Extracting prog: 1m32.898144726s
Minimizing prog: 11m19.248321992s
Simplifying prog options: 0s
Extracting C: 26.335908645s
Simplifying C: 5m20.425403712s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
single: successfully extracted reproducer
found reproducer with 9 syscalls
minimizing guilty program
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501)
write$input_event(0xffffffffffffffff, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x14)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$input_event(r0, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, 0x0)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, 0x0)
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program did not crash
testing program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=44.577580606s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
simplifying C reproducer
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program did not crash
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program did not crash
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing compiled C program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
program crashed: possible deadlock in n_tty_flush_buffer
testing program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
validation run: crashed=true
testing program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
validation run: crashed=true
testing program (duration=44.577580606s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty20-ioctl$VT_ACTIVATE-ioctl$KDSKBENT-openat$uinput-ioctl$UI_SET_EVBIT-ioctl$UI_SET_KEYBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-write$input_event
detailed listing:
executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$VT_ACTIVATE(r0, 0x5606, 0x14)
ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1})
ioctl$UI_DEV_CREATE(r1, 0x5501)
write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18)
program crashed: possible deadlock in n_tty_flush_buffer
validation run: crashed=true
reproducing took 20m40.507590185s
repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/1:4/5984 is trying to acquire lock:
ffff88802cd722c8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
ffff88802cd722c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
but task is already holding lock:
ffff888027ed30b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&buf->lock){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
tty_ldisc_flush+0xd2/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #2 (console_lock){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
console_lock+0x7a/0xa0 kernel/printk/printk.c:2896
uart_configure_port drivers/tty/serial/serial_core.c:2530 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3101 [inline]
serial_core_register_port+0xe65/0x16f0 drivers/tty/serial/serial_core.c:3322
serial8250_register_8250_port+0x15af/0x2330 drivers/tty/serial/8250/8250_core.c:828
serial_pnp_probe+0x436/0x930 drivers/tty/serial/8250/8250_pnp.c:480
pnp_device_probe+0x2b3/0x4a0 drivers/pnp/driver.c:111
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x210/0x460 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
driver_register+0x1e2/0x360 drivers/base/driver.c:174
serial8250_init+0xcc/0x1c0 drivers/tty/serial/8250/8250_platform.c:317
do_one_initcall+0x11c/0x6f0 init/main.c:1353
do_initcall_level init/main.c:1415 [inline]
do_initcalls init/main.c:1431 [inline]
do_basic_setup init/main.c:1451 [inline]
kernel_init_freeable+0x6ea/0x7b0 init/main.c:1666
kernel_init+0x21/0x1e0 init/main.c:1556
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #1 (&port->mutex){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
class_mutex_constructor include/linux/mutex.h:253 [inline]
uart_set_termios+0x8e/0x690 drivers/tty/serial/serial_core.c:1645
tty_set_termios+0x64d/0x980 drivers/tty/tty_ioctl.c:341
set_termios+0x5c8/0x880 drivers/tty/tty_ioctl.c:516
tty_mode_ioctl+0x17e/0xd40 drivers/tty/tty_ioctl.c:803
n_tty_ioctl_helper+0x47/0x2b0 drivers/tty/tty_ioctl.c:982
n_tty_ioctl+0x53/0x340 drivers/tty/n_tty.c:2496
tty_ioctl+0x11b4/0x1640 drivers/tty/tty_io.c:2774
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&tty->termios_rwsem){++++}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Chain exists of:
&tty->termios_rwsem --> console_lock --> &buf->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&buf->lock);
lock(console_lock);
lock(&buf->lock);
lock(&tty->termios_rwsem);
*** DEADLOCK ***
locks held by kworker/1:4/5984: 5, last CPU#1:
#0: ffff88801c0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc900034c7d08 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: class_console_lock_constructor include/linux/console.h:734 [inline]
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x13/0x320 drivers/tty/vt/vt_ioctl.c:987
#3: ffff88802cd720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref drivers/tty/tty_ldisc.c:263 [inline]
#3: ffff88802cd720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x1c/0xf0 drivers/tty/tty_ldisc.c:386
#4: ffff888027ed30b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
stack backtrace:
CPU: 1 UID: 0 PID: 5984 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events vc_SAK
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
tty tty20: SAK: killed process 6065 (syz.0.86): by fd#3
tty tty20: SAK: killed process 6080 (syz.0.94): by fd#3
Oops: general protection fault, probably for non-canonical address 0xdffffc000000044c: 0000 [#1] SMP KASAN NOPTI
KASAN: probably user-memory-access in range [0x0000000000002260-0x0000000000002267]
CPU: 1 UID: 0 PID: 5984 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events vc_SAK
RIP: 0010:reset_buffer_flags+0x22/0x1c0 drivers/tty/n_tty.c:314
Code: 90 90 90 90 90 90 90 90 55 53 48 89 fb e8 76 e9 6a fc 48 8d bb 60 22 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 75 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc900034c7af0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000000044c RSI: ffffffff85a0185a RDI: 0000000000002260
RBP: ffffffff85a049f0 R08: 0000000000000001 R09: ffffed100af3f44d
R10: ffff8880579fa26f R11: ffffffff81d66229 R12: ffff8880579fa260
R13: ffff8880579fa4d0 R14: ffff88802cf191e0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f210fe27dac CR3: 0000000054aa8000 CR4: 0000000000352ef0
Call Trace:
n_tty_flush_buffer+0x56/0x1a0 drivers/tty/n_tty.c:350
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:reset_buffer_flags+0x22/0x1c0 drivers/tty/n_tty.c:314
Code: 90 90 90 90 90 90 90 90 55 53 48 89 fb e8 76 e9 6a fc 48 8d bb 60 22 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 75 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc900034c7af0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000000044c RSI: ffffffff85a0185a RDI: 0000000000002260
RBP: ffffffff85a049f0 R08: 0000000000000001 R09: ffffed100af3f44d
R10: ffff8880579fa26f R11: ffffffff81d66229 R12: ffff8880579fa260
R13: ffff8880579fa4d0 R14: ffff88802cf191e0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f210fe27dac CR3: 0000000054aa8000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 55 push %rbp
9: 53 push %rbx
a: 48 89 fb mov %rdi,%rbx
d: e8 76 e9 6a fc call 0xfc6ae988
12: 48 8d bb 60 22 00 00 lea 0x2260(%rbx),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 75 01 00 00 jne 0x1a9
34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3b: fc ff df
3e: 48 rex.W
3f: 8d .byte 0x8d
final repro crashed as (corrupted=false):
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/1:4/5984 is trying to acquire lock:
ffff88802cd722c8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
ffff88802cd722c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
but task is already holding lock:
ffff888027ed30b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&buf->lock){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
tty_ldisc_flush+0xd2/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #2 (console_lock){+.+.}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
console_lock+0x7a/0xa0 kernel/printk/printk.c:2896
uart_configure_port drivers/tty/serial/serial_core.c:2530 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3101 [inline]
serial_core_register_port+0xe65/0x16f0 drivers/tty/serial/serial_core.c:3322
serial8250_register_8250_port+0x15af/0x2330 drivers/tty/serial/8250/8250_core.c:828
serial_pnp_probe+0x436/0x930 drivers/tty/serial/8250/8250_pnp.c:480
pnp_device_probe+0x2b3/0x4a0 drivers/pnp/driver.c:111
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x210/0x460 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__driver_attach+0x21f/0x5b0 drivers/base/dd.c:1292
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383
bus_add_driver+0x305/0x5b0 drivers/base/bus.c:763
driver_register+0x1e2/0x360 drivers/base/driver.c:174
serial8250_init+0xcc/0x1c0 drivers/tty/serial/8250/8250_platform.c:317
do_one_initcall+0x11c/0x6f0 init/main.c:1353
do_initcall_level init/main.c:1415 [inline]
do_initcalls init/main.c:1431 [inline]
do_basic_setup init/main.c:1451 [inline]
kernel_init_freeable+0x6ea/0x7b0 init/main.c:1666
kernel_init+0x21/0x1e0 init/main.c:1556
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #1 (&port->mutex){+.+.}-{4:4}:
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821
class_mutex_constructor include/linux/mutex.h:253 [inline]
uart_set_termios+0x8e/0x690 drivers/tty/serial/serial_core.c:1645
tty_set_termios+0x64d/0x980 drivers/tty/tty_ioctl.c:341
set_termios+0x5c8/0x880 drivers/tty/tty_ioctl.c:516
tty_mode_ioctl+0x17e/0xd40 drivers/tty/tty_ioctl.c:803
n_tty_ioctl_helper+0x47/0x2b0 drivers/tty/tty_ioctl.c:982
n_tty_ioctl+0x53/0x340 drivers/tty/n_tty.c:2496
tty_ioctl+0x11b4/0x1640 drivers/tty/tty_io.c:2774
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&tty->termios_rwsem){++++}-{4:4}:
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Chain exists of:
&tty->termios_rwsem --> console_lock --> &buf->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&buf->lock);
lock(console_lock);
lock(&buf->lock);
lock(&tty->termios_rwsem);
*** DEADLOCK ***
locks held by kworker/1:4/5984: 5, last CPU#1:
#0: ffff88801c0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
#1: ffffc900034c7d08 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: class_console_lock_constructor include/linux/console.h:734 [inline]
#2: ffffffff8edd6100 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x13/0x320 drivers/tty/vt/vt_ioctl.c:987
#3: ffff88802cd720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref drivers/tty/tty_ldisc.c:263 [inline]
#3: ffff88802cd720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x1c/0xf0 drivers/tty/tty_ldisc.c:386
#4: ffff888027ed30b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x72/0x310 drivers/tty/tty_buffer.c:236
stack backtrace:
CPU: 1 UID: 0 PID: 5984 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events vc_SAK
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059
check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191
check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5253
lock_acquire kernel/locking/lockdep.c:5886 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843
down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631
class_rwsem_write_constructor include/linux/rwsem.h:270 [inline]
n_tty_flush_buffer+0x21/0x1a0 drivers/tty/n_tty.c:349
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
tty tty20: SAK: killed process 6065 (syz.0.86): by fd#3
tty tty20: SAK: killed process 6080 (syz.0.94): by fd#3
Oops: general protection fault, probably for non-canonical address 0xdffffc000000044c: 0000 [#1] SMP KASAN NOPTI
KASAN: probably user-memory-access in range [0x0000000000002260-0x0000000000002267]
CPU: 1 UID: 0 PID: 5984 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events vc_SAK
RIP: 0010:reset_buffer_flags+0x22/0x1c0 drivers/tty/n_tty.c:314
Code: 90 90 90 90 90 90 90 90 55 53 48 89 fb e8 76 e9 6a fc 48 8d bb 60 22 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 75 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc900034c7af0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000000044c RSI: ffffffff85a0185a RDI: 0000000000002260
RBP: ffffffff85a049f0 R08: 0000000000000001 R09: ffffed100af3f44d
R10: ffff8880579fa26f R11: ffffffff81d66229 R12: ffff8880579fa260
R13: ffff8880579fa4d0 R14: ffff88802cf191e0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f210fe27dac CR3: 0000000054aa8000 CR4: 0000000000352ef0
Call Trace:
n_tty_flush_buffer+0x56/0x1a0 drivers/tty/n_tty.c:350
tty_buffer_flush+0x239/0x310 drivers/tty/tty_buffer.c:248
tty_ldisc_flush+0x68/0xf0 drivers/tty/tty_ldisc.c:388
__do_SAK+0x35f/0x470 drivers/tty/tty_io.c:2998
vc_SAK+0x7f/0x320 drivers/tty/vt/vt_ioctl.c:996
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:reset_buffer_flags+0x22/0x1c0 drivers/tty/n_tty.c:314
Code: 90 90 90 90 90 90 90 90 55 53 48 89 fb e8 76 e9 6a fc 48 8d bb 60 22 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 75 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc900034c7af0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000000044c RSI: ffffffff85a0185a RDI: 0000000000002260
RBP: ffffffff85a049f0 R08: 0000000000000001 R09: ffffed100af3f44d
R10: ffff8880579fa26f R11: ffffffff81d66229 R12: ffff8880579fa260
R13: ffff8880579fa4d0 R14: ffff88802cf191e0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f210fe27dac CR3: 0000000054aa8000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 55 push %rbp
9: 53 push %rbx
a: 48 89 fb mov %rdi,%rbx
d: e8 76 e9 6a fc call 0xfc6ae988
12: 48 8d bb 60 22 00 00 lea 0x2260(%rbx),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 75 01 00 00 jne 0x1a9
34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3b: fc ff df
3e: 48 rex.W
3f: 8d .byte 0x8d