============================================ WARNING: possible recursive locking detected 4.19.211-syzkaller #0 Not tainted -------------------------------------------- syz-executor.4/5582 is trying to acquire lock: 00000000a9f74ff6 (&port_lock_key){-.-.}, at: uart_write+0x1ce/0x6f0 drivers/tty/serial/serial_core.c:591 but task is already holding lock: 00000000a9f74ff6 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1876 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&port_lock_key); lock(&port_lock_key); *** DEADLOCK *** May be due to missing lock nesting notation 8 locks held by syz-executor.4/5582: #0: 0000000042020250 (&mm->mmap_sem){++++}, at: __mm_populate+0x24e/0x350 mm/gup.c:1277 #1: 00000000022da172 (rcu_read_lock){....}, at: filemap_map_pages+0xf5/0x11c0 mm/filemap.c:2642 #2: 000000003b1f3d0e (&(ptlock_ptr(page))->rlock#2){+.+.}, at: spin_lock include/linux/spinlock.h:329 [inline] #2: 000000003b1f3d0e (&(ptlock_ptr(page))->rlock#2){+.+.}, at: pte_alloc_one_map mm/memory.c:3479 [inline] #2: 000000003b1f3d0e (&(ptlock_ptr(page))->rlock#2){+.+.}, at: alloc_set_pte+0xfbc/0x1a00 mm/memory.c:3608 #3: 00000000022da172 (rcu_read_lock){....}, at: ieee80211_iterate_active_interfaces_atomic+0x0/0x170 net/mac80211/util.c:637 #4: 00000000022da172 (rcu_read_lock){....}, at: __ieee80211_beacon_get+0x0/0x1a30 include/linux/compiler.h:263 #5: 00000000d0711907 (&(&i->lock)->rlock){-.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] #5: 00000000d0711907 (&(&i->lock)->rlock){-.-.}, at: serial8250_interrupt+0x3a/0x240 drivers/tty/serial/8250/8250_core.c:115 #6: 00000000a9f74ff6 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1876 #7: 00000000d5467c4f (&tty->ldisc_sem){++++}, at: tty_ldisc_ref+0x1d/0x80 drivers/tty/tty_ldisc.c:293 stack backtrace: CPU: 1 PID: 5582 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_deadlock_bug kernel/locking/lockdep.c:1764 [inline] check_deadlock kernel/locking/lockdep.c:1808 [inline] validate_chain kernel/locking/lockdep.c:2404 [inline] __lock_acquire.cold+0x121/0x57e kernel/locking/lockdep.c:3416 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152 uart_write+0x1ce/0x6f0 drivers/tty/serial/serial_core.c:591 n_hdlc_send_frames+0x278/0x470 drivers/tty/n_hdlc.c:403 n_hdlc_tty_wakeup+0xa0/0xc0 drivers/tty/n_hdlc.c:479 tty_wakeup+0xd4/0x110 drivers/tty/tty_io.c:534 tty_port_default_wakeup+0x26/0x40 drivers/tty/tty_port.c:50 serial8250_tx_chars+0x490/0xaf0 drivers/tty/serial/8250/8250_port.c:1813 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1900 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1873 [inline] serial8250_default_handle_irq+0xae/0x220 drivers/tty/serial/8250/8250_port.c:1916 serial8250_interrupt+0x101/0x240 drivers/tty/serial/8250/8250_core.c:125 __handle_irq_event_percpu+0x27e/0x8e0 kernel/irq/handle.c:149 handle_irq_event_percpu kernel/irq/handle.c:189 [inline] handle_irq_event+0x102/0x290 kernel/irq/handle.c:206 handle_edge_irq+0x260/0xcf0 kernel/irq/chip.c:800 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x93/0x1c0 arch/x86/kernel/irq.c:246 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:334 [inline] RIP: 0010:deref_stack_reg+0x134/0x1d0 arch/x86/kernel/unwind_orc.c:328 Code: 49 8b 74 24 28 4c 89 e2 48 89 ef e8 16 33 f7 ff 41 89 c0 31 c0 45 85 c0 75 32 48 8d 74 24 28 48 89 ef 4c 89 ea e8 cc fc ff ff <48> c1 ea 03 48 8b 6c 24 28 48 b8 00 00 00 00 00 fc ff df 80 3c 02 RSP: 0018:ffff8880ba107698 EFLAGS: 00000283 ORIG_RAX: ffffffffffffffd2 RAX: dffffc0000000000 RBX: 1ffff11017420ed4 RCX: 0000000000000000 RDX: ffff8880ba1078a0 RSI: ffff8880ba1076c0 RDI: ffff8880a9b87e48 RBP: ffff8880a9b87e48 R08: 0000000000000001 R09: 0000000000000001 R10: ffff8880ba1078bf R11: 0000000000074071 R12: ffff8880ba107860 R13: ffff8880ba1078a0 R14: ffff8880a9b80000 R15: ffffffff8b986752 unwind_next_frame+0xf83/0x1400 arch/x86/kernel/unwind_orc.c:555 __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 kmem_cache_alloc_node+0x146/0x3b0 mm/slab.c:3649 __alloc_skb+0x71/0x560 net/core/skbuff.c:193 __netdev_alloc_skb+0x76/0x460 net/core/skbuff.c:407 netdev_alloc_skb include/linux/skbuff.h:2680 [inline] dev_alloc_skb include/linux/skbuff.h:2693 [inline] __ieee80211_beacon_get+0xc7d/0x1a30 net/mac80211/tx.c:4352 ieee80211_beacon_get_tim+0x88/0x890 net/mac80211/tx.c:4463 ieee80211_beacon_get include/net/mac80211.h:4484 [inline] mac80211_hwsim_beacon_tx+0xff/0x680 drivers/net/wireless/mac80211_hwsim.c:1577 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__sanitizer_cov_trace_pc+0x22/0x50 kernel/kcov.c:101 Code: 90 90 90 90 90 90 90 90 48 8b 34 24 65 48 8b 04 25 c0 df 01 00 65 8b 15 cc 59 9f 7e 81 e2 00 01 1f 00 75 2b 8b 90 60 13 00 00 <83> fa 02 75 20 48 8b 88 68 13 00 00 8b 80 64 13 00 00 48 8b 11 48 RSP: 0018:ffff8880a9b87848 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: ffff8880a5e863c0 RBX: ffffea0001ed1380 RCX: ffffffff817c36b5 RDX: 0000000000000002 RSI: ffffffff817c36c3 RDI: 0000000000000007 RBP: ffffea0001ed1380 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000 R13: dead000000000100 R14: ffffea0001ed1388 R15: ffff8880a9b87a20 PagePoisoned include/linux/page-flags.h:162 [inline] PageLocked include/linux/page-flags.h:272 [inline] unlock_page+0x93/0x230 mm/filemap.c:1228 filemap_map_pages+0x921/0x11c0 mm/filemap.c:2705 do_fault_around mm/memory.c:3776 [inline] do_read_fault mm/memory.c:3810 [inline] do_fault mm/memory.c:3944 [inline] handle_pte_fault mm/memory.c:4175 [inline] __handle_mm_fault+0x2a8e/0x41c0 mm/memory.c:4299 handle_mm_fault+0x436/0xb10 mm/memory.c:4336 faultin_page mm/gup.c:539 [inline] __get_user_pages+0x6f0/0x1710 mm/gup.c:745 populate_vma_page_range+0x200/0x290 mm/gup.c:1249 __mm_populate+0x1ea/0x350 mm/gup.c:1297 mm_populate include/linux/mm.h:2338 [inline] vm_mmap_pgoff+0x1e2/0x200 mm/util.c:362 ksys_mmap_pgoff+0x45f/0x5a0 mm/mmap.c:1580 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f61e913e669 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f61e7a91168 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007f61e9260050 RCX: 00007f61e913e669 RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000000020000000 RBP: 00007f61e9199560 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff3c71554f R14: 00007f61e7a91300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 49 8b 74 24 28 mov 0x28(%r12),%rsi 5: 4c 89 e2 mov %r12,%rdx 8: 48 89 ef mov %rbp,%rdi b: e8 16 33 f7 ff callq 0xfff73326 10: 41 89 c0 mov %eax,%r8d 13: 31 c0 xor %eax,%eax 15: 45 85 c0 test %r8d,%r8d 18: 75 32 jne 0x4c 1a: 48 8d 74 24 28 lea 0x28(%rsp),%rsi 1f: 48 89 ef mov %rbp,%rdi 22: 4c 89 ea mov %r13,%rdx 25: e8 cc fc ff ff callq 0xfffffcf6 * 2a: 48 c1 ea 03 shr $0x3,%rdx <-- trapping instruction 2e: 48 8b 6c 24 28 mov 0x28(%rsp),%rbp 33: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 3a: fc ff df 3d: 80 .byte 0x80 3e: 3c 02 cmp $0x2,%al