Warning: Permanently added '10.128.0.235' (ECDSA) to the list of known hosts. executing program [ 37.869867][ T4315] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 37.871801][ T4315] nci: nci_start_poll: failed to set local general bytes [ 42.885163][ T4307] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 42.887322][ T4307] [ 42.887885][ T4307] ====================================================== [ 42.889427][ T4307] WARNING: possible circular locking dependency detected [ 42.891074][ T4307] 6.1.16-syzkaller #0 Not tainted [ 42.892221][ T4307] ------------------------------------------------------ [ 42.893761][ T4307] syz-executor158/4307 is trying to acquire lock: [ 42.895092][ T4307] ffff800016d7d4e8 (nci_mutex){+.+.}-{3:3}, at: virtual_nci_close+0x28/0x58 [ 42.896943][ T4307] [ 42.896943][ T4307] but task is already holding lock: [ 42.898568][ T4307] ffff0000d3e82350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0xf0/0x5ac [ 42.900643][ T4307] [ 42.900643][ T4307] which lock already depends on the new lock. [ 42.900643][ T4307] [ 42.902850][ T4307] [ 42.902850][ T4307] the existing dependency chain (in reverse order) is: [ 42.904881][ T4307] [ 42.904881][ T4307] -> #3 (&ndev->req_lock){+.+.}-{3:3}: [ 42.906553][ T4307] __mutex_lock_common+0x190/0x21a0 [ 42.907821][ T4307] mutex_lock_nested+0x38/0x44 [ 42.908956][ T4307] nci_start_poll+0x498/0x1204 [ 42.910095][ T4307] nfc_start_poll+0x164/0x2a4 [ 42.911239][ T4307] nfc_genl_start_poll+0x1b8/0x308 [ 42.912521][ T4307] genl_rcv_msg+0x948/0xc2c [ 42.913599][ T4307] netlink_rcv_skb+0x20c/0x3b8 [ 42.914775][ T4307] genl_rcv+0x38/0x50 [ 42.915750][ T4307] netlink_unicast+0x660/0x8d4 [ 42.916903][ T4307] netlink_sendmsg+0x834/0xb18 [ 42.918063][ T4307] ____sys_sendmsg+0x558/0x844 [ 42.919146][ T4307] __sys_sendmsg+0x26c/0x33c [ 42.920264][ T4307] __arm64_sys_sendmsg+0x80/0x94 [ 42.921449][ T4307] invoke_syscall+0x98/0x2c0 [ 42.922592][ T4307] el0_svc_common+0x138/0x258 [ 42.923637][ T4307] do_el0_svc+0x64/0x218 [ 42.924643][ T4307] el0_svc+0x58/0x168 [ 42.925590][ T4307] el0t_64_sync_handler+0x84/0xf0 [ 42.926799][ T4307] el0t_64_sync+0x18c/0x190 [ 42.927912][ T4307] [ 42.927912][ T4307] -> #2 (&genl_data->genl_data_mutex){+.+.}-{3:3}: [ 42.929844][ T4307] __mutex_lock_common+0x190/0x21a0 [ 42.931095][ T4307] mutex_lock_nested+0x38/0x44 [ 42.932232][ T4307] nfc_urelease_event_work+0xfc/0x2a8 [ 42.933513][ T4307] process_one_work+0x868/0x16f4 [ 42.934655][ T4307] worker_thread+0x8e4/0xfec [ 42.935783][ T4307] kthread+0x24c/0x2d4 [ 42.936833][ T4307] ret_from_fork+0x10/0x20 [ 42.937918][ T4307] [ 42.937918][ T4307] -> #1 (nfc_devlist_mutex){+.+.}-{3:3}: [ 42.939600][ T4307] __mutex_lock_common+0x190/0x21a0 [ 42.940861][ T4307] mutex_lock_nested+0x38/0x44 [ 42.942031][ T4307] nfc_register_device+0x4c/0x310 [ 42.943258][ T4307] nci_register_device+0x6ac/0x7c4 [ 42.944486][ T4307] virtual_ncidev_open+0x6c/0xd8 [ 42.945661][ T4307] misc_open+0x2f0/0x368 [ 42.946679][ T4307] chrdev_open+0x3e8/0x4fc [ 42.947769][ T4307] do_dentry_open+0x734/0xfa0 [ 42.948888][ T4307] vfs_open+0x7c/0x90 [ 42.949842][ T4307] path_openat+0x1e14/0x2548 [ 42.950946][ T4307] do_filp_open+0x1bc/0x3cc [ 42.952054][ T4307] do_sys_openat2+0x128/0x3d8 [ 42.953168][ T4307] __arm64_sys_openat+0x1f0/0x240 [ 42.954330][ T4307] invoke_syscall+0x98/0x2c0 [ 42.955400][ T4307] el0_svc_common+0x138/0x258 [ 42.956517][ T4307] do_el0_svc+0x64/0x218 [ 42.957549][ T4307] el0_svc+0x58/0x168 [ 42.958521][ T4307] el0t_64_sync_handler+0x84/0xf0 [ 42.959703][ T4307] el0t_64_sync+0x18c/0x190 [ 42.960818][ T4307] [ 42.960818][ T4307] -> #0 (nci_mutex){+.+.}-{3:3}: [ 42.962329][ T4307] __lock_acquire+0x3338/0x764c [ 42.963439][ T4307] lock_acquire+0x300/0x8e4 [ 42.964497][ T4307] __mutex_lock_common+0x190/0x21a0 [ 42.965735][ T4307] mutex_lock_nested+0x38/0x44 [ 42.966842][ T4307] virtual_nci_close+0x28/0x58 [ 42.967955][ T4307] nci_close_device+0x2fc/0x5ac [ 42.969080][ T4307] nci_unregister_device+0x58/0x21c [ 42.970315][ T4307] virtual_ncidev_close+0x70/0xb0 [ 42.971477][ T4307] __fput+0x30c/0x7bc [ 42.972473][ T4307] ____fput+0x20/0x30 [ 42.973433][ T4307] task_work_run+0x240/0x2f0 [ 42.974523][ T4307] do_exit+0x554/0x1a88 [ 42.975509][ T4307] do_group_exit+0x194/0x22c [ 42.976573][ T4307] __wake_up_parent+0x0/0x60 [ 42.977638][ T4307] invoke_syscall+0x98/0x2c0 [ 42.978762][ T4307] el0_svc_common+0x138/0x258 [ 42.979915][ T4307] do_el0_svc+0x64/0x218 [ 42.980921][ T4307] el0_svc+0x58/0x168 [ 42.981952][ T4307] el0t_64_sync_handler+0x84/0xf0 [ 42.983149][ T4307] el0t_64_sync+0x18c/0x190 [ 42.984192][ T4307] [ 42.984192][ T4307] other info that might help us debug this: [ 42.984192][ T4307] [ 42.986386][ T4307] Chain exists of: [ 42.986386][ T4307] nci_mutex --> &genl_data->genl_data_mutex --> &ndev->req_lock [ 42.986386][ T4307] [ 42.989271][ T4307] Possible unsafe locking scenario: [ 42.989271][ T4307] [ 42.990867][ T4307] CPU0 CPU1 [ 42.992007][ T4307] ---- ---- [ 42.993147][ T4307] lock(&ndev->req_lock); [ 42.994088][ T4307] lock(&genl_data->genl_data_mutex); [ 42.995780][ T4307] lock(&ndev->req_lock); [ 42.997267][ T4307] lock(nci_mutex); [ 42.998139][ T4307] [ 42.998139][ T4307] *** DEADLOCK *** [ 42.998139][ T4307] [ 42.999895][ T4307] 1 lock held by syz-executor158/4307: [ 43.001005][ T4307] #0: ffff0000d3e82350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0xf0/0x5ac [ 43.003071][ T4307] [ 43.003071][ T4307] stack backtrace: [ 43.004354][ T4307] CPU: 0 PID: 4307 Comm: syz-executor158 Not tainted 6.1.16-syzkaller #0 [ 43.006162][ T4307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 43.008348][ T4307] Call trace: [ 43.009064][ T4307] dump_backtrace+0x1c8/0x1f4 [ 43.010086][ T4307] show_stack+0x2c/0x3c [ 43.010997][ T4307] dump_stack_lvl+0x108/0x170 [ 43.012052][ T4307] dump_stack+0x1c/0x5c [ 43.012985][ T4307] print_circular_bug+0x150/0x1b8 [ 43.014045][ T4307] check_noncircular+0x2cc/0x378 [ 43.015082][ T4307] __lock_acquire+0x3338/0x764c [ 43.016125][ T4307] lock_acquire+0x300/0x8e4 [ 43.017065][ T4307] __mutex_lock_common+0x190/0x21a0 [ 43.018173][ T4307] mutex_lock_nested+0x38/0x44 [ 43.019220][ T4307] virtual_nci_close+0x28/0x58 [ 43.020262][ T4307] nci_close_device+0x2fc/0x5ac [ 43.021294][ T4307] nci_unregister_device+0x58/0x21c [ 43.022479][ T4307] virtual_ncidev_close+0x70/0xb0 [ 43.023596][ T4307] __fput+0x30c/0x7bc [ 43.024425][ T4307] ____fput+0x20/0x30 [ 43.025299][ T4307] task_work_run+0x240/0x2f0 [ 43.026254][ T4307] do_exit+0x554/0x1a88 [ 43.027147][ T4307] do_group_exit+0x194/0x22c [ 43.028174][ T4307] __wake_up_parent+0x0/0x60 [ 43.029172][ T4307] invoke_syscall+0x98/0x2c0 [ 43.030227][ T4307] el0_svc_common+0x138/0x258 [ 43.031232][ T4307] do_el0_svc+0x64/0x218 [ 43.032130][ T4307] el0_svc+0x58/0x168 [ 43.032963][ T4307] el0t_64_sync_handler+0x84/0xf0 [ 43.034015][ T4307] el0t_64_sync+0x18c/0x190