program:
syz_emit_vhci(&(0x7f0000000e40)=ANY=[@ANYBLOB="0404"], 0xd)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bind$bt_sco(r0, &(0x7f0000000000), 0x8)
listen(r0, 0x0)
syz_emit_vhci(&(0x7f0000000140)=@HCI_EVENT_PKT={0x4, @hci_ev_sync_conn_complete={{0x2c, 0x11}}}, 0x14)
[ 75.475699][ T4666] Bluetooth: hci0: command tx timeout
[ 75.551404][ T4666] BUG: sleeping function called from invalid context at net/core/sock.c:3664
[ 75.554919][ T4666] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4666, name: kworker/u5:1
[ 75.558825][ T4666] preempt_count: 1, expected: 0
[ 75.560673][ T4666] RCU nest depth: 0, expected: 0
[ 75.562543][ T4666] 6 locks held by kworker/u5:1/4666:
[ 75.564527][ T4666] #0: ffff88803ee3f148 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x990/0x18e0
[ 75.569089][ T4666] #1: ffffc9000e2bfc60 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9cb/0x18e0
[ 75.574020][ T4666] #2: ffff8880518e0078 (&hdev->lock){+.+.}-{4:4}, at: hci_sync_conn_complete_evt+0xb1/0xaa0
[ 75.578627][ T4666] #3: ffffffff90039aa8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_sync_conn_complete_evt+0x532/0xaa0
[ 75.583013][ T4666] #4: ffff8880340c8a20 (&conn->lock#3){+.+.}-{3:3}, at: sco_connect_cfm+0x212/0xc30
[ 75.586869][ T4666] #5: ffff888044318258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x458/0xc30
[ 75.591352][ T4666] Preemption disabled at:
[ 75.591363][ T4666] [<0000000000000000>] 0x0
[ 75.594867][ T4666] CPU: 0 UID: 0 PID: 4666 Comm: kworker/u5:1 Not tainted 6.14.0-syzkaller-02665-g1e26c5e28ca5 #0 PREEMPT(full)
[ 75.594886][ T4666] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.594895][ T4666] Workqueue: hci0 hci_rx_work
[ 75.594910][ T4666] Call Trace:
[ 75.594916][ T4666]
[ 75.594921][ T4666] dump_stack_lvl+0x241/0x360
[ 75.594939][ T4666] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.594952][ T4666] ? __pfx__printk+0x10/0x10
[ 75.594970][ T4666] __might_resched+0x558/0x6c0
[ 75.594980][ T4666] ? __lock_acquire+0xad5/0xd80
[ 75.594996][ T4666] ? __pfx___might_resched+0x10/0x10
[ 75.595012][ T4666] lock_sock_nested+0x5d/0x100
[ 75.595026][ T4666] sco_connect_cfm+0x458/0xc30
[ 75.595043][ T4666] ? __pfx_sco_connect_cfm+0x10/0x10
[ 75.595056][ T4666] ? hci_conn_add_sysfs+0xfc/0x200
[ 75.595074][ T4666] ? __pfx_sco_connect_cfm+0x10/0x10
[ 75.595084][ T4666] hci_sync_conn_complete_evt+0x5ab/0xaa0
[ 75.595109][ T4666] hci_event_packet+0xac9/0x1550
[ 75.595122][ T4666] ? __pfx_hci_sync_conn_complete_evt+0x10/0x10
[ 75.595137][ T4666] ? __pfx_hci_event_packet+0x10/0x10
[ 75.595150][ T4666] ? kcov_remote_start+0x460/0x7d0
[ 75.595165][ T4666] ? lockdep_hardirqs_on+0x9d/0x150
[ 75.595181][ T4666] ? hci_send_to_monitor+0xdc/0x530
[ 75.595195][ T4666] hci_rx_work+0x3f3/0xdb0
[ 75.595210][ T4666] ? process_scheduled_works+0x9cb/0x18e0
[ 75.595224][ T4666] process_scheduled_works+0xac3/0x18e0
[ 75.595250][ T4666] ? __pfx_process_scheduled_works+0x10/0x10
[ 75.595270][ T4666] ? assign_work+0x367/0x3d0
[ 75.595287][ T4666] worker_thread+0x870/0xd30
[ 75.595303][ T4666] ? __kthread_parkme+0x169/0x1d0
[ 75.595314][ T4666] ? __pfx_worker_thread+0x10/0x10
[ 75.595325][ T4666] kthread+0x7a9/0x920
[ 75.595337][ T4666] ? __pfx_worker_thread+0x10/0x10
[ 75.595347][ T4666] ? __pfx_kthread+0x10/0x10
[ 75.595358][ T4666] ? __pfx_kthread+0x10/0x10
[ 75.595369][ T4666] ? __pfx_kthread+0x10/0x10
[ 75.595380][ T4666] ? __pfx_kthread+0x10/0x10
[ 75.595391][ T4666] ? _raw_spin_unlock_irq+0x23/0x50
[ 75.595402][ T4666] ? lockdep_hardirqs_on+0x9d/0x150
[ 75.595414][ T4666] ? __pfx_kthread+0x10/0x10
[ 75.595426][ T4666] ret_from_fork+0x4b/0x80
[ 75.595435][ T4666] ? __pfx_kthread+0x10/0x10
[ 75.595446][ T4666] ret_from_fork_asm+0x1a/0x30
[ 75.595467][ T4666]
[ 75.689413][ T5318]
[ 75.690368][ T5318] ======================================================
[ 75.692890][ T5318] WARNING: possible circular locking dependency detected
[ 75.695406][ T5318] 6.14.0-syzkaller-02665-g1e26c5e28ca5 #0 Tainted: G W
[ 75.698401][ T5318] ------------------------------------------------------
[ 75.700896][ T5318] syz.0.0/5318 is trying to acquire lock:
[ 75.703106][ T5318] ffff8880340c8a20 (&conn->lock#3){+.+.}-{3:3}, at: sco_chan_del+0x74/0x180
[ 75.706437][ T5318]
[ 75.706437][ T5318] but task is already holding lock:
[ 75.709144][ T5318] ffff888044319258 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}, at: __sco_sock_close+0xe8/0x310
[ 75.712748][ T5318]
[ 75.712748][ T5318] which lock already depends on the new lock.
[ 75.712748][ T5318]
[ 75.716591][ T5318]
[ 75.716591][ T5318] the existing dependency chain (in reverse order) is:
[ 75.720021][ T5318]
[ 75.720021][ T5318] -> #2 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}:
[ 75.723041][ T5318] lock_acquire+0x116/0x2f0
[ 75.724923][ T5318] lock_sock_nested+0x48/0x100
[ 75.727103][ T5318] bt_accept_dequeue+0xfa/0x570
[ 75.729236][ T5318] __sco_sock_close+0xd2/0x310
[ 75.731300][ T5318] sco_sock_release+0xb3/0x320
[ 75.733211][ T5318] sock_close+0xbc/0x240
[ 75.735203][ T5318] __fput+0x3e9/0x9f0
[ 75.736911][ T5318] task_work_run+0x251/0x310
[ 75.738861][ T5318] syscall_exit_to_user_mode+0x13f/0x340
[ 75.741025][ T5318] do_syscall_64+0x100/0x230
[ 75.742725][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.745048][ T5318]
[ 75.745048][ T5318] -> #1 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
[ 75.748715][ T5318] lock_acquire+0x116/0x2f0
[ 75.750674][ T5318] lock_sock_nested+0x48/0x100
[ 75.752760][ T5318] sco_connect_cfm+0x458/0xc30
[ 75.754832][ T5318] hci_sync_conn_complete_evt+0x5ab/0xaa0
[ 75.757119][ T5318] hci_event_packet+0xac9/0x1550
[ 75.759106][ T5318] hci_rx_work+0x3f3/0xdb0
[ 75.760907][ T5318] process_scheduled_works+0xac3/0x18e0
[ 75.763187][ T5318] worker_thread+0x870/0xd30
[ 75.764980][ T5318] kthread+0x7a9/0x920
[ 75.766506][ T5318] ret_from_fork+0x4b/0x80
[ 75.768152][ T5318] ret_from_fork_asm+0x1a/0x30
[ 75.770069][ T5318]
[ 75.770069][ T5318] -> #0 (&conn->lock#3){+.+.}-{3:3}:
[ 75.772850][ T5318] validate_chain+0xa69/0x24e0
[ 75.774616][ T5318] __lock_acquire+0xad5/0xd80
[ 75.776618][ T5318] lock_acquire+0x116/0x2f0
[ 75.778617][ T5318] _raw_spin_lock+0x2e/0x40
[ 75.780607][ T5318] sco_chan_del+0x74/0x180
[ 75.782568][ T5318] __sco_sock_close+0x152/0x310
[ 75.784660][ T5318] sco_sock_release+0xb3/0x320
[ 75.786770][ T5318] sock_close+0xbc/0x240
[ 75.788578][ T5318] __fput+0x3e9/0x9f0
[ 75.790203][ T5318] task_work_run+0x251/0x310
[ 75.792149][ T5318] syscall_exit_to_user_mode+0x13f/0x340
[ 75.794392][ T5318] do_syscall_64+0x100/0x230
[ 75.796281][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.798553][ T5318]
[ 75.798553][ T5318] other info that might help us debug this:
[ 75.798553][ T5318]
[ 75.801971][ T5318] Chain exists of:
[ 75.801971][ T5318] &conn->lock#3 --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> sk_lock-AF_BLUETOOTH
[ 75.801971][ T5318]
[ 75.807265][ T5318] Possible unsafe locking scenario:
[ 75.807265][ T5318]
[ 75.810254][ T5318] CPU0 CPU1
[ 75.812443][ T5318] ---- ----
[ 75.814575][ T5318] lock(sk_lock-AF_BLUETOOTH);
[ 75.816589][ T5318] lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
[ 75.819698][ T5318] lock(sk_lock-AF_BLUETOOTH);
[ 75.822112][ T5318] lock(&conn->lock#3);
[ 75.823868][ T5318]
[ 75.823868][ T5318] *** DEADLOCK ***
[ 75.823868][ T5318]
[ 75.826717][ T5318] 3 locks held by syz.0.0/5318:
[ 75.828527][ T5318] #0: ffff888045922008 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: sock_close+0x90/0x240
[ 75.832386][ T5318] #1: ffff888044318258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_sock_release+0x5a/0x320
[ 75.836379][ T5318] #2: ffff888044319258 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}, at: __sco_sock_close+0xe8/0x310
[ 75.840291][ T5318]
[ 75.840291][ T5318] stack backtrace:
[ 75.842642][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Tainted: G W 6.14.0-syzkaller-02665-g1e26c5e28ca5 #0 PREEMPT(full)
[ 75.842660][ T5318] Tainted: [W]=WARN
[ 75.842663][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.842670][ T5318] Call Trace:
[ 75.842676][ T5318]
[ 75.842681][ T5318] dump_stack_lvl+0x241/0x360
[ 75.842697][ T5318] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.842709][ T5318] ? __pfx__printk+0x10/0x10
[ 75.842721][ T5318] ? print_lock+0x171/0x1a0
[ 75.842736][ T5318] print_circular_bug+0x2e1/0x300
[ 75.842770][ T5318] check_noncircular+0x142/0x160
[ 75.842781][ T5318] validate_chain+0xa69/0x24e0
[ 75.842790][ T5318] ? rcu_is_watching+0x15/0xb0
[ 75.842799][ T5318] ? work_grab_pending+0x4d6/0xb00
[ 75.842812][ T5318] __lock_acquire+0xad5/0xd80
[ 75.842826][ T5318] lock_acquire+0x116/0x2f0
[ 75.842837][ T5318] ? sco_chan_del+0x74/0x180
[ 75.842848][ T5318] ? __pfx___cancel_work+0x10/0x10
[ 75.842856][ T5318] ? __sco_sock_close+0xe8/0x310
[ 75.842866][ T5318] _raw_spin_lock+0x2e/0x40
[ 75.842877][ T5318] ? sco_chan_del+0x74/0x180
[ 75.842887][ T5318] sco_chan_del+0x74/0x180
[ 75.842897][ T5318] __sco_sock_close+0x152/0x310
[ 75.842908][ T5318] sco_sock_release+0xb3/0x320
[ 75.842918][ T5318] sock_close+0xbc/0x240
[ 75.842929][ T5318] ? __pfx_sock_close+0x10/0x10
[ 75.842938][ T5318] __fput+0x3e9/0x9f0
[ 75.842950][ T5318] task_work_run+0x251/0x310
[ 75.842958][ T5318] ? _raw_spin_unlock+0x28/0x50
[ 75.842966][ T5318] ? __pfx_task_work_run+0x10/0x10
[ 75.842974][ T5318] ? syscall_exit_to_user_mode+0xa3/0x340
[ 75.842982][ T5318] syscall_exit_to_user_mode+0x13f/0x340
[ 75.842991][ T5318] do_syscall_64+0x100/0x230
[ 75.843000][ T5318] ? clear_bhb_loop+0x45/0xa0
[ 75.843007][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.843013][ T5318] RIP: 0033:0x7f8bf898d169
[ 75.843022][ T5318] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 75.843027][ T5318] RSP: 002b:00007ffc35178208 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 75.843037][ T5318] RAX: 0000000000000000 RBX: 0000000000012678 RCX: 00007f8bf898d169
[ 75.843043][ T5318] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 75.843049][ T5318] RBP: 00007f8bf8ba7ba0 R08: 0000000000000001 R09: 00000005351784ff
[ 75.843054][ T5318] R10: 00007f8bf87ff030 R11: 0000000000000246 R12: 00007f8bf8ba5fac
[ 75.843060][ T5318] R13: 00007f8bf8ba5fa0 R14: ffffffffffffffff R15: 00007ffc35178320
[ 75.843069][ T5318]