program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x5606, 0x1) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000140), 0x18) write$input_event(r1, &(0x7f0000000180)={{}, 0x1, 0x1c}, 0x18) write$input_event(r1, &(0x7f00000001c0), 0x18) [ 84.635810][ T5294] Bluetooth: hci0: command tx timeout [ 84.699913][ T5332] input: syz0 as /devices/virtual/input/input5 [ 84.728078][ T1384] [ 84.728086][ T1384] ====================================================== [ 84.728090][ T1384] WARNING: possible circular locking dependency detected [ 84.728093][ T1384] syzkaller #0 Not tainted [ 84.728097][ T1384] ------------------------------------------------------ [ 84.728100][ T1384] kworker/0:3/1384 is trying to acquire lock: [ 84.728104][ T1384] ffff888011cea2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 84.728190][ T1384] [ 84.728190][ T1384] but task is already holding lock: [ 84.728192][ T1384] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 84.728212][ T1384] [ 84.728212][ T1384] which lock already depends on the new lock. [ 84.728212][ T1384] [ 84.728215][ T1384] [ 84.728215][ T1384] the existing dependency chain (in reverse order) is: [ 84.728217][ T1384] [ 84.728217][ T1384] -> #3 (&buf->lock){+.+.}-{4:4}: [ 84.728230][ T1384] __mutex_lock+0x19d/0x1550 [ 84.728265][ T1384] tty_buffer_flush+0x74/0x2b0 [ 84.728275][ T1384] tty_ldisc_flush+0x6b/0xc0 [ 84.728286][ T1384] __do_SAK+0x25e/0x680 [ 84.728294][ T1384] vc_SAK+0x78/0x220 [ 84.728305][ T1384] process_scheduled_works+0xa8e/0x14e0 [ 84.728317][ T1384] worker_thread+0xa47/0xfb0 [ 84.728328][ T1384] kthread+0x388/0x470 [ 84.728340][ T1384] ret_from_fork+0x514/0xb70 [ 84.728350][ T1384] ret_from_fork_asm+0x1a/0x30 [ 84.728356][ T1384] [ 84.728356][ T1384] -> #2 (console_lock){+.+.}-{0:0}: [ 84.728367][ T1384] console_lock+0x76/0x90 [ 84.728374][ T1384] serial_core_register_port+0xc47/0x2840 [ 84.728384][ T1384] serial8250_register_8250_port+0x16b4/0x2090 [ 84.728393][ T1384] serial_pnp_probe+0x56a/0x7f0 [ 84.728402][ T1384] pnp_device_probe+0x30b/0x4c0 [ 84.728411][ T1384] really_probe+0x254/0xae0 [ 84.728419][ T1384] __driver_probe_device+0x1e8/0x360 [ 84.728426][ T1384] driver_probe_device+0x4f/0x240 [ 84.728433][ T1384] __driver_attach+0x339/0x600 [ 84.728440][ T1384] bus_for_each_dev+0x23b/0x2c0 [ 84.728449][ T1384] bus_add_driver+0x345/0x670 [ 84.728458][ T1384] driver_register+0x23a/0x320 [ 84.728466][ T1384] serial8250_init+0x8f/0x160 [ 84.728525][ T1384] do_one_initcall+0x250/0x870 [ 84.728535][ T1384] do_initcall_level+0x10a/0x1a0 [ 84.728544][ T1384] do_initcalls+0x59/0xa0 [ 84.728553][ T1384] kernel_init_freeable+0x29d/0x3e0 [ 84.728565][ T1384] kernel_init+0x1d/0x1d0 [ 84.728578][ T1384] ret_from_fork+0x514/0xb70 [ 84.728592][ T1384] ret_from_fork_asm+0x1a/0x30 [ 84.728615][ T1384] [ 84.728615][ T1384] -> #1 (&port->mutex){+.+.}-{4:4}: [ 84.728626][ T1384] __mutex_lock+0x19d/0x1550 [ 84.728635][ T1384] uart_set_termios+0x83/0x12e0 [ 84.728645][ T1384] tty_set_termios+0xcaf/0x1800 [ 84.728653][ T1384] set_termios+0x53d/0x6c0 [ 84.728662][ T1384] tty_mode_ioctl+0x49c/0x7c0 [ 84.728671][ T1384] tty_ioctl+0x9bd/0xdd0 [ 84.728680][ T1384] __se_sys_ioctl+0xfc/0x170 [ 84.728690][ T1384] do_syscall_64+0x174/0x580 [ 84.728698][ T1384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.728705][ T1384] [ 84.728705][ T1384] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 84.728715][ T1384] __lock_acquire+0x1520/0x2cf0 [ 84.728730][ T1384] lock_acquire+0x106/0x350 [ 84.728739][ T1384] down_write+0x96/0x200 [ 84.728747][ T1384] n_tty_flush_buffer+0x30/0x230 [ 84.728754][ T1384] tty_buffer_flush+0x1ec/0x2b0 [ 84.728764][ T1384] tty_ldisc_flush+0x6b/0xc0 [ 84.728774][ T1384] __do_SAK+0x25e/0x680 [ 84.728779][ T1384] vc_SAK+0x78/0x220 [ 84.728787][ T1384] process_scheduled_works+0xa8e/0x14e0 [ 84.728794][ T1384] worker_thread+0xa47/0xfb0 [ 84.728802][ T1384] kthread+0x388/0x470 [ 84.728811][ T1384] ret_from_fork+0x514/0xb70 [ 84.728821][ T1384] ret_from_fork_asm+0x1a/0x30 [ 84.728827][ T1384] [ 84.728827][ T1384] other info that might help us debug this: [ 84.728827][ T1384] [ 84.728831][ T1384] Chain exists of: [ 84.728831][ T1384] &tty->termios_rwsem --> console_lock --> &buf->lock [ 84.728831][ T1384] [ 84.728849][ T1384] Possible unsafe locking scenario: [ 84.728849][ T1384] [ 84.728853][ T1384] CPU0 CPU1 [ 84.728856][ T1384] ---- ---- [ 84.728860][ T1384] lock(&buf->lock); [ 84.728867][ T1384] lock(console_lock); [ 84.728873][ T1384] lock(&buf->lock); [ 84.728878][ T1384] lock(&tty->termios_rwsem); [ 84.728884][ T1384] [ 84.728884][ T1384] *** DEADLOCK *** [ 84.728884][ T1384] [ 84.728886][ T1384] 5 locks held by kworker/0:3/1384: [ 84.728890][ T1384] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 84.728909][ T1384] #1: ffffc9000256fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 84.728928][ T1384] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 84.728947][ T1384] #3: ffff888011cea0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 84.728967][ T1384] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 84.728987][ T1384] [ 84.728987][ T1384] stack backtrace: [ 84.728992][ T1384] CPU: 0 UID: 0 PID: 1384 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 84.729000][ T1384] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.729005][ T1384] Workqueue: events vc_SAK [ 84.729014][ T1384] Call Trace: [ 84.729017][ T1384] [ 84.729020][ T1384] dump_stack_lvl+0xe8/0x150 [ 84.729030][ T1384] print_circular_bug+0x2e1/0x300 [ 84.729038][ T1384] check_noncircular+0x12e/0x150 [ 84.729046][ T1384] __lock_acquire+0x1520/0x2cf0 [ 84.729056][ T1384] ? __pfx___mutex_trylock_common+0x10/0x10 [ 84.729064][ T1384] ? rcu_is_watching+0x15/0xb0 [ 84.729070][ T1384] ? trace_contention_end+0x3d/0x140 [ 84.729078][ T1384] ? n_tty_flush_buffer+0x30/0x230 [ 84.729085][ T1384] lock_acquire+0x106/0x350 [ 84.729094][ T1384] ? n_tty_flush_buffer+0x30/0x230 [ 84.729104][ T1384] down_write+0x96/0x200 [ 84.729117][ T1384] ? n_tty_flush_buffer+0x30/0x230 [ 84.729127][ T1384] ? __pfx_down_write+0x10/0x10 [ 84.729141][ T1384] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 84.729149][ T1384] n_tty_flush_buffer+0x30/0x230 [ 84.729156][ T1384] ? tty_buffer_flush+0x1df/0x2b0 [ 84.729166][ T1384] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 84.729174][ T1384] tty_buffer_flush+0x1ec/0x2b0 [ 84.729185][ T1384] tty_ldisc_flush+0x6b/0xc0 [ 84.729195][ T1384] __do_SAK+0x25e/0x680 [ 84.729200][ T1384] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 84.729208][ T1384] vc_SAK+0x78/0x220 [ 84.729217][ T1384] ? process_scheduled_works+0xa20/0x14e0 [ 84.729226][ T1384] process_scheduled_works+0xa8e/0x14e0 [ 84.729238][ T1384] ? __pfx_process_scheduled_works+0x10/0x10 [ 84.729246][ T1384] ? assign_work+0x3cf/0x5d0 [ 84.729254][ T1384] worker_thread+0xa47/0xfb0 [ 84.729264][ T1384] ? __kthread_parkme+0x71/0x1f0 [ 84.729273][ T1384] kthread+0x388/0x470 [ 84.729283][ T1384] ? __pfx_worker_thread+0x10/0x10 [ 84.729291][ T1384] ? __pfx_kthread+0x10/0x10 [ 84.729300][ T1384] ret_from_fork+0x514/0xb70 [ 84.729311][ T1384] ? __pfx_ret_from_fork+0x10/0x10 [ 84.729321][ T1384] ? __switch_to+0xc89/0x1420 [ 84.729329][ T1384] ? __pfx_kthread+0x10/0x10 [ 84.729339][ T1384] ret_from_fork_asm+0x1a/0x30 [ 84.729347][ T1384] [ 84.730647][ T1384] tty tty1: SAK: killed process 5331 (syz.0.0): by fd#3 [ 84.730668][ T1384] tty tty1: SAK: killed process 5332 (syz.0.0): by fd#3 [ 84.730674][ T1384] tty tty1: SAK: killed process 5333 (syz.0.0): by fd#3