program: openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x22) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r0, 0x0, 0x0) connect$bt_rfcomm(r0, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}, 0x10) syz_emit_vhci(&(0x7f0000000400)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc8}}}, 0x6) syz_emit_vhci(0x0, 0x0) [ 148.751442][ T4651] Bluetooth: hci0: command tx timeout [ 148.891275][ T4651] [ 148.892475][ T4651] ====================================================== [ 148.895492][ T4651] WARNING: possible circular locking dependency detected [ 148.898509][ T4651] syzkaller #0 Not tainted [ 148.900441][ T4651] ------------------------------------------------------ [ 148.903440][ T4651] kworker/u5:1/4651 is trying to acquire lock: [ 148.906079][ T4651] ffffffff903fdc20 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_security_cfm+0x90/0x820 [ 148.910109][ T4651] [ 148.910109][ T4651] but task is already holding lock: [ 148.913456][ T4651] ffffffff903d99c0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_complete_evt+0x318/0xc80 [ 148.918015][ T4651] [ 148.918015][ T4651] which lock already depends on the new lock. [ 148.918015][ T4651] [ 148.922320][ T4651] [ 148.922320][ T4651] the existing dependency chain (in reverse order) is: [ 148.926111][ T4651] [ 148.926111][ T4651] -> #2 (hci_cb_list_lock){+.+.}-{4:4}: [ 148.929455][ T4651] __mutex_lock+0x19d/0x1550 [ 148.931664][ T4651] hci_remote_features_evt+0x53d/0x950 [ 148.934224][ T4651] hci_event_packet+0x6cd/0xf10 [ 148.936500][ T4651] hci_rx_work+0x3ee/0x1020 [ 148.938647][ T4651] process_scheduled_works+0xc3d/0x1630 [ 148.941253][ T4651] worker_thread+0xa47/0xfb0 [ 148.943485][ T4651] kthread+0x38b/0x480 [ 148.945537][ T4651] ret_from_fork+0x514/0xb70 [ 148.947831][ T4651] ret_from_fork_asm+0x1a/0x30 [ 148.950049][ T4651] [ 148.950049][ T4651] -> #1 (&hdev->lock){+.+.}-{4:4}: [ 148.953165][ T4651] __mutex_lock+0x19d/0x1550 [ 148.955404][ T4651] l2cap_chan_connect+0xff/0xf60 [ 148.957805][ T4651] l2cap_sock_connect+0x5e4/0x7e0 [ 148.960120][ T4651] kernel_connect+0x141/0x1c0 [ 148.962324][ T4651] rfcomm_dlc_open+0x644/0x1080 [ 148.964533][ T4651] rfcomm_sock_connect+0x2ed/0x650 [ 148.966955][ T4651] __sys_connect+0x316/0x450 [ 148.969172][ T4651] __x64_sys_connect+0x7a/0x90 [ 148.971495][ T4651] do_syscall_64+0x166/0x520 [ 148.973824][ T4651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.976713][ T4651] [ 148.976713][ T4651] -> #0 (rfcomm_mutex){+.+.}-{4:4}: [ 148.979867][ T4651] __lock_acquire+0x15ff/0x2e50 [ 148.982232][ T4651] lock_acquire+0x115/0x350 [ 148.984304][ T4651] __mutex_lock+0x19d/0x1550 [ 148.986520][ T4651] rfcomm_security_cfm+0x90/0x820 [ 148.988981][ T4651] hci_auth_complete_evt+0x39f/0xc80 [ 148.991612][ T4651] hci_event_packet+0x6cd/0xf10 [ 148.994156][ T4651] hci_rx_work+0x3ee/0x1020 [ 148.996443][ T4651] process_scheduled_works+0xc3d/0x1630 [ 148.999042][ T4651] worker_thread+0xa47/0xfb0 [ 149.001313][ T4651] kthread+0x38b/0x480 [ 149.003328][ T4651] ret_from_fork+0x514/0xb70 [ 149.005552][ T4651] ret_from_fork_asm+0x1a/0x30 [ 149.007908][ T4651] [ 149.007908][ T4651] other info that might help us debug this: [ 149.007908][ T4651] [ 149.012512][ T4651] Chain exists of: [ 149.012512][ T4651] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 149.012512][ T4651] [ 149.019060][ T4651] Possible unsafe locking scenario: [ 149.019060][ T4651] [ 149.022325][ T4651] CPU0 CPU1 [ 149.024707][ T4651] ---- ---- [ 149.027004][ T4651] lock(hci_cb_list_lock); [ 149.028942][ T4651] lock(&hdev->lock); [ 149.031713][ T4651] lock(hci_cb_list_lock); [ 149.034737][ T4651] lock(rfcomm_mutex); [ 149.036588][ T4651] [ 149.036588][ T4651] *** DEADLOCK *** [ 149.036588][ T4651] [ 149.039978][ T4651] locks held by kworker/u5:1/4651: 4, last CPU#0: [ 149.042627][ T4651] #0: ffff888044903940 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 149.047348][ T4651] #1: ffffc9000f9afc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 149.052371][ T4651] #2: ffff88804fcc00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_auth_complete_evt+0x95/0xc80 [ 149.056579][ T4651] #3: ffffffff903d99c0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_complete_evt+0x318/0xc80 [ 149.060903][ T4651] [ 149.060903][ T4651] stack backtrace: [ 149.063563][ T4651] CPU: 0 UID: 0 PID: 4651 Comm: kworker/u5:1 Not tainted syzkaller #0 PREEMPT(full) [ 149.067707][ T4651] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 149.072047][ T4651] Workqueue: hci0 hci_rx_work [ 149.074106][ T4651] Call Trace: [ 149.075605][ T4651] [ 149.076855][ T4651] dump_stack_lvl+0xe8/0x150 [ 149.078784][ T4651] print_circular_bug+0x2e2/0x300 [ 149.080879][ T4651] check_noncircular+0x12f/0x150 [ 149.082982][ T4651] __lock_acquire+0x15ff/0x2e50 [ 149.084818][ T4651] ? __mutex_trylock_common+0x15f/0x270 [ 149.087066][ T4651] ? __pfx___mutex_trylock_common+0x10/0x10 [ 149.089462][ T4651] ? rcu_is_watching+0x16/0xb0 [ 149.091487][ T4651] ? trace_contention_end+0x3d/0x140 [ 149.093846][ T4651] lock_acquire+0x115/0x350 [ 149.095820][ T4651] ? rfcomm_security_cfm+0x90/0x820 [ 149.098070][ T4651] __mutex_lock+0x19d/0x1550 [ 149.100073][ T4651] ? rfcomm_security_cfm+0x90/0x820 [ 149.102332][ T4651] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 149.104737][ T4651] ? __pfx___mutex_trylock_common+0x10/0x10 [ 149.107222][ T4651] ? rfcomm_security_cfm+0x90/0x820 [ 149.109364][ T4651] ? __pfx___mutex_lock+0x10/0x10 [ 149.111342][ T4651] ? l2cap_security_cfm+0x10b0/0x1170 [ 149.113391][ T4651] ? __pfx_l2cap_security_cfm+0x10/0x10 [ 149.115415][ T4651] ? hci_auth_complete_evt+0x318/0xc80 [ 149.117520][ T4651] rfcomm_security_cfm+0x90/0x820 [ 149.119656][ T4651] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 149.122105][ T4651] ? hci_conn_hash_lookup_handle+0x20/0x250 [ 149.124744][ T4651] ? hci_conn_hash_lookup_handle+0x20/0x250 [ 149.127227][ T4651] ? hci_conn_hash_lookup_handle+0x20/0x250 [ 149.129692][ T4651] ? hci_conn_hash_lookup_handle+0x22e/0x250 [ 149.132118][ T4651] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 149.134681][ T4651] hci_auth_complete_evt+0x39f/0xc80 [ 149.137021][ T4651] ? __pfx_hci_auth_complete_evt+0x10/0x10 [ 149.139604][ T4651] ? skb_pull_data+0xf0/0x200 [ 149.141829][ T4651] hci_event_packet+0x6cd/0xf10 [ 149.144108][ T4651] ? __pfx_hci_auth_complete_evt+0x10/0x10 [ 149.146635][ T4651] ? __pfx_hci_event_packet+0x10/0x10 [ 149.148835][ T4651] ? audit_filter_rules+0x55c0/0x5d10 [ 149.151233][ T4651] ? hci_send_to_monitor+0xe2/0x590 [ 149.153603][ T4651] hci_rx_work+0x3ee/0x1020 [ 149.155687][ T4651] ? process_scheduled_works+0x97a/0x1630 [ 149.158258][ T4651] process_scheduled_works+0xc3d/0x1630 [ 149.160589][ T4651] ? __pfx_process_scheduled_works+0x10/0x10 [ 149.162917][ T4651] ? assign_work+0x3cf/0x5d0 [ 149.164837][ T4651] worker_thread+0xa47/0xfb0 [ 149.166590][ T4651] ? __kthread_parkme+0x71/0x1f0 [ 149.168528][ T4651] kthread+0x38b/0x480 [ 149.170130][ T4651] ? __pfx_worker_thread+0x10/0x10 [ 149.172237][ T4651] ? __pfx_kthread+0x10/0x10 [ 149.174259][ T4651] ret_from_fork+0x514/0xb70 [ 149.176271][ T4651] ? __pfx_ret_from_fork+0x10/0x10 [ 149.178518][ T4651] ? __switch_to+0xc89/0x1420 [ 149.180552][ T4651] ? __pfx_kthread+0x10/0x10 [ 149.182516][ T4651] ret_from_fork_asm+0x1a/0x30 [ 149.184645][ T4651]