======================================================
WARNING: possible circular locking dependency detected
6.1.83-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14466 is trying to acquire lock:
ffff888077e88350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_request net/nfc/nci/core.c:148 [inline]
ffff888077e88350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_set_local_general_bytes net/nfc/nci/core.c:774 [inline]
ffff888077e88350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_start_poll+0x59f/0xf20 net/nfc/nci/core.c:838
but task is already holding lock:
ffff88807c431508 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_genl_start_poll+0x1da/0x350 net/nfc/netlink.c:826
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&genl_data->genl_data_mutex){+.+.}-{3:3}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
nfc_urelease_event_work+0x113/0x2f0 net/nfc/netlink.c:1849
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
-> #2 (nfc_devlist_mutex){+.+.}-{3:3}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
nfc_register_device+0x38/0x310 net/nfc/core.c:1116
nci_register_device+0x7be/0x900 net/nfc/nci/core.c:1265
virtual_ncidev_open+0x55/0xc0 drivers/nfc/virtual_ncidev.c:146
misc_open+0x304/0x380 drivers/char/misc.c:143
chrdev_open+0x54a/0x630 fs/char_dev.c:414
do_dentry_open+0x7f9/0x10f0 fs/open.c:882
do_open fs/namei.c:3628 [inline]
path_openat+0x2644/0x2e60 fs/namei.c:3785
do_filp_open+0x230/0x480 fs/namei.c:3812
do_sys_openat2+0x13b/0x500 fs/open.c:1318
do_sys_open fs/open.c:1334 [inline]
__do_sys_openat fs/open.c:1350 [inline]
__se_sys_openat fs/open.c:1345 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1345
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #1 (nci_mutex){+.+.}-{3:3}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
virtual_nci_close+0x13/0x40 drivers/nfc/virtual_ncidev.c:44
nci_open_device net/nfc/nci/core.c:544 [inline]
nci_dev_up+0x954/0xd40 net/nfc/nci/core.c:631
nfc_dev_up+0x185/0x330 net/nfc/core.c:118
nfc_genl_dev_up+0x80/0xd0 net/nfc/netlink.c:770
genl_family_rcv_msg_doit net/netlink/genetlink.c:756 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
genl_rcv_msg+0xc1a/0xf70 net/netlink/genetlink.c:850
netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508
genl_rcv+0x24/0x40 net/netlink/genetlink.c:861
netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]
netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352
netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5a5/0x8f0 net/socket.c:2514
___sys_sendmsg net/socket.c:2568 [inline]
__sys_sendmsg+0x2a9/0x390 net/socket.c:2597
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #0 (&ndev->req_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
nci_request net/nfc/nci/core.c:148 [inline]
nci_set_local_general_bytes net/nfc/nci/core.c:774 [inline]
nci_start_poll+0x59f/0xf20 net/nfc/nci/core.c:838
nfc_start_poll+0x184/0x2f0 net/nfc/core.c:225
nfc_genl_start_poll+0x1e7/0x350 net/nfc/netlink.c:828
genl_family_rcv_msg_doit net/netlink/genetlink.c:756 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
genl_rcv_msg+0xc1a/0xf70 net/netlink/genetlink.c:850
netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508
genl_rcv+0x24/0x40 net/netlink/genetlink.c:861
netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]
netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352
netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5a5/0x8f0 net/socket.c:2514
___sys_sendmsg net/socket.c:2568 [inline]
__sys_sendmsg+0x2a9/0x390 net/socket.c:2597
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
other info that might help us debug this:
Chain exists of:
&ndev->req_lock --> nfc_devlist_mutex --> &genl_data->genl_data_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&genl_data->genl_data_mutex);
lock(nfc_devlist_mutex);
lock(&genl_data->genl_data_mutex);
lock(&ndev->req_lock);
*** DEADLOCK ***
4 locks held by syz-executor.2/14466:
#0: ffffffff8e2f8030 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860
#1: ffffffff8e2f7ee8 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
#1: ffffffff8e2f7ee8 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x125/0xf70 net/netlink/genetlink.c:848
#2: ffff88807c431508 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_genl_start_poll+0x1da/0x350 net/nfc/netlink.c:826
#3: ffff88807c431100 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:837 [inline]
#3: ffff88807c431100 (&dev->mutex){....}-{3:3}, at: nfc_start_poll+0x56/0x2f0 net/nfc/core.c:208
stack backtrace:
CPU: 0 PID: 14466 Comm: syz-executor.2 Not tainted 6.1.83-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain+0x1661/0x5950 kernel/locking/lockdep.c:3825
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x132/0xd80 kernel/locking/mutex.c:747
nci_request net/nfc/nci/core.c:148 [inline]
nci_set_local_general_bytes net/nfc/nci/core.c:774 [inline]
nci_start_poll+0x59f/0xf20 net/nfc/nci/core.c:838
nfc_start_poll+0x184/0x2f0 net/nfc/core.c:225
nfc_genl_start_poll+0x1e7/0x350 net/nfc/netlink.c:828
genl_family_rcv_msg_doit net/netlink/genetlink.c:756 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
genl_rcv_msg+0xc1a/0xf70 net/netlink/genetlink.c:850
netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508
genl_rcv+0x24/0x40 net/netlink/genetlink.c:861
netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]
netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352
netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x5a5/0x8f0 net/socket.c:2514
___sys_sendmsg net/socket.c:2568 [inline]
__sys_sendmsg+0x2a9/0x390 net/socket.c:2597
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f26be67dde9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f26bf3d10c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f26be7ac050 RCX: 00007f26be67dde9
RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000005
RBP: 00007f26be6ca47a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f26be7ac050 R15: 00007ffca50f9778
</TASK>