw_spin_rq_lock kernel/sched/sched.h:1326 [inline]
rq_lock kernel/sched/sched.h:1621 [inline]
task_fork_fair+0x5d/0x350 kernel/sched/fair.c:11480
sched_cgroup_fork+0x2d3/0x330 kernel/sched/core.c:4466
copy_process+0x224a/0x3ef0 kernel/fork.c:2320
kernel_clone+0x210/0x960 kernel/fork.c:2604
kernel_thread+0x168/0x1e0 kernel/fork.c:2656
rest_init+0x21/0x330 init/main.c:703
start_kernel+0x48c/0x535 init/main.c:1137
secondary_startup_64_no_verify+0xb1/0xbb
-> #1 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
try_to_wake_up+0xae/0x1300 kernel/sched/core.c:4030
up+0x6e/0x90 kernel/locking/semaphore.c:190
__up_console_sem+0x11a/0x1e0 kernel/printk/printk.c:256
console_unlock+0x1145/0x12b0 kernel/printk/printk.c:2754
vt_disallocate_all+0xf9/0x1b0 drivers/tty/vt/vt_ioctl.c:660
vt_ioctl+0x1922/0x1d10 drivers/tty/vt/vt_ioctl.c:902
tty_ioctl+0x871/0xc50 drivers/tty/tty_io.c:2810
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
-> #0 ((console_sem).lock){-.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2569 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2267
_printk+0xd1/0x111 kernel/printk/printk.c:2293
fail_dump lib/fault-inject.c:45 [inline]
should_fail+0x36c/0x4c0 lib/fault-inject.c:146
strncpy_from_user+0x32/0x370 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x6c/0x130 mm/maccess.c:295
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:194 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:203 [inline]
bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:200
bpf_prog_b0fe9b75aaebb688+0x38/0x730
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1921
__traceiter_sched_switch+0x7d/0xb0 include/trace/events/sched.h:220
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6780
irqentry_exit+0x53/0x80 kernel/entry/common.c:426
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
native_irq_enable arch/x86/include/asm/irqflags.h:45 [inline]
arch_local_irq_enable arch/x86/include/asm/irqflags.h:80 [inline]
do_user_addr_fault arch/x86/mm/fault.c:1294 [inline]
handle_page_fault arch/x86/mm/fault.c:1485 [inline]
exc_page_fault+0x110/0x740 arch/x86/mm/fault.c:1541
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:568
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock((console_sem).lock);
*** DEADLOCK ***
2 locks held by syz-executor.0/15118:
#0: ffff8880b9a39718 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
#1: ffffffff8c91f720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:268
stack backtrace:
CPU: 0 PID: 15118 Comm: syz-executor.0 Not tainted 5.15.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
down_trylock+0x1c/0xa0 kernel/locking/semaphore.c:138
__down_trylock_console_sem+0x105/0x250 kernel/printk/printk.c:239
console_trylock kernel/printk/printk.c:2569 [inline]
console_trylock_spinning+0x8a/0x3f0 kernel/printk/printk.c:1867
vprintk_emit+0xa6/0x150 kernel/printk/printk.c:2267
_printk+0xd1/0x111 kernel/printk/printk.c:2293
fail_dump lib/fault-inject.c:45 [inline]
should_fail+0x36c/0x4c0 lib/fault-inject.c:146
strncpy_from_user+0x32/0x370 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x6c/0x130 mm/maccess.c:295
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:194 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:203 [inline]
bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:200
bpf_prog_b0fe9b75aaebb688+0x38/0x730
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1921
__traceiter_sched_switch+0x7d/0xb0 include/trace/events/sched.h:220
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6780
irqentry_exit+0x53/0x80 kernel/entry/common.c:426
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/irqflags.h:80 [inline]
RIP: 0010:do_user_addr_fault arch/x86/mm/fault.c:1294 [inline]
RIP: 0010:handle_page_fault arch/x86/mm/fault.c:1485 [inline]
RIP: 0010:exc_page_fault+0x110/0x740 arch/x86/mm/fault.c:1541
Code: ff ff 7f 0f 85 e4 04 00 00 4d 85 e4 0f 84 db 04 00 00 48 8b 04 24 f6 80 88 00 00 00 03 74 0d e8 56 c1 69 f7 fb bb 54 02 00 00 14 bb 14 02 00 00 f6 80 91 00 00 00 02 74 06 e8 3b c1 69 f7 fb
RSP: 0000:ffffc9000412fee8 EFLAGS: 00000282
RAX: 28d4252612f1ba00 RBX: 0000000000000254 RCX: ffffffff913caf03
RDX: dffffc0000000000 RSI: ffffffff8a8b1500 RDI: ffffffff8ad88e40
RBP: 00007f1d2c373000 R08: ffffffff8186b3f0 R09: fffffbfff1bc7746
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888011c6b100
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f1d36195836
Code: f0 72 6e 48 63 cd 48 01 c1 49 39 4f 08 72 4c 8d 4d ff 85 ed 74 33 66 0f 1f 44 00 00 48 39 f0 72 1b 4d 8b 07 49 89 c1 49 29 f1 <47> 0f b6 0c 08 45 84 c9 74 08 45 88 0c 00 49 8b 47 10 48 83 c0 01
RSP: 002b:00007f1d34769530 EFLAGS: 00010206
RAX: 0000000000029001 RBX: 00007f1d347695d0 RCX: 000000000000001e
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f1d34769670
RBP: 0000000000000102 R08: 00007f1d2c34a000 R09: 0000000000029000
R10: 0000000000000000 R11: 00007f1d347695e0 R12: 0000000000000001
R13: 00007f1d36258cc0 R14: 0000000000000000 R15: 00007f1d34769670
CPU: 0 PID: 15118 Comm: syz-executor.0 Not tainted 5.15.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail+0x38a/0x4c0 lib/fault-inject.c:146
strncpy_from_user+0x32/0x370 lib/strncpy_from_user.c:118
strncpy_from_user_nofault+0x6c/0x130 mm/maccess.c:295
bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:194 [inline]
____bpf_probe_read_user_str kernel/trace/bpf_trace.c:203 [inline]
bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:200
bpf_prog_b0fe9b75aaebb688+0x38/0x730
bpf_dispatcher_nop_func include/linux/bpf.h:780 [inline]
__bpf_prog_run include/linux/filter.h:625 [inline]
bpf_prog_run include/linux/filter.h:632 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline]
bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1921
__traceiter_sched_switch+0x7d/0xb0 include/trace/events/sched.h:220
trace_sched_switch include/trace/events/sched.h:220 [inline]
__schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6780
irqentry_exit+0x53/0x80 kernel/entry/common.c:426
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:643
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/irqflags.h:80 [inline]
RIP: 0010:do_user_addr_fault arch/x86/mm/fault.c:1294 [inline]
RIP: 0010:handle_page_fault arch/x86/mm/fault.c:1485 [inline]
RIP: 0010:exc_page_fault+0x110/0x740 arch/x86/mm/fault.c:1541
Code: ff ff 7f 0f 85 e4 04 00 00 4d 85 e4 0f 84 db 04 00 00 48 8b 04 24 f6 80 88 00 00 00 03 74 0d e8 56 c1 69 f7 fb bb 54 02 00 00 14 bb 14 02 00 00 f6 80 91 00 00 00 02 74 06 e8 3b c1 69 f7 fb
RSP: 0000:ffffc9000412fee8 EFLAGS: 00000282
RAX: 28d4252612f1ba00 RBX: 0000000000000254 RCX: ffffffff913caf03
RDX: dffffc0000000000 RSI: ffffffff8a8b1500 RDI: ffffffff8ad88e40
RBP: 00007f1d2c373000 R08: ffffffff8186b3f0 R09: fffffbfff1bc7746
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888011c6b100
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000000
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7f1d36195836
Code: f0 72 6e 48 63 cd 48 01 c1 49 39 4f 08 72 4c 8d 4d ff 85 ed 74 33 66 0f 1f 44 00 00 48 39 f0 72 1b 4d 8b 07 49 89 c1 49 29 f1 <47> 0f b6 0c 08 45 84 c9 74 08 45 88 0c 00 49 8b 47 10 48 83 c0 01
RSP: 002b:00007f1d34769530 EFLAGS: 00010206
RAX: 0000000000029001 RBX: 00007f1d347695d0 RCX: 000000000000001e
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f1d34769670
RBP: 0000000000000102 R08: 00007f1d2c34a000 R09: 0000000000029000
R10: 0000000000000000 R11: 00007f1d347695e0 R12: 0000000000000001
R13: 00007f1d36258cc0 R14: 0000000000000000 R15: 00007f1d34769670
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 7f 0f jg 0x11
2: 85 e4 test %esp,%esp
4: 04 00 add $0x0,%al
6: 00 4d 85 add %cl,-0x7b(%rbp)
9: e4 0f in $0xf,%al
b: 84 db test %bl,%bl
d: 04 00 add $0x0,%al
f: 00 48 8b add %cl,-0x75(%rax)
12: 04 24 add $0x24,%al
14: f6 80 88 00 00 00 03 testb $0x3,0x88(%rax)
1b: 74 0d je 0x2a
1d: e8 56 c1 69 f7 call 0xf769c178
22: fb sti
23: bb 54 02 00 00 mov $0x254,%ebx
* 28: eb 14 jmp 0x3e <-- trapping instruction
2a: bb 14 02 00 00 mov $0x214,%ebx
2f: f6 80 91 00 00 00 02 testb $0x2,0x91(%rax)
36: 74 06 je 0x3e
38: e8 3b c1 69 f7 call 0xf769c178
3d: fb sti