======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.3.7/4417 is trying to acquire lock:
ffff0000cba3c938 ((wq_completion)nfc2_nci_tx_wq){+.+.}-{0:0}, at: __flush_workqueue+0x108/0x1060 kernel/workqueue.c:2809

but task is already holding lock:
ffff0000cd735350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0xe8/0x57c net/nfc/nci/core.c:560

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #5 (&ndev->req_lock){+.+.}-{3:3}:
       __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
       __mutex_lock kernel/locking/mutex.c:747 [inline]
       mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
       nci_request net/nfc/nci/core.c:148 [inline]
       nci_set_local_general_bytes net/nfc/nci/core.c:776 [inline]
       nci_start_poll+0x424/0xaa0 net/nfc/nci/core.c:840
       nfc_start_poll+0x124/0x284 net/nfc/core.c:225
       nfc_genl_start_poll+0x1b0/0x2f4 net/nfc/netlink.c:828
       genl_family_rcv_msg_doit+0x210/0x308 net/netlink/genetlink.c:756
       genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
       genl_rcv_msg+0x424/0x600 net/netlink/genetlink.c:850
       netlink_rcv_skb+0x220/0x3ec net/netlink/af_netlink.c:2516
       genl_rcv+0x38/0x50 net/netlink/genetlink.c:861
       netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
       netlink_unicast+0x5fc/0x80c net/netlink/af_netlink.c:1344
       netlink_sendmsg+0x6f0/0x9d8 net/netlink/af_netlink.c:1877
       sock_sendmsg_nosec net/socket.c:718 [inline]
       __sock_sendmsg net/socket.c:730 [inline]
       ____sys_sendmsg+0x588/0x90c net/socket.c:2519
       ___sys_sendmsg net/socket.c:2573 [inline]
       __sys_sendmsg+0x288/0x374 net/socket.c:2602
       __do_sys_sendmsg net/socket.c:2611 [inline]
       __se_sys_sendmsg net/socket.c:2609 [inline]
       __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #4 (&genl_data->genl_data_mutex){+.+.}-{3:3}:
       __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
       __mutex_lock kernel/locking/mutex.c:747 [inline]
       mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
       nfc_urelease_event_work+0x108/0x2b8 net/nfc/netlink.c:1849
       process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
       worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
       kthread+0x254/0x2e0 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #3 (nfc_devlist_mutex){+.+.}-{3:3}:
       __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
       __mutex_lock kernel/locking/mutex.c:747 [inline]
       mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
       nfc_register_device+0x48/0x300 net/nfc/core.c:1116
       nci_register_device+0x6b8/0x7e4 net/nfc/nci/core.c:1272
       virtual_ncidev_open+0x6c/0xd8 drivers/nfc/virtual_ncidev.c:146
       misc_open+0x310/0x388 drivers/char/misc.c:145
       chrdev_open+0x3d0/0x51c fs/char_dev.c:414
       do_dentry_open+0x738/0xf8c fs/open.c:882
       vfs_open+0x7c/0x90 fs/open.c:1015
       do_open fs/namei.c:3677 [inline]
       path_openat+0x1fc0/0x27a0 fs/namei.c:3834
       do_filp_open+0x198/0x38c fs/namei.c:3861
       do_sys_openat2+0x134/0x3fc fs/open.c:1320
       do_sys_open fs/open.c:1336 [inline]
       __do_sys_openat fs/open.c:1352 [inline]
       __se_sys_openat fs/open.c:1347 [inline]
       __arm64_sys_openat+0x11c/0x150 fs/open.c:1347
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #2 (nci_mutex){+.+.}-{3:3}:
       __mutex_lock_common+0x1a0/0x1f3c kernel/locking/mutex.c:603
       __mutex_lock kernel/locking/mutex.c:747 [inline]
       mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
       virtual_nci_send+0x28/0xe4 drivers/nfc/virtual_ncidev.c:54
       nci_send_frame net/nfc/nci/core.c:1364 [inline]
       nci_tx_work+0x288/0x500 net/nfc/nci/core.c:1527
       process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
       worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
       kthread+0x254/0x2e0 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #1 ((work_completion)(&ndev->tx_work)){+.+.}-{0:0}:
       process_one_work+0x710/0x13bc kernel/workqueue.c:2268
       worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
       kthread+0x254/0x2e0 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #0 ((wq_completion)nfc2_nci_tx_wq){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3095 [inline]
       check_prevs_add kernel/locking/lockdep.c:3214 [inline]
       validate_chain kernel/locking/lockdep.c:3830 [inline]
       __lock_acquire+0x2808/0x6634 kernel/locking/lockdep.c:5063
       lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5678
       __flush_workqueue+0x134/0x1060 kernel/workqueue.c:2812
       nci_close_device+0x188/0x57c net/nfc/nci/core.c:578
       nci_unregister_device+0x78/0x258 net/nfc/nci/core.c:1309
       virtual_ncidev_close+0x70/0xb0 drivers/nfc/virtual_ncidev.c:166
       __fput+0x1b4/0x7b0 fs/file_table.c:320
       ____fput+0x20/0x30 fs/file_table.c:348
       task_work_run+0x1f4/0x280 kernel/task_work.c:203
       resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
       do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
       prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
       exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
       el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

other info that might help us debug this:

Chain exists of:
  (wq_completion)nfc2_nci_tx_wq --> &genl_data->genl_data_mutex --> &ndev->req_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ndev->req_lock);
                               lock(&genl_data->genl_data_mutex);
                               lock(&ndev->req_lock);
  lock((wq_completion)nfc2_nci_tx_wq);

 *** DEADLOCK ***

1 lock held by syz.3.7/4417:
 #0: ffff0000cd735350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0xe8/0x57c net/nfc/nci/core.c:560

stack backtrace:
CPU: 1 PID: 4417 Comm: syz.3.7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2048
 check_noncircular+0x264/0x2f8 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3095 [inline]
 check_prevs_add kernel/locking/lockdep.c:3214 [inline]
 validate_chain kernel/locking/lockdep.c:3830 [inline]
 __lock_acquire+0x2808/0x6634 kernel/locking/lockdep.c:5063
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5678
 __flush_workqueue+0x134/0x1060 kernel/workqueue.c:2812
 nci_close_device+0x188/0x57c net/nfc/nci/core.c:578
 nci_unregister_device+0x78/0x258 net/nfc/nci/core.c:1309
 virtual_ncidev_close+0x70/0xb0 drivers/nfc/virtual_ncidev.c:166
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint: atomic_set include/linux/atomic/atomic-instrumented.h:-1 [inline]
ODEBUG: free active (active state 0) object type: timer_list hint: nci_data_timer+0x0/0x94 net/nfc/nci/core.c:616
WARNING: CPU: 1 PID: 4417 at lib/debugobjects.c:518 debug_print_object lib/debugobjects.c:515 [inline]
WARNING: CPU: 1 PID: 4417 at lib/debugobjects.c:518 __debug_check_no_obj_freed lib/debugobjects.c:1045 [inline]
WARNING: CPU: 1 PID: 4417 at lib/debugobjects.c:518 debug_check_no_obj_freed+0x2d4/0x454 lib/debugobjects.c:1075
Modules linked in:
CPU: 1 PID: 4417 Comm: syz.3.7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:515 [inline]
pc : __debug_check_no_obj_freed lib/debugobjects.c:1045 [inline]
pc : debug_check_no_obj_freed+0x2d4/0x454 lib/debugobjects.c:1075
lr : debug_print_object lib/debugobjects.c:515 [inline]
lr : __debug_check_no_obj_freed lib/debugobjects.c:1045 [inline]
lr : debug_check_no_obj_freed+0x2d4/0x454 lib/debugobjects.c:1075
sp : ffff800020fc7890
x29: ffff800020fc78c0 x28: ffff0000f596bf38 x27: 0000000000000000
x26: ffff800011d3b280 x25: ffff0000cd7350a0 x24: ffff8000118cd0a4
x23: 1ffff00003901987 x22: ffff0000cd735800 x21: dfff800000000000
x20: ffff800011d3b288 x19: ffff0000cd735000 x18: 1fffe00033e6db7e
x17: 6e6968207473696c x16: ffff800011bb65f8 x15: 6570797420746365
x14: 0000000000000001 x13: 1fffe00033e6dba3 x12: 0000000000000000
x11: ff00800008195f68 x10: 0000000000000000 x9 : b55910d677a1a600
x8 : b55910d677a1a600 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020fc7318 x4 : ffff8000154a4e80 x3 : ffff800008541118
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
 debug_print_object lib/debugobjects.c:515 [inline]
 __debug_check_no_obj_freed lib/debugobjects.c:1045 [inline]
 debug_check_no_obj_freed+0x2d4/0x454 lib/debugobjects.c:1075
 slab_free_hook mm/slub.c:1704 [inline]
 slab_free_freelist_hook+0x104/0x1e8 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xbc/0x21c mm/slub.c:3700
 kfree+0xd0/0x1a8 mm/slab_common.c:988
 nci_free_device+0x8c/0xa0 net/nfc/nci/core.c:1221
 virtual_ncidev_close+0x78/0xb0 drivers/nfc/virtual_ncidev.c:167
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 5635
hardirqs last  enabled at (5635): [<ffff800011c9da4c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (5635): [<ffff800011c9da4c>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (5634): [<ffff800011c9d870>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (5634): [<ffff800011c9d870>] _raw_spin_lock_irqsave+0xa4/0xb0 kernel/locking/spinlock.c:162
softirqs last  enabled at (5346): [<ffff80000d55fd90>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (5346): [<ffff80000d55fd90>] remove_user_radios drivers/net/wireless/mac80211_hwsim.c:5391 [inline]
softirqs last  enabled at (5346): [<ffff80000d55fd90>] mac80211_hwsim_netlink_notify+0x31c/0x750 drivers/net/wireless/mac80211_hwsim.c:5409
softirqs last disabled at (5344): [<ffff80000d55fb78>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (5344): [<ffff80000d55fb78>] remove_user_radios drivers/net/wireless/mac80211_hwsim.c:5382 [inline]
softirqs last disabled at (5344): [<ffff80000d55fb78>] mac80211_hwsim_netlink_notify+0x104/0x750 drivers/net/wireless/mac80211_hwsim.c:5409
---[ end trace 0000000000000000 ]---