Bluetooth: hci1: Opcode 0x0c03 failed: -110
BUG: workqueue leaked lock or atomic: kworker/u5:4/0x00000000/4248
     last function: hci_rx_work
1 lock held by kworker/u5:4/4248:
 #0: ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
 #0: ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
 #0: ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x584/0x6d04 net/bluetooth/l2cap_core.c:7867
CPU: 1 PID: 4248 Comm: kworker/u5:4 Not tainted 6.1.101-syzkaller-00106-gc18e82d3ee44 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: hci2 hci_rx_work
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 process_one_work+0xc24/0x1404 kernel/workqueue.c:2307
 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

======================================================
WARNING: possible circular locking dependency detected
6.1.101-syzkaller-00106-gc18e82d3ee44 #0 Not tainted
------------------------------------------------------
kworker/u5:4/4248 is trying to acquire lock:
ffff0000e979d938 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265

but task is already holding lock:
ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x584/0x6d04 net/bluetooth/l2cap_core.c:7867

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&chan->lock/1){+.+.}-{3:3}:
       __lock_release kernel/locking/lockdep.c:5376 [inline]
       lock_release+0x364/0xa50 kernel/locking/lockdep.c:5682
       process_one_work+0x894/0x1404 kernel/workqueue.c:2298
       worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
       kthread+0x250/0x2d8 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

-> #0 ((wq_completion)hci2#2){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3090 [inline]
       check_prevs_add kernel/locking/lockdep.c:3209 [inline]
       validate_chain kernel/locking/lockdep.c:3825 [inline]
       __lock_acquire+0x3338/0x7680 kernel/locking/lockdep.c:5049
       lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
       process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
       worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
       kthread+0x250/0x2d8 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&chan->lock/1);
                               lock((wq_completion)hci2#2);
                               lock(&chan->lock/1);
  lock((wq_completion)hci2#2);

 *** DEADLOCK ***

1 lock held by kworker/u5:4/4248:
 #0: ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
 #0: ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
 #0: ffff0000ed4ca530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x584/0x6d04 net/bluetooth/l2cap_core.c:7867

stack backtrace:
CPU: 1 PID: 4248 Comm: kworker/u5:4 Not tainted 6.1.101-syzkaller-00106-gc18e82d3ee44 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: hci2 hci_ncmd_timeout
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2048
 check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3090 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain kernel/locking/lockdep.c:3825 [inline]
 __lock_acquire+0x3338/0x7680 kernel/locking/lockdep.c:5049
 lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
 process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0
Bluetooth: hci2: Injecting HCI hardware error event