TITLE: possible deadlock in vcs_read
TYPE: LOCKDEP

[   75.037355] ======================================================
[   75.037357] WARNING: possible circular locking dependency detected
[   75.037363] 4.15.0-rc2+ #216 Not tainted
[   75.037365] ------------------------------------------------------
[   75.037369] syz-executor7/8848 is trying to acquire lock:
[   75.037371]  (console_lock){+.+.}, at: [<000000001c8cd30e>] vcs_read+0x129/0xae0
[   75.037394] 
[   75.037394] but task is already holding lock:
[   75.037395]  (&pipe->mutex/1){+.+.}, at: [<00000000dd7fc330>] pipe_lock+0x56/0x70
[   75.037414] 
[   75.037414] which lock already depends on the new lock.
[   75.037414] 
[   75.037416] 
[   75.037416] the existing dependency chain (in reverse order) is:
[   75.037418] 
[   75.037418] -> #3 (&pipe->mutex/1){+.+.}:
[   75.037437]        lock_acquire+0x1d5/0x580
[   75.037447]        __mutex_lock+0x16f/0x1a80
[   75.037457]        mutex_lock_nested+0x16/0x20
[   75.037463]        pipe_lock+0x56/0x70
[   75.037473]        iter_file_splice_write+0x264/0xf30
[   75.037480]        SyS_splice+0x7d5/0x1630
[   75.037487]        entry_SYSCALL_64_fastpath+0x1f/0x96
[   75.037489] 
[   75.037489] -> #2 (sb_writers){.+.+}:
[   75.037502]        dput.part.23+0x492/0x830
[   75.037508]        dput+0x1f/0x30
[   75.037521]        done_path_create+0xad/0x110
[   75.037532]        handle_create+0x196/0x760
[   75.037542]        devtmpfsd+0x3b4/0x4b0
[   75.037544] 
[   75.037544] -> #1 ((completion)&req.done){+.+.}:
[   75.037559]        lock_acquire+0x1d5/0x580
[   75.037569]        wait_for_completion+0xcb/0x7b0
[   75.037580]        devtmpfs_create_node+0x32b/0x4a0
[   75.037589]        device_add+0x120f/0x1640
[   75.037597]        device_create_groups_vargs+0x1f3/0x250
[   75.037605]        device_create+0xda/0x110
[   75.037612]        vcs_make_sysfs+0x35/0x60
[   75.037621]        vc_allocate+0x4b7/0x6b0
[   75.037630]        con_install+0x52/0x440
[   75.037637]        tty_init_dev+0xf6/0x4a0
[   75.037651]        tty_open+0x608/0xab0
[   75.037662]        chrdev_open+0x257/0x730
[   75.037673]        do_dentry_open+0x682/0xd70
[   75.037682]        vfs_open+0x107/0x230
[   75.037690]        path_openat+0x1157/0x3530
[   75.037700]        do_filp_open+0x25b/0x3b0
[   75.037708]        do_sys_open+0x502/0x6d0
[   75.037716]        SyS_open+0x2d/0x40
[   75.037724]        entry_SYSCALL_64_fastpath+0x1f/0x96
[   75.037726] 
[   75.037726] -> #0 (console_lock){+.+.}:
[   75.037739]        __lock_acquire+0x3498/0x47f0
[   75.037746]        lock_acquire+0x1d5/0x580
[   75.037754]        console_lock+0x4b/0x80
[   75.037760]        vcs_read+0x129/0xae0
[   75.037768]        do_iter_read+0x3db/0x5b0
[   75.037773]        vfs_readv+0x121/0x1c0
[   75.037779]        default_file_splice_read+0x508/0xae0
[   75.037784]        do_splice_to+0x110/0x170
[   75.037790]        SyS_splice+0x11a8/0x1630
[   75.037796]        entry_SYSCALL_64_fastpath+0x1f/0x96
[   75.037798] 
[   75.037798] other info that might help us debug this:
[   75.037798] 
[   75.037800] Chain exists of:
[   75.037800]   console_lock --> sb_writers --> &pipe->mutex/1
[   75.037800] 
[   75.037809]  Possible unsafe locking scenario:
[   75.037809] 
[   75.037811]        CPU0                    CPU1
[   75.037812]        ----                    ----
[   75.037813]   lock(&pipe->mutex/1);
[   75.037818]                                lock(sb_writers);
[   75.037822]                                lock(&pipe->mutex/1);
[   75.037826]   lock(console_lock);
[   75.037829] 
[   75.037829]  *** DEADLOCK ***
[   75.037829] 
[   75.037832] 1 lock held by syz-executor7/8848:
[   75.037833]  #0:  (&pipe->mutex/1){+.+.}, at: [<00000000dd7fc330>] pipe_lock+0x56/0x70
[   75.037843] 
[   75.037843] stack backtrace:
[   75.037850] CPU: 0 PID: 8848 Comm: syz-executor7 Not tainted 4.15.0-rc2+ #216
[   75.037853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   75.037855] Call Trace:
[   75.037864]  dump_stack+0x194/0x257
[   75.037871]  ? arch_local_irq_restore+0x53/0x53
[   75.037883]  print_circular_bug+0x42d/0x610
[   75.037892]  ? save_stack_trace+0x1a/0x20
[   75.037901]  check_prev_add+0x666/0x15f0
[   75.037908]  ? copy_trace+0x150/0x150
[   75.037916]  ? check_usage+0xb60/0xb60
[   75.037922]  ? __save_stack_trace+0x61/0xd0
[   75.037933]  ? save_stack_trace+0x1a/0x20
[   75.037941]  __lock_acquire+0x3498/0x47f0
[   75.037948]  ? __lock_acquire+0x3498/0x47f0
[   75.037963]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   75.037970]  ? check_noncircular+0x20/0x20
[   75.037977]  ? perf_trace_lock+0xd6/0x900
[   75.037983]  ? __lock_is_held+0xbc/0x140
[   75.037992]  ? trace_event_raw_event_lock+0x340/0x340
[   75.038000]  ? check_noncircular+0x20/0x20
[   75.038007]  ? __lock_is_held+0xbc/0x140
[   75.038017]  ? check_noncircular+0x20/0x20
[   75.038025]  ? rcu_read_lock_sched_held+0x108/0x120
[   75.038033]  ? find_held_lock+0x39/0x1d0
[   75.038042]  ? print_usage_bug+0x3f0/0x3f0
[   75.038050]  ? lock_downgrade+0x980/0x980
[   75.038060]  lock_acquire+0x1d5/0x580
[   75.038066]  ? vcs_read+0x129/0xae0
[   75.038073]  ? lock_release+0xda0/0xda0
[   75.038080]  ? lock_release+0xda0/0xda0
[   75.038086]  ? mark_held_locks+0xb2/0x100
[   75.038093]  ? _raw_spin_unlock_irqrestore+0x31/0xba
[   75.038101]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   75.038107]  ? trace_hardirqs_on+0xd/0x10
[   75.038116]  console_lock+0x4b/0x80
[   75.038121]  ? vcs_read+0x129/0xae0
[   75.038126]  vcs_read+0x129/0xae0
[   75.038136]  ? fsnotify_first_mark+0x2b0/0x2b0
[   75.038145]  ? selinux_file_permission+0x82/0x460
[   75.038151]  ? vcs_poll+0x130/0x130
[   75.038157]  ? security_file_permission+0x89/0x1f0
[   75.038165]  ? rw_verify_area+0xe5/0x2b0
[   75.038174]  do_iter_read+0x3db/0x5b0
[   75.038182]  ? dup_iter+0x260/0x260
[   75.038192]  vfs_readv+0x121/0x1c0
[   75.038200]  ? compat_rw_copy_check_uvector+0x2e0/0x2e0
[   75.038206]  ? lock_acquire+0x1d5/0x580
[   75.038211]  ? pipe_lock+0x56/0x70
[   75.038219]  ? lock_release+0xda0/0xda0
[   75.038227]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   75.038235]  ? rcu_note_context_switch+0x710/0x710
[   75.038242]  ? __might_sleep+0x95/0x190
[   75.038247]  ? pipe_lock+0x56/0x70
[   75.038256]  ? __mutex_lock+0x16f/0x1a80
[   75.038260]  ? pipe_lock+0x56/0x70
[   75.038269]  default_file_splice_read+0x508/0xae0
[   75.038276]  ? default_file_splice_read+0x508/0xae0
[   75.038287]  ? do_splice_direct+0x3d0/0x3d0
[   75.038293]  ? __lock_is_held+0xbc/0x140
[   75.038306]  ? __lock_is_held+0xbc/0x140
[   75.038318]  ? _raw_spin_unlock+0x22/0x30
[   75.038325]  ? fsnotify+0x7b3/0x1140
[   75.038334]  ? fsnotify_first_mark+0x2b0/0x2b0
[   75.038343]  ? avc_policy_seqno+0x9/0x20
[   75.038348]  ? selinux_file_permission+0x82/0x460
[   75.038356]  ? security_file_permission+0x89/0x1f0
[   75.038364]  ? do_splice_direct+0x3d0/0x3d0
[   75.038370]  do_splice_to+0x110/0x170
[   75.038375]  ? do_splice_to+0x110/0x170
[   75.038383]  SyS_splice+0x11a8/0x1630
[   75.038395]  ? compat_SyS_vmsplice+0x250/0x250
[   75.038400]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   75.038410]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   75.038419]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   75.038424] RIP: 0033:0x452a39
[   75.038428] RSP: 002b:00007f2d70f0ac58 EFLAGS: 00000212 ORIG_RAX: 0000000000000113
[   75.038434] RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452a39
[   75.038437] RDX: 0000000000000018 RSI: 0000000000000000 RDI: 0000000000000016
[   75.038441] RBP: 0000000000000307 R08: 0000000000000058 R09: 0000000000000000
[   75.038444] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f2948
[   75.038448] R13: 00000000ffffffff R14: 00007f2d70f0b6d4 R15: 0000000000000000
