Extracting prog: 1m19.283814645s
Minimizing prog: 9m41.24836699s
Simplifying prog options: 0s
Extracting C: 30.551427459s
Simplifying C: 5m16.880880351s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501)
write$input_event(0xffffffffffffffff, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x1)
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$input_event(r0, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$input_event(r0, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, 0x0)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, 0x0)
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=40.431559863s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
simplifying C reproducer
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program did not crash
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program did not crash
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
validation run: crashed=true
testing program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
validation run: crashed=true
testing program (duration=40.431559863s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
validation run: crashed=true
reproducing took 19m17.18544586s
repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/1:3/1348 is trying to acquire lock:
ffff88802dc382c8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
ffff88802dc382c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
but task is already holding lock:
ffff88801c6c20b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&buf->lock){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #2 (console_lock){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
console_lock+0x7a/0xa0 kernel/printk/printk.c:2896
uart_configure_port drivers/tty/serial/serial_core.c:2530 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3101 [inline]
serial_core_register_port+0xe65/0x16f0 drivers/tty/serial/serial_core.c:3322
serial8250_register_8250_port+0x15af/0x2330 drivers/tty/serial/8250/8250_core.c:828
serial_pnp_probe+0x436/0x930 drivers/tty/serial/8250/8250_pnp.c:480
pnp_device_probe+0x2b3/0x4a0 drivers/pnp/driver.c:111
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x210/0x460 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
driver_register+0x1e2/0x360 drivers/base/driver.c:174
serial8250_init+0xcc/0x1c0 drivers/tty/serial/8250/8250_platform.c:317
do_one_initcall+0x11c/0x6f0 init/main.c:1353
do_initcall_level init/main.c:1415 [inline]
do_initcalls init/main.c:1431 [inline]
do_basic_setup init/main.c:1451 [inline]
kernel_init_freeable+0x6ea/0x7b0 init/main.c:1666
kernel_init+0x21/0x1e0 init/main.c:1556
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #1 (&port->mutex){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
class_mutex_constructor include/linux/mutex.h:253 [inline]
uart_set_termios+0x8e/0x690 drivers/tty/serial/serial_core.c:1645
tty_set_termios+0x64d/0x980 drivers/tty/tty_ioctl.c:341
set_termios+0x5c8/0x880 drivers/tty/tty_ioctl.c:516
tty_mode_ioctl+0x17e/0xd40 drivers/tty/tty_ioctl.c:803
n_tty_ioctl_helper+0x47/0x2b0 drivers/tty/tty_ioctl.c:982
n_tty_ioctl+0x53/0x340 drivers/tty/n_tty.c:2496
tty_ioctl+0x11b4/0x1640 drivers/tty/tty_io.c:2774
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&tty->termios_rwsem){++++}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Chain exists of:
&tty->termios_rwsem --> console_lock --> &buf->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&buf->lock);
lock(console_lock);
lock(&buf->lock);
lock(&tty->termios_rwsem);
*** DEADLOCK ***
locks held by kworker/1:3/1348: 5, last CPU#1:
#0: ffff88801c0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc900061afd08 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: class_console_lock_constructor include/linux/console.h:734 [inline]
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x13/0x320 drivers/tty/vt/vt_ioctl.c:987
#3: ffff88802dc380a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref drivers/tty/tty_ldisc.c:263 [inline]
#3: ffff88802dc380a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x1c/0xf0 drivers/tty/tty_ldisc.c:386
#4: ffff88801c6c20b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
stack backtrace:
CPU: 1 UID: 0 PID: 1348 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events vc_SAK
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
tty tty1: SAK: killed process 6161 (syz.2.135): by fd#3
tty tty1: SAK: killed process 6161 (syz.2.135): by fd#3
tty tty1: SAK: killed process 6162 (syz.1.136): by fd#3
tty tty1: SAK: killed process 6164 (syz.3.139): by fd#3
tty tty1: SAK: killed process 6182 (syz.2.157): by fd#3
tty tty1: SAK: killed process 6202 (syz.1.176): by fd#3
tty tty1: SAK: killed process 6289 (syz.1.263): by fd#3
tty tty1: SAK: killed process 6290 (syz.2.264): by fd#3
tty tty1: SAK: killed process 6293 (syz.0.268): by fd#3
tty tty1: SAK: killed process 6294 (syz.1.266): by fd#3
tty tty1: SAK: killed process 6343 (syz.2.317): by fd#3
tty tty1: SAK: killed process 6352 (syz.3.327): by fd#3
tty tty1: SAK: killed process 6357 (syz.3.331): by fd#3
tty tty1: SAK: killed process 6361 (syz.1.336): by fd#3
tty tty1: SAK: killed process 6363 (syz.2.337): by fd#3
tty tty1: SAK: killed process 6372 (syz.2.344): by fd#3
tty tty1: SAK: killed process 6373 (syz.0.347): by fd#3
tty tty1: SAK: killed process 6375 (syz.2.348): by fd#3
tty tty1: SAK: killed process 6382 (syz.3.355): by fd#3
tty tty1: SAK: killed process 6421 (syz.3.395): by fd#3
tty tty1: SAK: killed process 6423 (syz.1.397): by fd#3
tty tty1: SAK: killed process 6424 (syz.2.398): by fd#3
tty tty1: SAK: killed process 6426 (syz.1.400): by fd#3
tty tty1: SAK: killed process 6433 (syz.0.407): by fd#3
tty tty1: SAK: killed process 6438 (syz.1.412): by fd#3
tty tty1: SAK: killed process 6439 (syz.3.413): by fd#3
tty tty1: SAK: killed process 6464 (syz.1.438): by fd#3
tty tty1: SAK: killed process 6514 (syz.1.488): by fd#3
tty tty1: SAK: killed process 6517 (syz.0.491): by fd#3
tty tty1: SAK: killed process 6519 (syz.1.493): by fd#3
tty tty1: SAK: killed process 6550 (syz.0.525): by fd#3
tty tty1: SAK: killed process 6555 (syz.1.528): by fd#3
tty tty1: SAK: killed process 6556 (syz.3.530): by fd#3
tty tty1: SAK: killed process 6564 (syz.2.538): by fd#3
tty tty1: SAK: killed process 6565 (syz.1.539): by fd#3
tty tty1: SAK: killed process 6585 (syz.1.559): by fd#3
tty tty1: SAK: killed process 6589 (syz.1.564): by fd#3
tty tty1: SAK: killed process 6590 (syz.0.563): by fd#3
tty tty1: SAK: killed process 6592 (syz.1.566): by fd#3
tty tty1: SAK: killed process 6604 (syz.3.578): by fd#3
tty tty1: SAK: killed process 6614 (syz.2.588): by fd#3
tty tty1: SAK: killed process 6615 (syz.0.589): by fd#3
tty tty1: SAK: killed process 6624 (syz.3.598): by fd#3
tty tty1: SAK: killed process 6651 (syz.3.625): by fd#3
tty tty1: SAK: killed process 6653 (syz.2.627): by fd#3
tty tty1: SAK: killed process 6654 (syz.0.628): by fd#3
tty tty1: SAK: killed process 6656 (syz.3.630): by fd#3
tty tty1: SAK: killed process 6661 (syz.3.635): by fd#3
tty tty1: SAK: killed process 6667 (syz.1.641): by fd#3
tty tty1: SAK: killed process 6687 (syz.2.660): by fd#3
tty tty1: SAK: killed process 6688 (syz.3.662): by fd#3
tty tty1: SAK: killed process 6694 (syz.2.668): by fd#3
tty tty1: SAK: killed process 6930 (syz.0.898): by fd#3
tty tty1: SAK: killed process 6936 (syz.0.903): by fd#3
tty tty1: SAK: killed process 6953 (syz.2.920): by fd#3
tty tty1: SAK: killed process 6954 (syz.3.921): by fd#3
tty tty1: SAK: killed process 6962 (syz.0.929): by fd#3
tty tty1: SAK: killed process 6964 (syz.3.930): by fd#3
tty tty1: SAK: killed process 6965 (syz.0.933): by fd#3
tty tty1: SAK: killed process 6967 (syz.2.935): by fd#3
tty tty1: SAK: killed process 6971 (syz.1.938): by fd#3
tty tty1: SAK: killed process 6975 (syz.1.943): by fd#3
tty tty1: SAK: killed process 6977 (syz.2.944): by fd#3
final repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/1:3/1348 is trying to acquire lock:
ffff88802dc382c8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
ffff88802dc382c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
but task is already holding lock:
ffff88801c6c20b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&buf->lock){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #2 (console_lock){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
console_lock+0x7a/0xa0 kernel/printk/printk.c:2896
uart_configure_port drivers/tty/serial/serial_core.c:2530 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3101 [inline]
serial_core_register_port+0xe65/0x16f0 drivers/tty/serial/serial_core.c:3322
serial8250_register_8250_port+0x15af/0x2330 drivers/tty/serial/8250/8250_core.c:828
serial_pnp_probe+0x436/0x930 drivers/tty/serial/8250/8250_pnp.c:480
pnp_device_probe+0x2b3/0x4a0 drivers/pnp/driver.c:111
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x210/0x460 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
driver_register+0x1e2/0x360 drivers/base/driver.c:174
serial8250_init+0xcc/0x1c0 drivers/tty/serial/8250/8250_platform.c:317
do_one_initcall+0x11c/0x6f0 init/main.c:1353
do_initcall_level init/main.c:1415 [inline]
do_initcalls init/main.c:1431 [inline]
do_basic_setup init/main.c:1451 [inline]
kernel_init_freeable+0x6ea/0x7b0 init/main.c:1666
kernel_init+0x21/0x1e0 init/main.c:1556
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #1 (&port->mutex){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
class_mutex_constructor include/linux/mutex.h:253 [inline]
uart_set_termios+0x8e/0x690 drivers/tty/serial/serial_core.c:1645
tty_set_termios+0x64d/0x980 drivers/tty/tty_ioctl.c:341
set_termios+0x5c8/0x880 drivers/tty/tty_ioctl.c:516
tty_mode_ioctl+0x17e/0xd40 drivers/tty/tty_ioctl.c:803
n_tty_ioctl_helper+0x47/0x2b0 drivers/tty/tty_ioctl.c:982
n_tty_ioctl+0x53/0x340 drivers/tty/n_tty.c:2496
tty_ioctl+0x11b4/0x1640 drivers/tty/tty_io.c:2774
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&tty->termios_rwsem){++++}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Chain exists of:
&tty->termios_rwsem --> console_lock --> &buf->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&buf->lock);
lock(console_lock);
lock(&buf->lock);
lock(&tty->termios_rwsem);
*** DEADLOCK ***
locks held by kworker/1:3/1348: 5, last CPU#1:
#0: ffff88801c0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc900061afd08 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: class_console_lock_constructor include/linux/console.h:734 [inline]
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x13/0x320 drivers/tty/vt/vt_ioctl.c:987
#3: ffff88802dc380a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref drivers/tty/tty_ldisc.c:263 [inline]
#3: ffff88802dc380a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x1c/0xf0 drivers/tty/tty_ldisc.c:386
#4: ffff88801c6c20b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
stack backtrace:
CPU: 1 UID: 0 PID: 1348 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events vc_SAK
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
tty tty1: SAK: killed process 6161 (syz.2.135): by fd#3
tty tty1: SAK: killed process 6161 (syz.2.135): by fd#3
tty tty1: SAK: killed process 6162 (syz.1.136): by fd#3
tty tty1: SAK: killed process 6164 (syz.3.139): by fd#3
tty tty1: SAK: killed process 6182 (syz.2.157): by fd#3
tty tty1: SAK: killed process 6202 (syz.1.176): by fd#3
tty tty1: SAK: killed process 6289 (syz.1.263): by fd#3
tty tty1: SAK: killed process 6290 (syz.2.264): by fd#3
tty tty1: SAK: killed process 6293 (syz.0.268): by fd#3
tty tty1: SAK: killed process 6294 (syz.1.266): by fd#3
tty tty1: SAK: killed process 6343 (syz.2.317): by fd#3
tty tty1: SAK: killed process 6352 (syz.3.327): by fd#3
tty tty1: SAK: killed process 6357 (syz.3.331): by fd#3
tty tty1: SAK: killed process 6361 (syz.1.336): by fd#3
tty tty1: SAK: killed process 6363 (syz.2.337): by fd#3
tty tty1: SAK: killed process 6372 (syz.2.344): by fd#3
tty tty1: SAK: killed process 6373 (syz.0.347): by fd#3
tty tty1: SAK: killed process 6375 (syz.2.348): by fd#3
tty tty1: SAK: killed process 6382 (syz.3.355): by fd#3
tty tty1: SAK: killed process 6421 (syz.3.395): by fd#3
tty tty1: SAK: killed process 6423 (syz.1.397): by fd#3
tty tty1: SAK: killed process 6424 (syz.2.398): by fd#3
tty tty1: SAK: killed process 6426 (syz.1.400): by fd#3
tty tty1: SAK: killed process 6433 (syz.0.407): by fd#3
tty tty1: SAK: killed process 6438 (syz.1.412): by fd#3
tty tty1: SAK: killed process 6439 (syz.3.413): by fd#3
tty tty1: SAK: killed process 6464 (syz.1.438): by fd#3
tty tty1: SAK: killed process 6514 (syz.1.488): by fd#3
tty tty1: SAK: killed process 6517 (syz.0.491): by fd#3
tty tty1: SAK: killed process 6519 (syz.1.493): by fd#3
tty tty1: SAK: killed process 6550 (syz.0.525): by fd#3
tty tty1: SAK: killed process 6555 (syz.1.528): by fd#3
tty tty1: SAK: killed process 6556 (syz.3.530): by fd#3
tty tty1: SAK: killed process 6564 (syz.2.538): by fd#3
tty tty1: SAK: killed process 6565 (syz.1.539): by fd#3
tty tty1: SAK: killed process 6585 (syz.1.559): by fd#3
tty tty1: SAK: killed process 6589 (syz.1.564): by fd#3
tty tty1: SAK: killed process 6590 (syz.0.563): by fd#3
tty tty1: SAK: killed process 6592 (syz.1.566): by fd#3
tty tty1: SAK: killed process 6604 (syz.3.578): by fd#3
tty tty1: SAK: killed process 6614 (syz.2.588): by fd#3
tty tty1: SAK: killed process 6615 (syz.0.589): by fd#3
tty tty1: SAK: killed process 6624 (syz.3.598): by fd#3
tty tty1: SAK: killed process 6651 (syz.3.625): by fd#3
tty tty1: SAK: killed process 6653 (syz.2.627): by fd#3
tty tty1: SAK: killed process 6654 (syz.0.628): by fd#3
tty tty1: SAK: killed process 6656 (syz.3.630): by fd#3
tty tty1: SAK: killed process 6661 (syz.3.635): by fd#3
tty tty1: SAK: killed process 6667 (syz.1.641): by fd#3
tty tty1: SAK: killed process 6687 (syz.2.660): by fd#3
tty tty1: SAK: killed process 6688 (syz.3.662): by fd#3
tty tty1: SAK: killed process 6694 (syz.2.668): by fd#3
tty tty1: SAK: killed process 6930 (syz.0.898): by fd#3
tty tty1: SAK: killed process 6936 (syz.0.903): by fd#3
tty tty1: SAK: killed process 6953 (syz.2.920): by fd#3
tty tty1: SAK: killed process 6954 (syz.3.921): by fd#3
tty tty1: SAK: killed process 6962 (syz.0.929): by fd#3
tty tty1: SAK: killed process 6964 (syz.3.930): by fd#3
tty tty1: SAK: killed process 6965 (syz.0.933): by fd#3
tty tty1: SAK: killed process 6967 (syz.2.935): by fd#3
tty tty1: SAK: killed process 6971 (syz.1.938): by fd#3
tty tty1: SAK: killed process 6975 (syz.1.943): by fd#3
tty tty1: SAK: killed process 6977 (syz.2.944): by fd#3