======================================================
WARNING: possible circular locking dependency detected
6.12.0-rc1-syzkaller-00330-gfc20a3e57247 #0 Not tainted
------------------------------------------------------
syz.2.2159/13012 is trying to acquire lock:
ffff888022d22258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1609 [inline]
ffff888022d22258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x6d/0x3b0 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock:
ffff888011d31528 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x235/0x700 net/bluetooth/rfcomm/core.c:491
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&d->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
__rfcomm_dev_add net/bluetooth/rfcomm/tty.c:277 [inline]
rfcomm_dev_add net/bluetooth/rfcomm/tty.c:325 [inline]
__rfcomm_create_dev net/bluetooth/rfcomm/tty.c:424 [inline]
rfcomm_create_dev net/bluetooth/rfcomm/tty.c:485 [inline]
rfcomm_dev_ioctl+0x12ae/0x1e70 net/bluetooth/rfcomm/tty.c:584
rfcomm_sock_ioctl net/bluetooth/rfcomm/sock.c:869 [inline]
rfcomm_sock_compat_ioctl+0xba/0xe0 net/bluetooth/rfcomm/sock.c:882
compat_sock_ioctl+0x17b/0x7e0 net/socket.c:3539
__do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #1 (rfcomm_dev_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
rfcomm_dev_get+0x6e/0x2b0 net/bluetooth/rfcomm/tty.c:163
rfcomm_get_dev_info net/bluetooth/rfcomm/tty.c:561 [inline]
rfcomm_dev_ioctl+0x378/0x1e70 net/bluetooth/rfcomm/tty.c:593
rfcomm_sock_ioctl net/bluetooth/rfcomm/sock.c:869 [inline]
rfcomm_sock_compat_ioctl+0xba/0xe0 net/bluetooth/rfcomm/sock.c:882
compat_sock_ioctl+0x17b/0x7e0 net/socket.c:3539
__do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
lock_sock_nested+0x3a/0xf0 net/core/sock.c:3611
lock_sock include/net/sock.h:1609 [inline]
rfcomm_sk_state_change+0x6d/0x3b0 net/bluetooth/rfcomm/sock.c:73
__rfcomm_dlc_close+0x28c/0x700 net/bluetooth/rfcomm/core.c:493
rfcomm_dlc_close+0x1eb/0x240 net/bluetooth/rfcomm/core.c:524
__rfcomm_sock_close+0xa7/0x230 net/bluetooth/rfcomm/sock.c:220
rfcomm_sock_shutdown+0xd5/0x230 net/bluetooth/rfcomm/sock.c:901
rfcomm_sock_release+0x5d/0x140 net/bluetooth/rfcomm/sock.c:922
__sock_release+0xb0/0x270 net/socket.c:658
sock_close+0x1c/0x30 net/socket.c:1426
__fput+0x3f6/0xb60 fs/file_table.c:431
task_work_run+0x14e/0x250 kernel/task_work.c:228
get_signal+0x1d3/0x26d0 kernel/signal.c:2690
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
__do_fast_syscall_32+0x80/0x120 arch/x86/entry/common.c:389
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM --> rfcomm_dev_lock --> &d->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&d->lock);
lock(rfcomm_dev_lock);
lock(&d->lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
*** DEADLOCK ***
3 locks held by syz.2.2159/13012:
#0: ffff88804a109408 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
#0: ffff88804a109408 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: __sock_release+0x86/0x270 net/socket.c:657
#1: ffffffff8fd51e28 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_close+0x33/0x240 net/bluetooth/rfcomm/core.c:511
#2: ffff888011d31528 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x235/0x700 net/bluetooth/rfcomm/core.c:491
stack backtrace:
CPU: 2 UID: 0 PID: 13012 Comm: syz.2.2159 Not tainted 6.12.0-rc1-syzkaller-00330-gfc20a3e57247 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x419/0x5d0 kernel/locking/lockdep.c:2074
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
lock_sock_nested+0x3a/0xf0 net/core/sock.c:3611
lock_sock include/net/sock.h:1609 [inline]
rfcomm_sk_state_change+0x6d/0x3b0 net/bluetooth/rfcomm/sock.c:73
__rfcomm_dlc_close+0x28c/0x700 net/bluetooth/rfcomm/core.c:493
rfcomm_dlc_close+0x1eb/0x240 net/bluetooth/rfcomm/core.c:524
__rfcomm_sock_close+0xa7/0x230 net/bluetooth/rfcomm/sock.c:220
rfcomm_sock_shutdown+0xd5/0x230 net/bluetooth/rfcomm/sock.c:901
rfcomm_sock_release+0x5d/0x140 net/bluetooth/rfcomm/sock.c:922
__sock_release+0xb0/0x270 net/socket.c:658
sock_close+0x1c/0x30 net/socket.c:1426
__fput+0x3f6/0xb60 fs/file_table.c:431
task_work_run+0x14e/0x250 kernel/task_work.c:228
get_signal+0x1d3/0x26d0 kernel/signal.c:2690
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
__do_fast_syscall_32+0x80/0x120 arch/x86/entry/common.c:389
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f15579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f569656c EFLAGS: 00000296 ORIG_RAX: 000000000000016a
RAX: fffffffffffffffc RBX: 0000000000000008 RCX: 00000000200004c0
RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 10 06 adc %al,(%rsi)
2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
6: 10 07 adc %al,(%rdi)
8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
c: 10 08 adc %cl,(%rax)
e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1e: 00 51 52 add %dl,0x52(%rcx)
21: 55 push %rbp
22: 89 e5 mov %esp,%ebp
24: 0f 34 sysenter
26: cd 80 int $0x80
* 28: 5d pop %rbp <-- trapping instruction
29: 5a pop %rdx
2a: 59 pop %rcx
2b: c3 ret
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi