Warning: Permanently added '10.128.1.131' (ECDSA) to the list of known hosts. executing program [ 69.356943][ T3547] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 69.365824][ T3547] nci: nci_start_poll: failed to set local general bytes [ 74.410137][ T3547] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 74.418733][ T3547] [ 74.421054][ T3547] ====================================================== [ 74.428057][ T3547] WARNING: possible circular locking dependency detected [ 74.435078][ T3547] 6.1.26-syzkaller #0 Not tainted [ 74.440093][ T3547] ------------------------------------------------------ [ 74.447109][ T3547] syz-executor212/3547 is trying to acquire lock: [ 74.453516][ T3547] ffffffff8d7cc8e8 (nci_mutex){+.+.}-{3:3}, at: virtual_nci_close+0x13/0x40 [ 74.462230][ T3547] [ 74.462230][ T3547] but task is already holding lock: [ 74.469579][ T3547] ffff8881437e3350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0x106/0x5f0 [ 74.478885][ T3547] [ 74.478885][ T3547] which lock already depends on the new lock. [ 74.478885][ T3547] [ 74.489304][ T3547] [ 74.489304][ T3547] the existing dependency chain (in reverse order) is: [ 74.498315][ T3547] [ 74.498315][ T3547] -> #3 (&ndev->req_lock){+.+.}-{3:3}: [ 74.505969][ T3547] lock_acquire+0x1f8/0x5a0 [ 74.511089][ T3547] __mutex_lock_common+0x1d4/0x2520 [ 74.516809][ T3547] mutex_lock_nested+0x17/0x20 [ 74.522093][ T3547] nci_start_poll+0x59f/0xf20 [ 74.527289][ T3547] nfc_start_poll+0x184/0x2f0 [ 74.532488][ T3547] nfc_genl_start_poll+0x1e7/0x350 [ 74.538126][ T3547] genl_rcv_msg+0xc1a/0xf70 [ 74.543150][ T3547] netlink_rcv_skb+0x1cd/0x410 [ 74.548434][ T3547] genl_rcv+0x24/0x40 [ 74.552944][ T3547] netlink_unicast+0x7bf/0x990 [ 74.558237][ T3547] netlink_sendmsg+0xa26/0xd60 [ 74.563530][ T3547] ____sys_sendmsg+0x59e/0x8f0 [ 74.568825][ T3547] __sys_sendmsg+0x2a9/0x390 [ 74.573948][ T3547] do_syscall_64+0x3d/0xb0 [ 74.578926][ T3547] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 74.585375][ T3547] [ 74.585375][ T3547] -> #2 (&genl_data->genl_data_mutex){+.+.}-{3:3}: [ 74.594060][ T3547] lock_acquire+0x1f8/0x5a0 [ 74.599113][ T3547] __mutex_lock_common+0x1d4/0x2520 [ 74.604835][ T3547] mutex_lock_nested+0x17/0x20 [ 74.610119][ T3547] nfc_urelease_event_work+0x113/0x2f0 [ 74.616109][ T3547] process_one_work+0x8aa/0x11f0 [ 74.621572][ T3547] worker_thread+0xa5f/0x1210 [ 74.626773][ T3547] kthread+0x26e/0x300 [ 74.631371][ T3547] ret_from_fork+0x1f/0x30 [ 74.636307][ T3547] [ 74.636307][ T3547] -> #1 (nfc_devlist_mutex){+.+.}-{3:3}: [ 74.644130][ T3547] lock_acquire+0x1f8/0x5a0 [ 74.649144][ T3547] __mutex_lock_common+0x1d4/0x2520 [ 74.654869][ T3547] mutex_lock_nested+0x17/0x20 [ 74.660160][ T3547] nfc_register_device+0x38/0x310 [ 74.665788][ T3547] nci_register_device+0x7be/0x900 [ 74.671415][ T3547] virtual_ncidev_open+0x55/0xc0 [ 74.676875][ T3547] misc_open+0x304/0x380 [ 74.681636][ T3547] chrdev_open+0x54a/0x630 [ 74.686572][ T3547] do_dentry_open+0x7f9/0x10f0 [ 74.691866][ T3547] path_openat+0x2644/0x2e60 [ 74.696974][ T3547] do_filp_open+0x230/0x480 [ 74.701988][ T3547] do_sys_openat2+0x13b/0x500 [ 74.707181][ T3547] __x64_sys_openat+0x243/0x290 [ 74.712556][ T3547] do_syscall_64+0x3d/0xb0 [ 74.717485][ T3547] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 74.723906][ T3547] [ 74.723906][ T3547] -> #0 (nci_mutex){+.+.}-{3:3}: [ 74.731023][ T3547] validate_chain+0x1667/0x58e0 [ 74.736388][ T3547] __lock_acquire+0x125b/0x1f80 [ 74.741748][ T3547] lock_acquire+0x1f8/0x5a0 [ 74.746760][ T3547] __mutex_lock_common+0x1d4/0x2520 [ 74.752471][ T3547] mutex_lock_nested+0x17/0x20 [ 74.757762][ T3547] virtual_nci_close+0x13/0x40 [ 74.763058][ T3547] nci_close_device+0x3a8/0x5f0 [ 74.768515][ T3547] nci_unregister_device+0x3c/0x230 [ 74.774232][ T3547] virtual_ncidev_close+0x55/0x90 [ 74.779800][ T3547] __fput+0x3b7/0x890 [ 74.784321][ T3547] task_work_run+0x246/0x300 [ 74.789434][ T3547] do_exit+0x6fb/0x2300 [ 74.794110][ T3547] do_group_exit+0x202/0x2b0 [ 74.799221][ T3547] get_signal+0x16f7/0x17d0 [ 74.804259][ T3547] arch_do_signal_or_restart+0xb0/0x1a10 [ 74.810406][ T3547] exit_to_user_mode_loop+0x6a/0x100 [ 74.816208][ T3547] exit_to_user_mode_prepare+0xb1/0x140 [ 74.822270][ T3547] syscall_exit_to_user_mode+0x60/0x270 [ 74.828347][ T3547] do_syscall_64+0x49/0xb0 [ 74.833277][ T3547] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 74.839695][ T3547] [ 74.839695][ T3547] other info that might help us debug this: [ 74.839695][ T3547] [ 74.849944][ T3547] Chain exists of: [ 74.849944][ T3547] nci_mutex --> &genl_data->genl_data_mutex --> &ndev->req_lock [ 74.849944][ T3547] [ 74.863515][ T3547] Possible unsafe locking scenario: [ 74.863515][ T3547] [ 74.870964][ T3547] CPU0 CPU1 [ 74.876317][ T3547] ---- ---- [ 74.881670][ T3547] lock(&ndev->req_lock); [ 74.886112][ T3547] lock(&genl_data->genl_data_mutex); [ 74.894102][ T3547] lock(&ndev->req_lock); [ 74.901043][ T3547] lock(nci_mutex); [ 74.904954][ T3547] [ 74.904954][ T3547] *** DEADLOCK *** [ 74.904954][ T3547] [ 74.913102][ T3547] 1 lock held by syz-executor212/3547: [ 74.918558][ T3547] #0: ffff8881437e3350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0x106/0x5f0 [ 74.928335][ T3547] [ 74.928335][ T3547] stack backtrace: [ 74.934232][ T3547] CPU: 1 PID: 3547 Comm: syz-executor212 Not tainted 6.1.26-syzkaller #0 [ 74.942659][ T3547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 74.952722][ T3547] Call Trace: [ 74.956010][ T3547] [ 74.958964][ T3547] dump_stack_lvl+0x1e3/0x2cb [ 74.963655][ T3547] ? nf_tcp_handle_invalid+0x642/0x642 [ 74.969129][ T3547] ? print_circular_bug+0x12b/0x1a0 [ 74.974426][ T3547] check_noncircular+0x2fa/0x3b0 [ 74.979373][ T3547] ? add_chain_block+0x850/0x850 [ 74.984317][ T3547] ? lockdep_lock+0x11f/0x2a0 [ 74.989014][ T3547] ? prb_read_valid+0xf0/0xf0 [ 74.993704][ T3547] ? _find_first_zero_bit+0xd0/0x100 [ 74.999433][ T3547] validate_chain+0x1667/0x58e0 [ 75.004296][ T3547] ? __lock_acquire+0x125b/0x1f80 [ 75.009335][ T3547] ? desc_read+0x200/0x3f0 [ 75.013769][ T3547] ? memcpy+0x3c/0x60 [ 75.017768][ T3547] ? reacquire_held_locks+0x660/0x660 [ 75.023157][ T3547] ? desc_read+0x1a2/0x3f0 [ 75.027689][ T3547] ? _prb_read_valid+0xb46/0xbe0 [ 75.032675][ T3547] ? mark_lock+0x9a/0x340 [ 75.037014][ T3547] __lock_acquire+0x125b/0x1f80 [ 75.041877][ T3547] lock_acquire+0x1f8/0x5a0 [ 75.046409][ T3547] ? virtual_nci_close+0x13/0x40 [ 75.051369][ T3547] ? read_lock_is_recursive+0x10/0x10 [ 75.056840][ T3547] ? __might_sleep+0xb0/0xb0 [ 75.061442][ T3547] ? find_next_clump8+0x1a0/0x1a0 [ 75.066476][ T3547] ? console_unlock+0x271/0x6e0 [ 75.071342][ T3547] ? console_unlock+0x6aa/0x6e0 [ 75.076199][ T3547] __mutex_lock_common+0x1d4/0x2520 [ 75.081406][ T3547] ? virtual_nci_close+0x13/0x40 [ 75.086352][ T3547] ? irq_work_queue+0xc6/0x150 [ 75.091124][ T3547] ? __wake_up_klogd+0xd5/0x100 [ 75.096003][ T3547] ? vprintk_emit+0x109/0x1f0 [ 75.100689][ T3547] ? virtual_nci_close+0x13/0x40 [ 75.105632][ T3547] ? _printk+0xd1/0x111 [ 75.109789][ T3547] ? mutex_lock_io_nested+0x60/0x60 [ 75.114992][ T3547] ? panic+0x75d/0x75d [ 75.119072][ T3547] ? _raw_spin_unlock_irq+0x1f/0x40 [ 75.124282][ T3547] mutex_lock_nested+0x17/0x20 [ 75.129049][ T3547] virtual_nci_close+0x13/0x40 [ 75.133817][ T3547] nci_close_device+0x3a8/0x5f0 [ 75.138674][ T3547] ? nci_unregister_device+0x230/0x230 [ 75.144135][ T3547] ? mutex_unlock+0x10/0x10 [ 75.148644][ T3547] nci_unregister_device+0x3c/0x230 [ 75.153871][ T3547] ? virtual_ncidev_open+0xc0/0xc0 [ 75.158993][ T3547] virtual_ncidev_close+0x55/0x90 [ 75.164032][ T3547] ? virtual_ncidev_open+0xc0/0xc0 [ 75.169147][ T3547] __fput+0x3b7/0x890 [ 75.173142][ T3547] task_work_run+0x246/0x300 [ 75.177743][ T3547] ? task_work_cancel+0x2b0/0x2b0 [ 75.182776][ T3547] ? exit_task_namespaces+0xdd/0xf0 [ 75.187975][ T3547] do_exit+0x6fb/0x2300 [ 75.192150][ T3547] ? put_task_struct+0x80/0x80 [ 75.196917][ T3547] ? get_signal+0x137e/0x17d0 [ 75.201603][ T3547] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 75.207586][ T3547] ? print_irqtrace_events+0x210/0x210 [ 75.213043][ T3547] ? _raw_spin_lock_irq+0xdb/0x110 [ 75.218174][ T3547] do_group_exit+0x202/0x2b0 [ 75.222859][ T3547] ? _raw_spin_unlock_irq+0x1f/0x40 [ 75.228063][ T3547] ? lockdep_hardirqs_on+0x94/0x130 [ 75.233268][ T3547] get_signal+0x16f7/0x17d0 [ 75.237785][ T3547] ? ptrace_notify+0x370/0x370 [ 75.242601][ T3547] arch_do_signal_or_restart+0xb0/0x1a10 [ 75.248236][ T3547] ? ____sys_sendmsg+0x8f0/0x8f0 [ 75.253269][ T3547] ? get_sigframe_size+0x10/0x10 [ 75.258209][ T3547] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 75.264280][ T3547] ? exit_to_user_mode_loop+0x39/0x100 [ 75.269747][ T3547] exit_to_user_mode_loop+0x6a/0x100 [ 75.275036][ T3547] exit_to_user_mode_prepare+0xb1/0x140 [ 75.280587][ T3547] syscall_exit_to_user_mode+0x60/0x270 [ 75.286231][ T3547] do_syscall_64+0x49/0xb0 [ 75.290653][ T3547] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 75.296554][ T3547] RIP: 0033:0x7fd2d443a649 [ 75.300967][ T3547] Code: Unable to access opcode bytes at 0x7fd2d443a61f. executing program [ 75.307989][ T3547] RSP: 002b:00007fd2d43eb318 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 75.316404][ T3547] RAX: 0000000000000024 RBX: 00007fd2d44c2428 RCX: 00007fd2d443a649 [ 75.324376][ T3547] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000004 [ 75.332344][ T3547] RBP: 00007fd2d44c2420 R08: 0000000000000003 R09: 0000000000000000 [ 75.340316][ T3547] R10: 0000000000000008 R11: 0000000000000246 R12: 00007fd2d4490074 [ 75.348299][ T3547] R13: 00007fff17a081df R14: 00007fd2d43eb400 R15: 0000000000022000 [ 75.356289][ T3547] executing program [ 75.592495][ T3555] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 executing program [ 75.822210][ T3561] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 executing program [ 76.053019][ T3567] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 executing program [ 76.280495][ T3573] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 76.512612][ T3579] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 76.521354][ T3579] nci: nci_start_poll: failed to set local general bytes [ 81.289993][ T14] cfg80211: failed to load regulatory.db executing program [ 81.609553][ T3579] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 81.840339][ T3590] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 81.849050][ T3590] nci: nci_start_poll: failed to set local general bytes