================================ WARNING: inconsistent lock state 4.19.193-syzkaller #0 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. syz-executor.4/672 [HC0[0]:SC0[0]:HE1:SE1] takes: 0000000056eb60bb (slock-AF_BLUETOOTH-BTPROTO_SCO){+.?.}, at: spin_lock include/linux/spinlock.h:329 [inline] 0000000056eb60bb (slock-AF_BLUETOOTH-BTPROTO_SCO){+.?.}, at: sco_conn_del+0xe2/0x240 net/bluetooth/sco.c:175 {IN-SOFTIRQ-W} state was registered at: __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sco_sock_timeout+0x31/0x210 net/bluetooth/sco.c:82 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:535 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x49/0x310 arch/x86/kernel/process.c:557 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ec/0x4b0 kernel/sched/idle.c:263 cpu_startup_entry+0xc5/0xe0 kernel/sched/idle.c:369 start_kernel+0x8d6/0x911 init/main.c:736 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 irq event stamp: 4233215 hardirqs last enabled at (4233215): [] kfree+0x110/0x210 mm/slab.c:3823 hardirqs last disabled at (4233214): [] kfree+0x6f/0x210 mm/slab.c:3816 softirqs last enabled at (4232566): [] spin_unlock_bh include/linux/spinlock.h:374 [inline] softirqs last enabled at (4232566): [] peernet2id+0x8f/0xc0 net/core/net_namespace.c:266 softirqs last disabled at (4232564): [] spin_lock_bh include/linux/spinlock.h:334 [inline] softirqs last disabled at (4232564): [] peernet2id+0x6f/0xc0 net/core/net_namespace.c:264 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(slock-AF_BLUETOOTH-BTPROTO_SCO); lock(slock-AF_BLUETOOTH-BTPROTO_SCO); *** DEADLOCK *** 4 locks held by syz-executor.4/672: #0: 000000009f906d01 (rfkill_global_mutex){+.+.}, at: rfkill_fop_write+0xfe/0x4a0 net/rfkill/core.c:1241 #1: 0000000062489f44 (&hdev->req_lock){+.+.}, at: hci_dev_do_close+0x196/0xf10 net/bluetooth/hci_core.c:1618 #2: 00000000926b54d0 (&hdev->lock){+.+.}, at: hci_dev_do_close+0x2e0/0xf10 net/bluetooth/hci_core.c:1655 #3: 00000000a68c50e3 (hci_cb_list_lock){+.+.}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1259 [inline] #3: 00000000a68c50e3 (hci_cb_list_lock){+.+.}, at: hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1512 stack backtrace: CPU: 1 PID: 672 Comm: syz-executor.4 Not tainted 4.19.193-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_usage_bug.cold+0x42e/0x570 kernel/locking/lockdep.c:2545 valid_state kernel/locking/lockdep.c:2558 [inline] mark_lock_irq kernel/locking/lockdep.c:2752 [inline] mark_lock+0xc70/0x1160 kernel/locking/lockdep.c:3132 mark_irqflags kernel/locking/lockdep.c:3028 [inline] __lock_acquire+0x6a8/0x3ff0 kernel/locking/lockdep.c:3373 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sco_conn_del+0xe2/0x240 net/bluetooth/sco.c:175 sco_disconn_cfm+0x74/0xb0 net/bluetooth/sco.c:1133 hci_disconn_cfm include/net/bluetooth/hci_core.h:1262 [inline] hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1512 hci_dev_do_close+0x659/0xf10 net/bluetooth/hci_core.c:1668 hci_rfkill_set_block+0xe7/0x160 net/bluetooth/hci_core.c:2102 rfkill_set_block+0x1f9/0x540 net/rfkill/core.c:353 rfkill_fop_write+0x250/0x4a0 net/rfkill/core.c:1249 __vfs_write+0xf7/0x770 fs/read_write.c:485 vfs_write+0x1f3/0x540 fs/read_write.c:549 ksys_write+0x12b/0x2a0 fs/read_write.c:599 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0737558188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9 RDX: 0000000000000008 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007ffef651a6df R14: 00007f0737558300 R15: 0000000000022000 new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored ieee802154 phy0 wpan0: encryption failed: -22 new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored