====================================================== WARNING: possible circular locking dependency detected 5.10.149 #1 Not tainted ------------------------------------------------------ syz-executor.3/99415 is trying to acquire lock: ffff888047d15578 (&tty->read_wait){....}-{2:2}, at: __wake_up_common_lock+0xb4/0x140 kernel/sched/wait.c:122 but task is already holding lock: ffff888047d143b8 (&tty->ctrl_lock){....}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:379 [inline] ffff888047d143b8 (&tty->ctrl_lock){....}-{2:2}, at: pty_flush_buffer+0xaf/0x160 drivers/tty/pty.c:223 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&tty->ctrl_lock){....}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x36/0x60 kernel/locking/spinlock.c:159 __proc_set_tty+0x2c/0x620 drivers/tty/tty_jobctrl.c:98 proc_set_tty drivers/tty/tty_jobctrl.c:121 [inline] tiocsctty drivers/tty/tty_jobctrl.c:387 [inline] tty_jobctrl_ioctl+0x582/0xe20 drivers/tty/tty_jobctrl.c:564 tty_ioctl+0x1365/0x1840 drivers/tty/tty_io.c:2737 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 -> #1 (&sighand->siglock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x36/0x60 kernel/locking/spinlock.c:159 __lock_task_sighand+0xd3/0x2f0 kernel/signal.c:1391 lock_task_sighand include/linux/sched/signal.h:693 [inline] task_work_add+0x1df/0x2b0 kernel/task_work.c:58 io_req_task_work_add fs/io_uring.c:2069 [inline] __io_async_wake+0x40b/0x8d0 fs/io_uring.c:4949 __wake_up_common+0x14c/0x4c0 kernel/sched/wait.c:93 __wake_up_common_lock+0xd0/0x140 kernel/sched/wait.c:123 tty_ldisc_lock+0x40/0xb0 drivers/tty/tty_ldisc.c:335 tty_ldisc_hangup+0x204/0x690 drivers/tty/tty_ldisc.c:744 __tty_hangup.part.0+0x510/0x9b0 drivers/tty/tty_io.c:624 __tty_hangup drivers/tty/tty_io.c:574 [inline] tty_vhangup drivers/tty/tty_io.c:697 [inline] tty_ioctl+0x1212/0x1840 drivers/tty/tty_io.c:2683 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 -> #0 (&tty->read_wait){....}-{2:2}: check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain kernel/locking/lockdep.c:3728 [inline] __lock_acquire+0x29e7/0x5b00 kernel/locking/lockdep.c:4954 lock_acquire kernel/locking/lockdep.c:5565 [inline] lock_acquire+0x197/0x490 kernel/locking/lockdep.c:5530 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x36/0x60 kernel/locking/spinlock.c:159 __wake_up_common_lock+0xb4/0x140 kernel/sched/wait.c:122 pty_flush_buffer+0x124/0x160 drivers/tty/pty.c:225 tty_driver_flush_buffer+0x60/0x80 drivers/tty/tty_ioctl.c:95 tty_ldisc_hangup+0xdb/0x690 drivers/tty/tty_ldisc.c:726 __tty_hangup.part.0+0x510/0x9b0 drivers/tty/tty_io.c:624 __tty_hangup drivers/tty/tty_io.c:574 [inline] tty_vhangup drivers/tty/tty_io.c:697 [inline] tty_ioctl+0x1212/0x1840 drivers/tty/tty_io.c:2683 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 other info that might help us debug this: Chain exists of: &tty->read_wait --> &sighand->siglock --> &tty->ctrl_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&tty->ctrl_lock); lock(&sighand->siglock); lock(&tty->ctrl_lock); lock(&tty->read_wait); *** DEADLOCK *** 3 locks held by syz-executor.3/99415: #0: ffff888047d141c0 (&tty->legacy_mutex/1){+.+.}-{3:3}, at: tty_lock+0xbd/0x120 drivers/tty/tty_mutex.c:19 #1: ffff888047d14098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref drivers/tty/tty_ldisc.c:287 [inline] #1: ffff888047d14098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_hangup+0x2c/0x690 drivers/tty/tty_ldisc.c:722 #2: ffff888047d143b8 (&tty->ctrl_lock){....}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:379 [inline] #2: ffff888047d143b8 (&tty->ctrl_lock){....}-{2:2}, at: pty_flush_buffer+0xaf/0x160 drivers/tty/pty.c:223 stack backtrace: CPU: 1 PID: 99415 Comm: syz-executor.3 Not tainted 5.10.149 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 check_noncircular+0x263/0x2e0 kernel/locking/lockdep.c:2123 check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain kernel/locking/lockdep.c:3728 [inline] __lock_acquire+0x29e7/0x5b00 kernel/locking/lockdep.c:4954 lock_acquire kernel/locking/lockdep.c:5565 [inline] lock_acquire+0x197/0x490 kernel/locking/lockdep.c:5530 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x36/0x60 kernel/locking/spinlock.c:159 __wake_up_common_lock+0xb4/0x140 kernel/sched/wait.c:122 pty_flush_buffer+0x124/0x160 drivers/tty/pty.c:225 tty_driver_flush_buffer+0x60/0x80 drivers/tty/tty_ioctl.c:95 tty_ldisc_hangup+0xdb/0x690 drivers/tty/tty_ldisc.c:726 __tty_hangup.part.0+0x510/0x9b0 drivers/tty/tty_io.c:624 __tty_hangup drivers/tty/tty_io.c:574 [inline] tty_vhangup drivers/tty/tty_io.c:697 [inline] tty_ioctl+0x1212/0x1840 drivers/tty/tty_io.c:2683 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 RIP: 0033:0x7f0ce3051b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0ce05c7188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f0ce3164f60 RCX: 00007f0ce3051b19 RDX: 0000000000000000 RSI: 0000000000005437 RDI: 0000000000000005 RBP: 00007f0ce30abf6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff51fdb00f R14: 00007f0ce05c7300 R15: 0000000000022000 platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures Module has invalid ELF structures