program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x5606, 0x1) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000140), 0x18) write$input_event(r1, &(0x7f0000000180)={{}, 0x1, 0x1c}, 0x18) write$input_event(r1, &(0x7f00000001c0), 0x18) [ 100.994867][ T4648] Bluetooth: hci0: command tx timeout [ 101.044354][ T5320] input: syz0 as /devices/virtual/input/input5 [ 101.072187][ T1255] [ 101.072193][ T1255] ====================================================== [ 101.072197][ T1255] WARNING: possible circular locking dependency detected [ 101.072201][ T1255] syzkaller #0 Not tainted [ 101.072205][ T1255] ------------------------------------------------------ [ 101.072208][ T1255] kworker/0:3/1255 is trying to acquire lock: [ 101.072212][ T1255] ffff88801287d2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 101.072292][ T1255] [ 101.072292][ T1255] but task is already holding lock: [ 101.072295][ T1255] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 101.072315][ T1255] [ 101.072315][ T1255] which lock already depends on the new lock. [ 101.072315][ T1255] [ 101.072318][ T1255] [ 101.072318][ T1255] the existing dependency chain (in reverse order) is: [ 101.072320][ T1255] [ 101.072320][ T1255] -> #3 (&buf->lock){+.+.}-{4:4}: [ 101.072331][ T1255] __mutex_lock+0x19d/0x1550 [ 101.072364][ T1255] tty_buffer_flush+0x74/0x2b0 [ 101.072375][ T1255] tty_ldisc_flush+0x6b/0xc0 [ 101.072384][ T1255] __do_SAK+0x25e/0x680 [ 101.072390][ T1255] vc_SAK+0x78/0x220 [ 101.072398][ T1255] process_scheduled_works+0xa8e/0x14e0 [ 101.072406][ T1255] worker_thread+0xa47/0xfb0 [ 101.072414][ T1255] kthread+0x388/0x470 [ 101.072423][ T1255] ret_from_fork+0x514/0xb70 [ 101.072433][ T1255] ret_from_fork_asm+0x1a/0x30 [ 101.072440][ T1255] [ 101.072440][ T1255] -> #2 (console_lock){+.+.}-{0:0}: [ 101.072451][ T1255] console_lock+0x76/0x90 [ 101.072458][ T1255] serial_core_register_port+0xc47/0x2840 [ 101.072468][ T1255] serial8250_register_8250_port+0x16b4/0x2090 [ 101.072477][ T1255] serial_pnp_probe+0x56a/0x7f0 [ 101.072486][ T1255] pnp_device_probe+0x30b/0x4c0 [ 101.072502][ T1255] really_probe+0x254/0xae0 [ 101.072510][ T1255] __driver_probe_device+0x1e8/0x360 [ 101.072517][ T1255] driver_probe_device+0x4f/0x240 [ 101.072524][ T1255] __driver_attach+0x339/0x600 [ 101.072531][ T1255] bus_for_each_dev+0x23b/0x2c0 [ 101.072540][ T1255] bus_add_driver+0x345/0x670 [ 101.072549][ T1255] driver_register+0x23a/0x320 [ 101.072556][ T1255] serial8250_init+0x8f/0x160 [ 101.072611][ T1255] do_one_initcall+0x250/0x870 [ 101.072621][ T1255] do_initcall_level+0x10a/0x1a0 [ 101.072630][ T1255] do_initcalls+0x59/0xa0 [ 101.072638][ T1255] kernel_init_freeable+0x29d/0x3e0 [ 101.072646][ T1255] kernel_init+0x1d/0x1d0 [ 101.072655][ T1255] ret_from_fork+0x514/0xb70 [ 101.072665][ T1255] ret_from_fork_asm+0x1a/0x30 [ 101.072670][ T1255] [ 101.072670][ T1255] -> #1 (&port->mutex){+.+.}-{4:4}: [ 101.072681][ T1255] __mutex_lock+0x19d/0x1550 [ 101.072689][ T1255] uart_set_termios+0x83/0x12e0 [ 101.072699][ T1255] tty_set_termios+0xcaf/0x1800 [ 101.072707][ T1255] set_termios+0x53d/0x6c0 [ 101.072731][ T1255] tty_mode_ioctl+0x49c/0x7c0 [ 101.072741][ T1255] tty_ioctl+0x9bd/0xdd0 [ 101.072751][ T1255] __se_sys_ioctl+0xfc/0x170 [ 101.072761][ T1255] do_syscall_64+0x174/0x580 [ 101.072769][ T1255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.072776][ T1255] [ 101.072776][ T1255] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 101.072787][ T1255] __lock_acquire+0x1520/0x2cf0 [ 101.072796][ T1255] lock_acquire+0x106/0x350 [ 101.072805][ T1255] down_write+0x96/0x200 [ 101.072814][ T1255] n_tty_flush_buffer+0x30/0x230 [ 101.072821][ T1255] tty_buffer_flush+0x1ec/0x2b0 [ 101.072831][ T1255] tty_ldisc_flush+0x6b/0xc0 [ 101.072840][ T1255] __do_SAK+0x25e/0x680 [ 101.072846][ T1255] vc_SAK+0x78/0x220 [ 101.072858][ T1255] process_scheduled_works+0xa8e/0x14e0 [ 101.072866][ T1255] worker_thread+0xa47/0xfb0 [ 101.072873][ T1255] kthread+0x388/0x470 [ 101.072882][ T1255] ret_from_fork+0x514/0xb70 [ 101.072892][ T1255] ret_from_fork_asm+0x1a/0x30 [ 101.072898][ T1255] [ 101.072898][ T1255] other info that might help us debug this: [ 101.072898][ T1255] [ 101.072900][ T1255] Chain exists of: [ 101.072900][ T1255] &tty->termios_rwsem --> console_lock --> &buf->lock [ 101.072900][ T1255] [ 101.072912][ T1255] Possible unsafe locking scenario: [ 101.072912][ T1255] [ 101.072915][ T1255] CPU0 CPU1 [ 101.072917][ T1255] ---- ---- [ 101.072919][ T1255] lock(&buf->lock); [ 101.072924][ T1255] lock(console_lock); [ 101.072930][ T1255] lock(&buf->lock); [ 101.072935][ T1255] lock(&tty->termios_rwsem); [ 101.072940][ T1255] [ 101.072940][ T1255] *** DEADLOCK *** [ 101.072940][ T1255] [ 101.072943][ T1255] 5 locks held by kworker/0:3/1255: [ 101.072947][ T1255] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 101.072965][ T1255] #1: ffffc90001f2fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 101.072984][ T1255] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 101.073002][ T1255] #3: ffff88801287d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 101.073022][ T1255] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 101.073043][ T1255] [ 101.073043][ T1255] stack backtrace: [ 101.073048][ T1255] CPU: 0 UID: 0 PID: 1255 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 101.073055][ T1255] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.073060][ T1255] Workqueue: events vc_SAK [ 101.073069][ T1255] Call Trace: [ 101.073072][ T1255] [ 101.073076][ T1255] dump_stack_lvl+0xe8/0x150 [ 101.073086][ T1255] print_circular_bug+0x2e1/0x300 [ 101.073094][ T1255] check_noncircular+0x12e/0x150 [ 101.073101][ T1255] __lock_acquire+0x1520/0x2cf0 [ 101.073112][ T1255] ? __pfx___mutex_trylock_common+0x10/0x10 [ 101.073119][ T1255] ? rcu_is_watching+0x15/0xb0 [ 101.073126][ T1255] ? trace_contention_end+0x3d/0x140 [ 101.073133][ T1255] ? n_tty_flush_buffer+0x30/0x230 [ 101.073140][ T1255] lock_acquire+0x106/0x350 [ 101.073149][ T1255] ? n_tty_flush_buffer+0x30/0x230 [ 101.073158][ T1255] down_write+0x96/0x200 [ 101.073167][ T1255] ? n_tty_flush_buffer+0x30/0x230 [ 101.073174][ T1255] ? __pfx_down_write+0x10/0x10 [ 101.073184][ T1255] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 101.073192][ T1255] n_tty_flush_buffer+0x30/0x230 [ 101.073199][ T1255] ? tty_buffer_flush+0x1df/0x2b0 [ 101.073209][ T1255] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 101.073217][ T1255] tty_buffer_flush+0x1ec/0x2b0 [ 101.073228][ T1255] tty_ldisc_flush+0x6b/0xc0 [ 101.073238][ T1255] __do_SAK+0x25e/0x680 [ 101.073243][ T1255] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 101.073251][ T1255] vc_SAK+0x78/0x220 [ 101.073259][ T1255] ? process_scheduled_works+0xa20/0x14e0 [ 101.073267][ T1255] process_scheduled_works+0xa8e/0x14e0 [ 101.073278][ T1255] ? __pfx_process_scheduled_works+0x10/0x10 [ 101.073286][ T1255] ? assign_work+0x3cf/0x5d0 [ 101.073294][ T1255] worker_thread+0xa47/0xfb0 [ 101.073308][ T1255] ? __kthread_parkme+0x71/0x1f0 [ 101.073322][ T1255] kthread+0x388/0x470 [ 101.073331][ T1255] ? __pfx_worker_thread+0x10/0x10 [ 101.073339][ T1255] ? __pfx_kthread+0x10/0x10 [ 101.073349][ T1255] ret_from_fork+0x514/0xb70 [ 101.073359][ T1255] ? __pfx_ret_from_fork+0x10/0x10 [ 101.073369][ T1255] ? __switch_to+0xc89/0x1420 [ 101.073378][ T1255] ? __pfx_kthread+0x10/0x10 [ 101.073387][ T1255] ret_from_fork_asm+0x1a/0x30 [ 101.073395][ T1255]