hci0: status 0x00 handle 0x00c9 conn ffff88802aac5800 status 0x00 encrypt 0 conn ffff888076f00000 status 0x00 encrypt 0x00 ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u34:3/5741 is trying to acquire lock: ffffffff91f89ec0 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_security_cfm+0x3f/0x4b0 net/bluetooth/rfcomm/core.c:2279 but task is already holding lock: ffffffff91f5d000 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_cfm include/net/bluetooth/hci_core.h:2200 [inline] ffffffff91f5d000 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_key_refresh_complete_evt+0x670/0x1030 net/bluetooth/hci_event.c:5263 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (hci_cb_list_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1c20 kernel/locking/mutex.c:821 hci_connect_cfm include/net/bluetooth/hci_core.h:2164 [inline] hci_remote_features_evt+0x485/0x9b0 net/bluetooth/hci_event.c:3786 hci_event_func net/bluetooth/hci_event.c:7887 [inline] hci_event_packet+0x8e9/0xcd0 net/bluetooth/hci_event.c:7938 hci_rx_work+0x451/0xfc0 net/bluetooth/hci_core.c:4087 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #1 (&hdev->lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1c20 kernel/locking/mutex.c:821 hci_release_dev+0x160/0x630 net/bluetooth/hci_core.c:2731 bt_host_release+0x6b/0xb0 net/bluetooth/hci_sysfs.c:100 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 hci_conn_put include/net/bluetooth/hci_core.h:1690 [inline] l2cap_conn_free net/bluetooth/l2cap_core.c:1856 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_conn_put net/bluetooth/l2cap_core.c:1869 [inline] l2cap_chan_destroy net/bluetooth/l2cap_core.c:494 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_chan_put+0x352/0x3f0 net/bluetooth/l2cap_core.c:521 l2cap_sock_release+0x1db/0x280 net/bluetooth/l2cap_sock.c:1533 __sock_release net/socket.c:735 [inline] sock_release+0x91/0x1c0 net/socket.c:763 rfcomm_session_del.isra.0+0x16b/0x250 net/bluetooth/rfcomm/core.c:782 rfcomm_process_rx net/bluetooth/rfcomm/core.c:2086 [inline] rfcomm_process_sessions net/bluetooth/rfcomm/core.c:2171 [inline] rfcomm_run+0x6f6/0x5550 net/bluetooth/rfcomm/core.c:2261 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #0 (rfcomm_mutex){+.+.}-{4:4}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209 check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1c20 kernel/locking/mutex.c:821 rfcomm_security_cfm+0x3f/0x4b0 net/bluetooth/rfcomm/core.c:2279 hci_auth_cfm include/net/bluetooth/hci_core.h:2203 [inline] hci_key_refresh_complete_evt+0x6ea/0x1030 net/bluetooth/hci_event.c:5263 hci_event_func net/bluetooth/hci_event.c:7887 [inline] hci_event_packet+0x8e9/0xcd0 net/bluetooth/hci_event.c:7938 hci_rx_work+0x451/0xfc0 net/bluetooth/hci_core.c:4087 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Chain exists of: rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hci_cb_list_lock); lock(&hdev->lock); lock(hci_cb_list_lock); lock(rfcomm_mutex); *** DEADLOCK *** locks held by kworker/u34:3/5741: 4, last CPU#2: #0: ffff888022e01140 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90003857d08 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff8880447580b8 (&hdev->lock){+.+.}-{4:4}, at: hci_key_refresh_complete_evt+0x3d/0x1030 net/bluetooth/hci_event.c:5233 #3: ffffffff91f5d000 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_cfm include/net/bluetooth/hci_core.h:2200 [inline] #3: ffffffff91f5d000 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_key_refresh_complete_evt+0x670/0x1030 net/bluetooth/hci_event.c:5263 stack backtrace: CPU: 2 UID: 0 PID: 5741 Comm: kworker/u34:3 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: hci0 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209 check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1c20 kernel/locking/mutex.c:821 rfcomm_security_cfm+0x3f/0x4b0 net/bluetooth/rfcomm/core.c:2279 hci_auth_cfm include/net/bluetooth/hci_core.h:2203 [inline] hci_key_refresh_complete_evt+0x6ea/0x1030 net/bluetooth/hci_event.c:5263 hci_event_func net/bluetooth/hci_event.c:7887 [inline] hci_event_packet+0x8e9/0xcd0 net/bluetooth/hci_event.c:7938 hci_rx_work+0x451/0xfc0 net/bluetooth/hci_core.c:4087 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 hcon ffff888076f00000 orig refcnt 0 hcon ffff888076f00000 orig refcnt 1 kcov: kcov_move_area: ffffc9003500a000 1048576 <= ffffc90036c0f000 745236