program:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000280)={r0, r0, 0xc, 0x0, 0x0, 0x9, 0x1, 0x457, 0x9, 0x9, 0x1, 0x1, 'syz1\x00'})
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) (fail_nth: 5)
[ 85.419807][ T5312] Bluetooth: hci0: command tx timeout
[ 85.527632][ T5335] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input5
[ 85.571603][ T5335] FAULT_INJECTION: forcing a failure.
[ 85.571603][ T5335] name failslab, interval 1, probability 0, space 0, times 1
[ 85.576265][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted 6.16.0-syzkaller-04055-g14bed9bc81ba #0 PREEMPT(full)
[ 85.576276][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 85.576281][ T5335] Call Trace:
[ 85.576288][ T5335]
[ 85.576292][ T5335] dump_stack_lvl+0x189/0x250
[ 85.576382][ T5335] ? __pfx____ratelimit+0x10/0x10
[ 85.576424][ T5335] ? __pfx_dump_stack_lvl+0x10/0x10
[ 85.576435][ T5335] ? __pfx__printk+0x10/0x10
[ 85.576453][ T5335] ? __pfx___might_resched+0x10/0x10
[ 85.576463][ T5335] ? fs_reclaim_acquire+0x7d/0x100
[ 85.576506][ T5335] should_fail_ex+0x414/0x560
[ 85.576524][ T5335] should_failslab+0xa8/0x100
[ 85.576545][ T5335] __kmalloc_node_track_caller_noprof+0xcc/0x4e0
[ 85.576554][ T5335] ? kasprintf+0xd4/0x120
[ 85.576564][ T5335] kvasprintf+0xdc/0x190
[ 85.576570][ T5335] ? l2cap_conn_del+0x23d/0x680
[ 85.576605][ T5335] ? __pfx_kvasprintf+0x10/0x10
[ 85.576611][ T5335] ? check_path+0x21/0x40
[ 85.576623][ T5335] kasprintf+0xd4/0x120
[ 85.576630][ T5335] ? lockdep_unlock+0x89/0x120
[ 85.576640][ T5335] ? __pfx_kasprintf+0x10/0x10
[ 85.576651][ T5335] ? __pfx_input_devnode+0x10/0x10
[ 85.576660][ T5335] device_get_devnode+0x168/0x2a0
[ 85.576672][ T5335] devtmpfs_delete_node+0xcb/0x1d0
[ 85.576683][ T5335] ? __pfx_devtmpfs_delete_node+0x10/0x10
[ 85.576700][ T5335] ? __pfx_klist_children_put+0x10/0x10
[ 85.576708][ T5335] ? _raw_spin_unlock+0x28/0x50
[ 85.576715][ T5335] ? klist_del+0xc7/0x110
[ 85.576724][ T5335] device_del+0x2cf/0x8e0
[ 85.576734][ T5335] ? __input_unregister_device+0x2d8/0x5e0
[ 85.576744][ T5335] ? __pfx_device_del+0x10/0x10
[ 85.576757][ T5335] cdev_device_del+0x27/0xf0
[ 85.576767][ T5335] evdev_disconnect+0x4c/0xb0
[ 85.576778][ T5335] __input_unregister_device+0x356/0x5e0
[ 85.576788][ T5335] ? __wake_up_common_lock+0x190/0x1f0
[ 85.576798][ T5335] input_unregister_device+0x9b/0x100
[ 85.576807][ T5335] hidp_session_remove+0x135/0x260
[ 85.576818][ T5335] l2cap_conn_del+0x23d/0x680
[ 85.576829][ T5335] ? __pfx_l2cap_disconn_cfm+0x10/0x10
[ 85.576839][ T5335] hci_conn_hash_flush+0x10a/0x230
[ 85.576848][ T5335] hci_dev_close_sync+0xaef/0x1330
[ 85.576862][ T5335] ? __pfx_hci_dev_close_sync+0x10/0x10
[ 85.576877][ T5335] ? do_raw_read_unlock+0x3d/0x80
[ 85.576894][ T5335] hci_dev_close+0x108/0x200
[ 85.576909][ T5335] sock_do_ioctl+0xdc/0x300
[ 85.576919][ T5335] ? __pfx_sock_do_ioctl+0x10/0x10
[ 85.576926][ T5335] ? __lock_acquire+0xab9/0xd20
[ 85.576941][ T5335] sock_ioctl+0x576/0x790
[ 85.576950][ T5335] ? __pfx_sock_ioctl+0x10/0x10
[ 85.576957][ T5335] ? __fget_files+0x2a/0x420
[ 85.576964][ T5335] ? __fget_files+0x3a0/0x420
[ 85.576971][ T5335] ? __fget_files+0x2a/0x420
[ 85.576980][ T5335] ? bpf_lsm_file_ioctl+0x9/0x20
[ 85.576987][ T5335] ? __pfx_sock_ioctl+0x10/0x10
[ 85.576994][ T5335] __se_sys_ioctl+0xfc/0x170
[ 85.577005][ T5335] do_syscall_64+0xfa/0x3b0
[ 85.577013][ T5335] ? lockdep_hardirqs_on+0x9c/0x150
[ 85.577020][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.577027][ T5335] ? clear_bhb_loop+0x60/0xb0
[ 85.577035][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.577042][ T5335] RIP: 0033:0x7f259b18e9a9
[ 85.577051][ T5335] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 85.577056][ T5335] RSP: 002b:00007f259c03a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 85.577065][ T5335] RAX: ffffffffffffffda RBX: 00007f259b3b5fa0 RCX: 00007f259b18e9a9
[ 85.577070][ T5335] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000006
[ 85.577074][ T5335] RBP: 00007f259c03a090 R08: 0000000000000000 R09: 0000000000000000
[ 85.577078][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 85.577082][ T5335] R13: 0000000000000000 R14: 00007f259b3b5fa0 R15: 00007ffc4b108ca8
[ 85.577096][ T5335]
[ 85.778006][ T5335]
[ 85.779172][ T5335] ======================================================
[ 85.782180][ T5335] WARNING: possible circular locking dependency detected
[ 85.785669][ T5335] 6.16.0-syzkaller-04055-g14bed9bc81ba #0 Not tainted
[ 85.789167][ T5335] ------------------------------------------------------
[ 85.792438][ T5335] syz.0.0/5335 is trying to acquire lock:
[ 85.794958][ T5335] ffff88803f424840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: __flush_work+0xd2/0xbc0
[ 85.800297][ T5335]
[ 85.800297][ T5335] but task is already holding lock:
[ 85.803679][ T5335] ffff88803f424b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680
[ 85.808381][ T5335]
[ 85.808381][ T5335] which lock already depends on the new lock.
[ 85.808381][ T5335]
[ 85.812907][ T5335]
[ 85.812907][ T5335] the existing dependency chain (in reverse order) is:
[ 85.816684][ T5335]
[ 85.816684][ T5335] -> #1 (&conn->lock#2){+.+.}-{4:4}:
[ 85.820269][ T5335] lock_acquire+0x120/0x360
[ 85.822777][ T5335] __mutex_lock+0x182/0xe80
[ 85.825530][ T5335] l2cap_info_timeout+0x60/0xa0
[ 85.828200][ T5335] process_scheduled_works+0xade/0x17b0
[ 85.830909][ T5335] worker_thread+0x8a0/0xda0
[ 85.833021][ T5335] kthread+0x711/0x8a0
[ 85.835075][ T5335] ret_from_fork+0x3f9/0x770
[ 85.837268][ T5335] ret_from_fork_asm+0x1a/0x30
[ 85.839502][ T5335]
[ 85.839502][ T5335] -> #0 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}:
[ 85.844360][ T5335] validate_chain+0xb9b/0x2140
[ 85.847395][ T5335] __lock_acquire+0xab9/0xd20
[ 85.849883][ T5335] lock_acquire+0x120/0x360
[ 85.852189][ T5335] __flush_work+0x6b8/0xbc0
[ 85.854426][ T5335] __cancel_work_sync+0xbe/0x110
[ 85.856871][ T5335] l2cap_conn_del+0x4f0/0x680
[ 85.859042][ T5335] hci_conn_hash_flush+0x10a/0x230
[ 85.861497][ T5335] hci_dev_close_sync+0xaef/0x1330
[ 85.864275][ T5335] hci_dev_close+0x108/0x200
[ 85.866935][ T5335] sock_do_ioctl+0xdc/0x300
[ 85.869960][ T5335] sock_ioctl+0x576/0x790
[ 85.872587][ T5335] __se_sys_ioctl+0xfc/0x170
[ 85.874838][ T5335] do_syscall_64+0xfa/0x3b0
[ 85.877181][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.880077][ T5335]
[ 85.880077][ T5335] other info that might help us debug this:
[ 85.880077][ T5335]
[ 85.884235][ T5335] Possible unsafe locking scenario:
[ 85.884235][ T5335]
[ 85.887383][ T5335] CPU0 CPU1
[ 85.889679][ T5335] ---- ----
[ 85.892188][ T5335] lock(&conn->lock#2);
[ 85.894453][ T5335] lock((work_completion)(&(&conn->info_timer)->work));
[ 85.898635][ T5335] lock(&conn->lock#2);
[ 85.901769][ T5335] lock((work_completion)(&(&conn->info_timer)->work));
[ 85.904723][ T5335]
[ 85.904723][ T5335] *** DEADLOCK ***
[ 85.904723][ T5335]
[ 85.908635][ T5335] 5 locks held by syz.0.0/5335:
[ 85.911032][ T5335] #0: ffff8880332c8dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_close+0x100/0x200
[ 85.915096][ T5335] #1: ffff8880332c80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330
[ 85.919370][ T5335] #2: ffffffff8f66f2c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230
[ 85.924402][ T5335] #3: ffff88803f424b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680
[ 85.929161][ T5335] #4: ffffffff8e13ab20 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xd2/0xbc0
[ 85.933166][ T5335]
[ 85.933166][ T5335] stack backtrace:
[ 85.935813][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted 6.16.0-syzkaller-04055-g14bed9bc81ba #0 PREEMPT(full)
[ 85.935838][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 85.935844][ T5335] Call Trace:
[ 85.935852][ T5335]
[ 85.935858][ T5335] dump_stack_lvl+0x189/0x250
[ 85.935875][ T5335] ? __pfx_dump_stack_lvl+0x10/0x10
[ 85.935885][ T5335] ? __pfx__printk+0x10/0x10
[ 85.935899][ T5335] ? print_lock_name+0xde/0x100
[ 85.935912][ T5335] print_circular_bug+0x2ee/0x310
[ 85.935925][ T5335] check_noncircular+0x134/0x160
[ 85.935937][ T5335] validate_chain+0xb9b/0x2140
[ 85.935948][ T5335] ? do_raw_spin_lock+0x121/0x290
[ 85.935961][ T5335] ? look_up_lock_class+0x74/0x170
[ 85.935973][ T5335] ? register_lock_class+0x51/0x320
[ 85.935990][ T5335] __lock_acquire+0xab9/0xd20
[ 85.936005][ T5335] ? __flush_work+0xd2/0xbc0
[ 85.936015][ T5335] lock_acquire+0x120/0x360
[ 85.936028][ T5335] ? __flush_work+0xd2/0xbc0
[ 85.936040][ T5335] ? _raw_spin_unlock_irq+0x23/0x50
[ 85.936050][ T5335] ? __flush_work+0xd2/0xbc0
[ 85.936059][ T5335] __flush_work+0x6b8/0xbc0
[ 85.936068][ T5335] ? __flush_work+0xd2/0xbc0
[ 85.936079][ T5335] ? __flush_work+0xd2/0xbc0
[ 85.936089][ T5335] ? __pfx___flush_work+0x10/0x10
[ 85.936099][ T5335] ? __pfx_wq_barrier_func+0x10/0x10
[ 85.936117][ T5335] ? __pfx___cancel_work+0x10/0x10
[ 85.936128][ T5335] ? hci_conn_drop+0x14d/0x280
[ 85.936141][ T5335] __cancel_work_sync+0xbe/0x110
[ 85.936152][ T5335] l2cap_conn_del+0x4f0/0x680
[ 85.936168][ T5335] ? __pfx_l2cap_disconn_cfm+0x10/0x10
[ 85.936182][ T5335] hci_conn_hash_flush+0x10a/0x230
[ 85.936193][ T5335] hci_dev_close_sync+0xaef/0x1330
[ 85.936210][ T5335] ? __pfx_hci_dev_close_sync+0x10/0x10
[ 85.936223][ T5335] ? do_raw_read_unlock+0x3d/0x80
[ 85.936236][ T5335] hci_dev_close+0x108/0x200
[ 85.936251][ T5335] sock_do_ioctl+0xdc/0x300
[ 85.936263][ T5335] ? __pfx_sock_do_ioctl+0x10/0x10
[ 85.936272][ T5335] ? __lock_acquire+0xab9/0xd20
[ 85.936288][ T5335] sock_ioctl+0x576/0x790
[ 85.936299][ T5335] ? __pfx_sock_ioctl+0x10/0x10
[ 85.936310][ T5335] ? __fget_files+0x2a/0x420
[ 85.936322][ T5335] ? __fget_files+0x3a0/0x420
[ 85.936332][ T5335] ? __fget_files+0x2a/0x420
[ 85.936342][ T5335] ? bpf_lsm_file_ioctl+0x9/0x20
[ 85.936348][ T5335] ? __pfx_sock_ioctl+0x10/0x10
[ 85.936355][ T5335] __se_sys_ioctl+0xfc/0x170
[ 85.936365][ T5335] do_syscall_64+0xfa/0x3b0
[ 85.936374][ T5335] ? lockdep_hardirqs_on+0x9c/0x150
[ 85.936381][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.936387][ T5335] ? clear_bhb_loop+0x60/0xb0
[ 85.936394][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.936400][ T5335] RIP: 0033:0x7f259b18e9a9
[ 85.936410][ T5335] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 85.936416][ T5335] RSP: 002b:00007f259c03a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 85.936424][ T5335] RAX: ffffffffffffffda RBX: 00007f259b3b5fa0 RCX: 00007f259b18e9a9
[ 85.936429][ T5335] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000006
[ 85.936433][ T5335] RBP: 00007f259c03a090 R08: 0000000000000000 R09: 0000000000000000
[ 85.936437][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 85.936441][ T5335] R13: 0000000000000000 R14: 00007f259b3b5fa0 R15: 00007ffc4b108ca8
[ 85.936447][ T5335]
[ 86.585591][ T10] cfg80211: failed to load regulatory.db
[ 87.461677][ T4676] Bluetooth: hci0: command tx timeout
[ 89.541266][ T4676] Bluetooth: hci0: command tx timeout
[ 91.621120][ T4676] Bluetooth: hci0: command tx timeout