Extracting prog: 2m7.691302512s
Minimizing prog: 19m15.400449532s
Simplifying prog options: 3m39.730404491s
Extracting C: 1m51.043135941s
Simplifying C: 0s
1 programs, timeouts [30s 1m40s 6m0s]
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS-syz_open_dev$mouse
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
syz_open_dev$mouse(0x0, 0x8000000000000001, 0x2000)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS-syz_open_dev$mouse
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
syz_open_dev$mouse(0x0, 0x8000000000000001, 0x2000)
program crashed: KASAN: slab-use-after-free Read in __schedule
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program crashed: possible deadlock in task_fork_fair
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, 0x0, 0x0, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {0x0}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{0x0}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{0x0}], 0x1, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
extracting C reproducer
testing compiled C program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
program did not crash
simplifying guilty program options
testing program (duration=1m40.354491814s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
testing program (duration=1m40.354491814s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-ioctl$PPPIOCSCOMPRESS
detailed listing:
executing program 0:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0)
r0 = getpid()
process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0xfffffff7}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0)
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
program did not crash
reproducing took 26m53.865312206s
repro crashed as (corrupted=false):
------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc5-syzkaller-00207-gfb24560f31f9 #0 Not tainted
------------------------------------------------------
udevd/4831 is trying to acquire lock:
ffffffff8dda8018 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
but task is already holding lock:
ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:568 [inline]
ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:553
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560
raw_spin_rq_lock kernel/sched/sched.h:1415 [inline]
rq_lock kernel/sched/sched.h:1714 [inline]
task_fork_fair+0x73/0x250 kernel/sched/fair.c:12710
sched_cgroup_fork+0x3cf/0x510 kernel/sched/core.c:4633
copy_process+0x43a1/0x8de0 kernel/fork.c:2483
kernel_clone+0xfd/0x960 kernel/fork.c:2781
user_mode_thread+0xb4/0xf0 kernel/fork.c:2859
rest_init+0x23/0x2b0 init/main.c:712
start_kernel+0x3df/0x4c0 init/main.c:1103
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #1 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4051
up+0x79/0xb0 kernel/locking/semaphore.c:191
__up_console_sem kernel/printk/printk.c:340 [inline]
__console_unlock kernel/printk/printk.c:2801 [inline]
console_unlock+0x23e/0x290 kernel/printk/printk.c:3120
vga_remove_vgacon drivers/pci/vgaarb.c:186 [inline]
vga_remove_vgacon+0x90/0xd0 drivers/pci/vgaarb.c:167
__aperture_remove_legacy_vga_devices drivers/video/aperture.c:331 [inline]
aperture_remove_conflicting_pci_devices+0x16a/0x1e0 drivers/video/aperture.c:369
virtio_gpu_pci_quirk drivers/gpu/drm/virtio/virtgpu_drv.c:61 [inline]
virtio_gpu_probe+0x408/0x4e0 drivers/gpu/drm/virtio/virtgpu_drv.c:92
virtio_dev_probe+0x586/0x8a0 drivers/virtio/virtio.c:308
call_driver_probe drivers/base/dd.c:578 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__driver_attach+0x283/0x580 drivers/base/dd.c:1215
bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:368
bus_add_driver+0x2e9/0x690 drivers/base/bus.c:673
driver_register+0x15c/0x4b0 drivers/base/driver.c:246
do_one_initcall+0x128/0x700 init/main.c:1267
do_initcall_level init/main.c:1329 [inline]
do_initcalls init/main.c:1345 [inline]
do_basic_setup init/main.c:1364 [inline]
kernel_init_freeable+0x69d/0xca0 init/main.c:1578
kernel_init+0x1c/0x2b0 init/main.c:1467
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 ((console_sem).lock){-...}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x40/0x140 kernel/printk/printk.c:323
console_trylock kernel/printk/printk.c:2754 [inline]
console_trylock_spinning kernel/printk/printk.c:1958 [inline]
vprintk_emit+0x3d3/0x600 kernel/printk/printk.c:2347
vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45
_printk+0xc8/0x100 kernel/printk/printk.c:2373
__report_bug lib/bug.c:195 [inline]
report_bug+0x433/0x580 lib/bug.c:219
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
rq_clock_task kernel/sched/sched.h:1562 [inline]
update_stats_curr_start kernel/sched/fair.c:1301 [inline]
set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
set_next_task_fair+0x88/0x330 kernel/sched/fair.c:12875
set_next_task kernel/sched/sched.h:2353 [inline]
pick_next_task kernel/sched/core.c:5934 [inline]
__schedule+0x114c/0x5490 kernel/sched/core.c:6484
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:6851
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
check_kcov_mode kernel/kcov.c:182 [inline]
__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:216
unwind_get_return_address+0x58/0xe0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xc1/0x170 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3988 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4044
seq_open+0x5b/0x180 fs/seq_file.c:63
kernfs_fop_open+0x5e4/0xdb0 fs/kernfs/file.c:686
do_dentry_open+0x91f/0x15f0 fs/open.c:959
vfs_open+0x82/0x3f0 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2141/0x2d20 fs/namei.c:3886
do_filp_open+0x1dc/0x430 fs/namei.c:3913
do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock((console_sem).lock);
*** DEADLOCK ***
2 locks held by udevd/4831:
#0: ffff8880245605a8 (kn->active#5){.+.+}-{0:0}, at: kernfs_fop_open+0xa2/0xdb0 fs/kernfs/file.c:601
#1: ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:568 [inline]
#1: ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:553
stack backtrace:
CPU: 1 UID: 0 PID: 4831 Comm: udevd Not tainted 6.11.0-rc5-syzkaller-00207-gfb24560f31f9 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x40/0x140 kernel/printk/printk.c:323
console_trylock kernel/printk/printk.c:2754 [inline]
console_trylock_spinning kernel/printk/printk.c:1958 [inline]
vprintk_emit+0x3d3/0x600 kernel/printk/printk.c:2347
vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45
_printk+0xc8/0x100 kernel/printk/printk.c:2373
__report_bug lib/bug.c:195 [inline]
report_bug+0x433/0x580 lib/bug.c:219
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
RIP: 0010:rq_clock_task kernel/sched/sched.h:1562 [inline]
RIP: 0010:update_stats_curr_start kernel/sched/fair.c:1301 [inline]
RIP: 0010:set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
Code: 00 fc ff df 4c 89 e1 48 c1 e9 03 80 3c 11 00 0f 85 da 02 00 00 48 2b 45 60 4c 39 f0 49 0f 42 c6 49 89 45 68 e9 88 fe ff ff 90 <0f> 0b 90 e9 06 fe ff ff 0f 1f 44 00 00 48 89 ee 4c 89 ef e8 cb 41
RSP: 0018:ffffc90006437258 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88806a83edc0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8b4cda40 RDI: ffffffff8bb0f900
RBP: ffff888020a98080 R08: 0000000000000000 R09: fffffbfff2028813
R10: ffffffff9014409f R11: 0000000000000000 R12: ffff88803764f178
R13: ffff88803764f000 R14: ffff888020a98000 R15: ffff88806a73edc0
set_next_task_fair+0x88/0x330 kernel/sched/fair.c:12875
set_next_task kernel/sched/sched.h:2353 [inline]
pick_next_task kernel/sched/core.c:5934 [inline]
__schedule+0x114c/0x5490 kernel/sched/core.c:6484
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:6851
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:216
Code: 78 7e a9 00 01 ff 00 48 8b 34 24 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 1c 16 00 00 85 c0 74 2b <8b> 82 f8 15 00 00 83 f8 02 75 20 48 8b 8a 00 16 00 00 8b 92 fc 15
RSP: 0018:ffffc90006437548 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffffc90006437578 RCX: ffffffff813cd86c
RDX: ffff8880212f0000 RSI: ffffffff813cd888 RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006437578
R13: ffffffff81775bb0 R14: ffffc90006437638 R15: ffff8880212f0000
unwind_get_return_address+0x58/0xe0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xc1/0x170 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3988 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4044
seq_open+0x5b/0x180 fs/seq_file.c:63
kernfs_fop_open+0x5e4/0xdb0 fs/kernfs/file.c:686
do_dentry_open+0x91f/0x15f0 fs/open.c:959
vfs_open+0x82/0x3f0 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2141/0x2d20 fs/namei.c:3886
do_filp_open+0x1dc/0x430 fs/namei.c:3913
do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce04b6f9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffde1a48e10 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fce04b6f9a4
RDX: 0000000000080000 RSI: 00007ffde1a48f48 RDI: 00000000ffffff9c
RBP: 00007ffde1a48f48 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 0000563a18b35b42 R14: 0000000000000001 R15: 0000000000000000
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 rq_clock_task kernel/sched/sched.h:1562 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 update_stats_curr_start kernel/sched/fair.c:1301 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
Modules linked in:
CPU: 1 UID: 0 PID: 4831 Comm: udevd Not tainted 6.11.0-rc5-syzkaller-00207-gfb24560f31f9 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
RIP: 0010:rq_clock_task kernel/sched/sched.h:1562 [inline]
RIP: 0010:update_stats_curr_start kernel/sched/fair.c:1301 [inline]
RIP: 0010:set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
Code: 00 fc ff df 4c 89 e1 48 c1 e9 03 80 3c 11 00 0f 85 da 02 00 00 48 2b 45 60 4c 39 f0 49 0f 42 c6 49 89 45 68 e9 88 fe ff ff 90 <0f> 0b 90 e9 06 fe ff ff 0f 1f 44 00 00 48 89 ee 4c 89 ef e8 cb 41
RSP: 0018:ffffc90006437258 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88806a83edc0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8b4cda40 RDI: ffffffff8bb0f900
RBP: ffff888020a98080 R08: 0000000000000000 R09: fffffbfff2028813
R10: ffffffff9014409f R11: 0000000000000000 R12: ffff88803764f178
R13: ffff88803764f000 R14: ffff888020a98000 R15: ffff88806a73edc0
FS: 00007fce04a9c280(0000) GS:ffff88806a700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020ff7000 CR3: 00000000304d2000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
set_next_task_fair+0x88/0x330 kernel/sched/fair.c:12875
set_next_task kernel/sched/sched.h:2353 [inline]
pick_next_task kernel/sched/core.c:5934 [inline]
__schedule+0x114c/0x5490 kernel/sched/core.c:6484
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:6851
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:216
Code: 78 7e a9 00 01 ff 00 48 8b 34 24 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 1c 16 00 00 85 c0 74 2b <8b> 82 f8 15 00 00 83 f8 02 75 20 48 8b 8a 00 16 00 00 8b 92 fc 15
RSP: 0018:ffffc90006437548 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffffc90006437578 RCX: ffffffff813cd86c
RDX: ffff8880212f0000 RSI: ffffffff813cd888 RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006437578
R13: ffffffff81775bb0 R14: ffffc90006437638 R15: ffff8880212f0000
unwind_get_return_address+0x58/0xe0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xc1/0x170 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3988 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4044
seq_open+0x5b/0x180 fs/seq_file.c:63
kernfs_fop_open+0x5e4/0xdb0 fs/kernfs/file.c:686
do_dentry_open+0x91f/0x15f0 fs/open.c:959
vfs_open+0x82/0x3f0 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2141/0x2d20 fs/namei.c:3886
do_filp_open+0x1dc/0x430 fs/namei.c:3913
do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce04b6f9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffde1a48e10 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fce04b6f9a4
RDX: 0000000000080000 RSI: 00007ffde1a48f48 RDI: 00000000ffffff9c
RBP: 00007ffde1a48f48 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 0000563a18b35b42 R14: 0000000000000001 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 78 7e js 0x80
2: a9 00 01 ff 00 test $0xff0100,%eax
7: 48 8b 34 24 mov (%rsp),%rsi
b: 74 1d je 0x2a
d: f6 c4 01 test $0x1,%ah
10: 74 43 je 0x55
12: a9 00 00 0f 00 test $0xf0000,%eax
17: 75 3c jne 0x55
19: a9 00 00 f0 00 test $0xf00000,%eax
1e: 75 35 jne 0x55
20: 8b 82 1c 16 00 00 mov 0x161c(%rdx),%eax
26: 85 c0 test %eax,%eax
28: 74 2b je 0x55
* 2a: 8b 82 f8 15 00 00 mov 0x15f8(%rdx),%eax <-- trapping instruction
30: 83 f8 02 cmp $0x2,%eax
33: 75 20 jne 0x55
35: 48 8b 8a 00 16 00 00 mov 0x1600(%rdx),%rcx
3c: 8b .byte 0x8b
3d: 92 xchg %eax,%edx
3e: fc cld
3f: 15 .byte 0x15
final repro crashed as (corrupted=false):
------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc5-syzkaller-00207-gfb24560f31f9 #0 Not tainted
------------------------------------------------------
udevd/4831 is trying to acquire lock:
ffffffff8dda8018 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
but task is already holding lock:
ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:568 [inline]
ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:553
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:560
raw_spin_rq_lock kernel/sched/sched.h:1415 [inline]
rq_lock kernel/sched/sched.h:1714 [inline]
task_fork_fair+0x73/0x250 kernel/sched/fair.c:12710
sched_cgroup_fork+0x3cf/0x510 kernel/sched/core.c:4633
copy_process+0x43a1/0x8de0 kernel/fork.c:2483
kernel_clone+0xfd/0x960 kernel/fork.c:2781
user_mode_thread+0xb4/0xf0 kernel/fork.c:2859
rest_init+0x23/0x2b0 init/main.c:712
start_kernel+0x3df/0x4c0 init/main.c:1103
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148
-> #1 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0x9a/0x13e0 kernel/sched/core.c:4051
up+0x79/0xb0 kernel/locking/semaphore.c:191
__up_console_sem kernel/printk/printk.c:340 [inline]
__console_unlock kernel/printk/printk.c:2801 [inline]
console_unlock+0x23e/0x290 kernel/printk/printk.c:3120
vga_remove_vgacon drivers/pci/vgaarb.c:186 [inline]
vga_remove_vgacon+0x90/0xd0 drivers/pci/vgaarb.c:167
__aperture_remove_legacy_vga_devices drivers/video/aperture.c:331 [inline]
aperture_remove_conflicting_pci_devices+0x16a/0x1e0 drivers/video/aperture.c:369
virtio_gpu_pci_quirk drivers/gpu/drm/virtio/virtgpu_drv.c:61 [inline]
virtio_gpu_probe+0x408/0x4e0 drivers/gpu/drm/virtio/virtgpu_drv.c:92
virtio_dev_probe+0x586/0x8a0 drivers/virtio/virtio.c:308
call_driver_probe drivers/base/dd.c:578 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__driver_attach+0x283/0x580 drivers/base/dd.c:1215
bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:368
bus_add_driver+0x2e9/0x690 drivers/base/bus.c:673
driver_register+0x15c/0x4b0 drivers/base/driver.c:246
do_one_initcall+0x128/0x700 init/main.c:1267
do_initcall_level init/main.c:1329 [inline]
do_initcalls init/main.c:1345 [inline]
do_basic_setup init/main.c:1364 [inline]
kernel_init_freeable+0x69d/0xca0 init/main.c:1578
kernel_init+0x1c/0x2b0 init/main.c:1467
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 ((console_sem).lock){-...}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x40/0x140 kernel/printk/printk.c:323
console_trylock kernel/printk/printk.c:2754 [inline]
console_trylock_spinning kernel/printk/printk.c:1958 [inline]
vprintk_emit+0x3d3/0x600 kernel/printk/printk.c:2347
vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45
_printk+0xc8/0x100 kernel/printk/printk.c:2373
__report_bug lib/bug.c:195 [inline]
report_bug+0x433/0x580 lib/bug.c:219
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
rq_clock_task kernel/sched/sched.h:1562 [inline]
update_stats_curr_start kernel/sched/fair.c:1301 [inline]
set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
set_next_task_fair+0x88/0x330 kernel/sched/fair.c:12875
set_next_task kernel/sched/sched.h:2353 [inline]
pick_next_task kernel/sched/core.c:5934 [inline]
__schedule+0x114c/0x5490 kernel/sched/core.c:6484
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:6851
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
check_kcov_mode kernel/kcov.c:182 [inline]
__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:216
unwind_get_return_address+0x58/0xe0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xc1/0x170 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3988 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4044
seq_open+0x5b/0x180 fs/seq_file.c:63
kernfs_fop_open+0x5e4/0xdb0 fs/kernfs/file.c:686
do_dentry_open+0x91f/0x15f0 fs/open.c:959
vfs_open+0x82/0x3f0 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2141/0x2d20 fs/namei.c:3886
do_filp_open+0x1dc/0x430 fs/namei.c:3913
do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
(console_sem).lock --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock((console_sem).lock);
*** DEADLOCK ***
2 locks held by udevd/4831:
#0: ffff8880245605a8 (kn->active#5){.+.+}-{0:0}, at: kernfs_fop_open+0xa2/0xdb0 fs/kernfs/file.c:601
#1: ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:568 [inline]
#1: ffff88806a63edd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:553
stack backtrace:
CPU: 1 UID: 0 PID: 4831 Comm: udevd Not tainted 6.11.0-rc5-syzkaller-00207-gfb24560f31f9 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
down_trylock+0x12/0x70 kernel/locking/semaphore.c:139
__down_trylock_console_sem+0x40/0x140 kernel/printk/printk.c:323
console_trylock kernel/printk/printk.c:2754 [inline]
console_trylock_spinning kernel/printk/printk.c:1958 [inline]
vprintk_emit+0x3d3/0x600 kernel/printk/printk.c:2347
vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:45
_printk+0xc8/0x100 kernel/printk/printk.c:2373
__report_bug lib/bug.c:195 [inline]
report_bug+0x433/0x580 lib/bug.c:219
handle_bug+0x3d/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x17/0x50 arch/x86/kernel/traps.c:260
asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
RIP: 0010:rq_clock_task kernel/sched/sched.h:1562 [inline]
RIP: 0010:update_stats_curr_start kernel/sched/fair.c:1301 [inline]
RIP: 0010:set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
Code: 00 fc ff df 4c 89 e1 48 c1 e9 03 80 3c 11 00 0f 85 da 02 00 00 48 2b 45 60 4c 39 f0 49 0f 42 c6 49 89 45 68 e9 88 fe ff ff 90 <0f> 0b 90 e9 06 fe ff ff 0f 1f 44 00 00 48 89 ee 4c 89 ef e8 cb 41
RSP: 0018:ffffc90006437258 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88806a83edc0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8b4cda40 RDI: ffffffff8bb0f900
RBP: ffff888020a98080 R08: 0000000000000000 R09: fffffbfff2028813
R10: ffffffff9014409f R11: 0000000000000000 R12: ffff88803764f178
R13: ffff88803764f000 R14: ffff888020a98000 R15: ffff88806a73edc0
set_next_task_fair+0x88/0x330 kernel/sched/fair.c:12875
set_next_task kernel/sched/sched.h:2353 [inline]
pick_next_task kernel/sched/core.c:5934 [inline]
__schedule+0x114c/0x5490 kernel/sched/core.c:6484
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:6851
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:216
Code: 78 7e a9 00 01 ff 00 48 8b 34 24 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 1c 16 00 00 85 c0 74 2b <8b> 82 f8 15 00 00 83 f8 02 75 20 48 8b 8a 00 16 00 00 8b 92 fc 15
RSP: 0018:ffffc90006437548 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffffc90006437578 RCX: ffffffff813cd86c
RDX: ffff8880212f0000 RSI: ffffffff813cd888 RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006437578
R13: ffffffff81775bb0 R14: ffffc90006437638 R15: ffff8880212f0000
unwind_get_return_address+0x58/0xe0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xc1/0x170 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3988 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4044
seq_open+0x5b/0x180 fs/seq_file.c:63
kernfs_fop_open+0x5e4/0xdb0 fs/kernfs/file.c:686
do_dentry_open+0x91f/0x15f0 fs/open.c:959
vfs_open+0x82/0x3f0 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2141/0x2d20 fs/namei.c:3886
do_filp_open+0x1dc/0x430 fs/namei.c:3913
do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce04b6f9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffde1a48e10 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fce04b6f9a4
RDX: 0000000000080000 RSI: 00007ffde1a48f48 RDI: 00000000ffffff9c
RBP: 00007ffde1a48f48 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 0000563a18b35b42 R14: 0000000000000001 R15: 0000000000000000
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 rq_clock_task kernel/sched/sched.h:1562 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 update_stats_curr_start kernel/sched/fair.c:1301 [inline]
WARNING: CPU: 1 PID: 4831 at kernel/sched/sched.h:1406 set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
Modules linked in:
CPU: 1 UID: 0 PID: 4831 Comm: udevd Not tainted 6.11.0-rc5-syzkaller-00207-gfb24560f31f9 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1406 [inline]
RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1404 [inline]
RIP: 0010:rq_clock_task kernel/sched/sched.h:1562 [inline]
RIP: 0010:update_stats_curr_start kernel/sched/fair.c:1301 [inline]
RIP: 0010:set_next_entity+0x30d/0x670 kernel/sched/fair.c:5443
Code: 00 fc ff df 4c 89 e1 48 c1 e9 03 80 3c 11 00 0f 85 da 02 00 00 48 2b 45 60 4c 39 f0 49 0f 42 c6 49 89 45 68 e9 88 fe ff ff 90 <0f> 0b 90 e9 06 fe ff ff 0f 1f 44 00 00 48 89 ee 4c 89 ef e8 cb 41
RSP: 0018:ffffc90006437258 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88806a83edc0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8b4cda40 RDI: ffffffff8bb0f900
RBP: ffff888020a98080 R08: 0000000000000000 R09: fffffbfff2028813
R10: ffffffff9014409f R11: 0000000000000000 R12: ffff88803764f178
R13: ffff88803764f000 R14: ffff888020a98000 R15: ffff88806a73edc0
FS: 00007fce04a9c280(0000) GS:ffff88806a700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020ff7000 CR3: 00000000304d2000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
set_next_task_fair+0x88/0x330 kernel/sched/fair.c:12875
set_next_task kernel/sched/sched.h:2353 [inline]
pick_next_task kernel/sched/core.c:5934 [inline]
__schedule+0x114c/0x5490 kernel/sched/core.c:6484
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:6851
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:216
Code: 78 7e a9 00 01 ff 00 48 8b 34 24 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 1c 16 00 00 85 c0 74 2b <8b> 82 f8 15 00 00 83 f8 02 75 20 48 8b 8a 00 16 00 00 8b 92 fc 15
RSP: 0018:ffffc90006437548 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffffc90006437578 RCX: ffffffff813cd86c
RDX: ffff8880212f0000 RSI: ffffffff813cd888 RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006437578
R13: ffffffff81775bb0 R14: ffffc90006437638 R15: ffff8880212f0000
unwind_get_return_address+0x58/0xe0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xc1/0x170 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:312 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3988 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4044
seq_open+0x5b/0x180 fs/seq_file.c:63
kernfs_fop_open+0x5e4/0xdb0 fs/kernfs/file.c:686
do_dentry_open+0x91f/0x15f0 fs/open.c:959
vfs_open+0x82/0x3f0 fs/open.c:1089
do_open fs/namei.c:3727 [inline]
path_openat+0x2141/0x2d20 fs/namei.c:3886
do_filp_open+0x1dc/0x430 fs/namei.c:3913
do_sys_openat2+0x17a/0x1e0 fs/open.c:1416
do_sys_open fs/open.c:1431 [inline]
__do_sys_openat fs/open.c:1447 [inline]
__se_sys_openat fs/open.c:1442 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1442
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce04b6f9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffde1a48e10 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fce04b6f9a4
RDX: 0000000000080000 RSI: 00007ffde1a48f48 RDI: 00000000ffffff9c
RBP: 00007ffde1a48f48 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 0000563a18b35b42 R14: 0000000000000001 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 78 7e js 0x80
2: a9 00 01 ff 00 test $0xff0100,%eax
7: 48 8b 34 24 mov (%rsp),%rsi
b: 74 1d je 0x2a
d: f6 c4 01 test $0x1,%ah
10: 74 43 je 0x55
12: a9 00 00 0f 00 test $0xf0000,%eax
17: 75 3c jne 0x55
19: a9 00 00 f0 00 test $0xf00000,%eax
1e: 75 35 jne 0x55
20: 8b 82 1c 16 00 00 mov 0x161c(%rdx),%eax
26: 85 c0 test %eax,%eax
28: 74 2b je 0x55
* 2a: 8b 82 f8 15 00 00 mov 0x15f8(%rdx),%eax <-- trapping instruction
30: 83 f8 02 cmp $0x2,%eax
33: 75 20 jne 0x55
35: 48 8b 8a 00 16 00 00 mov 0x1600(%rdx),%rcx
3c: 8b .byte 0x8b
3d: 92 xchg %eax,%edx
3e: fc cld
3f: 15 .byte 0x15