Bluetooth: hci3: command 0x0406 tx timeout
BUG: workqueue leaked lock or atomic: kworker/u5:9/0x00000000/3659
     last function: hci_rx_work
1 lock held by kworker/u5:9/3659:
 #0: ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
 #0: ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
 #0: ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x6fe/0x8bf0 net/bluetooth/l2cap_core.c:7867
CPU: 0 PID: 3659 Comm: kworker/u5:9 Not tainted 6.1.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 process_one_work+0xd1e/0x11d0 kernel/workqueue.c:2307
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

======================================================
WARNING: possible circular locking dependency detected
6.1.102-syzkaller #0 Not tainted
------------------------------------------------------
kworker/u5:9/3659 is trying to acquire lock:
ffff88805b2ab938 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267

but task is already holding lock:
ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x6fe/0x8bf0 net/bluetooth/l2cap_core.c:7867

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&chan->lock/1){+.+.}-{3:3}:
       reacquire_held_locks+0x3a4/0x660 kernel/locking/lockdep.c:5187
       __lock_release kernel/locking/lockdep.c:5376 [inline]
       lock_release+0x378/0xa20 kernel/locking/lockdep.c:5682
       process_one_work+0x988/0x11d0 kernel/workqueue.c:2298
       worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
       kthread+0x28d/0x320 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #0 ((wq_completion)hci1#2){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3090 [inline]
       check_prevs_add kernel/locking/lockdep.c:3209 [inline]
       validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
       __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
       lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
       process_one_work+0x7bf/0x11d0 kernel/workqueue.c:2267
       worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
       kthread+0x28d/0x320 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&chan->lock/1);
                               lock((wq_completion)hci1#2);
                               lock(&chan->lock/1);
  lock((wq_completion)hci1#2);

 *** DEADLOCK ***

1 lock held by kworker/u5:9/3659:
 #0: ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:863 [inline]
 #0: ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:7801 [inline]
 #0: ffff88807dd39530 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x6fe/0x8bf0 net/bluetooth/l2cap_core.c:7867

stack backtrace:
CPU: 0 PID: 3659 Comm: kworker/u5:9 Not tainted 6.1.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3090 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
 __lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
 process_one_work+0x7bf/0x11d0 kernel/workqueue.c:2267
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Bluetooth: hci0: command tx timeout
Bluetooth: hci4: command tx timeout
Bluetooth: hci0: command tx timeout