block nbd4: shutting down sockets IPVS: set_ctl: invalid protocol: 46 172.20.20.187:20001 ttyprintk ttyprintk: tty_port_close_start: tty->count = 1 port count = 3 ====================================================== WARNING: possible circular locking dependency detected 4.14.158-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.4/4304 is trying to acquire lock: (console_owner){-.-.}, at: [] console_trylock_spinning kernel/printk/printk.c:1658 [inline] (console_owner){-.-.}, at: [] vprintk_emit kernel/printk/printk.c:1922 [inline] (console_owner){-.-.}, at: [] vprintk_emit+0x2f1/0x600 kernel/printk/printk.c:1888 but task is already holding lock: (&(&port->lock)->rlock){-.-.}, at: [] tty_port_close_start.part.0+0x2b/0x4e0 drivers/tty/tty_port.c:572 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&(&port->lock)->rlock){-.-.}: lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:160 tty_port_tty_get+0x22/0x90 drivers/tty/tty_port.c:287 tty_port_default_wakeup+0x16/0x40 drivers/tty/tty_port.c:46 tty_port_tty_wakeup+0x57/0x70 drivers/tty/tty_port.c:389 uart_write_wakeup+0x46/0x70 drivers/tty/serial/serial_core.c:116 serial8250_tx_chars+0x40d/0xa10 drivers/tty/serial/8250/8250_port.c:1810 serial8250_handle_irq.part.0+0x206/0x250 drivers/tty/serial/8250/8250_port.c:1883 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1869 [inline] serial8250_default_handle_irq+0xa1/0x120 drivers/tty/serial/8250/8250_port.c:1899 serial8250_interrupt+0xe9/0x1a0 drivers/tty/serial/8250/8250_core.c:129 __handle_irq_event_percpu+0x125/0x7f0 kernel/irq/handle.c:147 handle_irq_event_percpu+0x65/0x130 kernel/irq/handle.c:187 handle_irq_event+0xa7/0x134 kernel/irq/handle.c:204 handle_edge_irq+0x22b/0x840 kernel/irq/chip.c:770 generic_handle_irq_desc include/linux/irqdesc.h:159 [inline] handle_irq+0x39/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x99/0x1d0 arch/x86/kernel/irq.c:230 ret_from_intr+0x0/0x1e arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x95/0xe0 kernel/locking/spinlock.c:192 spin_unlock_irqrestore include/linux/spinlock.h:372 [inline] uart_write+0x29a/0x4f0 drivers/tty/serial/serial_core.c:625 process_output_block drivers/tty/n_tty.c:595 [inline] n_tty_write+0x38b/0xee0 drivers/tty/n_tty.c:2333 do_tty_write drivers/tty/tty_io.c:959 [inline] tty_write+0x3f6/0x700 drivers/tty/tty_io.c:1043 redirected_tty_write+0xa3/0xb0 drivers/tty/tty_io.c:1064 __vfs_write+0x105/0x6b0 fs/read_write.c:480 vfs_write+0x198/0x500 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xfd/0x230 fs/read_write.c:582 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 -> #1 (&port_lock_key){-.-.}: lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:160 serial8250_console_write+0x709/0x930 drivers/tty/serial/8250/8250_port.c:3232 univ8250_console_write+0x5f/0x70 drivers/tty/serial/8250/8250_core.c:597 call_console_drivers kernel/printk/printk.c:1725 [inline] console_unlock+0x9ba/0xed0 kernel/printk/printk.c:2397 vprintk_emit kernel/printk/printk.c:1923 [inline] vprintk_emit+0x1f9/0x600 kernel/printk/printk.c:1888 vprintk_default+0x28/0x30 kernel/printk/printk.c:1963 vprintk_func+0x5d/0x159 kernel/printk/printk_safe.c:401 printk+0x9e/0xbc kernel/printk/printk.c:1996 register_console+0x614/0x9e0 kernel/printk/printk.c:2716 univ8250_console_init+0x33/0x3f drivers/tty/serial/8250/8250_core.c:692 console_init+0x4d/0x5d kernel/printk/printk.c:2797 start_kernel+0x43c/0x6fd init/main.c:634 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:399 x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:380 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 -> #0 (console_owner){-.-.}: check_prev_add kernel/locking/lockdep.c:1901 [inline] check_prevs_add kernel/locking/lockdep.c:2018 [inline] validate_chain kernel/locking/lockdep.c:2460 [inline] __lock_acquire+0x2cb3/0x4620 kernel/locking/lockdep.c:3487 lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994 console_trylock_spinning kernel/printk/printk.c:1679 [inline] vprintk_emit kernel/printk/printk.c:1922 [inline] vprintk_emit+0x32e/0x600 kernel/printk/printk.c:1888 vprintk_default+0x28/0x30 kernel/printk/printk.c:1963 vprintk_func+0x5d/0x159 kernel/printk/printk_safe.c:401 printk+0x9e/0xbc kernel/printk/printk.c:1996 tty_port_close_start.part.0+0x491/0x4e0 drivers/tty/tty_port.c:574 tty_port_close_start drivers/tty/tty_port.c:646 [inline] tty_port_close+0x41/0xc0 drivers/tty/tty_port.c:639 tpk_close+0x7a/0x8c drivers/char/ttyprintk.c:109 tty_release+0x373/0xd60 drivers/tty/tty_io.c:1670 __fput+0x275/0x7a0 fs/file_table.c:210 ____fput+0x16/0x20 fs/file_table.c:244 task_work_run+0x114/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x42/0xb7 other info that might help us debug this: Chain exists of: console_owner --> &port_lock_key --> &(&port->lock)->rlock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(&port->lock)->rlock); lock(&port_lock_key); lock(&(&port->lock)->rlock); lock(console_owner); *** DEADLOCK *** 2 locks held by syz-executor.4/4304: #0: (&tty->legacy_mutex){+.+.}, at: [] tty_lock+0x68/0x80 drivers/tty/tty_mutex.c:19 #1: (&(&port->lock)->rlock){-.-.}, at: [] tty_port_close_start.part.0+0x2b/0x4e0 drivers/tty/tty_port.c:572 stack backtrace: CPU: 0 PID: 4304 Comm: syz-executor.4 Not tainted 4.14.158-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 print_circular_bug.isra.0.cold+0x1cc/0x28f kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1901 [inline] check_prevs_add kernel/locking/lockdep.c:2018 [inline] validate_chain kernel/locking/lockdep.c:2460 [inline] __lock_acquire+0x2cb3/0x4620 kernel/locking/lockdep.c:3487 lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3994 console_trylock_spinning kernel/printk/printk.c:1679 [inline] vprintk_emit kernel/printk/printk.c:1922 [inline] vprintk_emit+0x32e/0x600 kernel/printk/printk.c:1888 vprintk_default+0x28/0x30 kernel/printk/printk.c:1963 vprintk_func+0x5d/0x159 kernel/printk/printk_safe.c:401 printk+0x9e/0xbc kernel/printk/printk.c:1996 tty_port_close_start.part.0+0x491/0x4e0 drivers/tty/tty_port.c:574 tty_port_close_start drivers/tty/tty_port.c:646 [inline] tty_port_close+0x41/0xc0 drivers/tty/tty_port.c:639 tpk_close+0x7a/0x8c drivers/char/ttyprintk.c:109 tty_release+0x373/0xd60 drivers/tty/tty_io.c:1670 __fput+0x275/0x7a0 fs/file_table.c:210 ____fput+0x16/0x20 fs/file_table.c:244 task_work_run+0x114/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4bc/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x4144b1 RSP: 002b:00007fff9e605fa0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 000000000000000c RCX: 00000000004144b1 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b RBP: 0000000000000001 R08: 000000006e783fbb R09: 000000006e783fbf R10: 00007fff9e606080 R11: 0000000000000293 R12: 000000000075bf20 R13: 00000000000b23c2 R14: 0000000000761200 R15: 000000000075bf2c protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' block nbd4: shutting down sockets block nbd0: shutting down sockets block nbd3: shutting down sockets kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd3: shutting down sockets kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env block nbd5: Device being setup by another task kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' block nbd5: Device being setup by another task kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' block nbd3: shutting down sockets block nbd3: shutting down sockets kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd4: shutting down sockets kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' block nbd4: shutting down sockets IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20001 kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 block nbd4: shutting down sockets block nbd4: shutting down sockets kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 overlayfs: filesystem on './file0' not supported as upperdir kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' block nbd3: shutting down sockets kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' block nbd3: shutting down sockets kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env net_ratelimit: 12 callbacks suppressed protocol 88fb is buggy, dev hsr_slave_0 kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' protocol 88fb is buggy, dev hsr_slave_1 block nbd1: shutting down sockets block nbd1: shutting down sockets kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' audit: type=1804 audit(1576610811.155:543): pid=4478 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir282997234/syzkaller.MK7jxi/1151/bus" dev="sda1" ino=16833 res=1 audit: type=1804 audit(1576610811.165:544): pid=4478 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir282997234/syzkaller.MK7jxi/1151/bus" dev="sda1" ino=16833 res=1 IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd4: shutting down sockets block nbd4: shutting down sockets kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' block nbd0: shutting down sockets kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop5' (ffff8880a423e6e0): kobject_uevent_env kobject: 'loop5' (ffff8880a423e6e0): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd0: shutting down sockets kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' block nbd4: shutting down sockets block nbd1: shutting down sockets block nbd4: shutting down sockets kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd1: shutting down sockets kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' block nbd4: shutting down sockets block nbd4: shutting down sockets kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' block nbd4: shutting down sockets block nbd4: shutting down sockets kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd0: shutting down sockets block nbd0: shutting down sockets kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd4: shutting down sockets kobject: 'loop0' (ffff88808c17a360): kobject_uevent_env block nbd4: shutting down sockets kobject: 'loop0' (ffff88808c17a360): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4' block nbd3: shutting down sockets block nbd3: shutting down sockets kobject: 'loop3' (ffff8880a4187720): kobject_uevent_env kobject: 'loop3' (ffff8880a4187720): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop4' (ffff8880a41e8660): kobject_uevent_env kobject: 'loop4' (ffff8880a41e8660): fill_kobj_path: path = '/devices/virtual/block/loop4'