====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.6.225/5332 is trying to acquire lock: ffff88802acc7120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] ffff88802acc7120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 but task is already holding lock: ffffffff8d594a88 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline] ffffffff8d594a88 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (hci_cb_list_lock){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 hci_connect_cfm include/net/bluetooth/hci_core.h:1504 [inline] hci_remote_features_evt+0x5d9/0xa10 net/bluetooth/hci_event.c:3367 hci_event_packet+0x600/0x1310 net/bluetooth/hci_event.c:6455 hci_rx_work+0x255/0xa10 net/bluetooth/hci_core.c:5190 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #1 (&hdev->lock){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 sco_sock_connect+0x189/0x940 net/bluetooth/sco.c:608 __sys_connect_file net/socket.c:1933 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1950 __do_sys_connect net/socket.c:1960 [inline] __se_sys_connect net/socket.c:1957 [inline] __x64_sys_connect+0x76/0x80 net/socket.c:1957 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 hci_disconn_cfm include/net/bluetooth/hci_core.h:1522 [inline] hci_conn_hash_flush+0x107/0x220 net/bluetooth/hci_conn.c:1622 hci_dev_do_close+0x918/0x1020 net/bluetooth/hci_core.c:1813 hci_dev_close+0xd9/0x180 net/bluetooth/hci_core.c:1895 sock_do_ioctl+0xfb/0x320 net/socket.c:1148 sock_ioctl+0x48a/0x700 net/socket.c:1267 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 other info that might help us debug this: Chain exists of: sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hci_cb_list_lock); lock(&hdev->lock); lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); *** DEADLOCK *** 3 locks held by syz.6.225/5332: #0: ffff888064cf13f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 net/bluetooth/hci_core.c:1755 #1: ffff888064cf0478 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x408/0x1020 net/bluetooth/hci_core.c:1800 #2: ffffffff8d594a88 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline] #2: ffffffff8d594a88 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622 stack backtrace: CPU: 1 PID: 5332 Comm: syz.6.225 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] sco_conn_del+0x13e/0x350 net/bluetooth/sco.c:206 hci_disconn_cfm include/net/bluetooth/hci_core.h:1522 [inline] hci_conn_hash_flush+0x107/0x220 net/bluetooth/hci_conn.c:1622 hci_dev_do_close+0x918/0x1020 net/bluetooth/hci_core.c:1813 hci_dev_close+0xd9/0x180 net/bluetooth/hci_core.c:1895 sock_do_ioctl+0xfb/0x320 net/socket.c:1148 sock_ioctl+0x48a/0x700 net/socket.c:1267 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f5295034159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f529326b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f52952bc090 RCX: 00007f5295034159 RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000004 RBP: 00007f52950cb06b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f52952bc128 R14: 00007f52952bc090 R15: 00007fff09c34f28 sock ffff88802acc7000 state 5 sk ffff88802acc7000, conn ffff88801f740e00, err 103 hcon ffff888023f56000 orig refcnt 1 hci0 hcon ffff888023f56000 handle 0 hcon ffff8880256be000 orig refcnt 1 hcon ffff888023f56000 hci0: conn ffff888023f56000 kobject: '(null)' (ffff888023f56420): kobject_cleanup, parent 0000000000000000 kobject: '(null)' (ffff888023f56420): calling ktype release hci0 orig refcnt 14 hcon ffff888077738000 reason 22 hcon ffff888077738000 conn ffff888075eac000, err 103 hci0 hcon ffff888077738000 chan ffff888028f46a00 hci0 hcon ffff888077738000 handle 201 hcon ffff888077738000 hci0: conn ffff888077738000 device: 'hci0:201': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci0:201: removing kernfs uevent: removing PM: Removing info for No Bus:hci0:201 kobject: 'hci0:201' (ffff888077738420): kobject_uevent_env kobject: 'hci0:201' (ffff888077738420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/hci0:201' kernfs hci0:201: removing kobject: 'hci0:201' (ffff888077738420): kobject_cleanup, parent 0000000000000000 kobject: 'hci0:201' (ffff888077738420): calling ktype release kobject: 'hci0:201': free name hci0 orig refcnt 11 hcon ffff8880256be000 reason 22 hcon ffff8880256be000 conn ffff888075eab800, err 103 hci0 hcon ffff8880256be000 chan ffff88805fb1b000 hci0 hcon ffff8880256be000 handle 200 hcon ffff8880256be000 hci0: conn ffff8880256be000 device: 'hci0:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci0:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci0:200 kobject: 'hci0:200' (ffff8880256be420): kobject_uevent_env kobject: 'hci0:200' (ffff8880256be420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/hci0:200' kernfs hci0:200: removing kobject: 'hci0:200' (ffff8880256be420): kobject_cleanup, parent 0000000000000000 kobject: 'hci0:200' (ffff8880256be420): calling ktype release kobject: 'hci0:200': free name hci0 orig refcnt 8 hdev hci0 event 4 hdev 0000000000000000 len 8 hdev hci0 event 8 hci0 orig refcnt 7 hci0 orig refcnt 6 sock ffff888073f1ec00 sk ffff888025041000 channel 2 len 10 kcov: kcov_task_exit: t = ffff88805fcf1dc0, kcov->t = ffff88805fcf1dc0