BUG: workqueue leaked lock or atomic: kworker/u5:8/0x00000000/3568
     last function: hci_rx_work
1 lock held by kworker/u5:8/3568:
 #0: ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
 #0: ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
 #0: ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x6fe/0x8bf0 net/bluetooth/l2cap_core.c:7867
CPU: 1 PID: 3568 Comm: kworker/u5:8 Not tainted 6.1.101-syzkaller-00106-gc18e82d3ee44 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 process_one_work+0xd1e/0x11d0 kernel/workqueue.c:2307
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

======================================================
WARNING: possible circular locking dependency detected
6.1.101-syzkaller-00106-gc18e82d3ee44 #0 Not tainted
------------------------------------------------------
kworker/u5:8/3568 is trying to acquire lock:
ffff8880219b0938 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267

but task is already holding lock:
ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x6fe/0x8bf0 net/bluetooth/l2cap_core.c:7867

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&chan->lock/1){+.+.}-{3:3}:
       lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
       __mutex_lock_common kernel/locking/mutex.c:603 [inline]
       __mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
       l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
       l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
       l2cap_recv_frame+0x6fe/0x8bf0 net/bluetooth/l2cap_core.c:7867
       hci_acldata_packet net/bluetooth/hci_core.c:3865 [inline]
       hci_rx_work+0x363/0xce0 net/bluetooth/hci_core.c:4102
       process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
       worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
       kthread+0x28d/0x320 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #1 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
       lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
       process_one_work+0x7dc/0x11d0 kernel/workqueue.c:2268
       worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
       kthread+0x28d/0x320 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #0 ((wq_completion)hci1#2){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3090 [inline]
       check_prevs_add kernel/locking/lockdep.c:3209 [inline]
       validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
       __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
       lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
       process_one_work+0x7bf/0x11d0 kernel/workqueue.c:2267
       worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
       kthread+0x28d/0x320 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

other info that might help us debug this:

Chain exists of:
  (wq_completion)hci1#2 --> (work_completion)(&hdev->rx_work) --> &chan->lock/1

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&chan->lock/1);
                               lock((work_completion)(&hdev->rx_work));
                               lock(&chan->lock/1);
  lock((wq_completion)hci1#2);

 *** DEADLOCK ***

1 lock held by kworker/u5:8/3568:
 #0: ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
 #0: ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
 #0: ffff88802355d530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x6fe/0x8bf0 net/bluetooth/l2cap_core.c:7867

stack backtrace:
CPU: 1 PID: 3568 Comm: kworker/u5:8 Not tainted 6.1.101-syzkaller-00106-gc18e82d3ee44 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci1 hci_cmd_timeout
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3090 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
 __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
 process_one_work+0x7bf/0x11d0 kernel/workqueue.c:2267
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Bluetooth: hci1: command tx timeout
Bluetooth: hci1: command tx timeout
Bluetooth: hci1: command tx timeout