================================ WARNING: inconsistent lock state 4.19.206-syzkaller #0 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. syz-executor.5/28295 [HC0[0]:SC0[0]:HE1:SE1] takes: 00000000ab1411fe (slock-AF_BLUETOOTH-BTPROTO_SCO){+.?.}, at: spin_lock include/linux/spinlock.h:329 [inline] 00000000ab1411fe (slock-AF_BLUETOOTH-BTPROTO_SCO){+.?.}, at: sco_conn_del+0xe2/0x240 net/bluetooth/sco.c:175 {IN-SOFTIRQ-W} state was registered at: __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sco_sock_timeout+0x31/0x210 net/bluetooth/sco.c:82 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] lock_release+0x429/0x8b0 kernel/locking/lockdep.c:3930 rcu_lock_release include/linux/rcupdate.h:247 [inline] rcu_read_unlock include/linux/rcupdate.h:681 [inline] find_get_entry+0x4f4/0x8a0 mm/filemap.c:1491 pagecache_get_page+0x56/0xd50 mm/filemap.c:1564 find_get_page_flags include/linux/pagemap.h:278 [inline] __find_get_block_slow fs/buffer.c:206 [inline] __find_get_block+0x591/0xde0 fs/buffer.c:1295 sb_find_get_block include/linux/buffer_head.h:346 [inline] recently_deleted fs/ext4/ialloc.c:684 [inline] find_inode_bit+0x213/0x520 fs/ext4/ialloc.c:724 __ext4_new_inode+0x160c/0x5a20 fs/ext4/ialloc.c:916 ext4_symlink+0x3f5/0xc00 fs/ext4/namei.c:3176 vfs_symlink+0x453/0x6c0 fs/namei.c:4129 do_symlinkat+0x258/0x2c0 fs/namei.c:4156 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe irq event stamp: 14613 hardirqs last enabled at (14613): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (14612): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (14176): [] spin_unlock_bh include/linux/spinlock.h:374 [inline] softirqs last enabled at (14176): [] peernet2id+0x8f/0xc0 net/core/net_namespace.c:266 softirqs last disabled at (14174): [] spin_lock_bh include/linux/spinlock.h:334 [inline] softirqs last disabled at (14174): [] peernet2id+0x6f/0xc0 net/core/net_namespace.c:264 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(slock-AF_BLUETOOTH-BTPROTO_SCO); lock(slock-AF_BLUETOOTH-BTPROTO_SCO); *** DEADLOCK *** 4 locks held by syz-executor.5/28295: #0: 000000000df30df8 (rfkill_global_mutex){+.+.}, at: rfkill_fop_write+0xfe/0x4a0 net/rfkill/core.c:1241 overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. #1: 00000000e1876b62 (&hdev->req_lock){+.+.}, at: hci_dev_do_close+0x196/0xf10 net/bluetooth/hci_core.c:1623 #2: 00000000b17ce9e8 (&hdev->lock){+.+.}, at: hci_dev_do_close+0x2e0/0xf10 net/bluetooth/hci_core.c:1660 #3: 000000005d4a19c4 (hci_cb_list_lock){+.+.}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1260 [inline] #3: 000000005d4a19c4 (hci_cb_list_lock){+.+.}, at: hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1512 stack backtrace: CPU: 1 PID: 28295 Comm: syz-executor.5 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_usage_bug.cold+0x42e/0x570 kernel/locking/lockdep.c:2545 valid_state kernel/locking/lockdep.c:2558 [inline] mark_lock_irq kernel/locking/lockdep.c:2752 [inline] mark_lock+0xc70/0x1160 kernel/locking/lockdep.c:3132 mark_irqflags kernel/locking/lockdep.c:3028 [inline] __lock_acquire+0x6a8/0x3ff0 kernel/locking/lockdep.c:3373 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sco_conn_del+0xe2/0x240 net/bluetooth/sco.c:175 sco_disconn_cfm+0x74/0xb0 net/bluetooth/sco.c:1133 overlayfs: filesystem on './bus' not supported as upperdir hci_disconn_cfm include/net/bluetooth/hci_core.h:1263 [inline] hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1512 hci_dev_do_close+0x659/0xf10 net/bluetooth/hci_core.c:1673 hci_rfkill_set_block+0xe7/0x160 net/bluetooth/hci_core.c:2107 rfkill_set_block+0x1f9/0x540 net/rfkill/core.c:353 rfkill_fop_write+0x250/0x4a0 net/rfkill/core.c:1249 __vfs_write+0xf7/0x770 fs/read_write.c:485 vfs_write+0x1f3/0x540 fs/read_write.c:549 ksys_write+0x12b/0x2a0 fs/read_write.c:599 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f44ebe3f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9 RDX: 0000000000000008 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007ffc4463d61f R14: 00007f44ebe3f300 R15: 0000000000022000 ptrace attach of "/root/syz-executor.3"[28456] was attempted by "/root/syz-executor.3"[28459] ptrace attach of "/root/syz-executor.3"[28475] was attempted by "/root/syz-executor.3"[28481] ptrace attach of "/root/syz-executor.4"[28480] was attempted by "/root/syz-executor.4"[28484] ptrace attach of "/root/syz-executor.3"[28492] was attempted by "/root/syz-executor.3"[28496] ptrace attach of "/root/syz-executor.4"[28495] was attempted by "/root/syz-executor.4"[28497] ptrace attach of "/root/syz-executor.3"[28503] was attempted by "/root/syz-executor.3"[28509] ptrace attach of "/root/syz-executor.2"[28515] was attempted by "/root/syz-executor.2"[28517] ptrace attach of "/root/syz-executor.2"[28529] was attempted by "/root/syz-executor.2"[28535] tmpfs: Bad value 'loca55@X[}4L-' for mount option 'mpol' tmpfs: Bad value 'loca55@X[}4L-' for mount option 'mpol' tmpfs: Bad value 'loca55@X[}4L-' for mount option 'mpol' caif:caif_disconnect_client(): nothing to disconnect caif:caif_disconnect_client(): nothing to disconnect tmpfs: Bad value 'loca55@X[}4L-' for mount option 'mpol' tmpfs: Bad value 'loca55@X[}4L-' for mount option 'mpol' caif:caif_disconnect_client(): nothing to disconnect tmpfs: Bad value 'loca55@X[}4L-' for mount option 'mpol' tmpfs: Bad value 'loca55@X[}4L-' for mount option 'mpol' caif:caif_disconnect_client(): nothing to disconnect ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 caif:caif_disconnect_client(): nothing to disconnect Disabled LAPIC found during irq injection Disabled LAPIC found during irq injection Disabled LAPIC found during irq injection Disabled LAPIC found during irq injection Disabled LAPIC found during irq injection netlink: 'syz-executor.5': attribute type 4 has an invalid length. netlink: 'syz-executor.5': attribute type 4 has an invalid length. netlink: 'syz-executor.5': attribute type 16 has an invalid length. netlink: 'syz-executor.5': attribute type 4 has an invalid length. netlink: 'syz-executor.5': attribute type 4 has an invalid length. kauditd_printk_skb: 23 callbacks suppressed audit: type=1800 audit(1630926645.419:243): pid=29096 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.1" name="cpuacct.usage_user" dev="sda1" ino=15025 res=0 netlink: 'syz-executor.5': attribute type 4 has an invalid length. netlink: 'syz-executor.5': attribute type 4 has an invalid length. netlink: 'syz-executor.5': attribute type 16 has an invalid length.