program: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_ACTIVATE(r0, 0x5606, 0x14) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000140), 0x18) write$input_event(r1, &(0x7f0000000180)={{}, 0x1, 0x1c}, 0x18) write$input_event(r1, &(0x7f00000001c0), 0x18) [ 77.191029][ T44] Bluetooth: hci0: command tx timeout [ 77.194717][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 77.197476][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 77.319055][ T5323] input: syz0 as /devices/virtual/input/input5 [ 77.347025][ T5310] [ 77.347036][ T5310] ====================================================== [ 77.347041][ T5310] WARNING: possible circular locking dependency detected [ 77.347047][ T5310] syzkaller #0 Not tainted [ 77.347052][ T5310] ------------------------------------------------------ [ 77.347056][ T5310] kworker/0:5/5310 is trying to acquire lock: [ 77.347063][ T5310] ffff88801292b2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 77.347172][ T5310] [ 77.347172][ T5310] but task is already holding lock: [ 77.347176][ T5310] ffff88800bdcf0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 77.347205][ T5310] [ 77.347205][ T5310] which lock already depends on the new lock. [ 77.347205][ T5310] [ 77.347209][ T5310] [ 77.347209][ T5310] the existing dependency chain (in reverse order) is: [ 77.347213][ T5310] [ 77.347213][ T5310] -> #3 (&buf->lock){+.+.}-{4:4}: [ 77.347229][ T5310] __mutex_lock+0x19d/0x1550 [ 77.347289][ T5310] tty_buffer_flush+0x74/0x2b0 [ 77.347304][ T5310] tty_ldisc_flush+0x6b/0xc0 [ 77.347317][ T5310] __do_SAK+0x25e/0x680 [ 77.347326][ T5310] vc_SAK+0x78/0x220 [ 77.347338][ T5310] process_scheduled_works+0xa8e/0x14e0 [ 77.347350][ T5310] worker_thread+0xa47/0xfb0 [ 77.347362][ T5310] kthread+0x388/0x470 [ 77.347375][ T5310] ret_from_fork+0x514/0xb70 [ 77.347390][ T5310] ret_from_fork_asm+0x1a/0x30 [ 77.347400][ T5310] [ 77.347400][ T5310] -> #2 (console_lock){+.+.}-{0:0}: [ 77.347416][ T5310] console_lock+0x76/0x90 [ 77.347427][ T5310] serial_core_register_port+0xc47/0x2840 [ 77.347442][ T5310] serial8250_register_8250_port+0x16b4/0x2090 [ 77.347456][ T5310] serial_pnp_probe+0x56a/0x7f0 [ 77.347469][ T5310] pnp_device_probe+0x30b/0x4c0 [ 77.347483][ T5310] really_probe+0x254/0xae0 [ 77.347494][ T5310] __driver_probe_device+0x1e8/0x360 [ 77.347504][ T5310] driver_probe_device+0x4f/0x240 [ 77.347515][ T5310] __driver_attach+0x339/0x600 [ 77.347525][ T5310] bus_for_each_dev+0x23b/0x2c0 [ 77.347538][ T5310] bus_add_driver+0x345/0x670 [ 77.347560][ T5310] driver_register+0x23a/0x320 [ 77.347572][ T5310] serial8250_init+0x8f/0x160 [ 77.347646][ T5310] do_one_initcall+0x250/0x870 [ 77.347662][ T5310] do_initcall_level+0x10a/0x1a0 [ 77.347675][ T5310] do_initcalls+0x59/0xa0 [ 77.347686][ T5310] kernel_init_freeable+0x29d/0x3e0 [ 77.347699][ T5310] kernel_init+0x1d/0x1d0 [ 77.347713][ T5310] ret_from_fork+0x514/0xb70 [ 77.347728][ T5310] ret_from_fork_asm+0x1a/0x30 [ 77.347737][ T5310] [ 77.347737][ T5310] -> #1 (&port->mutex){+.+.}-{4:4}: [ 77.347754][ T5310] __mutex_lock+0x19d/0x1550 [ 77.347767][ T5310] uart_set_termios+0x83/0x12e0 [ 77.347782][ T5310] tty_set_termios+0xcaf/0x1800 [ 77.347795][ T5310] set_termios+0x53d/0x6c0 [ 77.347808][ T5310] tty_mode_ioctl+0x49c/0x7c0 [ 77.347820][ T5310] tty_ioctl+0x9bd/0xdd0 [ 77.347834][ T5310] __se_sys_ioctl+0xfc/0x170 [ 77.347851][ T5310] do_syscall_64+0x174/0x580 [ 77.347862][ T5310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.347872][ T5310] [ 77.347872][ T5310] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 77.347888][ T5310] __lock_acquire+0x1520/0x2cf0 [ 77.347903][ T5310] lock_acquire+0x106/0x350 [ 77.347916][ T5310] down_write+0x96/0x200 [ 77.347928][ T5310] n_tty_flush_buffer+0x30/0x230 [ 77.347940][ T5310] tty_buffer_flush+0x1ec/0x2b0 [ 77.347954][ T5310] tty_ldisc_flush+0x6b/0xc0 [ 77.347968][ T5310] __do_SAK+0x25e/0x680 [ 77.347976][ T5310] vc_SAK+0x78/0x220 [ 77.347988][ T5310] process_scheduled_works+0xa8e/0x14e0 [ 77.348000][ T5310] worker_thread+0xa47/0xfb0 [ 77.348011][ T5310] kthread+0x388/0x470 [ 77.348025][ T5310] ret_from_fork+0x514/0xb70 [ 77.348039][ T5310] ret_from_fork_asm+0x1a/0x30 [ 77.348048][ T5310] [ 77.348048][ T5310] other info that might help us debug this: [ 77.348048][ T5310] [ 77.348052][ T5310] Chain exists of: [ 77.348052][ T5310] &tty->termios_rwsem --> console_lock --> &buf->lock [ 77.348052][ T5310] [ 77.348071][ T5310] Possible unsafe locking scenario: [ 77.348071][ T5310] [ 77.348074][ T5310] CPU0 CPU1 [ 77.348078][ T5310] ---- ---- [ 77.348081][ T5310] lock(&buf->lock); [ 77.348089][ T5310] lock(console_lock); [ 77.348098][ T5310] lock(&buf->lock); [ 77.348106][ T5310] lock(&tty->termios_rwsem); [ 77.348114][ T5310] [ 77.348114][ T5310] *** DEADLOCK *** [ 77.348114][ T5310] [ 77.348118][ T5310] 5 locks held by kworker/0:5/5310: [ 77.348124][ T5310] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 77.348153][ T5310] #1: ffffc9000f53fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 77.348181][ T5310] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 77.348209][ T5310] #3: ffff88801292b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 77.348240][ T5310] #4: ffff88800bdcf0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 77.348271][ T5310] [ 77.348271][ T5310] stack backtrace: [ 77.348278][ T5310] CPU: 0 UID: 0 PID: 5310 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 77.348289][ T5310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.348296][ T5310] Workqueue: events vc_SAK [ 77.348309][ T5310] Call Trace: [ 77.348314][ T5310] [ 77.348318][ T5310] dump_stack_lvl+0xe8/0x150 [ 77.348334][ T5310] print_circular_bug+0x2e1/0x300 [ 77.348346][ T5310] check_noncircular+0x12e/0x150 [ 77.348358][ T5310] __lock_acquire+0x1520/0x2cf0 [ 77.348374][ T5310] ? __pfx___mutex_trylock_common+0x10/0x10 [ 77.348386][ T5310] ? rcu_is_watching+0x15/0xb0 [ 77.348396][ T5310] ? trace_contention_end+0x3d/0x140 [ 77.348407][ T5310] ? n_tty_flush_buffer+0x30/0x230 [ 77.348418][ T5310] lock_acquire+0x106/0x350 [ 77.348432][ T5310] ? n_tty_flush_buffer+0x30/0x230 [ 77.348445][ T5310] down_write+0x96/0x200 [ 77.348458][ T5310] ? n_tty_flush_buffer+0x30/0x230 [ 77.348469][ T5310] ? __pfx_down_write+0x10/0x10 [ 77.348483][ T5310] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 77.348495][ T5310] n_tty_flush_buffer+0x30/0x230 [ 77.348505][ T5310] ? tty_buffer_flush+0x1df/0x2b0 [ 77.348520][ T5310] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 77.348532][ T5310] tty_buffer_flush+0x1ec/0x2b0 [ 77.348548][ T5310] tty_ldisc_flush+0x6b/0xc0 [ 77.348570][ T5310] __do_SAK+0x25e/0x680 [ 77.348579][ T5310] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 77.348591][ T5310] vc_SAK+0x78/0x220 [ 77.348603][ T5310] ? process_scheduled_works+0xa20/0x14e0 [ 77.348615][ T5310] process_scheduled_works+0xa8e/0x14e0 [ 77.348632][ T5310] ? __pfx_process_scheduled_works+0x10/0x10 [ 77.348645][ T5310] ? assign_work+0x3cf/0x5d0 [ 77.348658][ T5310] worker_thread+0xa47/0xfb0 [ 77.348673][ T5310] ? __kthread_parkme+0x71/0x1f0 [ 77.348688][ T5310] kthread+0x388/0x470 [ 77.348701][ T5310] ? __pfx_worker_thread+0x10/0x10 [ 77.348713][ T5310] ? __pfx_kthread+0x10/0x10 [ 77.348727][ T5310] ret_from_fork+0x514/0xb70 [ 77.348742][ T5310] ? __pfx_ret_from_fork+0x10/0x10 [ 77.348757][ T5310] ? __switch_to+0xc89/0x1420 [ 77.348770][ T5310] ? __pfx_kthread+0x10/0x10 [ 77.348784][ T5310] ret_from_fork_asm+0x1a/0x30 [ 77.348797][ T5310]