program: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3eee}, [@IFLA_MTU={0x8, 0x4, 0x3eee}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) [ 73.893067][ T4662] Bluetooth: hci0: command tx timeout [ 74.050896][ T5319] lo: entered allmulticast mode [ 74.074239][ T5319] bond0: entered allmulticast mode [ 74.077549][ T5319] dummy0: entered allmulticast mode [ 74.096215][ T5319] eql: entered allmulticast mode [ 74.100563][ T5319] ifb0: entered allmulticast mode [ 74.115856][ T5319] ifb1: entered allmulticast mode [ 74.302398][ T9] e1000 0000:00:06.0 eth0: Reset adapter [ 74.312336][ T5319] [ 74.313399][ T5319] ====================================================== [ 74.316410][ T5319] WARNING: possible circular locking dependency detected [ 74.319374][ T5319] 6.15.0-rc7-syzkaller-00144-gb1427432d3b6 #0 Not tainted [ 74.322262][ T5319] ------------------------------------------------------ [ 74.325358][ T5319] syz.0.0/5319 is trying to acquire lock: [ 74.327829][ T5319] ffff8880350d16f0 ((work_completion)(&adapter->reset_task)){+.+.}-{0:0}, at: __flush_work+0xd2/0xbc0 [ 74.332831][ T5319] [ 74.332831][ T5319] but task is already holding lock: [ 74.335992][ T5319] ffffffff8f2fab48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 74.339794][ T5319] [ 74.339794][ T5319] which lock already depends on the new lock. [ 74.339794][ T5319] [ 74.344110][ T5319] [ 74.344110][ T5319] the existing dependency chain (in reverse order) is: [ 74.347873][ T5319] [ 74.347873][ T5319] -> #1 (rtnl_mutex){+.+.}-{4:4}: [ 74.350785][ T5319] lock_acquire+0x120/0x360 [ 74.352916][ T5319] __mutex_lock+0x182/0xe80 [ 74.355127][ T5319] e1000_reset_task+0x56/0xc0 [ 74.357436][ T5319] process_scheduled_works+0xadb/0x17a0 [ 74.360004][ T5319] worker_thread+0x8a0/0xda0 [ 74.362260][ T5319] kthread+0x70e/0x8a0 [ 74.364324][ T5319] ret_from_fork+0x4b/0x80 [ 74.366540][ T5319] ret_from_fork_asm+0x1a/0x30 [ 74.368802][ T5319] [ 74.368802][ T5319] -> #0 ((work_completion)(&adapter->reset_task)){+.+.}-{0:0}: [ 74.372772][ T5319] validate_chain+0xb9b/0x2140 [ 74.375002][ T5319] __lock_acquire+0xaac/0xd20 [ 74.377435][ T5319] lock_acquire+0x120/0x360 [ 74.379563][ T5319] __flush_work+0x6b8/0xbc0 [ 74.381720][ T5319] __cancel_work_sync+0xbe/0x110 [ 74.384075][ T5319] e1000_down+0x402/0x6b0 [ 74.386196][ T5319] e1000_close+0x17b/0xa10 [ 74.388346][ T5319] __dev_close_many+0x361/0x6f0 [ 74.390710][ T5319] __dev_change_flags+0x2c7/0x6d0 [ 74.393075][ T5319] netif_change_flags+0x88/0x1a0 [ 74.395507][ T5319] do_setlink+0xcb9/0x40d0 [ 74.397783][ T5319] rtnl_newlink+0x149f/0x1c70 [ 74.400087][ T5319] rtnetlink_rcv_msg+0x7cc/0xb70 [ 74.402484][ T5319] netlink_rcv_skb+0x219/0x490 [ 74.404871][ T5319] netlink_unicast+0x75b/0x8d0 [ 74.407285][ T5319] netlink_sendmsg+0x805/0xb30 [ 74.409727][ T5319] __sock_sendmsg+0x21c/0x270 [ 74.412075][ T5319] ____sys_sendmsg+0x505/0x830 [ 74.414349][ T5319] ___sys_sendmsg+0x21f/0x2a0 [ 74.416585][ T5319] __x64_sys_sendmsg+0x19b/0x260 [ 74.419081][ T5319] do_syscall_64+0xf6/0x210 [ 74.421311][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.424185][ T5319] [ 74.424185][ T5319] other info that might help us debug this: [ 74.424185][ T5319] [ 74.428613][ T5319] Possible unsafe locking scenario: [ 74.428613][ T5319] [ 74.431784][ T5319] CPU0 CPU1 [ 74.434007][ T5319] ---- ---- [ 74.436284][ T5319] lock(rtnl_mutex); [ 74.437985][ T5319] lock((work_completion)(&adapter->reset_task)); [ 74.441840][ T5319] lock(rtnl_mutex); [ 74.444661][ T5319] lock((work_completion)(&adapter->reset_task)); [ 74.447565][ T5319] [ 74.447565][ T5319] *** DEADLOCK *** [ 74.447565][ T5319] [ 74.451079][ T5319] 2 locks held by syz.0.0/5319: [ 74.453241][ T5319] #0: ffffffff8f2fab48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 74.457289][ T5319] #1: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xd2/0xbc0 [ 74.461264][ T5319] [ 74.461264][ T5319] stack backtrace: [ 74.463832][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted 6.15.0-rc7-syzkaller-00144-gb1427432d3b6 #0 PREEMPT(full) [ 74.463848][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 74.463856][ T5319] Call Trace: [ 74.463863][ T5319] [ 74.463869][ T5319] dump_stack_lvl+0x189/0x250 [ 74.463891][ T5319] ? __pfx_dump_stack_lvl+0x10/0x10 [ 74.463908][ T5319] ? __pfx__printk+0x10/0x10 [ 74.463920][ T5319] ? print_lock_name+0xde/0x100 [ 74.463938][ T5319] print_circular_bug+0x2ee/0x310 [ 74.463951][ T5319] check_noncircular+0x134/0x160 [ 74.463970][ T5319] validate_chain+0xb9b/0x2140 [ 74.463982][ T5319] ? do_raw_spin_lock+0x121/0x290 [ 74.463998][ T5319] ? look_up_lock_class+0x74/0x170 [ 74.464012][ T5319] ? register_lock_class+0x51/0x320 [ 74.464035][ T5319] __lock_acquire+0xaac/0xd20 [ 74.464059][ T5319] ? __flush_work+0xd2/0xbc0 [ 74.464070][ T5319] lock_acquire+0x120/0x360 [ 74.464086][ T5319] ? __flush_work+0xd2/0xbc0 [ 74.464099][ T5319] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.464113][ T5319] ? __flush_work+0xd2/0xbc0 [ 74.464130][ T5319] __flush_work+0x6b8/0xbc0 [ 74.464143][ T5319] ? __flush_work+0xd2/0xbc0 [ 74.464155][ T5319] ? __flush_work+0xd2/0xbc0 [ 74.464167][ T5319] ? __pfx___flush_work+0x10/0x10 [ 74.464180][ T5319] ? __pfx_wq_barrier_func+0x10/0x10 [ 74.464194][ T5319] ? __pfx___cancel_work+0x10/0x10 [ 74.464206][ T5319] ? __local_bh_enable_ip+0x12d/0x1c0 [ 74.464219][ T5319] __cancel_work_sync+0xbe/0x110 [ 74.464232][ T5319] e1000_down+0x402/0x6b0 [ 74.464249][ T5319] ? e1000_down+0xb2/0x6b0 [ 74.464265][ T5319] ? e1000_free_all_tx_resources+0x1b0/0x280 [ 74.464282][ T5319] e1000_close+0x17b/0xa10 [ 74.464298][ T5319] ? do_raw_spin_unlock+0x4d/0x240 [ 74.464311][ T5319] ? dev_deactivate_many+0xb82/0xd40 [ 74.464327][ T5319] ? __pfx_e1000_close+0x10/0x10 [ 74.464343][ T5319] ? dev_deactivate_many+0x258/0xd40 [ 74.464357][ T5319] ? __pfx_e1000_close+0x10/0x10 [ 74.464373][ T5319] __dev_close_many+0x361/0x6f0 [ 74.464388][ T5319] ? __pfx___dev_close_many+0x10/0x10 [ 74.464403][ T5319] __dev_change_flags+0x2c7/0x6d0 [ 74.464418][ T5319] ? __pfx_netif_set_mtu_ext+0x10/0x10 [ 74.464433][ T5319] ? __pfx___dev_change_flags+0x10/0x10 [ 74.464447][ T5319] ? netif_state_change+0x256/0x3a0 [ 74.464462][ T5319] netif_change_flags+0x88/0x1a0 [ 74.464478][ T5319] do_setlink+0xcb9/0x40d0 [ 74.464496][ T5319] ? __pfx_do_setlink+0x10/0x10 [ 74.464509][ T5319] ? do_raw_spin_lock+0x121/0x290 [ 74.464532][ T5319] ? lockdep_hardirqs_on+0x9c/0x150 [ 74.464546][ T5319] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 74.464559][ T5319] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 74.464573][ T5319] ? rcu_is_watching+0x15/0xb0 [ 74.464585][ T5319] ? __mutex_lock+0xa6d/0xe80 [ 74.464601][ T5319] ? __mutex_lock+0x51b/0xe80 [ 74.464618][ T5319] ? rtnl_newlink+0x8db/0x1c70 [ 74.464632][ T5319] ? __pfx___mutex_lock+0x10/0x10 [ 74.464653][ T5319] ? ns_capable+0x8a/0xf0 [ 74.464665][ T5319] ? rtnl_link_get_net_capable+0x16a/0x350 [ 74.464681][ T5319] rtnl_newlink+0x149f/0x1c70 [ 74.464698][ T5319] ? __pfx_rtnl_newlink+0x10/0x10 [ 74.464712][ T5319] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 74.464725][ T5319] ? lockdep_hardirqs_on+0x9c/0x150 [ 74.464739][ T5319] ? __lock_acquire+0xaac/0xd20 [ 74.464758][ T5319] ? __lock_acquire+0xaac/0xd20 [ 74.464775][ T5319] ? is_bpf_text_address+0x26/0x2b0 [ 74.464793][ T5319] ? is_bpf_text_address+0x292/0x2b0 [ 74.464808][ T5319] ? is_bpf_text_address+0x26/0x2b0 [ 74.464825][ T5319] ? aa_get_newest_label+0xf7/0x5d0 [ 74.464839][ T5319] ? __lock_acquire+0xaac/0xd20 [ 74.464860][ T5319] ? __pfx_rtnl_newlink+0x10/0x10 [ 74.464872][ T5319] rtnetlink_rcv_msg+0x7cc/0xb70 [ 74.464885][ T5319] ? kasan_save_track+0x4f/0x80 [ 74.464899][ T5319] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 74.464911][ T5319] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 74.464924][ T5319] ? __lock_acquire+0xaac/0xd20 [ 74.464939][ T5319] netlink_rcv_skb+0x219/0x490 [ 74.464951][ T5319] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 74.464962][ T5319] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 74.464977][ T5319] ? netlink_deliver_tap+0x2e/0x1b0 [ 74.464987][ T5319] ? netlink_deliver_tap+0x2e/0x1b0 [ 74.464996][ T5319] netlink_unicast+0x75b/0x8d0 [ 74.465007][ T5319] netlink_sendmsg+0x805/0xb30 [ 74.465019][ T5319] ? __pfx_netlink_sendmsg+0x10/0x10 [ 74.465032][ T5319] ? aa_sock_msg_perm+0x94/0x160 [ 74.465043][ T5319] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 74.465054][ T5319] ? __pfx_netlink_sendmsg+0x10/0x10 [ 74.465067][ T5319] __sock_sendmsg+0x21c/0x270 [ 74.465078][ T5319] ____sys_sendmsg+0x505/0x830 [ 74.465098][ T5319] ? __pfx_____sys_sendmsg+0x10/0x10 [ 74.465111][ T5319] ? import_iovec+0x74/0xa0 [ 74.465124][ T5319] ___sys_sendmsg+0x21f/0x2a0 [ 74.465138][ T5319] ? __pfx____sys_sendmsg+0x10/0x10 [ 74.465158][ T5319] ? __fget_files+0x2a/0x420 [ 74.465172][ T5319] ? __fget_files+0x3a0/0x420 [ 74.465187][ T5319] __x64_sys_sendmsg+0x19b/0x260 [ 74.465201][ T5319] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 74.465219][ T5319] ? do_syscall_64+0xba/0x210 [ 74.465231][ T5319] do_syscall_64+0xf6/0x210 [ 74.465246][ T5319] ? clear_bhb_loop+0x60/0xb0 [ 74.465257][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.465267][ T5319] RIP: 0033:0x7f66b598e969 [ 74.465280][ T5319] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 74.465288][ T5319] RSP: 002b:00007f66b680c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 74.465299][ T5319] RAX: ffffffffffffffda RBX: 00007f66b5bb5fa0 RCX: 00007f66b598e969 [ 74.465308][ T5319] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 74.465314][ T5319] RBP: 00007f66b5a10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 74.465321][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.465326][ T5319] R13: 0000000000000000 R14: 00007f66b5bb5fa0 R15: 00007ffe8433f558 [ 74.465337][ T5319] [ 75.921352][ T4662] Bluetooth: hci0: command tx timeout [ 76.482129][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.484850][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 78.001907][ T4662] Bluetooth: hci0: command tx timeout [ 80.081190][ T4662] Bluetooth: hci0: command tx timeout