program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x5606, 0x1) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000140), 0x18) write$input_event(r1, &(0x7f0000000180)={{}, 0x1, 0x1c}, 0x18) write$input_event(r1, &(0x7f00000001c0), 0x18) [ 76.705138][ T5281] Bluetooth: hci0: command tx timeout [ 76.709369][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.712176][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.845742][ T5319] input: syz0 as /devices/virtual/input/input5 [ 76.858688][ T5298] [ 76.858695][ T5298] ====================================================== [ 76.858698][ T5298] WARNING: possible circular locking dependency detected [ 76.858702][ T5298] syzkaller #0 Not tainted [ 76.858706][ T5298] ------------------------------------------------------ [ 76.858708][ T5298] kworker/0:4/5298 is trying to acquire lock: [ 76.858713][ T5298] ffff88801fbbe2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 76.858803][ T5298] [ 76.858803][ T5298] but task is already holding lock: [ 76.858806][ T5298] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 76.858830][ T5298] [ 76.858830][ T5298] which lock already depends on the new lock. [ 76.858830][ T5298] [ 76.858833][ T5298] [ 76.858833][ T5298] the existing dependency chain (in reverse order) is: [ 76.858837][ T5298] [ 76.858837][ T5298] -> #3 (&buf->lock){+.+.}-{4:4}: [ 76.858852][ T5298] __mutex_lock+0x19d/0x1550 [ 76.858894][ T5298] tty_buffer_flush+0x74/0x2b0 [ 76.858909][ T5298] tty_ldisc_flush+0x6b/0xc0 [ 76.858920][ T5298] __do_SAK+0x25e/0x680 [ 76.858929][ T5298] vc_SAK+0x78/0x220 [ 76.858941][ T5298] process_scheduled_works+0xa8e/0x14e0 [ 76.858951][ T5298] worker_thread+0xa47/0xfb0 [ 76.858961][ T5298] kthread+0x388/0x470 [ 76.858975][ T5298] ret_from_fork+0x514/0xb70 [ 76.858989][ T5298] ret_from_fork_asm+0x1a/0x30 [ 76.858998][ T5298] [ 76.858998][ T5298] -> #2 (console_lock){+.+.}-{0:0}: [ 76.859009][ T5298] console_lock+0x76/0x90 [ 76.859016][ T5298] serial_core_register_port+0xc47/0x2840 [ 76.859026][ T5298] serial8250_register_8250_port+0x16b4/0x2090 [ 76.859035][ T5298] serial_pnp_probe+0x56a/0x7f0 [ 76.859045][ T5298] pnp_device_probe+0x30b/0x4c0 [ 76.859059][ T5298] really_probe+0x254/0xae0 [ 76.859067][ T5298] __driver_probe_device+0x1e8/0x360 [ 76.859074][ T5298] driver_probe_device+0x4f/0x240 [ 76.859081][ T5298] __driver_attach+0x339/0x600 [ 76.859088][ T5298] bus_for_each_dev+0x23b/0x2c0 [ 76.859097][ T5298] bus_add_driver+0x345/0x670 [ 76.859106][ T5298] driver_register+0x23a/0x320 [ 76.859114][ T5298] serial8250_init+0x8f/0x160 [ 76.859174][ T5298] do_one_initcall+0x250/0x870 [ 76.859185][ T5298] do_initcall_level+0x10a/0x1a0 [ 76.859194][ T5298] do_initcalls+0x59/0xa0 [ 76.859202][ T5298] kernel_init_freeable+0x29d/0x3e0 [ 76.859210][ T5298] kernel_init+0x1d/0x1d0 [ 76.859220][ T5298] ret_from_fork+0x514/0xb70 [ 76.859229][ T5298] ret_from_fork_asm+0x1a/0x30 [ 76.859235][ T5298] [ 76.859235][ T5298] -> #1 (&port->mutex){+.+.}-{4:4}: [ 76.859246][ T5298] __mutex_lock+0x19d/0x1550 [ 76.859254][ T5298] uart_set_termios+0x83/0x12e0 [ 76.859264][ T5298] tty_set_termios+0xcaf/0x1800 [ 76.859273][ T5298] set_termios+0x53d/0x6c0 [ 76.859281][ T5298] tty_mode_ioctl+0x49c/0x7c0 [ 76.859290][ T5298] tty_ioctl+0x9bd/0xdd0 [ 76.859299][ T5298] __se_sys_ioctl+0xfc/0x170 [ 76.859309][ T5298] do_syscall_64+0x174/0x580 [ 76.859317][ T5298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.859324][ T5298] [ 76.859324][ T5298] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 76.859334][ T5298] __lock_acquire+0x1520/0x2cf0 [ 76.859344][ T5298] lock_acquire+0x106/0x350 [ 76.859353][ T5298] down_write+0x96/0x200 [ 76.859362][ T5298] n_tty_flush_buffer+0x30/0x230 [ 76.859369][ T5298] tty_buffer_flush+0x1ec/0x2b0 [ 76.859379][ T5298] tty_ldisc_flush+0x6b/0xc0 [ 76.859388][ T5298] __do_SAK+0x25e/0x680 [ 76.859394][ T5298] vc_SAK+0x78/0x220 [ 76.859402][ T5298] process_scheduled_works+0xa8e/0x14e0 [ 76.859409][ T5298] worker_thread+0xa47/0xfb0 [ 76.859417][ T5298] kthread+0x388/0x470 [ 76.859426][ T5298] ret_from_fork+0x514/0xb70 [ 76.859435][ T5298] ret_from_fork_asm+0x1a/0x30 [ 76.859441][ T5298] [ 76.859441][ T5298] other info that might help us debug this: [ 76.859441][ T5298] [ 76.859443][ T5298] Chain exists of: [ 76.859443][ T5298] &tty->termios_rwsem --> console_lock --> &buf->lock [ 76.859443][ T5298] [ 76.859456][ T5298] Possible unsafe locking scenario: [ 76.859456][ T5298] [ 76.859458][ T5298] CPU0 CPU1 [ 76.859460][ T5298] ---- ---- [ 76.859462][ T5298] lock(&buf->lock); [ 76.859467][ T5298] lock(console_lock); [ 76.859473][ T5298] lock(&buf->lock); [ 76.859478][ T5298] lock(&tty->termios_rwsem); [ 76.859483][ T5298] [ 76.859483][ T5298] *** DEADLOCK *** [ 76.859483][ T5298] [ 76.859485][ T5298] 5 locks held by kworker/0:4/5298: [ 76.859490][ T5298] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 76.859508][ T5298] #1: ffffc9000f147c40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 76.859527][ T5298] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 76.859546][ T5298] #3: ffff88801fbbe0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 76.859566][ T5298] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 76.859586][ T5298] [ 76.859586][ T5298] stack backtrace: [ 76.859591][ T5298] CPU: 0 UID: 0 PID: 5298 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 76.859599][ T5298] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.859603][ T5298] Workqueue: events vc_SAK [ 76.859613][ T5298] Call Trace: [ 76.859616][ T5298] [ 76.859619][ T5298] dump_stack_lvl+0xe8/0x150 [ 76.859629][ T5298] print_circular_bug+0x2e1/0x300 [ 76.859637][ T5298] check_noncircular+0x12e/0x150 [ 76.859644][ T5298] __lock_acquire+0x1520/0x2cf0 [ 76.859655][ T5298] ? __pfx___mutex_trylock_common+0x10/0x10 [ 76.859663][ T5298] ? rcu_is_watching+0x15/0xb0 [ 76.859669][ T5298] ? trace_contention_end+0x3d/0x140 [ 76.859682][ T5298] ? n_tty_flush_buffer+0x30/0x230 [ 76.859689][ T5298] lock_acquire+0x106/0x350 [ 76.859698][ T5298] ? n_tty_flush_buffer+0x30/0x230 [ 76.859707][ T5298] down_write+0x96/0x200 [ 76.859716][ T5298] ? n_tty_flush_buffer+0x30/0x230 [ 76.859723][ T5298] ? __pfx_down_write+0x10/0x10 [ 76.859733][ T5298] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 76.859741][ T5298] n_tty_flush_buffer+0x30/0x230 [ 76.859748][ T5298] ? tty_buffer_flush+0x1df/0x2b0 [ 76.859758][ T5298] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 76.859766][ T5298] tty_buffer_flush+0x1ec/0x2b0 [ 76.859777][ T5298] tty_ldisc_flush+0x6b/0xc0 [ 76.859787][ T5298] __do_SAK+0x25e/0x680 [ 76.859793][ T5298] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 76.859801][ T5298] vc_SAK+0x78/0x220 [ 76.859809][ T5298] ? process_scheduled_works+0xa20/0x14e0 [ 76.859817][ T5298] process_scheduled_works+0xa8e/0x14e0 [ 76.859828][ T5298] ? __pfx_process_scheduled_works+0x10/0x10 [ 76.859836][ T5298] ? assign_work+0x3cf/0x5d0 [ 76.859844][ T5298] worker_thread+0xa47/0xfb0 [ 76.859854][ T5298] ? __kthread_parkme+0x71/0x1f0 [ 76.859864][ T5298] kthread+0x388/0x470 [ 76.859873][ T5298] ? __pfx_worker_thread+0x10/0x10 [ 76.859881][ T5298] ? __pfx_kthread+0x10/0x10 [ 76.859891][ T5298] ret_from_fork+0x514/0xb70 [ 76.859901][ T5298] ? __pfx_ret_from_fork+0x10/0x10 [ 76.859911][ T5298] ? __switch_to+0xc89/0x1420 [ 76.859920][ T5298] ? __pfx_kthread+0x10/0x10 [ 76.859929][ T5298] ret_from_fork_asm+0x1a/0x30 [ 76.859938][ T5298] [ 76.860612][ T5298] tty tty1: SAK: killed process 5318 (syz.0.0): by fd#3 [ 76.860630][ T5298] tty tty1: SAK: killed process 5319 (syz.0.0): by fd#3 [ 76.860636][ T5298] tty tty1: SAK: killed process 5320 (syz.0.0): by fd#3