Bluetooth: hci0: command tx timeout ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ kworker/u5:0/45 is trying to acquire lock: ffff888040d40840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] ffff888040d40840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] ffff888040d40840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4233 [inline] ffff888040d40840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: __flush_work+0x100/0xc50 kernel/workqueue.c:4291 but task is already holding lock: ffff888040d40af8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 net/bluetooth/l2cap_core.c:1755 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&conn->lock#2){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x19f/0x1300 kernel/locking/mutex.c:776 l2cap_info_timeout+0x60/0xa0 net/bluetooth/l2cap_core.c:1661 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:467 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #0 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 touch_work_lockdep_map kernel/workqueue.c:4005 [inline] start_flush_work kernel/workqueue.c:4259 [inline] __flush_work+0x700/0xc50 kernel/workqueue.c:4291 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4447 l2cap_conn_del+0x40f/0x5c0 net/bluetooth/l2cap_core.c:1791 hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline] hci_disconn_complete_evt+0x501/0x950 net/bluetooth/hci_event.c:3459 hci_event_func net/bluetooth/hci_event.c:7784 [inline] hci_event_packet+0x805/0x12c0 net/bluetooth/hci_event.c:7838 hci_rx_work+0x3ee/0x1030 net/bluetooth/hci_core.c:4077 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:467 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&conn->lock#2); lock((work_completion)(&(&conn->info_timer)->work)); lock(&conn->lock#2); lock((work_completion)(&(&conn->info_timer)->work)); *** DEADLOCK *** 6 locks held by kworker/u5:0/45: #0: ffff888040d41948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline] #0: ffff888040d41948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358 #1: ffffc90000477c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline] #1: ffffc90000477c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358 #2: ffff88801cbb80c0 (&hdev->lock){+.+.}-{4:4}, at: hci_disconn_complete_evt+0x3f/0x950 net/bluetooth/hci_event.c:3401 #3: ffffffff8fd5aea8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline] #3: ffffffff8fd5aea8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_complete_evt+0x49b/0x950 net/bluetooth/hci_event.c:3459 #4: ffff888040d40af8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 net/bluetooth/l2cap_core.c:1755 #5: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #5: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #5: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: start_flush_work kernel/workqueue.c:4233 [inline] #5: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x100/0xc50 kernel/workqueue.c:4291 stack backtrace: CPU: 0 UID: 0 PID: 45 Comm: kworker/u5:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: hci0 hci_rx_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043 check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 touch_work_lockdep_map kernel/workqueue.c:4005 [inline] start_flush_work kernel/workqueue.c:4259 [inline] __flush_work+0x700/0xc50 kernel/workqueue.c:4291 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4447 l2cap_conn_del+0x40f/0x5c0 net/bluetooth/l2cap_core.c:1791 hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline] hci_disconn_complete_evt+0x501/0x950 net/bluetooth/hci_event.c:3459 hci_event_func net/bluetooth/hci_event.c:7784 [inline] hci_event_packet+0x805/0x12c0 net/bluetooth/hci_event.c:7838 hci_rx_work+0x3ee/0x1030 net/bluetooth/hci_core.c:4077 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:467 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245