program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x1b) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) write$input_event(r2, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r2, &(0x7f0000000240), 0x18) [ 116.271244][ T5297] Bluetooth: hci0: command tx timeout [ 116.336952][ T5336] input: syz0 as /devices/virtual/input/input5 [ 116.370722][ T10] [ 116.370729][ T10] ====================================================== [ 116.370733][ T10] WARNING: possible circular locking dependency detected [ 116.370737][ T10] syzkaller #0 Not tainted [ 116.370741][ T10] ------------------------------------------------------ [ 116.370744][ T10] kworker/0:1/10 is trying to acquire lock: [ 116.370748][ T10] ffff88801fded2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 116.370827][ T10] [ 116.370827][ T10] but task is already holding lock: [ 116.370830][ T10] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 116.370850][ T10] [ 116.370850][ T10] which lock already depends on the new lock. [ 116.370850][ T10] [ 116.370852][ T10] [ 116.370852][ T10] the existing dependency chain (in reverse order) is: [ 116.370855][ T10] [ 116.370855][ T10] -> #3 (&buf->lock){+.+.}-{4:4}: [ 116.370889][ T10] __mutex_lock+0x19d/0x1550 [ 116.370923][ T10] tty_buffer_flush+0x74/0x2b0 [ 116.370933][ T10] tty_ldisc_flush+0x6b/0xc0 [ 116.370942][ T10] __do_SAK+0x25e/0x680 [ 116.370948][ T10] vc_SAK+0x78/0x220 [ 116.370956][ T10] process_scheduled_works+0xa8e/0x14e0 [ 116.370964][ T10] worker_thread+0xa47/0xfb0 [ 116.370972][ T10] kthread+0x388/0x470 [ 116.370981][ T10] ret_from_fork+0x514/0xb70 [ 116.370991][ T10] ret_from_fork_asm+0x1a/0x30 [ 116.370998][ T10] [ 116.370998][ T10] -> #2 (console_lock){+.+.}-{0:0}: [ 116.371009][ T10] console_lock+0x76/0x90 [ 116.371016][ T10] serial_core_register_port+0xc47/0x2840 [ 116.371026][ T10] serial8250_register_8250_port+0x16b4/0x2090 [ 116.371035][ T10] serial_pnp_probe+0x56a/0x7f0 [ 116.371045][ T10] pnp_device_probe+0x30b/0x4c0 [ 116.371054][ T10] really_probe+0x254/0xae0 [ 116.371061][ T10] __driver_probe_device+0x1e8/0x360 [ 116.371068][ T10] driver_probe_device+0x4f/0x240 [ 116.371077][ T10] __driver_attach+0x339/0x600 [ 116.371087][ T10] bus_for_each_dev+0x23b/0x2c0 [ 116.371099][ T10] bus_add_driver+0x345/0x670 [ 116.371111][ T10] driver_register+0x23a/0x320 [ 116.371121][ T10] serial8250_init+0x8f/0x160 [ 116.371186][ T10] do_one_initcall+0x250/0x870 [ 116.371196][ T10] do_initcall_level+0x10a/0x1a0 [ 116.371205][ T10] do_initcalls+0x59/0xa0 [ 116.371213][ T10] kernel_init_freeable+0x29d/0x3e0 [ 116.371221][ T10] kernel_init+0x1d/0x1d0 [ 116.371230][ T10] ret_from_fork+0x514/0xb70 [ 116.371240][ T10] ret_from_fork_asm+0x1a/0x30 [ 116.371246][ T10] [ 116.371246][ T10] -> #1 (&port->mutex){+.+.}-{4:4}: [ 116.371256][ T10] __mutex_lock+0x19d/0x1550 [ 116.371264][ T10] uart_set_termios+0x83/0x12e0 [ 116.371275][ T10] tty_set_termios+0xcaf/0x1800 [ 116.371283][ T10] set_termios+0x53d/0x6c0 [ 116.371292][ T10] tty_mode_ioctl+0x49c/0x7c0 [ 116.371300][ T10] tty_ioctl+0x9bd/0xdd0 [ 116.371310][ T10] __se_sys_ioctl+0xfc/0x170 [ 116.371320][ T10] do_syscall_64+0x174/0x580 [ 116.371328][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.371335][ T10] [ 116.371335][ T10] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 116.371345][ T10] __lock_acquire+0x1520/0x2cf0 [ 116.371355][ T10] lock_acquire+0x106/0x350 [ 116.371364][ T10] down_write+0x96/0x200 [ 116.371372][ T10] n_tty_flush_buffer+0x30/0x230 [ 116.371379][ T10] tty_buffer_flush+0x1ec/0x2b0 [ 116.371389][ T10] tty_ldisc_flush+0x6b/0xc0 [ 116.371399][ T10] __do_SAK+0x25e/0x680 [ 116.371404][ T10] vc_SAK+0x78/0x220 [ 116.371412][ T10] process_scheduled_works+0xa8e/0x14e0 [ 116.371419][ T10] worker_thread+0xa47/0xfb0 [ 116.371427][ T10] kthread+0x388/0x470 [ 116.371436][ T10] ret_from_fork+0x514/0xb70 [ 116.371446][ T10] ret_from_fork_asm+0x1a/0x30 [ 116.371451][ T10] [ 116.371451][ T10] other info that might help us debug this: [ 116.371451][ T10] [ 116.371454][ T10] Chain exists of: [ 116.371454][ T10] &tty->termios_rwsem --> console_lock --> &buf->lock [ 116.371454][ T10] [ 116.371466][ T10] Possible unsafe locking scenario: [ 116.371466][ T10] [ 116.371468][ T10] CPU0 CPU1 [ 116.371471][ T10] ---- ---- [ 116.371473][ T10] lock(&buf->lock); [ 116.371478][ T10] lock(console_lock); [ 116.371484][ T10] lock(&buf->lock); [ 116.371489][ T10] lock(&tty->termios_rwsem); [ 116.371495][ T10] [ 116.371495][ T10] *** DEADLOCK *** [ 116.371495][ T10] [ 116.371497][ T10] 5 locks held by kworker/0:1/10: [ 116.371501][ T10] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 116.371520][ T10] #1: ffffc9000023fc40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 116.371538][ T10] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 116.371557][ T10] #3: ffff88801fded0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 116.371582][ T10] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 116.371603][ T10] [ 116.371603][ T10] stack backtrace: [ 116.371608][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 116.371616][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.371620][ T10] Workqueue: events vc_SAK [ 116.371630][ T10] Call Trace: [ 116.371633][ T10] [ 116.371637][ T10] dump_stack_lvl+0xe8/0x150 [ 116.371651][ T10] print_circular_bug+0x2e1/0x300 [ 116.371659][ T10] check_noncircular+0x12e/0x150 [ 116.371666][ T10] __lock_acquire+0x1520/0x2cf0 [ 116.371677][ T10] ? __pfx___mutex_trylock_common+0x10/0x10 [ 116.371685][ T10] ? rcu_is_watching+0x15/0xb0 [ 116.371691][ T10] ? trace_contention_end+0x3d/0x140 [ 116.371698][ T10] ? n_tty_flush_buffer+0x30/0x230 [ 116.371706][ T10] lock_acquire+0x106/0x350 [ 116.371715][ T10] ? n_tty_flush_buffer+0x30/0x230 [ 116.371724][ T10] down_write+0x96/0x200 [ 116.371732][ T10] ? n_tty_flush_buffer+0x30/0x230 [ 116.371740][ T10] ? __pfx_down_write+0x10/0x10 [ 116.371749][ T10] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 116.371757][ T10] n_tty_flush_buffer+0x30/0x230 [ 116.371764][ T10] ? tty_buffer_flush+0x1df/0x2b0 [ 116.371774][ T10] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 116.371782][ T10] tty_buffer_flush+0x1ec/0x2b0 [ 116.371793][ T10] tty_ldisc_flush+0x6b/0xc0 [ 116.371803][ T10] __do_SAK+0x25e/0x680 [ 116.371809][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 116.371816][ T10] vc_SAK+0x78/0x220 [ 116.371825][ T10] ? process_scheduled_works+0xa20/0x14e0 [ 116.371832][ T10] process_scheduled_works+0xa8e/0x14e0 [ 116.371843][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 116.371852][ T10] ? assign_work+0x3cf/0x5d0 [ 116.371859][ T10] worker_thread+0xa47/0xfb0 [ 116.371871][ T10] kthread+0x388/0x470 [ 116.371880][ T10] ? __pfx_worker_thread+0x10/0x10 [ 116.371888][ T10] ? __pfx_kthread+0x10/0x10 [ 116.371897][ T10] ret_from_fork+0x514/0xb70 [ 116.371908][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 116.371917][ T10] ? __switch_to+0xc89/0x1420 [ 116.371926][ T10] ? __pfx_kthread+0x10/0x10 [ 116.371936][ T10] ret_from_fork_asm+0x1a/0x30 [ 116.371944][ T10]