WARNING: locking bug in hci_dev

WARNING: locking bug in hci_dev_reset
Status: upstream: reported syz repro on 2020/08/05 06:17
Reported-by: syzbot+f456fc1d58a1f67c401f@syzkaller.appspotmail.com
First crash: 357d, last: 76d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: syz .config

Fix bisection: the fix commit could be any of (bisect log):
ac3a0c847296 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
f4cdcae03f9c Merge branch 'cxgb4-fixes'

Sample crash report:

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 0 PID: 22435 at kernel/locking/lockdep.c:183 hlock_class kernel/locking/lockdep.c:183 [inline]
WARNING: CPU: 0 PID: 22435 at kernel/locking/lockdep.c:183 hlock_class kernel/locking/lockdep.c:172 [inline]
WARNING: CPU: 0 PID: 22435 at kernel/locking/lockdep.c:183 check_wait_context kernel/locking/lockdep.c:4054 [inline]
WARNING: CPU: 0 PID: 22435 at kernel/locking/lockdep.c:183 __lock_acquire+0x1629/0x56e0 kernel/locking/lockdep.c:4330
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 22435 Comm: syz-executor.2 Not tainted 5.8.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:231
 __warn.cold+0x20/0x45 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x38/0x90 arch/x86/kernel/traps.c:235
 exc_invalid_op+0x13/0x40 arch/x86/kernel/traps.c:255
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:540
RIP: 0010:hlock_class kernel/locking/lockdep.c:183 [inline]
RIP: 0010:hlock_class kernel/locking/lockdep.c:172 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4054 [inline]
RIP: 0010:__lock_acquire+0x1629/0x56e0 kernel/locking/lockdep.c:4330
Code: 08 84 d2 0f 85 bd 35 00 00 8b 35 a2 a2 55 09 85 f6 0f 85 cc fa ff ff 48 c7 c6 20 b0 4b 88 48 c7 c7 20 ab 4b 88 e8 b9 44 eb ff <0f> 0b e9 b2 fa ff ff e8 3b a0 8e 06 85 c0 0f 84 ed fa ff ff 48 c7
RSP: 0018:ffffc90002a17810 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff8880949044c0 RSI: ffffffff815d4ef7 RDI: fffff52000542ef4
RBP: ffff888094904db8 R08: 0000000000000000 R09: ffffffff89bb5c23
R10: 0000000000000aea R11: 0000000000000001 R12: ffff8880949044c0
R13: 00000000000006d9 R14: ffff88809487c138 R15: 0000000000040000
 lock_acquire+0x1f1/0xad0 kernel/locking/lockdep.c:4959
 flush_workqueue+0x110/0x13e0 kernel/workqueue.c:2780
 drain_workqueue+0x1a5/0x3c0 kernel/workqueue.c:2945
 hci_dev_do_reset net/bluetooth/hci_core.c:1864 [inline]
 hci_dev_reset+0x23e/0x450 net/bluetooth/hci_core.c:1907
 hci_sock_ioctl+0x510/0x800 net/bluetooth/hci_sock.c:1036
 sock_do_ioctl+0xcb/0x2d0 net/socket.c:1048
 sock_ioctl+0x3b8/0x730 net/socket.c:1199
 vfs_ioctl fs/ioctl.c:48 [inline]
 ksys_ioctl+0x11a/0x180 fs/ioctl.c:753
 __do_sys_ioctl fs/ioctl.c:762 [inline]
 __se_sys_ioctl fs/ioctl.c:760 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:760
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45cce9
Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fab01629c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000001d300 RCX: 000000000045cce9
RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000006
RBP: 000000000078c120 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c0ec
R13: 00007ffc2d1075ff R14: 00007fab0162a9c0 R15: 000000000078c0ec
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-net-this-kasan-gce	2020/08/05 06:03	net	ac3a0c847296	80a06902	.config	log	report	syz