[syzbot] [serial?] possible deadlock in console_lock_spinning_enable (5)

Hello,

syzbot found the following issue on:

HEAD commit: 8867bbd4a056 mm: arm64: Fix the out-of-bounds issue in con..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11626d7d980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc88a9f65787e86
dashboard link: https://syzkaller.appspot.com/bug?extid=622acb507894a48b2ce9
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5ef30d34e749/disk-8867bbd4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a21c2389ebfb/vmlinux-8867bbd4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9720b12c3f99/Image-8867bbd4.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

sp0: Synchronizing with TNC
------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
6.10.0-rc2-syzkaller-g8867bbd4a056 #0 Tainted: G W
------------------------------------------------------
syz.2.1398/12737 is trying to acquire lock:
ffff80008f58d020 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x88/0xec kernel/printk/printk.c:1866

but task is already holding lock:
ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_port_lock_irqsave include/linux/serial_core.h:618 [inline]
ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_write+0x114/0x2ec drivers/tty/serial/serial_core.c:624

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&port_lock_key){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
uart_port_lock_irqsave include/linux/serial_core.h:618 [inline]
pl011_console_write+0x148/0x724 drivers/tty/serial/amba-pl011.c:2316
console_emit_next_record kernel/printk/printk.c:2928 [inline]
console_flush_all+0x5cc/0xb74 kernel/printk/printk.c:2994
console_unlock+0xec/0x3d4 kernel/printk/printk.c:3063
vprintk_emit+0x1ec/0x350 kernel/printk/printk.c:2345
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2360
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2370
register_console+0x700/0xa8c kernel/printk/printk.c:3596
uart_configure_port drivers/tty/serial/serial_core.c:2664 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3192 [inline]
serial_core_register_port+0x1428/0x1bf4 drivers/tty/serial/serial_core.c:3429
serial_ctrl_register_port+0x28/0x38 drivers/tty/serial/serial_ctrl.c:41
uart_add_one_port+0x28/0x38 drivers/tty/serial/serial_port.c:136
pl011_register_port+0x1b4/0x44c drivers/tty/serial/amba-pl011.c:2744
sbsa_uart_probe+0x488/0x608 drivers/tty/serial/amba-pl011.c:2914
platform_probe+0x148/0x1c0 drivers/base/platform.c:1404
really_probe+0x38c/0x8fc drivers/base/dd.c:656
__driver_probe_device+0x194/0x374 drivers/base/dd.c:798
driver_probe_device+0x78/0x330 drivers/base/dd.c:828
__device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:956
bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
__device_attach+0x2b4/0x434 drivers/base/dd.c:1028
device_initial_probe+0x24/0x34 drivers/base/dd.c:1077
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3721
platform_device_add+0x3e8/0x6e8 drivers/base/platform.c:716
platform_device_register_full+0x4ec/0x604 drivers/base/platform.c:844
acpi_create_platform_device+0x5bc/0x744 drivers/acpi/acpi_platform.c:177
acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2184
acpi_bus_attach+0x8b8/0xaa8 drivers/acpi/scan.c:2293
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1143
device_for_each_child+0xec/0x174 drivers/base/core.c:4050
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1155
acpi_bus_attach+0x358/0xaa8 drivers/acpi/scan.c:2298
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1143
device_for_each_child+0xec/0x174 drivers/base/core.c:4050
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1155
acpi_bus_attach+0x358/0xaa8 drivers/acpi/scan.c:2298
acpi_bus_scan+0x118/0x4f0 drivers/acpi/scan.c:2579
acpi_scan_init+0x214/0x6b0 drivers/acpi/scan.c:2714
acpi_init+0x190/0x254 drivers/acpi/bus.c:1460
do_one_initcall+0x254/0x9e4 init/main.c:1267
do_initcall_level+0x154/0x214 init/main.c:1329
do_initcalls+0x58/0xac init/main.c:1345
do_basic_setup+0x8c/0xa0 init/main.c:1364
kernel_init_freeable+0x324/0x478 init/main.c:1578
kernel_init+0x24/0x2a0 init/main.c:1467
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

-> #0 (console_owner){-.-.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x3384/0x763c kernel/locking/lockdep.c:5137
lock_acquire+0x248/0x73c kernel/locking/lockdep.c:5754
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1870
console_emit_next_record kernel/printk/printk.c:2922 [inline]
console_flush_all+0x58c/0xb74 kernel/printk/printk.c:2994
console_unlock+0xec/0x3d4 kernel/printk/printk.c:3063
vprintk_emit+0x1ec/0x350 kernel/printk/printk.c:2345
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2360
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2370
__report_bug lib/bug.c:195 [inline]
report_bug+0x3b8/0x5b0 lib/bug.c:219
bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:978
call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
brk_handler+0x17c/0x2e0 arch/arm64/kernel/debug-monitors.c:328
do_debug_exception+0x1e4/0x398 arch/arm64/mm/fault.c:909
el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:472
el1h_64_sync_handler+0x40/0xac arch/arm64/kernel/entry-common.c:512
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
tnc_init drivers/net/hamradio/6pack.c:531 [inline]
sixpack_open+0x5d8/0x8b0 drivers/net/hamradio/6pack.c:628
tty_ldisc_open+0x9c/0x14c drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x2f8/0x4e0 drivers/tty/tty_ldisc.c:563
tiocsetd+0x100/0x13c drivers/tty/tty_io.c:2439
tty_ioctl+0xba0/0xd8c drivers/tty/tty_io.c:2739
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&port_lock_key);
lock(console_owner);
lock(&port_lock_key);
lock(console_owner);

*** DEADLOCK ***

5 locks held by syz.2.1398/12737:
#0: ffff0000ed2011c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_lock+0x78/0xc8 drivers/tty/tty_mutex.c:18
#1: ffff0000ed2010a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_write+0x3c/0x4c drivers/tty/tty_ldsem.c:366
#2: ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_port_lock_irqsave include/linux/serial_core.h:618 [inline]
#2: ffff800094049db8 (&port_lock_key){-.-.}-{2:2}, at: uart_write+0x114/0x2ec drivers/tty/serial/serial_core.c:624
#3: ffff80008f474940 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x1d0/0x350 kernel/printk/printk.c:2344
#4: ffff80008f474570 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire+0x10/0x4c include/linux/rcupdate.h:333

stack backtrace:
CPU: 0 PID: 12737 Comm: syz.2.1398 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:114
dump_stack+0x1c/0x28 lib/dump_stack.c:123
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2060
check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x3384/0x763c kernel/locking/lockdep.c:5137
lock_acquire+0x248/0x73c kernel/locking/lockdep.c:5754
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1870
console_emit_next_record kernel/printk/printk.c:2922 [inline]
console_flush_all+0x58c/0xb74 kernel/printk/printk.c:2994
console_unlock+0xec/0x3d4 kernel/printk/printk.c:3063
vprintk_emit+0x1ec/0x350 kernel/printk/printk.c:2345
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2360
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2370
__report_bug lib/bug.c:195 [inline]
report_bug+0x3b8/0x5b0 lib/bug.c:219
bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:978
call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
brk_handler+0x17c/0x2e0 arch/arm64/kernel/debug-monitors.c:328
do_debug_exception+0x1e4/0x398 arch/arm64/mm/fault.c:909
el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:472
el1h_64_sync_handler+0x40/0xac arch/arm64/kernel/entry-common.c:512
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:593
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
tnc_init drivers/net/hamradio/6pack.c:531 [inline]
sixpack_open+0x5d8/0x8b0 drivers/net/hamradio/6pack.c:628
tty_ldisc_open+0x9c/0x14c drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x2f8/0x4e0 drivers/tty/tty_ldisc.c:563
tiocsetd+0x100/0x13c drivers/tty/tty_io.c:2439
tty_ioctl+0xba0/0xd8c drivers/tty/tty_io.c:2739
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
WARNING: CPU: 0 PID: 12737 at drivers/tty/serial/serial_core.c:625 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
WARNING: CPU: 0 PID: 12737 at drivers/tty/serial/serial_core.c:625 uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
WARNING: CPU: 0 PID: 12737 at drivers/tty/serial/serial_core.c:625 uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
Modules linked in:
CPU: 0 PID: 12737 Comm: syz.2.1398 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : uart_write+0x280/0x2ec include/linux/spinlock.h:406
lr : uart_write+0x278/0x2ec drivers/tty/serial/serial_core.c:625
sp : ffff800097fc7ad0
x29: ffff800097fc7ad0 x28: 1ffff00012ff8f68 x27: dfff800000000000
x26: 0000000000000001 x25: dfff800000000000 x24: ffff0000c9708f48
x23: 0000000000000000 x22: ffff800094049da0 x21: ffff800097fc7b60
x20: 0000000000000001 x19: ffff0000c9708be8 x18: ffff800097fc7780
x17: 00000000000411dd x16: ffff8000803514ec x15: ffff700012ff8f40
x14: 1ffff00012ff8f40 x13: 0000000000000004 x12: ffffffffffffffff
x11: 0000000000040000 x10: 000000000001f74c x9 : ffff8000ab01c000
x8 : 000000000001f74d x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff80008035161c
x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff800094049da0
Call trace:
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:669 [inline]
uart_write+0x280/0x2ec drivers/tty/serial/serial_core.c:626
tnc_init drivers/net/hamradio/6pack.c:531 [inline]
sixpack_open+0x5d8/0x8b0 drivers/net/hamradio/6pack.c:628
tty_ldisc_open+0x9c/0x14c drivers/tty/tty_ldisc.c:432
tty_set_ldisc+0x2f8/0x4e0 drivers/tty/tty_ldisc.c:563
tiocsetd+0x100/0x13c drivers/tty/tty_io.c:2439
tty_ioctl+0xba0/0xd8c drivers/tty/tty_io.c:2739
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
irq event stamp: 1952
hardirqs last enabled at (1951): [<ffff8000803794d8>] __up_console_sem kernel/printk/printk.c:341 [inline]
hardirqs last enabled at (1951): [<ffff8000803794d8>] __console_unlock kernel/printk/printk.c:2746 [inline]
hardirqs last enabled at (1951): [<ffff8000803794d8>] console_unlock+0x17c/0x3d4 kernel/printk/printk.c:3065
hardirqs last disabled at (1952): [<ffff80008b2f9ba8>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (1952): [<ffff80008b2f9ba8>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162
softirqs last enabled at (1800): [<ffff8000893ef2dc>] neigh_parms_alloc+0x330/0x464 net/core/neighbour.c:1738
softirqs last disabled at (1798): [<ffff8000893ef230>] neigh_parms_alloc+0x284/0x464 net/core/neighbour.c:1736
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot has found a reproducer for the following issue on:

HEAD commit: 5f5673607153 Merge branch 'for-next/core' into for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1237cb9f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=dedbcb1ff4387972
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1637cb9f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f0f580580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/40172aed5414/disk-5f567360.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/58372f305e9d/vmlinux-5f567360.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d2aae6fa798f/Image-5f567360.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/de597512c7c3/mount_0.gz
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
------------------------------------------------------
kworker/0:2/5992 is trying to acquire lock:
ffff80008f7436e0 (console_owner){....}-{0:0}, at: console_lock_spinning_enable+0x88/0xec kernel/printk/printk.c:1869
ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: start_flush_work kernel/workqueue.c:4125 [inline]
ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: __flush_work+0x178/0x954 kernel/workqueue.c:4176
-> #3 (&pool->lock){-.-.}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
__queue_work+0x8b0/0x1308
queue_work_on+0xe0/0x1a0 kernel/workqueue.c:2392
queue_work include/linux/workqueue.h:621 [inline]
rpm_suspend+0xc20/0x1470 drivers/base/power/runtime.c:662
rpm_idle+0x570/0x8c0 drivers/base/power/runtime.c:536
__pm_runtime_idle+0x114/0x1d4 drivers/base/power/runtime.c:1104
pm_runtime_put include/linux/pm_runtime.h:448 [inline]
__device_attach+0x34c/0x434 drivers/base/dd.c:1047
device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3682
serial_base_port_add+0x25c/0x370 drivers/tty/serial/serial_base_bus.c:179
serial_core_port_device_add drivers/tty/serial/serial_core.c:3388 [inline]
serial_core_register_port+0x2fc/0x1bf4 drivers/tty/serial/serial_core.c:3429
serial_ctrl_register_port+0x28/0x38 drivers/tty/serial/serial_ctrl.c:41
uart_add_one_port+0x28/0x38 drivers/tty/serial/serial_port.c:143
really_probe+0x38c/0x8fc drivers/base/dd.c:657
__driver_probe_device+0x194/0x374 drivers/base/dd.c:799
driver_probe_device+0x78/0x330 drivers/base/dd.c:829
__device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:957
bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
__device_attach+0x2b4/0x434 drivers/base/dd.c:1029
device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3682
platform_device_add+0x3e8/0x6e8 drivers/base/platform.c:716
platform_device_register_full+0x4f0/0x608 drivers/base/platform.c:844
acpi_create_platform_device+0x5bc/0x744 drivers/acpi/acpi_platform.c:177
acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2193
acpi_bus_attach+0x804/0xad4 drivers/acpi/scan.c:2304
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_bus_scan+0x118/0x4f0 drivers/acpi/scan.c:2590
acpi_scan_init+0x214/0x6b0 drivers/acpi/scan.c:2727
acpi_init+0x190/0x254 drivers/acpi/bus.c:1462
do_one_initcall+0x24c/0x9c0 init/main.c:1267
-> #2 (&dev->power.lock){-...}-{2:2}:
__pm_runtime_resume+0xf0/0x180 drivers/base/power/runtime.c:1171
pm_runtime_get include/linux/pm_runtime.h:396 [inline]
__uart_start+0x154/0x3d8 drivers/tty/serial/serial_core.c:148
uart_write+0x154/0x374 drivers/tty/serial/serial_core.c:633
process_output_block drivers/tty/n_tty.c:574 [inline]
n_tty_write+0xaec/0xed0 drivers/tty/n_tty.c:2389
iterate_tty_write drivers/tty/tty_io.c:1021 [inline]
file_tty_write+0x410/0x7b8 drivers/tty/tty_io.c:1096
tty_write drivers/tty/tty_io.c:1117 [inline]
redirected_tty_write+0xac/0x14c drivers/tty/tty_io.c:1140
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0x940/0xc80 fs/read_write.c:590
ksys_write+0x15c/0x26c fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:652
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
-> #1 (&port_lock_key){....}-{2:2}:
console_emit_next_record kernel/printk/printk.c:2983 [inline]
console_flush_all+0x570/0xafc kernel/printk/printk.c:3049
console_unlock+0xfc/0x3d4 kernel/printk/printk.c:3118
vprintk_emit+0x224/0x3a4 kernel/printk/printk.c:2348
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2363
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2373
register_console+0x6e8/0xa74 kernel/printk/printk.c:3654
uart_configure_port drivers/tty/serial/serial_core.c:2672 [inline]
serial_core_add_one_port drivers/tty/serial/serial_core.c:3200 [inline]
serial_core_register_port+0x1428/0x1bf4 drivers/tty/serial/serial_core.c:3437
serial_ctrl_register_port+0x28/0x38 drivers/tty/serial/serial_ctrl.c:41
uart_add_one_port+0x28/0x38 drivers/tty/serial/serial_port.c:143
really_probe+0x38c/0x8fc drivers/base/dd.c:657
__driver_probe_device+0x194/0x374 drivers/base/dd.c:799
driver_probe_device+0x78/0x330 drivers/base/dd.c:829
__device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:957
bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
__device_attach+0x2b4/0x434 drivers/base/dd.c:1029
device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
bus_probe_device+0x178/0x240 drivers/base/bus.c:532
device_add+0x728/0xa6c drivers/base/core.c:3682
platform_device_add+0x3e8/0x6e8 drivers/base/platform.c:716
platform_device_register_full+0x4f0/0x608 drivers/base/platform.c:844
acpi_create_platform_device+0x5bc/0x744 drivers/acpi/acpi_platform.c:177
acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2193
acpi_bus_attach+0x804/0xad4 drivers/acpi/scan.c:2304
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1145
device_for_each_child+0xec/0x174 drivers/base/core.c:4011
acpi_dev_for_each_child+0xc4/0x108 drivers/acpi/bus.c:1157
acpi_bus_attach+0x868/0xad4 drivers/acpi/scan.c:2309
acpi_bus_scan+0x118/0x4f0 drivers/acpi/scan.c:2590
acpi_scan_init+0x214/0x6b0 drivers/acpi/scan.c:2727
acpi_init+0x190/0x254 drivers/acpi/bus.c:1462
do_one_initcall+0x24c/0x9c0 init/main.c:1267
-> #0 (console_owner){....}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x33d8/0x779c kernel/locking/lockdep.c:5142
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1873
console_emit_next_record kernel/printk/printk.c:2977 [inline]
console_flush_all+0x53c/0xafc kernel/printk/printk.c:3049
console_unlock+0xfc/0x3d4 kernel/printk/printk.c:3118
vprintk_emit+0x224/0x3a4 kernel/printk/printk.c:2348
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2363
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2373
__warn_printk+0x27c/0x484 kernel/panic.c:785
check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
start_flush_work kernel/workqueue.c:4139 [inline]
__flush_work+0x21c/0x954 kernel/workqueue.c:4176
flush_work kernel/workqueue.c:4233 [inline]
flush_delayed_work+0xcc/0xf8 kernel/workqueue.c:4255
hfs_file_fsync+0xec/0x148 fs/hfs/inode.c:681
vfs_fsync_range+0x168/0x188 fs/sync.c:188
generic_write_sync include/linux/fs.h:2822 [inline]
dio_complete+0x4f0/0x65c fs/direct-io.c:314
dio_aio_complete_work+0x28/0x38 fs/direct-io.c:326
process_one_work+0x79c/0x15b8 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x978/0xec4 kernel/workqueue.c:3389
kthread+0x288/0x310 kernel/kthread.c:389
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Chain exists of:
console_owner --> &dev->power.lock --> &pool->lock
lock(&pool->lock);
lock(&dev->power.lock);
lock(&pool->lock);
lock(console_owner);

*** DEADLOCK ***

7 locks held by kworker/0:2/5992:
#0: ffff0000cc19e148 ((wq_completion)dio/loop0){+.+.}-{0:0}, at: process_one_work+0x624/0x15b8 kernel/workqueue.c:3205
#1: ffff8000a2e57c20 ((work_completion)(&dio->complete_work)){+.+.}-{0:0}, at: process_one_work+0x6a0/0x15b8 kernel/workqueue.c:3205
#2: ffff0000c5989620 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:800 [inline]
#2: ffff0000c5989620 (&sb->s_type->i_mutex_key#16){+.+.}-{3:3}, at: hfs_file_fsync+0xa0/0x148 fs/hfs/inode.c:674
#3: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325
#4: ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: start_flush_work kernel/workqueue.c:4125 [inline]
#4: ffff0001b36ade18 (&pool->lock){-.-.}-{2:2}, at: __flush_work+0x178/0x954 kernel/workqueue.c:4176
#5: ffff80008f62b000 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x208/0x3a4 kernel/printk/printk.c:2347
#6: ffff80008f62ac30 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire+0x10/0x4c include/linux/rcupdate.h:330

stack backtrace:
CPU: 0 UID: 0 PID: 5992 Comm: kworker/0:2 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: dio/loop0 dio_aio_complete_work
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
dump_stack+0x1c/0x28 lib/dump_stack.c:128
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2059
check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x33d8/0x779c kernel/locking/lockdep.c:5142
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1873
console_emit_next_record kernel/printk/printk.c:2977 [inline]
console_flush_all+0x53c/0xafc kernel/printk/printk.c:3049
console_unlock+0xfc/0x3d4 kernel/printk/printk.c:3118
vprintk_emit+0x224/0x3a4 kernel/printk/printk.c:2348
vprintk_default+0xa0/0xe4 kernel/printk/printk.c:2363
vprintk+0x200/0x2d4 kernel/printk/printk_safe.c:45
_printk+0xdc/0x128 kernel/printk/printk.c:2373
__warn_printk+0x27c/0x484 kernel/panic.c:785
check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
start_flush_work kernel/workqueue.c:4139 [inline]
__flush_work+0x21c/0x954 kernel/workqueue.c:4176
flush_work kernel/workqueue.c:4233 [inline]
flush_delayed_work+0xcc/0xf8 kernel/workqueue.c:4255
hfs_file_fsync+0xec/0x148 fs/hfs/inode.c:681
vfs_fsync_range+0x168/0x188 fs/sync.c:188
generic_write_sync include/linux/fs.h:2822 [inline]
dio_complete+0x4f0/0x65c fs/direct-io.c:314
dio_aio_complete_work+0x28/0x38 fs/direct-io.c:326
process_one_work+0x79c/0x15b8 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x978/0xec4 kernel/workqueue.c:3389
kthread+0x288/0x310 kernel/kthread.c:389
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
workqueue: WQ_MEM_RECLAIM dio/loop0:dio_aio_complete_work is flushing !WQ_MEM_RECLAIM events_long:flush_mdb
WARNING: CPU: 0 PID: 5992 at kernel/workqueue.c:3706 check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
Modules linked in:
CPU: 0 UID: 0 PID: 5992 Comm: kworker/0:2 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: dio/loop0 dio_aio_complete_work
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
lr : check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
sp : ffff8000a2e57790
x29: ffff8000a2e57790 x28: 0000000000000000 x27: 1fffe0001858492b
x26: 0000000000000000 x25: ffff8000927b6000 x24: ffff0000cc19e000
x23: dfff800000000000 x22: ffff0000d12a2e18 x21: ffff0000cc19e170
x20: ffff800081211778 x19: ffff0000c0029000 x18: 0000000000000008
x17: 0000000000000000 x16: ffff800083032784 x15: 0000000000000001
x14: 1fffe000366d325a x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000003 x10: 0000000000ff0100 x9 : 9770cdebfc84a400
x8 : 9770cdebfc84a400 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000a2e56ed8 x4 : ffff80008f65b620 x3 : ffff8000806051a0
x2 : 0000000000000001 x1 : 0000000100000001 x0 : 0000000000000000
Call trace:
check_flush_dependency+0x27c/0x330 kernel/workqueue.c:3702
start_flush_work kernel/workqueue.c:4139 [inline]
__flush_work+0x21c/0x954 kernel/workqueue.c:4176
flush_work kernel/workqueue.c:4233 [inline]
flush_delayed_work+0xcc/0xf8 kernel/workqueue.c:4255
hfs_file_fsync+0xec/0x148 fs/hfs/inode.c:681
vfs_fsync_range+0x168/0x188 fs/sync.c:188
generic_write_sync include/linux/fs.h:2822 [inline]
dio_complete+0x4f0/0x65c fs/direct-io.c:314
dio_aio_complete_work+0x28/0x38 fs/direct-io.c:326
process_one_work+0x79c/0x15b8 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x978/0xec4 kernel/workqueue.c:3389
kthread+0x288/0x310 kernel/kthread.c:389
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 73714
hardirqs last enabled at (73713): [<ffff80008b3388f8>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
hardirqs last enabled at (73713): [<ffff80008b3388f8>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
hardirqs last disabled at (73714): [<ffff80008b42e1b4>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline]
hardirqs last disabled at (73714): [<ffff80008b42e1b4>] _raw_spin_lock_irq+0x28/0x70 kernel/locking/spinlock.c:170
softirqs last enabled at (73712): [<ffff8000801f8e88>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last enabled at (73712): [<ffff8000801f8e88>] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582
softirqs last disabled at (73693): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

syzbot has bisected this issue to:

commit bc0d90ee021f1baecd6aaa010d787eb373aa74dd
Author: Parav Pandit <[email protected]>
Date: Tue Jan 5 10:32:02 2021 +0000

vdpa: Enable user to query vdpa device info

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1440c2b0580000
start commit: 619f0b6fad52 Merge tag 'seccomp-v6.13-rc8' of git://git.ke..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=1640c2b0580000
console output: https://syzkaller.appspot.com/x/log.txt?x=1240c2b0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d1cb4a1f148c0861
dashboard link: https://syzkaller.appspot.com/bug?extid=622acb507894a48b2ce9
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=175029df980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f29a18580000

Reported-by: [email protected]
Fixes: bc0d90ee021f ("vdpa: Enable user to query vdpa device info")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

syzbot got this somehow wrong, it started with the lockdep bug but then
switched to a different
| crash: BUG: unable to handle kernel paging request in bpf_trace_run3
so the bisecting session yielded (I believe) random commit, didn't it?

(The lockdep appears valid, with PSI enabled and the fault injection at
unfortunate place (with BPF'd tracepoint).)

Michal

On Thu, 03 Oct 2024 13:37:23 -0700
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f0f580580000

#syz test upstream master

--- x/kernel/workqueue.c
+++ y/kernel/workqueue.c
@@ -7815,7 +7815,7 @@ void __init workqueue_init_early(void)

system_wq = alloc_workqueue("events", 0, 0);
system_highpri_wq = alloc_workqueue("events_highpri", WQ_HIGHPRI, 0);
- system_long_wq = alloc_workqueue("events_long", 0, 0);
+ system_long_wq = alloc_workqueue("events_long", WQ_MEM_RECLAIM, 0);
system_unbound_wq = alloc_workqueue("events_unbound", WQ_UNBOUND,
WQ_MAX_ACTIVE);
system_freezable_wq = alloc_workqueue("events_freezable",
--

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in console_lock_spinning_enable

FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 1
6.13.0-syzkaller-gc4b9570cfb63-dirty #0 Not tainted
------------------------------------------------------
syz.1.427/7673 is trying to acquire lock:
ffffffff8e0cb740 (console_owner){-...}-{0:0}, at: console_lock_spinning_enable+0x9f/0xd0 kernel/printk/printk.c:1924
ffff8880b863ec18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598
-> #4 (&rq->__lock){-.-.}-{2:2}:
_raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598
raw_spin_rq_lock kernel/sched/sched.h:1519 [inline]
task_rq_lock+0xcf/0x3b0 kernel/sched/core.c:700
cgroup_move_task+0x82/0x250 kernel/sched/psi.c:1161
css_set_move_task+0x288/0x5f0 kernel/cgroup/cgroup.c:898
cgroup_post_fork+0x1c6/0x910 kernel/cgroup/cgroup.c:6691
copy_process+0x5034/0x8d10 kernel/fork.c:2617
kernel_clone+0xfd/0x960 kernel/fork.c:2803
user_mode_thread+0xb4/0xf0 kernel/fork.c:2881
rest_init+0x23/0x2b0 init/main.c:712
start_kernel+0x3e9/0x4d0 init/main.c:1103
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148

-> #3 (&p->pi_lock){-.-.}-{2:2}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]
try_to_wake_up+0xb6/0x1490 kernel/sched/core.c:4209
__wake_up_common+0x131/0x1e0 kernel/sched/wait.c:89
__wake_up_common_lock kernel/sched/wait.c:106 [inline]
__wake_up+0x31/0x60 kernel/sched/wait.c:127
tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq+0x74d/0xc80 drivers/tty/serial/8250/8250_port.c:1949
serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1969
serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
variable_ffs arch/x86/include/asm/bitops.h:321 [inline]
handle_softirqs+0x1da/0x8f0 kernel/softirq.c:549
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline]
acpi_safe_halt+0x1a/0x20 drivers/acpi/processor_idle.c:111
acpi_idle_enter+0xc5/0x160 drivers/acpi/processor_idle.c:699
cpuidle_enter_state+0xaa/0x4f0 drivers/cpuidle/cpuidle.c:268
cpuidle_enter+0x4e/0xa0 drivers/cpuidle/cpuidle.c:389
cpuidle_idle_call kernel/sched/idle.c:230 [inline]
do_idle+0x310/0x3f0 kernel/sched/idle.c:325
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
start_secondary+0x222/0x2b0 arch/x86/kernel/smpboot.c:315
common_startup_64+0x13e/0x148

-> #2 (&tty->write_wait){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
__wake_up_common_lock kernel/sched/wait.c:105 [inline]
__wake_up+0x1c/0x60 kernel/sched/wait.c:127
tty_port_default_wakeup+0x2a/0x40 drivers/tty/tty_port.c:69
serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq+0x74d/0xc80 drivers/tty/serial/8250/8250_port.c:1949
serial8250_default_handle_irq+0x9a/0x210 drivers/tty/serial/8250/8250_port.c:1969
serial8250_interrupt+0x103/0x210 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
variable_ffs arch/x86/include/asm/bitops.h:321 [inline]
handle_softirqs+0x1da/0x8f0 kernel/softirq.c:549
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:786 [inline]
uart_write+0x2a4/0xb30 drivers/tty/serial/serial_core.c:636
process_output_block drivers/tty/n_tty.c:574 [inline]
n_tty_write+0x419/0x1140 drivers/tty/n_tty.c:2389
iterate_tty_write drivers/tty/tty_io.c:1015 [inline]
file_tty_write.constprop.0+0x506/0x9a0 drivers/tty/tty_io.c:1090
tty_write drivers/tty/tty_io.c:1111 [inline]
redirected_tty_write drivers/tty/tty_io.c:1134 [inline]
redirected_tty_write+0xcc/0x140 drivers/tty/tty_io.c:1114
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0x5ae/0x1150 fs/read_write.c:679
ksys_write+0x12b/0x250 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&port_lock_key){-.-.}-{3:3}:
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
uart_port_lock_irqsave include/linux/serial_core.h:715 [inline]
serial8250_console_write+0xb56/0x17c0 drivers/tty/serial/8250/8250_port.c:3372
console_emit_next_record kernel/printk/printk.c:3122 [inline]
console_flush_all+0x803/0xc60 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
_printk+0xc8/0x100 kernel/printk/printk.c:2457
register_console+0xbfd/0x1170 kernel/printk/printk.c:4099
univ8250_console_init+0x5f/0x90 drivers/tty/serial/8250/8250_core.c:513
console_init+0x154/0x690 kernel/printk/printk.c:4292
start_kernel+0x29f/0x4d0 init/main.c:1038
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0xb2/0xc0 arch/x86/kernel/head64.c:488
common_startup_64+0x13e/0x148

-> #0 (console_owner){-...}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain kernel/locking/lockdep.c:3906 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
console_lock_spinning_enable+0xb0/0xd0 kernel/printk/printk.c:1924
console_emit_next_record kernel/printk/printk.c:3116 [inline]
console_flush_all+0x7ac/0xc60 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
_printk+0xc8/0x100 kernel/printk/printk.c:2457
fail_dump lib/fault-inject.c:46 [inline]
should_fail_ex+0x46c/0x5b0 lib/fault-inject.c:154
__copy_to_user_inatomic include/linux/uaccess.h:132 [inline]
copy_to_user_nofault+0xac/0x180 mm/maccess.c:156
____bpf_probe_write_user kernel/trace/bpf_trace.c:348 [inline]
bpf_probe_write_user+0xaf/0xf0 kernel/trace/bpf_trace.c:326
bpf_prog_6303d92f98284ad8+0x44/0x48
bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]
bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2406
__bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
__traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x180b/0x5b60 kernel/sched/core.c:6757
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7082
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
arch_local_irq_restore arch/x86/include/asm/irqflags.h:154 [inline]
lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5854
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
__fget_files+0x46/0x3a0 fs/file.c:1049
__fget_light fs/file.c:1152 [inline]
fdget fs/file.c:1160 [inline]
fdget_pos+0x2fc/0x390 fs/file.c:1187
class_fd_pos_constructor include/linux/file.h:85 [inline]
ksys_write+0x72/0x250 fs/read_write.c:722
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
console_owner --> &p->pi_lock --> &rq->__lock
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock(console_owner);

*** DEADLOCK ***

5 locks held by syz.1.427/7673:
#0: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: __fget_files+0x40/0x3a0 fs/file.c:1049
#1: ffff8880b863ec18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2362 [inline]
#2: ffffffff8e1be440 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run4+0x1d6/0x5a0 kernel/trace/bpf_trace.c:2406
#3: ffffffff8e1abb80 (console_lock){+.+.}-{0:0}, at: _printk+0xc8/0x100 kernel/printk/printk.c:2457
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:342 [inline]
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:304 [inline]
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:288 [inline]
#4: ffffffff8e1abbf0 (console_srcu){....}-{0:0}, at: console_flush_all+0x159/0xc60 kernel/printk/printk.c:3187

stack backtrace:
CPU: 0 UID: 0 PID: 7673 Comm: syz.1.427 Not tainted 6.13.0-syzkaller-gc4b9570cfb63-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain kernel/locking/lockdep.c:3906 [inline]
__lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
console_lock_spinning_enable+0xb0/0xd0 kernel/printk/printk.c:1924
console_emit_next_record kernel/printk/printk.c:3116 [inline]
console_flush_all+0x7ac/0xc60 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
_printk+0xc8/0x100 kernel/printk/printk.c:2457
fail_dump lib/fault-inject.c:46 [inline]
should_fail_ex+0x46c/0x5b0 lib/fault-inject.c:154
__copy_to_user_inatomic include/linux/uaccess.h:132 [inline]
copy_to_user_nofault+0xac/0x180 mm/maccess.c:156
____bpf_probe_write_user kernel/trace/bpf_trace.c:348 [inline]
bpf_probe_write_user+0xaf/0xf0 kernel/trace/bpf_trace.c:326
bpf_prog_6303d92f98284ad8+0x44/0x48
bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]
bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2406
__bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
__traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x180b/0x5b60 kernel/sched/core.c:6757
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7082
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5816
Code: b8 ff ff ff ff 65 0f c1 05 00 a8 8b 7e 83 f8 01 0f 85 d0 01 00 00 9c 58 f6 c4 02 0f 85 e5 01 00 00 48 85 ed 0f 85 b6 01 00 00 <48> b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 00 00 00 48 c7
RSP: 0018:ffffc900046c7d28 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 1ffff920008d8fa6 RCX: 00000000d439196c
RDX: 0000000000000001 RSI: ffffffff8b6cdcc0 RDI: ffffffff8bd2c740
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2dd0d98
R10: ffffffff96e86cc7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e1be440 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
__fget_files+0x46/0x3a0 fs/file.c:1049
__fget_light fs/file.c:1152 [inline]
fdget fs/file.c:1160 [inline]
fdget_pos+0x2fc/0x390 fs/file.c:1187
class_fd_pos_constructor include/linux/file.h:85 [inline]
ksys_write+0x72/0x250 fs/read_write.c:722
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f751a1847df
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f751b083030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f751a1847df
RDX: 0000000000000001 RSI: 00007f751b0830a0 RDI: 0000000000000005
RBP: 00007f751b083090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 0000000000000000 R14: 00007f751a375fa0 R15: 00007fff4f6d3d38
</TASK>
CPU: 0 UID: 0 PID: 7673 Comm: syz.1.427 Not tainted 6.13.0-syzkaller-gc4b9570cfb63-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
fail_dump lib/fault-inject.c:53 [inline]
should_fail_ex+0x497/0x5b0 lib/fault-inject.c:154
__copy_to_user_inatomic include/linux/uaccess.h:132 [inline]
copy_to_user_nofault+0xac/0x180 mm/maccess.c:156
____bpf_probe_write_user kernel/trace/bpf_trace.c:348 [inline]
bpf_probe_write_user+0xaf/0xf0 kernel/trace/bpf_trace.c:326
bpf_prog_6303d92f98284ad8+0x44/0x48
bpf_dispatcher_nop_func include/linux/bpf.h:1290 [inline]
__bpf_prog_run include/linux/filter.h:701 [inline]
bpf_prog_run include/linux/filter.h:708 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]
bpf_trace_run4+0x245/0x5a0 kernel/trace/bpf_trace.c:2406
__bpf_trace_sched_switch+0x13e/0x190 include/trace/events/sched.h:222
__traceiter_sched_switch+0x6c/0xc0 include/trace/events/sched.h:222
trace_sched_switch include/trace/events/sched.h:222 [inline]
__schedule+0x180b/0x5b60 kernel/sched/core.c:6757
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7082
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5816
Code: b8 ff ff ff ff 65 0f c1 05 00 a8 8b 7e 83 f8 01 0f 85 d0 01 00 00 9c 58 f6 c4 02 0f 85 e5 01 00 00 48 85 ed 0f 85 b6 01 00 00 <48> b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 00 00 00 48 c7
RSP: 0018:ffffc900046c7d28 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 1ffff920008d8fa6 RCX: 00000000d439196c
RDX: 0000000000000001 RSI: ffffffff8b6cdcc0 RDI: ffffffff8bd2c740
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2dd0d98
R10: ffffffff96e86cc7 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e1be440 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock include/linux/rcupdate.h:849 [inline]
__fget_files+0x46/0x3a0 fs/file.c:1049
__fget_light fs/file.c:1152 [inline]
fdget fs/file.c:1160 [inline]
fdget_pos+0x2fc/0x390 fs/file.c:1187
class_fd_pos_constructor include/linux/file.h:85 [inline]
ksys_write+0x72/0x250 fs/read_write.c:722
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f751a1847df
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f751b083030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f751a1847df
RDX: 0000000000000001 RSI: 00007f751b0830a0 RDI: 0000000000000005
RBP: 00007f751b083090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 0000000000000000 R14: 00007f751a375fa0 R15: 00007fff4f6d3d38
</TASK>
----------------
Code disassembly (best guess):
0: b8 ff ff ff ff mov $0xffffffff,%eax
5: 65 0f c1 05 00 a8 8b xadd %eax,%gs:0x7e8ba800(%rip) # 0x7e8ba80d
c: 7e
d: 83 f8 01 cmp $0x1,%eax
10: 0f 85 d0 01 00 00 jne 0x1e6
16: 9c pushf
17: 58 pop %rax
18: f6 c4 02 test $0x2,%ah
1b: 0f 85 e5 01 00 00 jne 0x206
21: 48 85 ed test %rbp,%rbp
24: 0f 85 b6 01 00 00 jne 0x1e0
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 48 01 c3 add %rax,%rbx
37: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
3e: 48 rex.W
3f: c7 .byte 0xc7


Tested on:

commit: c4b9570c Merge tag 'audit-pr-20250121' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=135a1824580000
kernel config: https://syzkaller.appspot.com/x/.config?x=899f38f532606c8e
dashboard link: https://syzkaller.appspot.com/bug?extid=622acb507894a48b2ce9
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1343c5df980000