program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x1b) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) write$input_event(r2, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r2, &(0x7f0000000240), 0x18) [ 85.656528][ T5320] input: syz0 as /devices/virtual/input/input5 [ 85.692886][ T1422] [ 85.692894][ T1422] ====================================================== [ 85.692898][ T1422] WARNING: possible circular locking dependency detected [ 85.692901][ T1422] syzkaller #0 Not tainted [ 85.692905][ T1422] ------------------------------------------------------ [ 85.692908][ T1422] kworker/0:3/1422 is trying to acquire lock: [ 85.692912][ T1422] ffff888012b652c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 85.693003][ T1422] [ 85.693003][ T1422] but task is already holding lock: [ 85.693006][ T1422] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 85.693035][ T1422] [ 85.693035][ T1422] which lock already depends on the new lock. [ 85.693035][ T1422] [ 85.693038][ T1422] [ 85.693038][ T1422] the existing dependency chain (in reverse order) is: [ 85.693042][ T1422] [ 85.693042][ T1422] -> #3 (&buf->lock){+.+.}-{4:4}: [ 85.693058][ T1422] __mutex_lock+0x19d/0x1550 [ 85.693095][ T1422] tty_buffer_flush+0x74/0x2b0 [ 85.693105][ T1422] tty_ldisc_flush+0x6b/0xc0 [ 85.693114][ T1422] __do_SAK+0x25e/0x680 [ 85.693120][ T1422] vc_SAK+0x78/0x220 [ 85.693128][ T1422] process_scheduled_works+0xa8e/0x14e0 [ 85.693136][ T1422] worker_thread+0xa47/0xfb0 [ 85.693144][ T1422] kthread+0x388/0x470 [ 85.693153][ T1422] ret_from_fork+0x514/0xb70 [ 85.693163][ T1422] ret_from_fork_asm+0x1a/0x30 [ 85.693170][ T1422] [ 85.693170][ T1422] -> #2 (console_lock){+.+.}-{0:0}: [ 85.693181][ T1422] console_lock+0x76/0x90 [ 85.693188][ T1422] serial_core_register_port+0xc47/0x2840 [ 85.693198][ T1422] serial8250_register_8250_port+0x16b4/0x2090 [ 85.693207][ T1422] serial_pnp_probe+0x56a/0x7f0 [ 85.693216][ T1422] pnp_device_probe+0x30b/0x4c0 [ 85.693225][ T1422] really_probe+0x254/0xae0 [ 85.693233][ T1422] __driver_probe_device+0x1e8/0x360 [ 85.693240][ T1422] driver_probe_device+0x4f/0x240 [ 85.693250][ T1422] __driver_attach+0x339/0x600 [ 85.693260][ T1422] bus_for_each_dev+0x23b/0x2c0 [ 85.693273][ T1422] bus_add_driver+0x345/0x670 [ 85.693286][ T1422] driver_register+0x23a/0x320 [ 85.693294][ T1422] serial8250_init+0x8f/0x160 [ 85.693352][ T1422] do_one_initcall+0x250/0x870 [ 85.693362][ T1422] do_initcall_level+0x10a/0x1a0 [ 85.693371][ T1422] do_initcalls+0x59/0xa0 [ 85.693378][ T1422] kernel_init_freeable+0x29d/0x3e0 [ 85.693387][ T1422] kernel_init+0x1d/0x1d0 [ 85.693413][ T1422] ret_from_fork+0x514/0xb70 [ 85.693423][ T1422] ret_from_fork_asm+0x1a/0x30 [ 85.693428][ T1422] [ 85.693428][ T1422] -> #1 (&port->mutex){+.+.}-{4:4}: [ 85.693439][ T1422] __mutex_lock+0x19d/0x1550 [ 85.693447][ T1422] uart_set_termios+0x83/0x12e0 [ 85.693457][ T1422] tty_set_termios+0xcaf/0x1800 [ 85.693466][ T1422] set_termios+0x53d/0x6c0 [ 85.693475][ T1422] tty_mode_ioctl+0x49c/0x7c0 [ 85.693484][ T1422] tty_ioctl+0x9bd/0xdd0 [ 85.693498][ T1422] __se_sys_ioctl+0xfc/0x170 [ 85.693514][ T1422] do_syscall_64+0x174/0x580 [ 85.693525][ T1422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.693532][ T1422] [ 85.693532][ T1422] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 85.693543][ T1422] __lock_acquire+0x1520/0x2cf0 [ 85.693552][ T1422] lock_acquire+0x106/0x350 [ 85.693561][ T1422] down_write+0x96/0x200 [ 85.693569][ T1422] n_tty_flush_buffer+0x30/0x230 [ 85.693577][ T1422] tty_buffer_flush+0x1ec/0x2b0 [ 85.693587][ T1422] tty_ldisc_flush+0x6b/0xc0 [ 85.693596][ T1422] __do_SAK+0x25e/0x680 [ 85.693601][ T1422] vc_SAK+0x78/0x220 [ 85.693609][ T1422] process_scheduled_works+0xa8e/0x14e0 [ 85.693617][ T1422] worker_thread+0xa47/0xfb0 [ 85.693624][ T1422] kthread+0x388/0x470 [ 85.693633][ T1422] ret_from_fork+0x514/0xb70 [ 85.693643][ T1422] ret_from_fork_asm+0x1a/0x30 [ 85.693648][ T1422] [ 85.693648][ T1422] other info that might help us debug this: [ 85.693648][ T1422] [ 85.693651][ T1422] Chain exists of: [ 85.693651][ T1422] &tty->termios_rwsem --> console_lock --> &buf->lock [ 85.693651][ T1422] [ 85.693663][ T1422] Possible unsafe locking scenario: [ 85.693663][ T1422] [ 85.693665][ T1422] CPU0 CPU1 [ 85.693668][ T1422] ---- ---- [ 85.693670][ T1422] lock(&buf->lock); [ 85.693675][ T1422] lock(console_lock); [ 85.693680][ T1422] lock(&buf->lock); [ 85.693686][ T1422] lock(&tty->termios_rwsem); [ 85.693691][ T1422] [ 85.693691][ T1422] *** DEADLOCK *** [ 85.693691][ T1422] [ 85.693693][ T1422] 5 locks held by kworker/0:3/1422: [ 85.693697][ T1422] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 85.693719][ T1422] #1: ffffc9000282fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 85.693748][ T1422] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 85.693770][ T1422] #3: ffff888012b650a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 85.693791][ T1422] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 85.693811][ T1422] [ 85.693811][ T1422] stack backtrace: [ 85.693817][ T1422] CPU: 0 UID: 0 PID: 1422 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 85.693825][ T1422] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.693829][ T1422] Workqueue: events vc_SAK [ 85.693838][ T1422] Call Trace: [ 85.693846][ T1422] [ 85.693849][ T1422] dump_stack_lvl+0xe8/0x150 [ 85.693860][ T1422] print_circular_bug+0x2e1/0x300 [ 85.693867][ T1422] check_noncircular+0x12e/0x150 [ 85.693875][ T1422] __lock_acquire+0x1520/0x2cf0 [ 85.693885][ T1422] ? __pfx___mutex_trylock_common+0x10/0x10 [ 85.693893][ T1422] ? rcu_is_watching+0x15/0xb0 [ 85.693900][ T1422] ? trace_contention_end+0x3d/0x140 [ 85.693907][ T1422] ? n_tty_flush_buffer+0x30/0x230 [ 85.693914][ T1422] lock_acquire+0x106/0x350 [ 85.693923][ T1422] ? n_tty_flush_buffer+0x30/0x230 [ 85.693936][ T1422] down_write+0x96/0x200 [ 85.693948][ T1422] ? n_tty_flush_buffer+0x30/0x230 [ 85.693960][ T1422] ? __pfx_down_write+0x10/0x10 [ 85.693974][ T1422] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 85.693986][ T1422] n_tty_flush_buffer+0x30/0x230 [ 85.693994][ T1422] ? tty_buffer_flush+0x1df/0x2b0 [ 85.694004][ T1422] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 85.694011][ T1422] tty_buffer_flush+0x1ec/0x2b0 [ 85.694022][ T1422] tty_ldisc_flush+0x6b/0xc0 [ 85.694032][ T1422] __do_SAK+0x25e/0x680 [ 85.694038][ T1422] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 85.694046][ T1422] vc_SAK+0x78/0x220 [ 85.694054][ T1422] ? process_scheduled_works+0xa20/0x14e0 [ 85.694062][ T1422] process_scheduled_works+0xa8e/0x14e0 [ 85.694073][ T1422] ? __pfx_process_scheduled_works+0x10/0x10 [ 85.694081][ T1422] ? assign_work+0x3cf/0x5d0 [ 85.694089][ T1422] worker_thread+0xa47/0xfb0 [ 85.694099][ T1422] ? __kthread_parkme+0x71/0x1f0 [ 85.694108][ T1422] kthread+0x388/0x470 [ 85.694118][ T1422] ? __pfx_worker_thread+0x10/0x10 [ 85.694126][ T1422] ? __pfx_kthread+0x10/0x10 [ 85.694136][ T1422] ret_from_fork+0x514/0xb70 [ 85.694146][ T1422] ? __pfx_ret_from_fork+0x10/0x10 [ 85.694158][ T1422] ? __switch_to+0xc89/0x1420 [ 85.694171][ T1422] ? __pfx_kthread+0x10/0x10 [ 85.694185][ T1422] ret_from_fork_asm+0x1a/0x30 [ 85.694198][ T1422] [ 85.700146][ T1422] tty tty1: SAK: killed process 5319 (syz.0.0): by fd#3 [ 85.700354][ T1422] tty tty1: SAK: killed process 5320 (syz.0.0): by fd#3 [ 85.700363][ T1422] tty tty1: SAK: killed process 5321 (syz.0.0): by fd#3