program: r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) setsockopt$inet_tcp_int(r0, 0x6, 0x9, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) accept4$x25(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000100)=0x12, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close_range(r2, 0xffffffffffffffff, 0x0) [ 94.983464][ T44] Bluetooth: hci0: command tx timeout [ 95.201799][ T5311] [ 95.202972][ T5311] ====================================================== [ 95.206287][ T5311] WARNING: possible circular locking dependency detected [ 95.210352][ T5311] syzkaller #0 Not tainted [ 95.212887][ T5311] ------------------------------------------------------ [ 95.215986][ T5311] syz.0.0/5311 is trying to acquire lock: [ 95.218512][ T5311] ffff88801fd0fae8 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x101/0xca0 [ 95.223618][ T5311] [ 95.223618][ T5311] but task is already holding lock: [ 95.226861][ T5311] ffff88801fd10ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 95.231168][ T5311] [ 95.231168][ T5311] which lock already depends on the new lock. [ 95.231168][ T5311] [ 95.235684][ T5311] [ 95.235684][ T5311] the existing dependency chain (in reverse order) is: [ 95.239425][ T5311] [ 95.239425][ T5311] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 95.242711][ T5311] lock_sock_nested+0x41/0x100 [ 95.244818][ T5311] smc_listen_out+0xd4/0x3d0 [ 95.247370][ T5311] smc_listen_work+0x81d/0x1410 [ 95.250419][ T5311] process_scheduled_works+0xa8e/0x14e0 [ 95.253061][ T5311] worker_thread+0xa47/0xfb0 [ 95.255298][ T5311] kthread+0x388/0x470 [ 95.258077][ T5311] ret_from_fork+0x514/0xb70 [ 95.260695][ T5311] ret_from_fork_asm+0x1a/0x30 [ 95.262961][ T5311] [ 95.262961][ T5311] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 95.267294][ T5311] __lock_acquire+0x1520/0x2cf0 [ 95.269993][ T5311] lock_acquire+0x106/0x350 [ 95.272250][ T5311] __flush_work+0x74c/0xca0 [ 95.274815][ T5311] __cancel_work_sync+0xbe/0x110 [ 95.278038][ T5311] smc_clcsock_release+0x60/0xf0 [ 95.280947][ T5311] __smc_release+0x64e/0x7c0 [ 95.283253][ T5311] smc_close_non_accepted+0xd5/0x1f0 [ 95.285576][ T5311] smc_close_active+0xb42/0xf30 [ 95.287762][ T5311] __smc_release+0x9c/0x7c0 [ 95.289851][ T5311] smc_release+0x2c5/0x550 [ 95.291838][ T5311] sock_close+0xad/0x220 [ 95.293771][ T5311] __fput+0x418/0xa50 [ 95.295522][ T5311] task_work_run+0x1d9/0x270 [ 95.297704][ T5311] exit_to_user_mode_loop+0x1fa/0x730 [ 95.300322][ T5311] do_syscall_64+0x353/0x580 [ 95.302558][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.305457][ T5311] [ 95.305457][ T5311] other info that might help us debug this: [ 95.305457][ T5311] [ 95.310645][ T5311] Possible unsafe locking scenario: [ 95.310645][ T5311] [ 95.314025][ T5311] CPU0 CPU1 [ 95.316240][ T5311] ---- ---- [ 95.318759][ T5311] lock(sk_lock-AF_SMC/1); [ 95.321107][ T5311] lock((work_completion)(&new_smc->smc_listen_work)); [ 95.325493][ T5311] lock(sk_lock-AF_SMC/1); [ 95.328458][ T5311] lock((work_completion)(&new_smc->smc_listen_work)); [ 95.331401][ T5311] [ 95.331401][ T5311] *** DEADLOCK *** [ 95.331401][ T5311] [ 95.334672][ T5311] 3 locks held by syz.0.0/5311: [ 95.336867][ T5311] #0: ffff8880444d9f00 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x82/0x220 [ 95.341556][ T5311] #1: ffff88801fd10ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 95.345489][ T5311] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x101/0xca0 [ 95.349655][ T5311] [ 95.349655][ T5311] stack backtrace: [ 95.352487][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.352508][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.352517][ T5311] Call Trace: [ 95.352529][ T5311] [ 95.352572][ T5311] dump_stack_lvl+0xe8/0x150 [ 95.352603][ T5311] print_circular_bug+0x2e1/0x300 [ 95.352627][ T5311] check_noncircular+0x12e/0x150 [ 95.352646][ T5311] __lock_acquire+0x1520/0x2cf0 [ 95.352663][ T5311] ? __pfx___schedule+0x10/0x10 [ 95.352677][ T5311] ? irqentry_exit+0x218/0x8f0 [ 95.352689][ T5311] ? irqentry_exit+0x218/0x8f0 [ 95.352701][ T5311] ? trace_irq_disable+0x3b/0x140 [ 95.352722][ T5311] ? __flush_work+0x101/0xca0 [ 95.352761][ T5311] lock_acquire+0x106/0x350 [ 95.352775][ T5311] ? __flush_work+0x101/0xca0 [ 95.352792][ T5311] ? preempt_schedule_thunk+0x16/0x40 [ 95.352810][ T5311] ? __flush_work+0x101/0xca0 [ 95.352821][ T5311] __flush_work+0x74c/0xca0 [ 95.352834][ T5311] ? __flush_work+0x101/0xca0 [ 95.352846][ T5311] ? __flush_work+0x101/0xca0 [ 95.352864][ T5311] ? __pfx___flush_work+0x10/0x10 [ 95.352884][ T5311] ? __pfx_wq_barrier_func+0x10/0x10 [ 95.352901][ T5311] ? __cancel_work_sync+0x5c/0x110 [ 95.352914][ T5311] __cancel_work_sync+0xbe/0x110 [ 95.352926][ T5311] smc_clcsock_release+0x60/0xf0 [ 95.352967][ T5311] __smc_release+0x64e/0x7c0 [ 95.352983][ T5311] smc_close_non_accepted+0xd5/0x1f0 [ 95.352997][ T5311] smc_close_active+0xb42/0xf30 [ 95.353010][ T5311] ? __pfx_sock_def_readable+0x10/0x10 [ 95.353028][ T5311] __smc_release+0x9c/0x7c0 [ 95.353041][ T5311] ? __local_bh_enable_ip+0xd0/0x130 [ 95.353063][ T5311] smc_release+0x2c5/0x550 [ 95.353077][ T5311] sock_close+0xad/0x220 [ 95.353093][ T5311] ? __pfx_sock_close+0x10/0x10 [ 95.353104][ T5311] __fput+0x418/0xa50 [ 95.353123][ T5311] task_work_run+0x1d9/0x270 [ 95.353142][ T5311] ? __pfx_task_work_run+0x10/0x10 [ 95.353158][ T5311] exit_to_user_mode_loop+0x1fa/0x730 [ 95.353180][ T5311] ? rcu_is_watching+0x15/0xb0 [ 95.353203][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.353216][ T5311] do_syscall_64+0x353/0x580 [ 95.353229][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 95.353239][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.353248][ T5311] RIP: 0033:0x7f295439e0d9 [ 95.353261][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.353270][ T5311] RSP: 002b:00007ffc23110578 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 95.353281][ T5311] RAX: 0000000000000000 RBX: 00007f2954627da0 RCX: 00007f295439e0d9 [ 95.353288][ T5311] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 95.353293][ T5311] RBP: 00007f2954627da0 R08: 00007f2954626038 R09: 0000000000000000 [ 95.353298][ T5311] R10: 0000000000df9de0 R11: 0000000000000246 R12: 00000000000175df [ 95.353303][ T5311] R13: 00007f295462609c R14: 0000000000017352 R15: 00007f2954626090 [ 95.353311][ T5311]