possible deadlock in hci_le_conn_update

Status: upstream: reported C repro on 2026/10/02 00:07
Reported-by: syzbot+9dcafe22f2815a23354a@syzkaller.appspotmail.com
First crash: 16d, last: 7d23h
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 possible deadlock in hci_le_conn_update 4 2 12d 15d 0/3 upstream: reported on 2026/10/03 07:11
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/18 22:51 tree origin upstream running

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/u5:0/51 is trying to acquire lock:
ffff88805d1c40b8 (&hdev->lock){+.+.}-{3:3}, at: hci_le_conn_update+0xd0/0x320 net/bluetooth/hci_conn.c:502

but task is already holding lock:
ffff8880611cf338 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_recv_acldata+0xe2/0x11a0 net/bluetooth/l2cap_core.c:7755

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&conn->lock#2){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
       l2cap_conn_ready net/bluetooth/l2cap_core.c:1657 [inline]
       l2cap_connect_cfm+0x663/0x1160 net/bluetooth/l2cap_core.c:7522
       hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
       hci_remote_features_evt+0x59b/0x900 net/bluetooth/hci_event.c:3719
       hci_event_func net/bluetooth/hci_event.c:7500 [inline]
       hci_event_packet+0x807/0x1280 net/bluetooth/hci_event.c:7552
       hci_rx_work+0x43a/0xd60 net/bluetooth/hci_core.c:4017
       process_one_work kernel/workqueue.c:2657 [inline]
       process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
       worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
       kthread+0x2fa/0x390 kernel/kthread.c:388
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

-> #1 (hci_cb_list_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
       hci_connect_cfm include/net/bluetooth/hci_core.h:2001 [inline]
       hci_remote_features_evt+0x535/0x900 net/bluetooth/hci_event.c:3719
       hci_event_func net/bluetooth/hci_event.c:7500 [inline]
       hci_event_packet+0x807/0x1280 net/bluetooth/hci_event.c:7552
       hci_rx_work+0x43a/0xd60 net/bluetooth/hci_core.c:4017
       process_one_work kernel/workqueue.c:2657 [inline]
       process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
       worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
       kthread+0x2fa/0x390 kernel/kthread.c:388
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

-> #0 (&hdev->lock){+.+.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3162 [inline]
       check_prevs_add kernel/locking/lockdep.c:3281 [inline]
       validate_chain kernel/locking/lockdep.c:3897 [inline]
       __lock_acquire+0x3a07/0x7eb0 kernel/locking/lockdep.c:5171
       lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5790
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
       hci_le_conn_update+0xd0/0x320 net/bluetooth/hci_conn.c:502
       l2cap_conn_param_update_req net/bluetooth/l2cap_core.c:4750 [inline]
       l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5569 [inline]
       l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5646 [inline]
       l2cap_recv_frame+0xcc96/0xfd60 net/bluetooth/l2cap_core.c:7064
       l2cap_recv_acldata+0x50b/0x11a0 net/bluetooth/l2cap_core.c:7780
       hci_acldata_packet net/bluetooth/hci_core.c:3784 [inline]
       hci_rx_work+0x545/0xd60 net/bluetooth/hci_core.c:4022
       process_one_work kernel/workqueue.c:2657 [inline]
       process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
       worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
       kthread+0x2fa/0x390 kernel/kthread.c:388
       ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
       ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

other info that might help us debug this:

Chain exists of:
  &hdev->lock --> hci_cb_list_lock --> &conn->lock#2

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&conn->lock#2);
                               lock(hci_cb_list_lock);
                               lock(&conn->lock#2);
  lock(&hdev->lock);

 *** DEADLOCK ***

3 locks held by kworker/u5:0/51:
 #0: ffff88802e2f4d38 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff88802e2f4d38 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90000bbfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90000bbfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffff8880611cf338 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_recv_acldata+0xe2/0x11a0 net/bluetooth/l2cap_core.c:7755

stack backtrace:
CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: hci4 hci_rx_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 check_noncircular+0x2fc/0x400 kernel/locking/lockdep.c:2215
 check_prev_add kernel/locking/lockdep.c:3162 [inline]
 check_prevs_add kernel/locking/lockdep.c:3281 [inline]
 validate_chain kernel/locking/lockdep.c:3897 [inline]
 __lock_acquire+0x3a07/0x7eb0 kernel/locking/lockdep.c:5171
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5790
 __mutex_lock_common kernel/locking/mutex.c:603 [inline]
 __mutex_lock+0x135/0xc80 kernel/locking/mutex.c:747
 hci_le_conn_update+0xd0/0x320 net/bluetooth/hci_conn.c:502
 l2cap_conn_param_update_req net/bluetooth/l2cap_core.c:4750 [inline]
 l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5569 [inline]
 l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5646 [inline]
 l2cap_recv_frame+0xcc96/0xfd60 net/bluetooth/l2cap_core.c:7064
 l2cap_recv_acldata+0x50b/0x11a0 net/bluetooth/l2cap_core.c:7780
 hci_acldata_packet net/bluetooth/hci_core.c:3784 [inline]
 hci_rx_work+0x545/0xd60 net/bluetooth/hci_core.c:4022
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Bluetooth: hci2: command 0x2016 tx timeout
sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:200'
CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 sysfs_warn_dup fs/sysfs/dir.c:30 [inline]
 sysfs_create_dir_ns+0x26e/0x2a0 fs/sysfs/dir.c:63
 create_dir lib/kobject.c:73 [inline]
 kobject_add_internal+0x617/0xc90 lib/kobject.c:240
 kobject_add_varg lib/kobject.c:374 [inline]
 kobject_add+0x164/0x240 lib/kobject.c:426
 device_add+0x3fa/0xc40 drivers/base/core.c:3690
 hci_conn_add_sysfs+0xd5/0x1e0 net/bluetooth/hci_sysfs.c:48
 le_conn_complete_evt+0xe9a/0x1480 net/bluetooth/hci_event.c:5776
 hci_le_conn_complete_evt+0x187/0x440 net/bluetooth/hci_event.c:5825
 hci_event_func net/bluetooth/hci_event.c:7497 [inline]
 hci_event_packet+0x7b4/0x1280 net/bluetooth/hci_event.c:7552
 hci_rx_work+0x43a/0xd60 net/bluetooth/hci_core.c:4017
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
kobject: kobject_add_internal failed for hci1:200 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci1: failed to register connection device
sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:200'
CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 sysfs_warn_dup fs/sysfs/dir.c:30 [inline]
 sysfs_create_dir_ns+0x26e/0x2a0 fs/sysfs/dir.c:63
 create_dir lib/kobject.c:73 [inline]
 kobject_add_internal+0x617/0xc90 lib/kobject.c:240
 kobject_add_varg lib/kobject.c:374 [inline]
 kobject_add+0x164/0x240 lib/kobject.c:426
 device_add+0x3fa/0xc40 drivers/base/core.c:3690
 hci_conn_add_sysfs+0xd5/0x1e0 net/bluetooth/hci_sysfs.c:48
 le_conn_complete_evt+0xe9a/0x1480 net/bluetooth/hci_event.c:5776
 hci_le_conn_complete_evt+0x187/0x440 net/bluetooth/hci_event.c:5825
 hci_event_func net/bluetooth/hci_event.c:7497 [inline]
 hci_event_packet+0x7b4/0x1280 net/bluetooth/hci_event.c:7552
 hci_rx_work+0x43a/0xd60 net/bluetooth/hci_core.c:4017
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
kobject: kobject_add_internal failed for hci1:200 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci1: failed to register connection device
Bluetooth: hci1: command 0x2016 tx timeout
Bluetooth: hci4: command 0x2016 tx timeout

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/04 14:09 linux-6.6.y a91a6aa9253c 57bbd979 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/10 23:39 linux-6.6.y a91a6aa9253c 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/10 23:38 linux-6.6.y a91a6aa9253c 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/10 11:02 linux-6.6.y a91a6aa9253c 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/10 06:57 linux-6.6.y a91a6aa9253c 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/05 00:28 linux-6.6.y a91a6aa9253c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/05 00:27 linux-6.6.y a91a6aa9253c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/05 00:22 linux-6.6.y a91a6aa9253c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/04 01:50 linux-6.6.y a91a6aa9253c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/04 01:50 linux-6.6.y a91a6aa9253c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/02 00:23 linux-6.6.y 79643295eba1 f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
2026/10/02 00:07 linux-6.6.y 79643295eba1 f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan possible deadlock in hci_le_conn_update
* Struck through repros no longer work on HEAD.