program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r0) r2 = socket(0x3, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001c00010400000000000000aa740002000000", @ANYRES32=r4, @ANYBLOB="000000000a0001000180c2000000000008000f0001000000"], 0x30}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0x2, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x1a01}, [@IFLA_GROUP={0x8, 0x1b, 0x3}]}, 0x28}}, 0x0) (async) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="00878fb80f00cf", @ANYRES16=r1, @ANYBLOB="09020000000000000000010000000500040001000000060001004e200000050002000a000000"], 0x2c}}, 0x0) (async) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000040)=0x90000) (async) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r7, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) (async) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000100)=0xb0000) (async) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r8, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0x0, 0xfffffffffffffffc}) (async) close_range(r6, 0xffffffffffffffff, 0x0) (async) syz_emit_ethernet(0x1d2, &(0x7f0000000b80)={@local, @link_local, @void, {@ipv6={0x86dd, @udp={0xb, 0x6, "4958d2", 0x19c, 0x11, 0xff, @dev={0xfe, 0x80, '\x00', 0x2a}, @mcast1, {[@srh={0x2d, 0x2, 0x4, 0x1, 0x8, 0x18, 0x63, [@loopback]}, @hopopts={0x32, 0x3, '\x00', [@hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}, @enc_lim={0x4, 0x1, 0x6}, @ra={0x5, 0x2, 0xfffc}, @padn={0x1, 0x1, [0x0]}]}, @routing={0x62, 0x2, 0x2, 0x7, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}, @routing={0x2, 0x8, 0x1, 0x61, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @multicast1}, @dev={0xfe, 0x80, '\x00', 0x1d}, @local]}], {0x4e23, 0x4e24, 0xfc, 0x0, @opaque="290a308148eb3e6d1f54ae9792528ac775f20dd3158541460a4932a4e3678afb39228b3e92ae7c40eb4cbb6d9c6349bf146e7d6c326fe71ac3644e5468fab42cef658e09b52c62b645ecded12a7f7ed4ef9dc8146b2b2048a3af09f6784aaadc663657ed9a4ec97f0d23f3566977cc77258441eaa35c7b09279c3961fa5cfa9c14b5462d90068e90c2d412beb83d84c2b32bee595601e09eb9c0f97aee2a1a542b818d831c5c2fb35695dacc878bdd564f4ddc93e5503cbbb2de9f79d471505a52c0a17871edfd0d9710d742c3557c9c1b0e41b64d0ed85646642e5c07173723215448eee9ed8d76ffd1221471945f1a01bc0211"}}}}}}, 0x0) (async) r9 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) ioctl$LOOP_SET_STATUS(r9, 0x4c02, &(0x7f0000000800)={0x0, {}, 0x0, {}, 0xedeb, 0x0, 0x1e, 0x4, "050fb05978e2aa3233a2156d993291648d2f0447b10df774073fc8b4f4d6010b9f6dd61f8753c5441627cafd9603000000bcc47c6798d0238e571c8f7c7500", "327e0c9a4436d27d7b055534fdc98e6dfdfa2b20e2fe5d39eedae9fcdeb77904", [0x10, 0x4]}) (async) flock(r9, 0x2) (async) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1509, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}, 0x0, 0x4, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f00000008c0)={[{@usrquota}, {@auto_da_alloc}, {@bh}, {@max_batch_time={'max_batch_time', 0x3d, 0x8c9}}, {@debug}, {@errors_remount}]}, 0x7, 0x605, &(0x7f00000001c0)="$eJzs3c9rHGUfAPDvzCZ5kzbvm/ZFxBbFgIcWpGlSi1Uv1nqwh4IFexDx0NAkNXT7gyYFWwum4EFBQcSrSC/+A96ld28iqDfPQhWpKKh0ZXZn281mN13T7E6b+XxgsvM8s7vP893Jk3memTw7AZTWZPYjjdgVcftkEjHRsm08Ghsn8+fd+vXqqWxJolZ77Zckkjyv+fwkf9yeJ0Yj4psjEf+vrC136fKVM7PVWsO7EfuXz17Yv3T5yr7Fs7On50/Pn5s58NzBQ9PPzxyc2ZQ4t+ePR4+9+vhH77317MK31X1JHI4Tw+/MRVscm2UyJuN2HmJr/lBEHMpWOnwuD5stEEKpVfLfx+GIeDQmolJPNUzE4oeFVg7oq1ologaUVKL9Q0k1+wHNsX1v4+ATfe6VDM7NlxoDoLXxDzXOjcRofWy07VbSMjJqnNvYsQnlZ2X8fXX3Z9kSq85D/HFn7wxtQjndrFyLiMc6xZ/U67ajHmkWf7qqHslKxHREjOT1e/k+6pC0rPfjPMx6Nhp/GhGH88cs/8gGy59sSw86fgDK6UbW/8kO5CtZ6u7xL+t7NPs/0aH/M97h2LURRR//uvf/msf70fo58rStH5b1WY53fsvh9owfPzj6SbfyW/t/2ZKV3+wLDsLNaxG72+J/Pws27/9k8Scd9n/2lJOHeyvjle9+PtptW9Hx165H7Ok4/rnbK83W1rk+uX9hsTo/3fjZsYyvvn7zi27lFx1/tv+3dYm/Zf+n7a/LPpMLPZbx5fHrZ7ttG+8Y/0rL6DT9aSRpjDdH8te8Pbu8fHEmYiQ51shIW/IPrF+X5nOa75HFv/epzu1/1e//tdXvM9b8k9mDC6+fudVt20b2f8vF5Nu1HuvQTRb/3L33/5r2n+V93GMZv79x6Ylu29aLf+x+AgMAAAAAAIASSuvXYJN06s56mk5NNebLPhLb0ur5peWnF85fOjcXsbf+/5DDafNK90QjnWTpmfz/YZvpA23pZyJiZ0R8Whmrp6dOna/OFR08AAAAAAAAAAAAAAAAAAAAPCC25/P/m/ep/q3SmP8PlEQ/bzAHPNi0fyivevtfc4snoAwc/6G8tH8oL+0fykv7h/LS/qG8tH8oL+0fykv7BwAAAIAtaeeTN35IImLlhbH6khnJt5kRBFvbcNEVAApTKboCQGHuXPrX2YfS6an//2f+5YD9rw5QgKRTZr1zUFu/8d/o+EoAAAAAAAAAAAAAoA/27Oo+/9/cYNjaTPuD8rqP+f++OgAecr76H8rLGB+41yz+0W4bzP8HAAAAAAAAAAAAgIEZry9JOpXPBR6PNJ2aivhvROyI4WRhsTo/HRH/i4jvK8P/ydIzRVcaAAAAAAAAAAAAAAAAAAAAtpily1fOzFar8xdbV/5ak7O1V5p3QR1AWS/Gv3xVJIP/WMYiovCd0reVoZacJGIl2/MPRMUuLkVLzlDBu6DgP0wAAAAAAAAAAAAAAAAAAFBCLXOPO9v9+YBrBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACDd/f+//1bKTpGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODh9E8AAAD//yTFRqU=") (async) truncate(&(0x7f0000000240)='./file0\x00', 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) [ 94.224178][ T44] Bluetooth: hci0: command tx timeout [ 94.420458][ T5317] [ 94.421420][ T5317] ============================================ [ 94.423636][ T5317] WARNING: possible recursive locking detected [ 94.426202][ T5317] syzkaller #0 Not tainted [ 94.428092][ T5317] -------------------------------------------- [ 94.430649][ T5317] syz.0.0/5317 is trying to acquire lock: [ 94.433154][ T5317] ffffffff8f627030 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0xe9/0xec0 [ 94.438244][ T5317] [ 94.438244][ T5317] but task is already holding lock: [ 94.441345][ T5317] ffffffff8f627030 (qp_broker_list.mutex){+.+.}-{4:4}, at: qp_broker_alloc+0x19f/0x2080 [ 94.445280][ T5317] [ 94.445280][ T5317] other info that might help us debug this: [ 94.448374][ T5317] Possible unsafe locking scenario: [ 94.448374][ T5317] [ 94.451494][ T5317] CPU0 [ 94.452942][ T5317] ---- [ 94.454508][ T5317] lock(qp_broker_list.mutex); [ 94.456617][ T5317] lock(qp_broker_list.mutex); [ 94.458730][ T5317] [ 94.458730][ T5317] *** DEADLOCK *** [ 94.458730][ T5317] [ 94.461957][ T5317] May be due to missing lock nesting notation [ 94.461957][ T5317] [ 94.465463][ T5317] 1 lock held by syz.0.0/5317: [ 94.467574][ T5317] #0: ffffffff8f627030 (qp_broker_list.mutex){+.+.}-{4:4}, at: qp_broker_alloc+0x19f/0x2080 [ 94.471711][ T5317] [ 94.471711][ T5317] stack backtrace: [ 94.474246][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.474261][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.474268][ T5317] Call Trace: [ 94.474275][ T5317] [ 94.474280][ T5317] dump_stack_lvl+0xe8/0x150 [ 94.474298][ T5317] print_deadlock_bug+0x279/0x290 [ 94.474314][ T5317] __lock_acquire+0x24df/0x2cf0 [ 94.474333][ T5317] ? kernel_text_address+0xa5/0xe0 [ 94.474346][ T5317] ? __kernel_text_address+0xd/0x30 [ 94.474359][ T5317] ? stack_depot_save_flags+0x28b/0x800 [ 94.474368][ T5317] ? lock_acquire+0x106/0x350 [ 94.474381][ T5317] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.474394][ T5317] lock_acquire+0x106/0x350 [ 94.474405][ T5317] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.474420][ T5317] __mutex_lock+0x19d/0x1550 [ 94.474496][ T5317] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.474507][ T5317] ? kasan_save_track+0x3e/0x80 [ 94.474518][ T5317] ? kasan_save_free_info+0x40/0x50 [ 94.474531][ T5317] ? __kasan_slab_free+0x5c/0x80 [ 94.474541][ T5317] ? kfree+0x1c5/0x640 [ 94.474554][ T5317] ? vmci_ctx_put+0x5ba/0xc00 [ 94.474567][ T5317] ? vmci_ctx_enqueue_datagram+0x3c3/0x440 [ 94.474581][ T5317] ? vmci_datagram_dispatch+0x450/0xc80 [ 94.474590][ T5317] ? qp_notify_peer+0x161/0x210 [ 94.474601][ T5317] ? qp_broker_alloc+0x1901/0x2080 [ 94.474611][ T5317] ? vmci_qp_broker_alloc+0x92/0xc0 [ 94.474621][ T5317] ? vmci_host_unlocked_ioctl+0x14bc/0x2850 [ 94.474632][ T5317] ? do_syscall_64+0x174/0x580 [ 94.474644][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.474654][ T5317] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.474665][ T5317] ? __pfx___mutex_lock+0x10/0x10 [ 94.474680][ T5317] vmci_qp_broker_detach+0xe9/0xec0 [ 94.474695][ T5317] ? __pfx_vmci_qp_broker_detach+0x10/0x10 [ 94.474706][ T5317] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.474715][ T5317] ? lockdep_hardirqs_on+0x7a/0x110 [ 94.474727][ T5317] ? kfree+0x1c5/0x640 [ 94.474739][ T5317] ? vmci_ctx_put+0x5ba/0xc00 [ 94.474753][ T5317] ? vmci_ctx_put+0x13e/0xc00 [ 94.474766][ T5317] vmci_ctx_put+0x619/0xc00 [ 94.474780][ T5317] ? vmci_ctx_put+0x13e/0xc00 [ 94.474793][ T5317] ? __pfx_vmci_ctx_put+0x10/0x10 [ 94.474807][ T5317] ? preempt_schedule_thunk+0x16/0x40 [ 94.474817][ T5317] ? preempt_schedule_common+0x82/0xd0 [ 94.474828][ T5317] ? preempt_schedule_thunk+0x16/0x40 [ 94.474840][ T5317] vmci_ctx_enqueue_datagram+0x3c3/0x440 [ 94.474862][ T5317] vmci_datagram_dispatch+0x450/0xc80 [ 94.474874][ T5317] ? __pfx_vmci_datagram_dispatch+0x10/0x10 [ 94.474886][ T5317] qp_notify_peer+0x161/0x210 [ 94.474898][ T5317] ? __pfx_gup_fast_fallback+0x10/0x10 [ 94.474911][ T5317] ? __pfx_qp_notify_peer+0x10/0x10 [ 94.474923][ T5317] ? get_user_pages_fast+0x4d/0xb0 [ 94.474936][ T5317] ? qp_host_get_user_memory+0x2c5/0x410 [ 94.474948][ T5317] qp_broker_alloc+0x1901/0x2080 [ 94.474962][ T5317] vmci_qp_broker_alloc+0x92/0xc0 [ 94.474976][ T5317] vmci_host_unlocked_ioctl+0x14bc/0x2850 [ 94.474989][ T5317] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 94.475004][ T5317] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.475016][ T5317] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.475028][ T5317] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.475041][ T5317] ? do_vfs_ioctl+0x116f/0x1530 [ 94.475055][ T5317] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.475069][ T5317] ? hook_file_ioctl+0x1f0/0x5f0 [ 94.475086][ T5317] ? __fget_files+0x2a/0x420 [ 94.475097][ T5317] ? __fget_files+0x2a/0x420 [ 94.475107][ T5317] ? __fget_files+0x3a2/0x420 [ 94.475116][ T5317] ? __fget_files+0x2a/0x420 [ 94.475127][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.475137][ T5317] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 94.475148][ T5317] __se_sys_ioctl+0xfc/0x170 [ 94.475161][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.475170][ T5317] do_syscall_64+0x174/0x580 [ 94.475182][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.475193][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.475204][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.475214][ T5317] RIP: 0033:0x7fdf3219e0d9 [ 94.475224][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.475233][ T5317] RSP: 002b:00007fdf330b4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.475245][ T5317] RAX: ffffffffffffffda RBX: 00007fdf32426090 RCX: 00007fdf3219e0d9 [ 94.475252][ T5317] RDX: 0000200000000540 RSI: 00000000000007a8 RDI: 0000000000000009 [ 94.475258][ T5317] RBP: 00007fdf32235024 R08: 0000000000000000 R09: 0000000000000000 [ 94.475265][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.475270][ T5317] R13: 00007fdf32426128 R14: 00007fdf32426090 R15: 00007ffd99eb4768 [ 94.475280][ T5317] [ 94.780793][ T5324] loop0: detected capacity change from 0 to 1028 [ 94.797032][ T5324] EXT4-fs: Ignoring removed bh option [ 94.810465][ T5324] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 96.304313][ T44] Bluetooth: hci0: command tx timeout [ 98.384661][ T44] Bluetooth: hci0: command tx timeout