======================================================
WARNING: possible circular locking dependency detected
5.10.199 #1 Not tainted
------------------------------------------------------
syz-executor.2/12636 is trying to acquire lock:
ffff8880176b0b78 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xdd/0xa90 kernel/workqueue.c:3050

but task is already holding lock:
ffffffff85619468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0xff/0x4b0 net/rfkill/core.c:1232

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #4 (rfkill_global_mutex){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:968 [inline]
       __mutex_lock+0x13d/0x10b0 kernel/locking/mutex.c:1109
       rfkill_register+0x36/0xa10 net/rfkill/core.c:1016
       hci_register_dev+0x42e/0xc00 net/bluetooth/hci_core.c:3773
       __vhci_create_device+0x2c8/0x5c0 drivers/bluetooth/hci_vhci.c:129
       vhci_create_device drivers/bluetooth/hci_vhci.c:153 [inline]
       vhci_open_timeout+0x38/0x50 drivers/bluetooth/hci_vhci.c:310
       process_one_work+0x9a9/0x14b0 kernel/workqueue.c:2282
       worker_thread+0x61d/0x1310 kernel/workqueue.c:2428
       kthread+0x38f/0x470 kernel/kthread.c:313
       ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299

-> #3 (&data->open_mutex){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:968 [inline]
       __mutex_lock+0x13d/0x10b0 kernel/locking/mutex.c:1109
       vhci_send_frame+0x63/0xa0 drivers/bluetooth/hci_vhci.c:71
       hci_send_frame+0x1b9/0x320 net/bluetooth/hci_core.c:4060
       hci_sched_acl_pkt net/bluetooth/hci_core.c:4585 [inline]
       hci_sched_acl net/bluetooth/hci_core.c:4670 [inline]
       hci_tx_work+0x10af/0x1660 net/bluetooth/hci_core.c:4741
       process_one_work+0x9a9/0x14b0 kernel/workqueue.c:2282
       worker_thread+0x61d/0x1310 kernel/workqueue.c:2428
       kthread+0x38f/0x470 kernel/kthread.c:313
       ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299

-> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}:
       __flush_work+0x105/0xa90 kernel/workqueue.c:3053
       hci_dev_do_close+0x131/0x1240 net/bluetooth/hci_core.c:1745
       hci_unregister_dev+0x149/0x430 net/bluetooth/hci_core.c:3849
       vhci_release+0x70/0xf0 drivers/bluetooth/hci_vhci.c:345
       __fput+0x285/0x980 fs/file_table.c:281
       task_work_run+0xe2/0x1a0 kernel/task_work.c:161
       exit_task_work include/linux/task_work.h:32 [inline]
       do_exit+0xb6f/0x2600 kernel/exit.c:858
       do_group_exit+0x125/0x310 kernel/exit.c:980
       get_signal+0x4bc/0x22f0 kernel/signal.c:2751
       arch_do_signal_or_restart+0x2b7/0x1990 arch/x86/kernel/signal.c:805
       handle_signal_work kernel/entry/common.c:145 [inline]
       exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
       exit_to_user_mode_prepare+0x10f/0x190 kernel/entry/common.c:199
       syscall_exit_to_user_mode+0x38/0x1e0 kernel/entry/common.c:274
       entry_SYSCALL_64_after_hwframe+0x62/0xc7

-> #1 (&hdev->req_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:968 [inline]
       __mutex_lock+0x13d/0x10b0 kernel/locking/mutex.c:1109
       hci_req_sync net/bluetooth/hci_request.c:275 [inline]
       bg_scan_update+0x82/0x500 net/bluetooth/hci_request.c:2895
       process_one_work+0x9a9/0x14b0 kernel/workqueue.c:2282
       worker_thread+0x61d/0x1310 kernel/workqueue.c:2428
       kthread+0x38f/0x470 kernel/kthread.c:313
       ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299

-> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:2988 [inline]
       check_prevs_add kernel/locking/lockdep.c:3113 [inline]
       validate_chain kernel/locking/lockdep.c:3728 [inline]
       __lock_acquire+0x29e7/0x5b00 kernel/locking/lockdep.c:4954
       lock_acquire kernel/locking/lockdep.c:5565 [inline]
       lock_acquire+0x197/0x470 kernel/locking/lockdep.c:5530
       __flush_work+0x105/0xa90 kernel/workqueue.c:3053
       __cancel_work_timer+0x368/0x4c0 kernel/workqueue.c:3144
       hci_request_cancel_all+0x73/0x230 net/bluetooth/hci_request.c:3438
       hci_dev_do_close+0xd9/0x1240 net/bluetooth/hci_core.c:1733
       hci_rfkill_set_block+0x166/0x1a0 net/bluetooth/hci_core.c:2223
       rfkill_set_block+0x1fd/0x540 net/rfkill/core.c:341
       rfkill_fop_write+0x253/0x4b0 net/rfkill/core.c:1240
       vfs_write+0x29a/0xa70 fs/read_write.c:603
       ksys_write+0x1f6/0x260 fs/read_write.c:658
       do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
       entry_SYSCALL_64_after_hwframe+0x62/0xc7

other info that might help us debug this:

Chain exists of:
  (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(rfkill_global_mutex);
                               lock(&data->open_mutex);
                               lock(rfkill_global_mutex);
  lock((work_completion)(&hdev->bg_scan_update));

 *** DEADLOCK ***

1 lock held by syz-executor.2/12636:
 #0: ffffffff85619468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0xff/0x4b0 net/rfkill/core.c:1232

stack backtrace:
CPU: 1 PID: 12636 Comm: syz-executor.2 Not tainted 5.10.199 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x167 lib/dump_stack.c:118
 check_noncircular+0x263/0x2e0 kernel/locking/lockdep.c:2123
 check_prev_add kernel/locking/lockdep.c:2988 [inline]
 check_prevs_add kernel/locking/lockdep.c:3113 [inline]
 validate_chain kernel/locking/lockdep.c:3728 [inline]
 __lock_acquire+0x29e7/0x5b00 kernel/locking/lockdep.c:4954
 lock_acquire kernel/locking/lockdep.c:5565 [inline]
 lock_acquire+0x197/0x470 kernel/locking/lockdep.c:5530
 __flush_work+0x105/0xa90 kernel/workqueue.c:3053
 __cancel_work_timer+0x368/0x4c0 kernel/workqueue.c:3144
 hci_request_cancel_all+0x73/0x230 net/bluetooth/hci_request.c:3438
 hci_dev_do_close+0xd9/0x1240 net/bluetooth/hci_core.c:1733
 hci_rfkill_set_block+0x166/0x1a0 net/bluetooth/hci_core.c:2223
 rfkill_set_block+0x1fd/0x540 net/rfkill/core.c:341
 rfkill_fop_write+0x253/0x4b0 net/rfkill/core.c:1240
 vfs_write+0x29a/0xa70 fs/read_write.c:603
 ksys_write+0x1f6/0x260 fs/read_write.c:658
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x62/0xc7
RIP: 0033:0x7f8b75baab19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8b73120188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f8b75cbdf60 RCX: 00007f8b75baab19
RDX: 0000000000000008 RSI: 00000000200000c0 RDI: 0000000000000006
RBP: 00007f8b75c04f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe3fe0e33f R14: 00007f8b73120300 R15: 0000000000022000
audit: type=1326 audit(1699116839.816:293): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12661 comm="syz-executor.7" exe="/syz-executor.7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca7a6bfb19 code=0x7ffc0000
audit: type=1326 audit(1699116839.838:294): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12661 comm="syz-executor.7" exe="/syz-executor.7" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fca7a6bfb19 code=0x7ffc0000
audit: type=1326 audit(1699116839.866:295): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12661 comm="syz-executor.7" exe="/syz-executor.7" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca7a6bfb19 code=0x7ffc0000
audit: type=1326 audit(1699116840.339:296): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12680 comm="syz-executor.5" exe="/syz-executor.5" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa273b11b19 code=0x0
capability: warning: `syz-executor.5' uses deprecated v2 capabilities in a way that may be insecure
audit: type=1326 audit(1699116841.174:297): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12680 comm="syz-executor.5" exe="/syz-executor.5" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa273b11b19 code=0x0
audit: type=1326 audit(1699116841.568:298): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12727 comm="syz-executor.5" exe="/syz-executor.5" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa273b11b19 code=0x0
Module has invalid ELF structures
Module has invalid ELF structures
audit: type=1326 audit(1699116844.104:299): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12762 comm="syz-executor.5" exe="/syz-executor.5" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa273b11b19 code=0x0
Module has invalid ELF structures
Module has invalid ELF structures
Module has invalid ELF structures
Module has invalid ELF structures
Module has invalid ELF structures
Module has invalid ELF structures
audit: type=1326 audit(1699116845.280:300): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12811 comm="syz-executor.5" exe="/syz-executor.5" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa273b11b19 code=0x0
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.7'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.7'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
udc-core: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_probe_driver returned -19
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.7'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.