dump_stack_lvl+0x8b/0xb3
should_fail.cold+0x5/0xa
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
======================================================
WARNING: possible circular locking dependency detected
5.17.0-rc3-next-20220211 #1 Not tainted
------------------------------------------------------
syz-executor.7/12299 is trying to acquire lock:
ffffffff85114a20 (console_owner){-.-.}-{0:0}, at: vprintk_emit+0x29b/0x450
but task is already holding lock:
ffff888018689158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xea/0x1e0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&port->lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x39/0x50
tty_port_tty_get+0x1f/0x100
tty_port_default_wakeup+0x11/0x40
serial8250_tx_chars+0x50b/0xb00
serial8250_handle_irq.part.0+0x3f1/0x4c0
serial8250_default_handle_irq+0xb8/0x230
serial8250_interrupt+0xf4/0x1a0
__handle_irq_event_percpu+0x20f/0x820
handle_irq_event+0xa7/0x1e0
handle_edge_irq+0x262/0xd10
__common_interrupt+0x92/0x1d0
common_interrupt+0x9f/0xc0
asm_common_interrupt+0x1e/0x40
default_idle+0xb/0x10
default_idle_call+0x87/0xd0
do_idle+0x3b9/0x530
cpu_startup_entry+0x14/0x20
secondary_startup_64_no_verify+0xd5/0xdb
-> #1 (&port_lock_key){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x39/0x50
serial8250_console_write+0x90e/0xb20
console_unlock+0x756/0xae0
register_console+0x378/0x7d0
should_failslab+0x5/0x10
univ8250_console_init+0x3a/0x46
console_init+0x3c1/0x58d
kmem_cache_alloc+0x5b/0x480
start_kernel+0x301/0x4aa
secondary_startup_64_no_verify+0xd5/0xdb
-> #0
create_object.isra.0+0x3a/0xa20
(console_owner){-.-.}-{0:0}:
__lock_acquire+0x2c2f/0x6120
lock_acquire+0x1a2/0x4d0
vprintk_emit+0x2d8/0x450
kmem_cache_alloc_trace+0x22e/0x3c0
vprintk+0x80/0x90
_printk+0xba/0xed
copy_mount_options+0x55/0x180
should_fail+0x472/0x5a0
should_failslab+0x5/0x10
__kmalloc+0x72/0x440
__x64_sys_mount+0x1a8/0x300
tty_buffer_alloc+0x23f/0x2a0
__tty_buffer_request_room+0x156/0x2a0
tty_insert_flip_string_fixed_flag+0x91/0x240
pty_write+0x11c/0x1e0
n_tty_write+0x416/0xfe0
file_tty_write.constprop.0+0x529/0x910
new_sync_write+0x437/0x660
do_syscall_64+0x3b/0x90
vfs_write+0x7d1/0xae0
ksys_write+0x12d/0x250
entry_SYSCALL_64_after_hwframe+0x44/0xae
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f78070b9b19
other info that might help us debug this:
Chain exists of:
console_owner --> &port_lock_key --> &port->lock
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&port->lock);
lock(
RSP: 002b:00007f780462f188 EFLAGS: 00000246
&port_lock_key);
lock(&port->lock);
lock(console_owner
ORIG_RAX: 00000000000000a5
);
*** DEADLOCK ***
5 locks held by syz-executor.7/12299:
RAX: ffffffffffffffda RBX: 00007f78071ccf60 RCX: 00007f78070b9b19
#0: ffff88800c5fb098 (&tty->ldisc_sem){++++}-{0:0}
RDX: 00000000200025c0 RSI: 0000000020000240 RDI: 0000000000000000
, at: tty_ldisc_ref_wait+0x22/0x80
RBP: 00007f780462f1d0 R08: 0000000020000140 R09: 0000000000000000
#1: ffff88800c5fb130 (&tty->atomic_write_lock){+.+.}-{3:3}
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
, at: file_tty_write.constprop.0+0x29f/0x910
R13: 00007ffed5a07bbf R14: 00007f780462f300 R15: 0000000000022000
#2: ffff88800c5fb2e8 (&o_tty->termios_rwsem/1
){++++}-{3:3}, at: n_tty_write+0x1bf/0xfe0
#3: ffffc9000074d378 (&ldata->output_lock){+.+.}-{3:3}, at: n_tty_write+0x542/0xfe0
#4: ffff888018689158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xea/0x1e0
stack backtrace:
CPU: 1 PID: 12299 Comm: syz-executor.7 Not tainted 5.17.0-rc3-next-20220211 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
check_noncircular+0x25f/0x2e0
__lock_acquire+0x2c2f/0x6120
lock_acquire+0x1a2/0x4d0
vprintk_emit+0x2d8/0x450
vprintk+0x80/0x90
_printk+0xba/0xed
should_fail+0x472/0x5a0
should_failslab+0x5/0x10
__kmalloc+0x72/0x440
tty_buffer_alloc+0x23f/0x2a0
__tty_buffer_request_room+0x156/0x2a0
tty_insert_flip_string_fixed_flag+0x91/0x240
pty_write+0x11c/0x1e0
n_tty_write+0x416/0xfe0
file_tty_write.constprop.0+0x529/0x910
new_sync_write+0x437/0x660
vfs_write+0x7d1/0xae0
ksys_write+0x12d/0x250
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fc1124e8b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc10fa5e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fc1125fbf60 RCX: 00007fc1124e8b19
RDX: 00000000000000ac RSI: 00000000200000c0 RDI: 0000000000000004
RBP: 00007fc10fa5e1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd023640ef R14: 00007fc10fa5e300 R15: 0000000000022000
CPU: 1 PID: 12299 Comm: syz-executor.7 Not tainted 5.17.0-rc3-next-20220211 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
should_fail.cold+0x5/0xa
should_failslab+0x5/0x10
__kmalloc+0x72/0x440
tty_buffer_alloc+0x23f/0x2a0
__tty_buffer_request_room+0x156/0x2a0
tty_insert_flip_string_fixed_flag+0x91/0x240
pty_write+0x11c/0x1e0
n_tty_write+0x416/0xfe0
file_tty_write.constprop.0+0x529/0x910
new_sync_write+0x437/0x660
vfs_write+0x7d1/0xae0
ksys_write+0x12d/0x250
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fc1124e8b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc10fa5e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fc1125fbf60 RCX: 00007fc1124e8b19
RDX: 00000000000000ac RSI: 00000000200000c0 RDI: 0000000000000004
RBP: 00007fc10fa5e1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd023640ef R14: 00007fc10fa5e300 R15: 0000000000022000
audit: type=1326 audit(1644698590.802:170): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12305 comm="syz-executor.3" exe="/syz-executor.3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb4f2efdb19 code=0x0
Process accounting paused
audit: type=1326 audit(1644698590.812:171): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12306 comm="syz-executor.2" exe="/syz-executor.2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f46660a7b19 code=0x0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: ff c3 inc %ebx
2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
9: 00 00 00
c: 0f 1f 40 00 nopl 0x0(%rax)
10: 48 89 f8 mov %rdi,%rax
13: 48 89 f7 mov %rsi,%rdi
16: 48 89 d6 mov %rdx,%rsi
19: 48 89 ca mov %rcx,%rdx
1c: 4d 89 c2 mov %r8,%r10
1f: 4d 89 c8 mov %r9,%r8
22: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
27: 0f 05 syscall
* 29: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
2f: 73 01 jae 0x32
31: c3 retq
32: 48 c7 c1 bc ff ff ff mov $0xffffffffffffffbc,%rcx
39: f7 d8 neg %eax
3b: 64 89 01 mov %eax,%fs:(%rcx)
3e: 48 rex.W