program: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket(0x2b, 0x1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0xffffffff) r1 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) recvfrom$inet(r1, 0x0, 0x0, 0x10060, 0x0, 0x0) [ 86.962574][ T4641] Bluetooth: hci0: command tx timeout [ 87.100142][ T5311] [ 87.101238][ T5311] ====================================================== [ 87.104080][ T5311] WARNING: possible circular locking dependency detected [ 87.106822][ T5311] syzkaller #0 Not tainted [ 87.108616][ T5311] ------------------------------------------------------ [ 87.111407][ T5311] syz.0.0/5311 is trying to acquire lock: [ 87.113679][ T5311] ffff8880396e0a68 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x101/0xca0 [ 87.118232][ T5311] [ 87.118232][ T5311] but task is already holding lock: [ 87.121187][ T5311] ffff8880396e0ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 87.124788][ T5311] [ 87.124788][ T5311] which lock already depends on the new lock. [ 87.124788][ T5311] [ 87.128982][ T5311] [ 87.128982][ T5311] the existing dependency chain (in reverse order) is: [ 87.132515][ T5311] [ 87.132515][ T5311] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 87.135256][ T5311] lock_sock_nested+0x41/0x100 [ 87.137146][ T5311] smc_listen_out+0xd4/0x3d0 [ 87.138958][ T5311] smc_listen_work+0x81d/0x1410 [ 87.140861][ T5311] process_scheduled_works+0xa88/0x14c0 [ 87.143211][ T5311] worker_thread+0xa47/0xfb0 [ 87.145246][ T5311] kthread+0x38b/0x480 [ 87.147257][ T5311] ret_from_fork+0x514/0xb70 [ 87.149493][ T5311] ret_from_fork_asm+0x1a/0x30 [ 87.151552][ T5311] [ 87.151552][ T5311] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 87.155361][ T5311] __lock_acquire+0x1520/0x2cf0 [ 87.157431][ T5311] lock_acquire+0x106/0x350 [ 87.159268][ T5311] __flush_work+0x74c/0xca0 [ 87.161277][ T5311] __cancel_work_sync+0xbf/0x110 [ 87.163743][ T5311] smc_clcsock_release+0x60/0xf0 [ 87.165772][ T5311] __smc_release+0x64e/0x7c0 [ 87.167921][ T5311] smc_close_non_accepted+0xd5/0x1f0 [ 87.170283][ T5311] smc_close_active+0xb42/0xf30 [ 87.172331][ T5311] __smc_release+0x9c/0x7c0 [ 87.174333][ T5311] smc_release+0x2c5/0x550 [ 87.176443][ T5311] __sock_release+0xa0/0x1f0 [ 87.178637][ T5311] sock_close+0x1c/0x30 [ 87.180681][ T5311] __fput+0x418/0xa50 [ 87.182595][ T5311] task_work_run+0x1d9/0x270 [ 87.184743][ T5311] exit_to_user_mode_loop+0x204/0x770 [ 87.187271][ T5311] do_syscall_64+0x328/0x520 [ 87.189429][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.192054][ T5311] [ 87.192054][ T5311] other info that might help us debug this: [ 87.192054][ T5311] [ 87.196186][ T5311] Possible unsafe locking scenario: [ 87.196186][ T5311] [ 87.199259][ T5311] CPU0 CPU1 [ 87.201559][ T5311] ---- ---- [ 87.203774][ T5311] lock(sk_lock-AF_SMC/1); [ 87.205608][ T5311] lock((work_completion)(&new_smc->smc_listen_work)); [ 87.209547][ T5311] lock(sk_lock-AF_SMC/1); [ 87.212497][ T5311] lock((work_completion)(&new_smc->smc_listen_work)); [ 87.215481][ T5311] [ 87.215481][ T5311] *** DEADLOCK *** [ 87.215481][ T5311] [ 87.218625][ T5311] locks held by syz.0.0/5311: 3, last CPU#0: [ 87.221315][ T5311] #0: ffff888051c55940 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 [ 87.225542][ T5311] #1: ffff8880396e0ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 87.229433][ T5311] #2: ffffffff8eb5a2a0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x101/0xca0 [ 87.233033][ T5311] [ 87.233033][ T5311] stack backtrace: [ 87.235294][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.235307][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.235314][ T5311] Call Trace: [ 87.235320][ T5311] [ 87.235326][ T5311] dump_stack_lvl+0xe8/0x150 [ 87.235346][ T5311] print_circular_bug+0x2e1/0x300 [ 87.235358][ T5311] check_noncircular+0x12e/0x150 [ 87.235370][ T5311] __lock_acquire+0x1520/0x2cf0 [ 87.235388][ T5311] ? do_raw_spin_unlock+0x4d/0x200 [ 87.235401][ T5311] ? __flush_work+0x101/0xca0 [ 87.235413][ T5311] lock_acquire+0x106/0x350 [ 87.235426][ T5311] ? __flush_work+0x101/0xca0 [ 87.235441][ T5311] ? __flush_work+0x101/0xca0 [ 87.235452][ T5311] __flush_work+0x74c/0xca0 [ 87.235464][ T5311] ? __flush_work+0x101/0xca0 [ 87.235476][ T5311] ? __flush_work+0x101/0xca0 [ 87.235488][ T5311] ? __pfx___flush_work+0x10/0x10 [ 87.235500][ T5311] ? __pfx_wq_barrier_func+0x10/0x10 [ 87.235516][ T5311] ? __cancel_work_sync+0x5c/0x110 [ 87.235528][ T5311] __cancel_work_sync+0xbf/0x110 [ 87.235541][ T5311] smc_clcsock_release+0x60/0xf0 [ 87.235553][ T5311] __smc_release+0x64e/0x7c0 [ 87.235569][ T5311] smc_close_non_accepted+0xd5/0x1f0 [ 87.235585][ T5311] smc_close_active+0xb42/0xf30 [ 87.235596][ T5311] ? __pfx_sock_def_readable+0x10/0x10 [ 87.235607][ T5311] __smc_release+0x9c/0x7c0 [ 87.235617][ T5311] ? __local_bh_enable_ip+0xd6/0x140 [ 87.235625][ T5311] smc_release+0x2c5/0x550 [ 87.235634][ T5311] __sock_release+0xa0/0x1f0 [ 87.235642][ T5311] ? __pfx_sock_close+0x10/0x10 [ 87.235650][ T5311] sock_close+0x1c/0x30 [ 87.235660][ T5311] __fput+0x418/0xa50 [ 87.235673][ T5311] task_work_run+0x1d9/0x270 [ 87.235688][ T5311] ? __pfx_task_work_run+0x10/0x10 [ 87.235705][ T5311] exit_to_user_mode_loop+0x204/0x770 [ 87.235720][ T5311] ? rcu_is_watching+0x16/0xb0 [ 87.235730][ T5311] do_syscall_64+0x328/0x520 [ 87.235742][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.235749][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 87.235756][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.235763][ T5311] RIP: 0033:0x7f1d8979e0d9 [ 87.235771][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.235776][ T5311] RSP: 002b:00007ffeb4bf8ec8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 87.235785][ T5311] RAX: 0000000000000000 RBX: 00007ffeb4bf8fb0 RCX: 00007f1d8979e0d9 [ 87.235789][ T5311] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 87.235793][ T5311] RBP: 0000000000015300 R08: 0000000000000001 R09: 0000000000000000 [ 87.235799][ T5311] R10: 00007f1d895ff02c R11: 0000000000000246 R12: 00007ffeb4bf8ff0 [ 87.235806][ T5311] R13: 00007f1d89a25fac R14: 00000000000153c6 R15: 00007f1d89a25fa0 [ 87.235815][ T5311]