syzbot


possible deadlock in sco_conn_del

Status: upstream: reported C repro on 2023/03/13 19:51
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+5b0d22db545d622669cf@syzkaller.appspotmail.com
First crash: 469d, last: 3d02h
Fix commit to backport (bisect log) :
tree: upstream
commit d772781964415c63759572b917e21c4f7ec08d9f
Author: Jakub Kicinski <kuba@kernel.org>
Date: Fri Jan 6 06:33:54 2023 +0000

  devlink: bump the instance index directly when iterating

  
Bug presence (2)
Date Name Commit Repro Result
2023/06/03 linux-6.1.y (ToT) d2869ace6eeb C [report] INFO: rcu detected stall in corrupted
2023/06/03 upstream (ToT) 4ecd704a4c51 C Didn't crash
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in sco_conn_del bluetooth C done done 279 405d 809d 22/27 fixed on 2023/07/01 16:05
linux-5.15 possible deadlock in sco_conn_del missing-backport origin:lts-only C inconclusive 229 3h18m 468d 0/3 upstream: reported C repro on 2023/03/14 20:00
Fix bisection attempts (1)
Created Duration User Patch Repo Result
2023/09/03 16:03 6h44m fix candidate upstream job log (1)

Sample crash report:
Bluetooth: hci0: hardware error 0x00
======================================================
WARNING: possible circular locking dependency detected
6.1.84-syzkaller #0 Not tainted
------------------------------------------------------
kworker/u5:0/47 is trying to acquire lock:
ffff888018ac1130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1745 [inline]
ffff888018ac1130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_del+0x104/0x300 net/bluetooth/sco.c:197

but task is already holding lock:
ffffffff8e3f02e8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1805 [inline]
ffffffff8e3f02e8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb8/0x2a0 net/bluetooth/hci_conn.c:2441

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
       lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
       hci_connect_cfm include/net/bluetooth/hci_core.h:1790 [inline]
       hci_remote_features_evt+0x664/0xab0 net/bluetooth/hci_event.c:3778
       hci_event_func net/bluetooth/hci_event.c:7514 [inline]
       hci_event_packet+0xa9d/0x1510 net/bluetooth/hci_event.c:7566
       hci_rx_work+0x3cd/0xce0 net/bluetooth/hci_core.c:4130
       process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
       worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
       kthread+0x28d/0x320 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307

-> #1 (&hdev->lock){+.+.}-{3:3}:
       lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
       sco_sock_connect+0x181/0x8f0 net/bluetooth/sco.c:593
       __sys_connect_file net/socket.c:2006 [inline]
       __sys_connect+0x2c9/0x300 net/socket.c:2023
       __do_sys_connect net/socket.c:2033 [inline]
       __se_sys_connect net/socket.c:2030 [inline]
       __x64_sys_connect+0x76/0x80 net/socket.c:2030
       do_syscall_x64 arch/x86/entry/common.c:51 [inline]
       do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
       entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3090 [inline]
       check_prevs_add kernel/locking/lockdep.c:3209 [inline]
       validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
       __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
       lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
       lock_sock_nested+0x44/0x100 net/core/sock.c:3484
       lock_sock include/net/sock.h:1745 [inline]
       sco_conn_del+0x104/0x300 net/bluetooth/sco.c:197
       hci_disconn_cfm include/net/bluetooth/hci_core.h:1808 [inline]
       hci_conn_hash_flush+0x10e/0x2a0 net/bluetooth/hci_conn.c:2441
       hci_dev_close_sync+0x9a9/0x1020 net/bluetooth/hci_sync.c:5015
       hci_dev_do_close net/bluetooth/hci_core.c:554 [inline]
       hci_error_reset+0x12c/0x3c0 net/bluetooth/hci_core.c:1060
       process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
       worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
       kthread+0x28d/0x320 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307

other info that might help us debug this:

Chain exists of:
  sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hci_cb_list_lock);
                               lock(&hdev->lock);
                               lock(hci_cb_list_lock);
  lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);

 *** DEADLOCK ***

5 locks held by kworker/u5:0/47:
 #0: ffff88807c166138 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90000b87d20 ((work_completion)(&hdev->error_reset)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffff8880239150b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:552 [inline]
 #2: ffff8880239150b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_error_reset+0x124/0x3c0 net/bluetooth/hci_core.c:1060
 #3: ffff888023914078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x48d/0x1020 net/bluetooth/hci_sync.c:5002
 #4: ffffffff8e3f02e8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1805 [inline]
 #4: ffffffff8e3f02e8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb8/0x2a0 net/bluetooth/hci_conn.c:2441

stack backtrace:
CPU: 0 PID: 47 Comm: kworker/u5:0 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_error_reset
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3090 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
 __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
 lock_sock_nested+0x44/0x100 net/core/sock.c:3484
 lock_sock include/net/sock.h:1745 [inline]
 sco_conn_del+0x104/0x300 net/bluetooth/sco.c:197
 hci_disconn_cfm include/net/bluetooth/hci_core.h:1808 [inline]
 hci_conn_hash_flush+0x10e/0x2a0 net/bluetooth/hci_conn.c:2441
 hci_dev_close_sync+0x9a9/0x1020 net/bluetooth/hci_sync.c:5015
 hci_dev_do_close net/bluetooth/hci_core.c:554 [inline]
 hci_error_reset+0x12c/0x3c0 net/bluetooth/hci_core.c:1060
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292

Crashes (219):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/06 14:52 linux-6.1.y 347385861c50 ca620dd8 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/02/27 12:55 linux-6.1.y 81e1dc2f7001 05e69c83 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2023/10/28 06:07 linux-6.1.y 32c9cdbe383c 3c418d72 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2023/06/03 05:21 linux-6.1.y d2869ace6eeb a4ae4f42 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/14 21:50 linux-6.1.y 909ba1f1b414 fdb4c10c .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/03/12 19:24 linux-6.1.y 61adba85cc40 c35c26ec .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/02/24 12:33 linux-6.1.y 81e1dc2f7001 8d446f15 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/02/15 09:09 linux-6.1.y f1bb70486c9c d9b1cdd5 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2023/10/29 00:03 linux-6.1.y 32c9cdbe383c 3c418d72 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2023/06/09 08:11 linux-6.1.y 76ba310227d2 058b3a5a .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2023/06/03 10:02 linux-6.1.y d2869ace6eeb a4ae4f42 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2023/06/09 07:54 linux-6.1.y 76ba310227d2 058b3a5a .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/16 20:27 linux-6.1.y eb44d83053d6 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/16 17:02 linux-6.1.y eb44d83053d6 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/16 08:34 linux-6.1.y ae9f2a70d69e f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/11 16:59 linux-6.1.y 88690811da69 b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/09 04:12 linux-6.1.y 88690811da69 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/07 17:34 linux-6.1.y 88690811da69 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/07 01:31 linux-6.1.y 88690811da69 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/06 15:33 linux-6.1.y 88690811da69 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/05 22:40 linux-6.1.y 88690811da69 5aa1a7c9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/05 20:52 linux-6.1.y 88690811da69 5aa1a7c9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/03 15:55 linux-6.1.y 88690811da69 0aba2352 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/03 13:47 linux-6.1.y 88690811da69 0aba2352 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/02 00:13 linux-6.1.y 88690811da69 3113787f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/26 04:08 linux-6.1.y 88690811da69 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/25 03:54 linux-6.1.y 4078fa637fcd a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/23 05:52 linux-6.1.y 4078fa637fcd 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/19 21:31 linux-6.1.y 4078fa637fcd c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/17 13:13 linux-6.1.y 4078fa637fcd a12e99e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/17 01:38 linux-6.1.y 909ba1f1b414 c2e07261 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/16 07:44 linux-6.1.y 909ba1f1b414 ef5d53ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/14 07:32 linux-6.1.y 909ba1f1b414 fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/11 21:08 linux-6.1.y 909ba1f1b414 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/11 01:04 linux-6.1.y 909ba1f1b414 f7c35481 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/09 23:44 linux-6.1.y 909ba1f1b414 05079661 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/09 16:51 linux-6.1.y 909ba1f1b414 05079661 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/08 15:30 linux-6.1.y 909ba1f1b414 20bf80e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/05/08 09:53 linux-6.1.y 909ba1f1b414 4cf3f9b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
2024/06/21 21:36 linux-6.1.y eb44d83053d6 edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/21 12:08 linux-6.1.y eb44d83053d6 dac2aa43 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/15 22:26 linux-6.1.y ae9f2a70d69e f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/14 03:55 linux-6.1.y ae9f2a70d69e a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/13 20:28 linux-6.1.y ae9f2a70d69e a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/11 19:00 linux-6.1.y 88690811da69 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/11 14:03 linux-6.1.y 88690811da69 b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/07 10:53 linux-6.1.y 88690811da69 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/05 10:14 linux-6.1.y 88690811da69 e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/05 04:15 linux-6.1.y 88690811da69 e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/06/01 06:48 linux-6.1.y 88690811da69 3113787f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/31 00:39 linux-6.1.y 88690811da69 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/29 04:24 linux-6.1.y 88690811da69 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/29 00:43 linux-6.1.y 88690811da69 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/27 19:31 linux-6.1.y 88690811da69 761766e6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/27 15:37 linux-6.1.y 88690811da69 761766e6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/24 23:48 linux-6.1.y 4078fa637fcd a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/21 13:57 linux-6.1.y 4078fa637fcd 4c0d3ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/18 16:17 linux-6.1.y 4078fa637fcd c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/13 23:32 linux-6.1.y 909ba1f1b414 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/11 19:20 linux-6.1.y 909ba1f1b414 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/10 22:03 linux-6.1.y 909ba1f1b414 f7c35481 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2024/05/10 03:09 linux-6.1.y 909ba1f1b414 de979bc2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in sco_conn_del
2023/03/13 19:50 linux-6.1.y 6449a0ba6843 026e2200 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in sco_conn_del
* Struck through repros no longer work on HEAD.