======================================================
WARNING: possible circular locking dependency detected
6.12.0-rc2-syzkaller-00058-g75b607fab38d #0 Not tainted
------------------------------------------------------
syz.1.860/8685 is trying to acquire lock:
ffffffff8fd521e8 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_exists+0x5f/0x1a0 net/bluetooth/rfcomm/core.c:546
but task is already holding lock:
ffffffff8fd571a8 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_create_dev net/bluetooth/rfcomm/tty.c:484 [inline]
ffffffff8fd571a8 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x9db/0x1e70 net/bluetooth/rfcomm/tty.c:584
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (rfcomm_ioctl_mutex){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
rfcomm_create_dev net/bluetooth/rfcomm/tty.c:484 [inline]
rfcomm_dev_ioctl+0x9db/0x1e70 net/bluetooth/rfcomm/tty.c:584
rfcomm_sock_ioctl net/bluetooth/rfcomm/sock.c:869 [inline]
rfcomm_sock_compat_ioctl+0xba/0xe0 net/bluetooth/rfcomm/sock.c:882
compat_sock_ioctl+0x17b/0x7e0 net/socket.c:3539
__do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #2 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}:
lock_sock_nested+0x3a/0xf0 net/core/sock.c:3611
lock_sock include/net/sock.h:1609 [inline]
rfcomm_sk_state_change+0x6d/0x3b0 net/bluetooth/rfcomm/sock.c:73
__rfcomm_dlc_close+0x28c/0x700 net/bluetooth/rfcomm/core.c:493
rfcomm_dlc_close+0x1eb/0x240 net/bluetooth/rfcomm/core.c:524
__rfcomm_sock_close+0xa7/0x230 net/bluetooth/rfcomm/sock.c:220
rfcomm_sock_shutdown+0xd5/0x230 net/bluetooth/rfcomm/sock.c:901
rfcomm_sock_release+0x5d/0x140 net/bluetooth/rfcomm/sock.c:922
__sock_release+0xb0/0x270 net/socket.c:658
sock_close+0x1c/0x30 net/socket.c:1426
__fput+0x3f6/0xb60 fs/file_table.c:431
task_work_run+0x14e/0x250 kernel/task_work.c:228
get_signal+0x1d3/0x26d0 kernel/signal.c:2690
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
__do_fast_syscall_32+0x80/0x120 arch/x86/entry/common.c:389
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #1 (&d->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
__rfcomm_dlc_close+0x235/0x700 net/bluetooth/rfcomm/core.c:491
rfcomm_dlc_close+0x1eb/0x240 net/bluetooth/rfcomm/core.c:524
__rfcomm_sock_close+0xa7/0x230 net/bluetooth/rfcomm/sock.c:220
rfcomm_sock_shutdown+0xd5/0x230 net/bluetooth/rfcomm/sock.c:901
rfcomm_sock_release+0x5d/0x140 net/bluetooth/rfcomm/sock.c:922
__sock_release+0xb0/0x270 net/socket.c:658
sock_close+0x1c/0x30 net/socket.c:1426
__fput+0x3f6/0xb60 fs/file_table.c:431
task_work_run+0x14e/0x250 kernel/task_work.c:228
get_signal+0x1d3/0x26d0 kernel/signal.c:2690
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
__do_fast_syscall_32+0x80/0x120 arch/x86/entry/common.c:389
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
-> #0 (rfcomm_mutex){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
rfcomm_dlc_exists+0x5f/0x1a0 net/bluetooth/rfcomm/core.c:546
__rfcomm_create_dev net/bluetooth/rfcomm/tty.c:414 [inline]
rfcomm_create_dev net/bluetooth/rfcomm/tty.c:485 [inline]
rfcomm_dev_ioctl+0xabc/0x1e70 net/bluetooth/rfcomm/tty.c:584
rfcomm_sock_ioctl net/bluetooth/rfcomm/sock.c:869 [inline]
rfcomm_sock_compat_ioctl+0xba/0xe0 net/bluetooth/rfcomm/sock.c:882
compat_sock_ioctl+0x17b/0x7e0 net/socket.c:3539
__do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
other info that might help us debug this:
Chain exists of:
rfcomm_mutex --> sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM --> rfcomm_ioctl_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(rfcomm_ioctl_mutex);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
lock(rfcomm_ioctl_mutex);
lock(rfcomm_mutex);
*** DEADLOCK ***
2 locks held by syz.1.860/8685:
#0: ffff88805fada258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1609 [inline]
#0: ffff88805fada258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sock_ioctl net/bluetooth/rfcomm/sock.c:868 [inline]
#0: ffff88805fada258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sock_compat_ioctl+0xac/0xe0 net/bluetooth/rfcomm/sock.c:882
#1: ffffffff8fd571a8 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_create_dev net/bluetooth/rfcomm/tty.c:484 [inline]
#1: ffffffff8fd571a8 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x9db/0x1e70 net/bluetooth/rfcomm/tty.c:584
stack backtrace:
CPU: 2 UID: 0 PID: 8685 Comm: syz.1.860 Not tainted 6.12.0-rc2-syzkaller-00058-g75b607fab38d #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_circular_bug+0x419/0x5d0 kernel/locking/lockdep.c:2074
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
rfcomm_dlc_exists+0x5f/0x1a0 net/bluetooth/rfcomm/core.c:546
__rfcomm_create_dev net/bluetooth/rfcomm/tty.c:414 [inline]
rfcomm_create_dev net/bluetooth/rfcomm/tty.c:485 [inline]
rfcomm_dev_ioctl+0xabc/0x1e70 net/bluetooth/rfcomm/tty.c:584
rfcomm_sock_ioctl net/bluetooth/rfcomm/sock.c:869 [inline]
rfcomm_sock_compat_ioctl+0xba/0xe0 net/bluetooth/rfcomm/sock.c:882
compat_sock_ioctl+0x17b/0x7e0 net/socket.c:3539
__do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f25579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f56a656c EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400452c8
RDX: 0000000020000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 UID: 0 PID: 8685 Comm: syz.1.860 Not tainted 6.12.0-rc2-syzkaller-00058-g75b607fab38d #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
fail_dump lib/fault-inject.c:53 [inline]
should_fail_ex+0x497/0x5b0 lib/fault-inject.c:154
should_failslab+0xc2/0x120 mm/failslab.c:46
slab_pre_alloc_hook mm/slub.c:4038 [inline]
slab_alloc_node mm/slub.c:4114 [inline]
kmem_cache_alloc_noprof+0x6e/0x2f0 mm/slub.c:4141
__kernfs_new_node+0xd3/0x890 fs/kernfs/dir.c:624
kernfs_new_node+0x186/0x240 fs/kernfs/dir.c:700
kernfs_create_dir_ns+0x4c/0x150 fs/kernfs/dir.c:1061
sysfs_create_dir_ns+0x13b/0x2b0 fs/sysfs/dir.c:59
create_dir lib/kobject.c:73 [inline]
kobject_add_internal+0x2c8/0x990 lib/kobject.c:240
kobject_add_varg lib/kobject.c:374 [inline]
kobject_add+0x16f/0x240 lib/kobject.c:426
device_add+0x289/0x1a70 drivers/base/core.c:3613
tty_register_device_attr+0x38f/0x7c0 drivers/tty/tty_io.c:3275
rfcomm_dev_add net/bluetooth/rfcomm/tty.c:331 [inline]
__rfcomm_create_dev net/bluetooth/rfcomm/tty.c:424 [inline]
rfcomm_create_dev net/bluetooth/rfcomm/tty.c:485 [inline]
rfcomm_dev_ioctl+0x1849/0x1e70 net/bluetooth/rfcomm/tty.c:584
rfcomm_sock_ioctl net/bluetooth/rfcomm/sock.c:869 [inline]
rfcomm_sock_compat_ioctl+0xba/0xe0 net/bluetooth/rfcomm/sock.c:882
compat_sock_ioctl+0x17b/0x7e0 net/socket.c:3539
__do_compat_sys_ioctl+0x259/0x2b0 fs/ioctl.c:1007
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f25579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f56a656c EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400452c8
RDX: 0000000020000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
kobject: kobject_add_internal failed for rfcomm0 (error: -12 parent: tty)
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 10 06 adc %al,(%rsi)
2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
6: 10 07 adc %al,(%rdi)
8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
c: 10 08 adc %cl,(%rax)
e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1e: 00 51 52 add %dl,0x52(%rcx)
21: 55 push %rbp
22: 89 e5 mov %esp,%ebp
24: 0f 34 sysenter
26: cd 80 int $0x80
* 28: 5d pop %rbp <-- trapping instruction
29: 5a pop %rdx
2a: 59 pop %rcx
2b: c3 ret
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi