RBP: 00000000000005dd R08: 00007fee84093e20 R09: ffffffffffffffff
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000600
R13: 00007fee84093fdc R14: 00007fee84093fe0 R15: 0000000020000c80
============================================
WARNING: possible recursive locking detected
4.19.211-syzkaller #0 Not tainted
--------------------------------------------
syz-executor.3/12598 is trying to acquire lock:
0000000074fe8c03 (&port_lock_key){-.-.}, at: uart_write+0x1ce/0x6f0 drivers/tty/serial/serial_core.c:591
but task is already holding lock:
0000000074fe8c03 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1876
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&port_lock_key);
lock(&port_lock_key);
*** DEADLOCK ***
May be due to missing lock nesting notation
5 locks held by syz-executor.3/12598:
#0: 00000000b1c081f4 (rcu_read_lock){....}, at: ieee80211_iterate_active_interfaces_atomic+0x0/0x170 net/mac80211/util.c:637
#1: 00000000b1c081f4 (rcu_read_lock){....}, at: __ieee80211_beacon_get+0x0/0x1a30 include/linux/compiler.h:263
#2: 00000000443b86ca (&(&i->lock)->rlock){-.-.}, at: spin_lock include/linux/spinlock.h:329 [inline]
#2: 00000000443b86ca (&(&i->lock)->rlock){-.-.}, at: serial8250_interrupt+0x3a/0x240 drivers/tty/serial/8250/8250_core.c:115
#3: 0000000074fe8c03 (&port_lock_key){-.-.}, at: serial8250_handle_irq.part.0+0x21/0x3d0 drivers/tty/serial/8250/8250_port.c:1876
#4: 00000000db9015e4 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref+0x1d/0x80 drivers/tty/tty_ldisc.c:293
stack backtrace:
CPU: 0 PID: 12598 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_deadlock_bug kernel/locking/lockdep.c:1764 [inline]
check_deadlock kernel/locking/lockdep.c:1808 [inline]
validate_chain kernel/locking/lockdep.c:2404 [inline]
__lock_acquire.cold+0x121/0x57e kernel/locking/lockdep.c:3416
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
uart_write+0x1ce/0x6f0 drivers/tty/serial/serial_core.c:591
n_hdlc_send_frames+0x278/0x470 drivers/tty/n_hdlc.c:403
n_hdlc_tty_wakeup+0xa0/0xc0 drivers/tty/n_hdlc.c:479
tty_wakeup+0xd4/0x110 drivers/tty/tty_io.c:534
tty_port_default_wakeup+0x26/0x40 drivers/tty/tty_port.c:50
serial8250_tx_chars+0x490/0xaf0 drivers/tty/serial/8250/8250_port.c:1813
serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1900
serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1873 [inline]
serial8250_default_handle_irq+0xae/0x220 drivers/tty/serial/8250/8250_port.c:1916
serial8250_interrupt+0x101/0x240 drivers/tty/serial/8250/8250_core.c:125
__handle_irq_event_percpu+0x27e/0x8e0 kernel/irq/handle.c:149
handle_irq_event_percpu kernel/irq/handle.c:189 [inline]
handle_irq_event+0x102/0x290 kernel/irq/handle.c:206
handle_edge_irq+0x260/0xcf0 kernel/irq/chip.c:800
generic_handle_irq_desc include/linux/irqdesc.h:155 [inline]
handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87
do_IRQ+0x93/0x1c0 arch/x86/kernel/irq.c:246
common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670
RIP: 0010:preempt_count_sub+0x63/0x150 kernel/sched/core.c:3274
Code: 75 18 65 8b 05 3e 72 c0 7e 25 ff ff ff 7f 39 c3 7f 1a 81 fb fe 00 00 00 76 6a 65 8b 05 26 72 c0 7e f7 db 65 01 1d 1d 72 c0 7e <5b> c3 e8 b6 e4 31 02 85 c0 74 f5 48 c7 c0 40 f7 36 8d 48 ba 00 00
RSP: 0018:ffff8880ba007bc8 EFLAGS: 00000213 ORIG_RAX: ffffffffffffffdb
RAX: 0000000000000102 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffffffff83771e31 RDI: 0000000000000001
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff89f88280
R13: ffffffff89f88280 R14: 1ffff11017400fa8 R15: ffff8880ba007d60
rcu_lockdep_current_cpu_online kernel/rcu/tree.c:1081 [inline]
rcu_lockdep_current_cpu_online+0x12f/0x1b0 kernel/rcu/tree.c:1068
rcu_read_lock_held+0xc3/0x110 kernel/rcu/update.c:285
__ieee80211_beacon_get+0xaa7/0x1a30 net/mac80211/tx.c:4287
ieee80211_beacon_get_tim+0x88/0x890 net/mac80211/tx.c:4463
ieee80211_beacon_get include/net/mac80211.h:4484 [inline]
mac80211_hwsim_beacon_tx+0xff/0x680 drivers/net/wireless/mac80211_hwsim.c:1577
__iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614
ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650
mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615
__tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601
tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522
__do_softirq+0x265/0x980 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744
Code: 00 00 e8 3d 04 29 f9 e8 58 3f 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 9b 18 d9 01 00 74 5b fb 66 0f 1f 44 00 00 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 90 82 f1 89 48 c1 e8 03 80
RSP: 0018:ffff88804957fb50 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3053 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88803b6f4984
RBP: ffffed10076de820 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88803b6f4100
R13: ffffffff89f18298 R14: 0000000000000000 R15: 0000000000000000
retint_kernel+0x1b/0x2d
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:dump_stack+0x2da/0x2ef lib/dump_stack.c:123
Code: 00 74 0c 48 c7 c7 88 82 f1 89 e8 3f 0b 82 f9 48 83 3d 5f 2b db 01 00 75 07 e8 40 2e 4c f9 0f 0b e8 39 2e 4c f9 48 89 df 57 9d <0f> 1f 44 00 00 58 5b 5d 41 5c 41 5d 41 5e 41 5f e9 1f 2e 4c f9 e8
RSP: 0018:ffff88804957fc28 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff02
RAX: 0000000000040000 RBX: 0000000000000212 RCX: ffffc90008434000
RDX: 0000000000040000 RSI: ffffffff88165737 RDI: 0000000000000212
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff
R13: 0000000000000200 R14: dffffc0000000000 R15: 1ffffffff13e3052
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0xa/0xf lib/fault-inject.c:149
__should_failslab+0x115/0x180 mm/failslab.c:32
should_failslab+0x5/0x10 mm/slab_common.c:1590
slab_pre_alloc_hook mm/slab.h:424 [inline]
slab_alloc mm/slab.c:3383 [inline]
kmem_cache_alloc+0x277/0x370 mm/slab.c:3557
shmem_alloc_inode+0x18/0x40 mm/shmem.c:3609
alloc_inode+0x5d/0x180 fs/inode.c:211
new_inode_pseudo fs/inode.c:911 [inline]
new_inode+0x1d/0xf0 fs/inode.c:940
shmem_get_inode+0x96/0x8d0 mm/shmem.c:2196
__shmem_file_setup.part.0+0x7a/0x2b0 mm/shmem.c:3965
__shmem_file_setup mm/shmem.c:3959 [inline]
shmem_file_setup+0x61/0x90 mm/shmem.c:4006
__do_sys_memfd_create mm/memfd.c:325 [inline]
__se_sys_memfd_create+0x26b/0x440 mm/memfd.c:268
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fee85b220d9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fee84093f38 EFLAGS: 00000202 ORIG_RAX: 000000000000013f
RAX: ffffffffffffffda RBX: 00000000000005dd RCX: 00007fee85b220d9
RDX: 00007fee84093fdc RSI: 0000000000000000 RDI: 00007fee85b7ce81
RBP: 00000000000005dd R08: 00007fee84093e20 R09: ffffffffffffffff
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000600
R13: 00007fee84093fdc R14: 00007fee84093fe0 R15: 0000000020000c80
----------------
Code disassembly (best guess):
0: 75 18 jne 0x1a
2: 65 8b 05 3e 72 c0 7e mov %gs:0x7ec0723e(%rip),%eax # 0x7ec07247
9: 25 ff ff ff 7f and $0x7fffffff,%eax
e: 39 c3 cmp %eax,%ebx
10: 7f 1a jg 0x2c
12: 81 fb fe 00 00 00 cmp $0xfe,%ebx
18: 76 6a jbe 0x84
1a: 65 8b 05 26 72 c0 7e mov %gs:0x7ec07226(%rip),%eax # 0x7ec07247
21: f7 db neg %ebx
23: 65 01 1d 1d 72 c0 7e add %ebx,%gs:0x7ec0721d(%rip) # 0x7ec07247
* 2a: 5b pop %rbx <-- trapping instruction
2b: c3 retq
2c: e8 b6 e4 31 02 callq 0x231e4e7
31: 85 c0 test %eax,%eax
33: 74 f5 je 0x2a
35: 48 c7 c0 40 f7 36 8d mov $0xffffffff8d36f740,%rax
3c: 48 rex.W
3d: ba .byte 0xba