program: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty, 0x4}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x1000, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0xa4ffffff, @mcast1}}}, 0x108) r1 = socket$inet6(0xa, 0x1, 0x100) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x39}}}, 0x1c) socket$kcm(0x29, 0x5, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006000d00036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) [ 74.972348][ T5306] Bluetooth: hci0: command tx timeout [ 75.003345][ T5322] [ 75.004252][ T5322] ====================================================== [ 75.006723][ T5322] WARNING: possible circular locking dependency detected [ 75.009273][ T5322] 6.14.0-syzkaller-12456-gacc4d5ff0b61 #0 Not tainted [ 75.011745][ T5322] ------------------------------------------------------ [ 75.016180][ T5322] syz.0.0/5322 is trying to acquire lock: [ 75.022380][ T5322] ffffffff900fc2c8 (rtnl_mutex){+.+.}-{4:4}, at: smc_vlan_by_tcpsk+0x39b/0x4f0 [ 75.030029][ T5322] [ 75.030029][ T5322] but task is already holding lock: [ 75.032763][ T5322] ffff888040ce8258 (sk_lock-AF_INET6){+.+.}-{0:0}, at: smc_connect+0xb7/0xde0 [ 75.036084][ T5322] [ 75.036084][ T5322] which lock already depends on the new lock. [ 75.036084][ T5322] [ 75.039749][ T5322] [ 75.039749][ T5322] the existing dependency chain (in reverse order) is: [ 75.042911][ T5322] [ 75.042911][ T5322] -> #1 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 75.045834][ T5322] lock_acquire+0x116/0x2f0 [ 75.047797][ T5322] lock_sock_nested+0x48/0x100 [ 75.049673][ T5322] do_ipv6_setsockopt+0xccd/0x3680 [ 75.051519][ T5322] ipv6_setsockopt+0x5d/0x170 [ 75.053397][ T5322] do_sock_setsockopt+0x3b1/0x710 [ 75.055356][ T5322] __x64_sys_setsockopt+0x1ee/0x280 [ 75.057605][ T5322] do_syscall_64+0xf3/0x230 [ 75.059483][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.061920][ T5322] [ 75.061920][ T5322] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 75.064504][ T5322] validate_chain+0xa69/0x24e0 [ 75.066491][ T5322] __lock_acquire+0xad5/0xd80 [ 75.068345][ T5322] lock_acquire+0x116/0x2f0 [ 75.070242][ T5322] __mutex_lock+0x1a5/0x10c0 [ 75.072422][ T5322] smc_vlan_by_tcpsk+0x39b/0x4f0 [ 75.074385][ T5322] __smc_connect+0x296/0x1920 [ 75.076330][ T5322] smc_connect+0x868/0xde0 [ 75.078231][ T5322] __sys_connect+0x28c/0x2d0 [ 75.080199][ T5322] __x64_sys_connect+0x7a/0x90 [ 75.082267][ T5322] do_syscall_64+0xf3/0x230 [ 75.084230][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.086821][ T5322] [ 75.086821][ T5322] other info that might help us debug this: [ 75.086821][ T5322] [ 75.090709][ T5322] Possible unsafe locking scenario: [ 75.090709][ T5322] [ 75.093467][ T5322] CPU0 CPU1 [ 75.095511][ T5322] ---- ---- [ 75.097629][ T5322] lock(sk_lock-AF_INET6); [ 75.099291][ T5322] lock(rtnl_mutex); [ 75.101608][ T5322] lock(sk_lock-AF_INET6); [ 75.104215][ T5322] lock(rtnl_mutex); [ 75.105830][ T5322] [ 75.105830][ T5322] *** DEADLOCK *** [ 75.105830][ T5322] [ 75.108897][ T5322] 1 lock held by syz.0.0/5322: [ 75.110764][ T5322] #0: ffff888040ce8258 (sk_lock-AF_INET6){+.+.}-{0:0}, at: smc_connect+0xb7/0xde0 [ 75.114106][ T5322] [ 75.114106][ T5322] stack backtrace: [ 75.116524][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-12456-gacc4d5ff0b61 #0 PREEMPT(full) [ 75.116539][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.116546][ T5322] Call Trace: [ 75.116554][ T5322] [ 75.116560][ T5322] dump_stack_lvl+0x241/0x360 [ 75.116581][ T5322] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.116595][ T5322] ? __pfx__printk+0x10/0x10 [ 75.116609][ T5322] ? print_lock+0x171/0x1a0 [ 75.116628][ T5322] print_circular_bug+0x2e1/0x300 [ 75.116643][ T5322] check_noncircular+0x142/0x160 [ 75.116657][ T5322] validate_chain+0xa69/0x24e0 [ 75.116675][ T5322] __lock_acquire+0xad5/0xd80 [ 75.116688][ T5322] lock_acquire+0x116/0x2f0 [ 75.116697][ T5322] ? smc_vlan_by_tcpsk+0x39b/0x4f0 [ 75.116710][ T5322] ? kasan_save_track+0x51/0x80 [ 75.116760][ T5322] __mutex_lock+0x1a5/0x10c0 [ 75.116771][ T5322] ? smc_vlan_by_tcpsk+0x39b/0x4f0 [ 75.116785][ T5322] ? smc_vlan_by_tcpsk+0x39b/0x4f0 [ 75.116796][ T5322] ? __pfx___mutex_lock+0x10/0x10 [ 75.116810][ T5322] smc_vlan_by_tcpsk+0x39b/0x4f0 [ 75.116824][ T5322] ? __pfx_smc_vlan_by_tcpsk+0x10/0x10 [ 75.116836][ T5322] ? __kmalloc_cache_noprof+0x236/0x370 [ 75.116850][ T5322] ? __smc_connect+0x1c7/0x1920 [ 75.116865][ T5322] __smc_connect+0x296/0x1920 [ 75.116880][ T5322] ? do_raw_spin_unlock+0x58/0x8b0 [ 75.116895][ T5322] smc_connect+0x868/0xde0 [ 75.116911][ T5322] __sys_connect+0x28c/0x2d0 [ 75.116923][ T5322] ? __pfx___sys_connect+0x10/0x10 [ 75.116937][ T5322] __x64_sys_connect+0x7a/0x90 [ 75.116977][ T5322] do_syscall_64+0xf3/0x230 [ 75.116987][ T5322] ? clear_bhb_loop+0x45/0xa0 [ 75.116998][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.117009][ T5322] RIP: 0033:0x7f17dc38d169 [ 75.117020][ T5322] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.117028][ T5322] RSP: 002b:00007f17dd229038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 75.117040][ T5322] RAX: ffffffffffffffda RBX: 00007f17dc5a5fa0 RCX: 00007f17dc38d169 [ 75.117048][ T5322] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000004 [ 75.117055][ T5322] RBP: 00007f17dc40e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 75.117061][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.117066][ T5322] R13: 0000000000000000 R14: 00007f17dc5a5fa0 R15: 00007ffcb58964b8 [ 75.117077][ T5322] [ 75.230135][ T5323] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.