program: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x1b) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x0, 0x1c, 0x20f}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_CREATE(r2, 0x5501) write$input_event(r2, &(0x7f0000000200)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r2, &(0x7f0000000240), 0x18) [ 86.893963][ T5320] input: syz0 as /devices/virtual/input/input5 [ 86.973341][ T5299] [ 86.973351][ T5299] ====================================================== [ 86.973356][ T5299] WARNING: possible circular locking dependency detected [ 86.973362][ T5299] syzkaller #0 Not tainted [ 86.973368][ T5299] ------------------------------------------------------ [ 86.973372][ T5299] kworker/0:4/5299 is trying to acquire lock: [ 86.973379][ T5299] ffff888012aed2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x30/0x230 [ 86.973487][ T5299] [ 86.973487][ T5299] but task is already holding lock: [ 86.973491][ T5299] ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 86.973521][ T5299] [ 86.973521][ T5299] which lock already depends on the new lock. [ 86.973521][ T5299] [ 86.973524][ T5299] [ 86.973524][ T5299] the existing dependency chain (in reverse order) is: [ 86.973529][ T5299] [ 86.973529][ T5299] -> #3 (&buf->lock){+.+.}-{4:4}: [ 86.973544][ T5299] __mutex_lock+0x19d/0x1550 [ 86.973588][ T5299] tty_buffer_flush+0x74/0x2b0 [ 86.973602][ T5299] tty_ldisc_flush+0x6b/0xc0 [ 86.973616][ T5299] __do_SAK+0x25e/0x680 [ 86.973624][ T5299] vc_SAK+0x78/0x220 [ 86.973636][ T5299] process_scheduled_works+0xa8e/0x14e0 [ 86.973648][ T5299] worker_thread+0xa47/0xfb0 [ 86.973659][ T5299] kthread+0x388/0x470 [ 86.973673][ T5299] ret_from_fork+0x514/0xb70 [ 86.973687][ T5299] ret_from_fork_asm+0x1a/0x30 [ 86.973696][ T5299] [ 86.973696][ T5299] -> #2 (console_lock){+.+.}-{0:0}: [ 86.973729][ T5299] console_lock+0x76/0x90 [ 86.973742][ T5299] serial_core_register_port+0xc47/0x2840 [ 86.973756][ T5299] serial8250_register_8250_port+0x16b4/0x2090 [ 86.973795][ T5299] serial_pnp_probe+0x56a/0x7f0 [ 86.973811][ T5299] pnp_device_probe+0x30b/0x4c0 [ 86.973824][ T5299] really_probe+0x254/0xae0 [ 86.973836][ T5299] __driver_probe_device+0x1e8/0x360 [ 86.973846][ T5299] driver_probe_device+0x4f/0x240 [ 86.973858][ T5299] __driver_attach+0x339/0x600 [ 86.973868][ T5299] bus_for_each_dev+0x23b/0x2c0 [ 86.973881][ T5299] bus_add_driver+0x345/0x670 [ 86.973894][ T5299] driver_register+0x23a/0x320 [ 86.973906][ T5299] serial8250_init+0x8f/0x160 [ 86.973976][ T5299] do_one_initcall+0x250/0x870 [ 86.973991][ T5299] do_initcall_level+0x10a/0x1a0 [ 86.974004][ T5299] do_initcalls+0x59/0xa0 [ 86.974015][ T5299] kernel_init_freeable+0x29d/0x3e0 [ 86.974028][ T5299] kernel_init+0x1d/0x1d0 [ 86.974041][ T5299] ret_from_fork+0x514/0xb70 [ 86.974054][ T5299] ret_from_fork_asm+0x1a/0x30 [ 86.974063][ T5299] [ 86.974063][ T5299] -> #1 (&port->mutex){+.+.}-{4:4}: [ 86.974079][ T5299] __mutex_lock+0x19d/0x1550 [ 86.974091][ T5299] uart_set_termios+0x83/0x12e0 [ 86.974105][ T5299] tty_set_termios+0xcaf/0x1800 [ 86.974117][ T5299] set_termios+0x53d/0x6c0 [ 86.974130][ T5299] tty_mode_ioctl+0x49c/0x7c0 [ 86.974143][ T5299] tty_ioctl+0x9bd/0xdd0 [ 86.974158][ T5299] __se_sys_ioctl+0xfc/0x170 [ 86.974173][ T5299] do_syscall_64+0x174/0x580 [ 86.974184][ T5299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.974195][ T5299] [ 86.974195][ T5299] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 86.974211][ T5299] __lock_acquire+0x1520/0x2cf0 [ 86.974225][ T5299] lock_acquire+0x106/0x350 [ 86.974238][ T5299] down_write+0x96/0x200 [ 86.974251][ T5299] n_tty_flush_buffer+0x30/0x230 [ 86.974261][ T5299] tty_buffer_flush+0x1ec/0x2b0 [ 86.974275][ T5299] tty_ldisc_flush+0x6b/0xc0 [ 86.974289][ T5299] __do_SAK+0x25e/0x680 [ 86.974297][ T5299] vc_SAK+0x78/0x220 [ 86.974309][ T5299] process_scheduled_works+0xa8e/0x14e0 [ 86.974320][ T5299] worker_thread+0xa47/0xfb0 [ 86.974331][ T5299] kthread+0x388/0x470 [ 86.974345][ T5299] ret_from_fork+0x514/0xb70 [ 86.974359][ T5299] ret_from_fork_asm+0x1a/0x30 [ 86.974368][ T5299] [ 86.974368][ T5299] other info that might help us debug this: [ 86.974368][ T5299] [ 86.974372][ T5299] Chain exists of: [ 86.974372][ T5299] &tty->termios_rwsem --> console_lock --> &buf->lock [ 86.974372][ T5299] [ 86.974391][ T5299] Possible unsafe locking scenario: [ 86.974391][ T5299] [ 86.974394][ T5299] CPU0 CPU1 [ 86.974397][ T5299] ---- ---- [ 86.974400][ T5299] lock(&buf->lock); [ 86.974408][ T5299] lock(console_lock); [ 86.974417][ T5299] lock(&buf->lock); [ 86.974425][ T5299] lock(&tty->termios_rwsem); [ 86.974433][ T5299] [ 86.974433][ T5299] *** DEADLOCK *** [ 86.974433][ T5299] [ 86.974437][ T5299] 5 locks held by kworker/0:4/5299: [ 86.974443][ T5299] #0: ffff88801b0a8940 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 86.974471][ T5299] #1: ffffc9000e367c40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 86.974501][ T5299] #2: ffffffff8eb4bfa0 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 86.974529][ T5299] #3: ffff888012aed0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 86.974558][ T5299] #4: ffff88801b0ba0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 86.974589][ T5299] [ 86.974589][ T5299] stack backtrace: [ 86.974596][ T5299] CPU: 0 UID: 0 PID: 5299 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 86.974607][ T5299] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.974614][ T5299] Workqueue: events vc_SAK [ 86.974627][ T5299] Call Trace: [ 86.974632][ T5299] [ 86.974637][ T5299] dump_stack_lvl+0xe8/0x150 [ 86.974652][ T5299] print_circular_bug+0x2e1/0x300 [ 86.974664][ T5299] check_noncircular+0x12e/0x150 [ 86.974675][ T5299] __lock_acquire+0x1520/0x2cf0 [ 86.974692][ T5299] ? __pfx___mutex_trylock_common+0x10/0x10 [ 86.974703][ T5299] ? rcu_is_watching+0x15/0xb0 [ 86.974714][ T5299] ? trace_contention_end+0x3d/0x140 [ 86.974725][ T5299] ? n_tty_flush_buffer+0x30/0x230 [ 86.974736][ T5299] lock_acquire+0x106/0x350 [ 86.974749][ T5299] ? n_tty_flush_buffer+0x30/0x230 [ 86.974763][ T5299] down_write+0x96/0x200 [ 86.974776][ T5299] ? n_tty_flush_buffer+0x30/0x230 [ 86.974796][ T5299] ? __pfx_down_write+0x10/0x10 [ 86.974811][ T5299] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 86.974822][ T5299] n_tty_flush_buffer+0x30/0x230 [ 86.974833][ T5299] ? tty_buffer_flush+0x1df/0x2b0 [ 86.974849][ T5299] ? __pfx_n_tty_flush_buffer+0x10/0x10 [ 86.974861][ T5299] tty_buffer_flush+0x1ec/0x2b0 [ 86.974877][ T5299] tty_ldisc_flush+0x6b/0xc0 [ 86.974891][ T5299] __do_SAK+0x25e/0x680 [ 86.974901][ T5299] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 86.974913][ T5299] vc_SAK+0x78/0x220 [ 86.974925][ T5299] ? process_scheduled_works+0xa20/0x14e0 [ 86.974937][ T5299] process_scheduled_works+0xa8e/0x14e0 [ 86.974953][ T5299] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.974966][ T5299] ? assign_work+0x3cf/0x5d0 [ 86.974979][ T5299] worker_thread+0xa47/0xfb0 [ 86.974994][ T5299] ? __kthread_parkme+0x71/0x1f0 [ 86.975009][ T5299] kthread+0x388/0x470 [ 86.975023][ T5299] ? __pfx_worker_thread+0x10/0x10 [ 86.975034][ T5299] ? __pfx_kthread+0x10/0x10 [ 86.975049][ T5299] ret_from_fork+0x514/0xb70 [ 86.975064][ T5299] ? __pfx_ret_from_fork+0x10/0x10 [ 86.975079][ T5299] ? __switch_to+0xc89/0x1420 [ 86.975092][ T5299] ? __pfx_kthread+0x10/0x10 [ 86.975107][ T5299] ret_from_fork_asm+0x1a/0x30 [ 86.975120][ T5299] [ 87.263304][ T5282] Bluetooth: hci0: command tx timeout