program: r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) fcntl$setstatus(r0, 0x4, 0x800) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000000)={0x3}, 0x2) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}, 0xa) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="04060300c800"], 0x6) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="04080400c80001"], 0x7) [ 94.516495][ T5278] Bluetooth: hci0: command tx timeout [ 94.761072][ T5278] [ 94.762245][ T5278] ====================================================== [ 94.765379][ T5278] WARNING: possible circular locking dependency detected [ 94.768476][ T5278] syzkaller #0 Not tainted [ 94.770407][ T5278] ------------------------------------------------------ [ 94.773354][ T5278] kworker/u5:2/5278 is trying to acquire lock: [ 94.775764][ T5278] ffffffff904024e0 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_security_cfm+0x90/0x820 [ 94.779614][ T5278] [ 94.779614][ T5278] but task is already holding lock: [ 94.782587][ T5278] ffffffff903de1c0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_encrypt_cfm+0x313/0x500 [ 94.786401][ T5278] [ 94.786401][ T5278] which lock already depends on the new lock. [ 94.786401][ T5278] [ 94.790592][ T5278] [ 94.790592][ T5278] the existing dependency chain (in reverse order) is: [ 94.794495][ T5278] [ 94.794495][ T5278] -> #2 (hci_cb_list_lock){+.+.}-{4:4}: [ 94.797988][ T5278] __mutex_lock+0x19d/0x1550 [ 94.800127][ T5278] hci_remote_features_evt+0x53d/0x950 [ 94.802561][ T5278] hci_event_packet+0x6cd/0xf10 [ 94.804839][ T5278] hci_rx_work+0x3ee/0x1020 [ 94.806965][ T5278] process_scheduled_works+0xc3d/0x1630 [ 94.809612][ T5278] worker_thread+0xa47/0xfb0 [ 94.811773][ T5278] kthread+0x38b/0x480 [ 94.813840][ T5278] ret_from_fork+0x514/0xb70 [ 94.815998][ T5278] ret_from_fork_asm+0x1a/0x30 [ 94.818192][ T5278] [ 94.818192][ T5278] -> #1 (&hdev->lock){+.+.}-{4:4}: [ 94.821347][ T5278] __mutex_lock+0x19d/0x1550 [ 94.823710][ T5278] l2cap_chan_connect+0x9c/0x1110 [ 94.826132][ T5278] l2cap_sock_connect+0x5e4/0x7e0 [ 94.828520][ T5278] kernel_connect+0x141/0x1c0 [ 94.830753][ T5278] rfcomm_dlc_open+0x644/0x1080 [ 94.833683][ T5278] rfcomm_sock_connect+0x2ed/0x650 [ 94.836019][ T5278] __sys_connect+0x316/0x450 [ 94.838134][ T5278] __x64_sys_connect+0x7a/0x90 [ 94.840497][ T5278] do_syscall_64+0x166/0x520 [ 94.842813][ T5278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.845653][ T5278] [ 94.845653][ T5278] -> #0 (rfcomm_mutex){+.+.}-{4:4}: [ 94.848734][ T5278] __lock_acquire+0x164c/0x2de0 [ 94.851051][ T5278] lock_acquire+0x115/0x350 [ 94.853156][ T5278] __mutex_lock+0x19d/0x1550 [ 94.855348][ T5278] rfcomm_security_cfm+0x90/0x820 [ 94.857680][ T5278] hci_encrypt_cfm+0x37e/0x500 [ 94.859978][ T5278] hci_encrypt_change_evt+0x6e6/0xcf0 [ 94.862438][ T5278] hci_event_packet+0x6cd/0xf10 [ 94.864719][ T5278] hci_rx_work+0x3ee/0x1020 [ 94.866770][ T5278] process_scheduled_works+0xc3d/0x1630 [ 94.869388][ T5278] worker_thread+0xa47/0xfb0 [ 94.871615][ T5278] kthread+0x38b/0x480 [ 94.873644][ T5278] ret_from_fork+0x514/0xb70 [ 94.875824][ T5278] ret_from_fork_asm+0x1a/0x30 [ 94.878110][ T5278] [ 94.878110][ T5278] other info that might help us debug this: [ 94.878110][ T5278] [ 94.882541][ T5278] Chain exists of: [ 94.882541][ T5278] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 94.882541][ T5278] [ 94.887649][ T5278] Possible unsafe locking scenario: [ 94.887649][ T5278] [ 94.890821][ T5278] CPU0 CPU1 [ 94.892993][ T5278] ---- ---- [ 94.895204][ T5278] lock(hci_cb_list_lock); [ 94.897176][ T5278] lock(&hdev->lock); [ 94.899969][ T5278] lock(hci_cb_list_lock); [ 94.902890][ T5278] lock(rfcomm_mutex); [ 94.904563][ T5278] [ 94.904563][ T5278] *** DEADLOCK *** [ 94.904563][ T5278] [ 94.907733][ T5278] locks held by kworker/u5:2/5278: 4, last CPU#0: [ 94.910375][ T5278] #0: ffff888044450140 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 94.914714][ T5278] #1: ffffc9000df47c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 94.919686][ T5278] #2: ffff88801c3600b8 (&hdev->lock){+.+.}-{4:4}, at: hci_encrypt_change_evt+0x92/0xcf0 [ 94.923864][ T5278] #3: ffffffff903de1c0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_encrypt_cfm+0x313/0x500 [ 94.928101][ T5278] [ 94.928101][ T5278] stack backtrace: [ 94.930464][ T5278] CPU: 0 UID: 0 PID: 5278 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full) [ 94.934316][ T5278] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.938620][ T5278] Workqueue: hci0 hci_rx_work [ 94.940744][ T5278] Call Trace: [ 94.942294][ T5278] [ 94.943643][ T5278] dump_stack_lvl+0xe8/0x150 [ 94.945588][ T5278] print_circular_bug+0x2e2/0x300 [ 94.947767][ T5278] check_noncircular+0x12f/0x150 [ 94.949827][ T5278] __lock_acquire+0x164c/0x2de0 [ 94.951812][ T5278] ? trace_irq_disable+0x3b/0x140 [ 94.953917][ T5278] lock_acquire+0x115/0x350 [ 94.955753][ T5278] ? rfcomm_security_cfm+0x90/0x820 [ 94.957894][ T5278] __mutex_lock+0x19d/0x1550 [ 94.959864][ T5278] ? rfcomm_security_cfm+0x90/0x820 [ 94.962136][ T5278] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 94.964763][ T5278] ? __pfx_l2cap_send_conn_req+0x10/0x10 [ 94.967174][ T5278] ? __pfx___mutex_trylock_common+0x10/0x10 [ 94.969740][ T5278] ? rfcomm_security_cfm+0x90/0x820 [ 94.971997][ T5278] ? __pfx___mutex_lock+0x10/0x10 [ 94.974221][ T5278] ? l2cap_security_cfm+0x10b0/0x1170 [ 94.976555][ T5278] ? __pfx_l2cap_security_cfm+0x10/0x10 [ 94.979515][ T5278] ? hci_encrypt_cfm+0x313/0x500 [ 94.981589][ T5278] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 94.983953][ T5278] rfcomm_security_cfm+0x90/0x820 [ 94.986120][ T5278] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 94.988483][ T5278] ? hci_read_enc_key_size+0xbd/0x3c0 [ 94.995537][ T5278] ? __pfx_hci_read_enc_key_size+0x10/0x10 [ 94.998188][ T5278] ? hci_conn_hash_lookup_handle+0x20/0x250 [ 95.000857][ T5278] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 95.003300][ T5278] hci_encrypt_cfm+0x37e/0x500 [ 95.005408][ T5278] hci_encrypt_change_evt+0x6e6/0xcf0 [ 95.007653][ T5278] ? __pfx_hci_encrypt_change_evt+0x10/0x10 [ 95.010390][ T5278] ? skb_pull_data+0xf0/0x200 [ 95.012893][ T5278] hci_event_packet+0x6cd/0xf10 [ 95.015081][ T5278] ? __pfx_hci_encrypt_change_evt+0x10/0x10 [ 95.017746][ T5278] ? __pfx_hci_event_packet+0x10/0x10 [ 95.020105][ T5278] ? __sanitizer_cov_trace_const_cmp1+0x40/0xb0 [ 95.022595][ T5278] ? hci_send_to_monitor+0xe2/0x590 [ 95.024844][ T5278] hci_rx_work+0x3ee/0x1020 [ 95.026606][ T5278] ? process_scheduled_works+0x97a/0x1630 [ 95.028826][ T5278] process_scheduled_works+0xc3d/0x1630 [ 95.031205][ T5278] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.034036][ T5278] ? assign_work+0x3cf/0x5d0 [ 95.036136][ T5278] worker_thread+0xa47/0xfb0 [ 95.038225][ T5278] ? __kthread_parkme+0x71/0x1f0 [ 95.040859][ T5278] kthread+0x38b/0x480 [ 95.042717][ T5278] ? __pfx_worker_thread+0x10/0x10 [ 95.045020][ T5278] ? __pfx_kthread+0x10/0x10 [ 95.047017][ T5278] ret_from_fork+0x514/0xb70 [ 95.048998][ T5278] ? __pfx_ret_from_fork+0x10/0x10 [ 95.051172][ T5278] ? __switch_to+0xc89/0x1420 [ 95.053161][ T5278] ? __pfx_kthread+0x10/0x10 [ 95.055148][ T5278] ret_from_fork_asm+0x1a/0x30 [ 95.057203][ T5278]