possible deadlock in n_tty_receive_buf_common (2)

Status: upstream: reported on 2026/08/10 00:24
Subsystems: serial
[Documentation on labels]
Reported-by: syzbot+087f6a513e0d60ee6ee4@syzkaller.appspotmail.com
First crash: 9d04h, last: 9d04h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
3fe73d03 repro-c Reproduced: ✅ ❓ possible deadlock in n_tty_receive_buf_common (2) 2026/08/11 16:59 2026/08/11 22:59 2026/08/12 00:02 f8d35649
7245ceb8 assessment-security 💥 possible deadlock in n_tty_receive_buf_common (2) 2026/08/11 00:57 2026/08/11 00:57 2026/08/11 00:57 039457bd
cd0711c5 assessment-security 💥 possible deadlock in n_tty_receive_buf_common (2) 2026/08/09 12:19 2026/08/09 12:19 2026/08/09 12:19 5d63f80b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [serial?] possible deadlock in n_tty_receive_buf_common (2) 0 (1) 2026/08/10 00:24
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in n_tty_receive_buf_common 4 syz, C done error 698 2323d 2372d 0/29 auto-obsoleted due to no activity on 2022/12/23 02:52
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/08/12 11:18 21m nogikh@google.com upstream report job log log

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/u33:3/62 is trying to acquire lock:
ffff88804b3fe2c8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_read_constructor include/linux/rwsem.h:259 [inline]
ffff88804b3fe2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_receive_buf_common+0x85/0x1930 drivers/tty/n_tty.c:1678

but task is already holding lock:
ffff88801404a8b8 (&buf->lock){+.+.}-{4:4}, at: flush_to_ldisc+0x34/0x730 drivers/tty/tty_buffer.c:474

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&buf->lock){+.+.}-{4:4}:
       lock_acquire kernel/locking/lockdep.c:5868 [inline]
       lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
       tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
       tty_ldisc_flush+0xd2/0xf0 drivers/tty/tty_ldisc.c:388
       __do_SAK+0x368/0x480 drivers/tty/tty_io.c:3025
       vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:994
       process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
       process_scheduled_works kernel/workqueue.c:3405 [inline]
       worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
       kthread+0x370/0x450 kernel/kthread.c:436
       ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #2 (console_lock){+.+.}-{0:0}:
       lock_acquire kernel/locking/lockdep.c:5868 [inline]
       lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
       console_lock+0x7a/0xa0 kernel/printk/printk.c:2896
       uart_configure_port drivers/tty/serial/serial_core.c:2530 [inline]
       serial_core_add_one_port drivers/tty/serial/serial_core.c:3101 [inline]
       serial_core_register_port+0xe65/0x16f0 drivers/tty/serial/serial_core.c:3322
       serial8250_register_8250_port+0x15af/0x2330 drivers/tty/serial/8250/8250_core.c:828
       serial_pnp_probe+0x436/0x930 drivers/tty/serial/8250/8250_pnp.c:480
       pnp_device_probe+0x2b3/0x4a0 drivers/pnp/driver.c:111
       call_driver_probe drivers/base/dd.c:628 [inline]
       really_probe+0x241/0xa60 drivers/base/dd.c:706
       __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
       driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
       __driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
       bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
       bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
       driver_register+0x1e2/0x360 drivers/base/driver.c:174
       serial8250_init+0xcc/0x1c0 drivers/tty/serial/8250/8250_platform.c:317
       do_one_initcall+0x11d/0x700 init/main.c:1347
       do_initcall_level init/main.c:1409 [inline]
       do_initcalls init/main.c:1425 [inline]
       do_basic_setup init/main.c:1445 [inline]
       kernel_init_freeable+0x6ea/0x7b0 init/main.c:1658
       kernel_init+0x1f/0x1e0 init/main.c:1548
       ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #1 (&port->mutex){+.+.}-{4:4}:
       lock_acquire kernel/locking/lockdep.c:5868 [inline]
       lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
       class_mutex_constructor include/linux/mutex.h:253 [inline]
       uart_set_termios+0x8e/0x690 drivers/tty/serial/serial_core.c:1645
       tty_set_termios+0x64d/0x980 drivers/tty/tty_ioctl.c:341
       set_termios+0x5c8/0x880 drivers/tty/tty_ioctl.c:516
       tty_mode_ioctl+0x17e/0xd40 drivers/tty/tty_ioctl.c:803
       n_tty_ioctl_helper+0x47/0x2b0 drivers/tty/tty_ioctl.c:982
       n_tty_ioctl+0x53/0x340 drivers/tty/n_tty.c:2496
       tty_ioctl+0x11b4/0x1640 drivers/tty/tty_io.c:2801
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:597 [inline]
       __se_sys_ioctl fs/ioctl.c:583 [inline]
       __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0x115/0x840 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&tty->termios_rwsem){++++}-{4:4}:
       check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3165
       check_prevs_add kernel/locking/lockdep.c:3284 [inline]
       validate_chain kernel/locking/lockdep.c:3908 [inline]
       __lock_acquire+0x136c/0x1a40 kernel/locking/lockdep.c:5237
       lock_acquire kernel/locking/lockdep.c:5868 [inline]
       lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
       down_read+0x99/0x4c0 kernel/locking/rwsem.c:1574
       class_rwsem_read_constructor include/linux/rwsem.h:259 [inline]
       n_tty_receive_buf_common+0x85/0x1930 drivers/tty/n_tty.c:1678
       tty_ldisc_receive_buf+0xaa/0x1a0 drivers/tty/tty_buffer.c:394
       tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
       receive_buf drivers/tty/tty_buffer.c:452 [inline]
       flush_to_ldisc+0x26b/0x730 drivers/tty/tty_buffer.c:502
       process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
       process_scheduled_works kernel/workqueue.c:3405 [inline]
       worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
       kthread+0x370/0x450 kernel/kthread.c:436
       ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

other info that might help us debug this:

Chain exists of:
  &tty->termios_rwsem --> console_lock --> &buf->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&buf->lock);
                               lock(console_lock);
                               lock(&buf->lock);
  rlock(&tty->termios_rwsem);

 *** DEADLOCK ***

4 locks held by kworker/u33:3/62:
 #0: ffff88801bce4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: ffffc900009efd08 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
 #2: ffff88801404a8b8 (&buf->lock){+.+.}-{4:4}, at: flush_to_ldisc+0x34/0x730 drivers/tty/tty_buffer.c:474
 #3: ffff88804b3fe0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x21/0x90 drivers/tty/tty_ldisc.c:263

stack backtrace:
CPU: 0 UID: 0 PID: 62 Comm: kworker/u33:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound flush_to_ldisc
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_circular_bug.cold+0x178/0x1c7 kernel/locking/lockdep.c:2043
 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175
 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3165
 check_prevs_add kernel/locking/lockdep.c:3284 [inline]
 validate_chain kernel/locking/lockdep.c:3908 [inline]
 __lock_acquire+0x136c/0x1a40 kernel/locking/lockdep.c:5237
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
 down_read+0x99/0x4c0 kernel/locking/rwsem.c:1574
 class_rwsem_read_constructor include/linux/rwsem.h:259 [inline]
 n_tty_receive_buf_common+0x85/0x1930 drivers/tty/n_tty.c:1678
 tty_ldisc_receive_buf+0xaa/0x1a0 drivers/tty/tty_buffer.c:394
 tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:452 [inline]
 flush_to_ldisc+0x26b/0x730 drivers/tty/tty_buffer.c:502
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/04 17:39 upstream 848acc8ffe1b 3c5eaa21 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 possible deadlock in n_tty_receive_buf_common
* Struck through repros no longer work on HEAD.