====================================================== WARNING: possible circular locking dependency detected 5.10.200 #1 Not tainted ------------------------------------------------------ syz-executor.4/16080 is trying to acquire lock: ffff888018014b78 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xdd/0xa90 kernel/workqueue.c:3050 but task is already holding lock: ffffffff85619468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0xff/0x4b0 net/rfkill/core.c:1232 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (rfkill_global_mutex){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:968 [inline] __mutex_lock+0x13d/0x10b0 kernel/locking/mutex.c:1109 rfkill_register+0x36/0xa10 net/rfkill/core.c:1016 hci_register_dev+0x42e/0xc00 net/bluetooth/hci_core.c:3773 __vhci_create_device+0x2c8/0x5c0 drivers/bluetooth/hci_vhci.c:129 vhci_create_device drivers/bluetooth/hci_vhci.c:153 [inline] vhci_open_timeout+0x38/0x50 drivers/bluetooth/hci_vhci.c:310 process_one_work+0x9a9/0x14b0 kernel/workqueue.c:2282 worker_thread+0x61d/0x1310 kernel/workqueue.c:2428 kthread+0x38f/0x470 kernel/kthread.c:313 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299 -> #3 (&data->open_mutex){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:968 [inline] __mutex_lock+0x13d/0x10b0 kernel/locking/mutex.c:1109 vhci_send_frame+0x63/0xa0 drivers/bluetooth/hci_vhci.c:71 hci_send_frame+0x1b9/0x320 net/bluetooth/hci_core.c:4060 hci_sched_acl_pkt net/bluetooth/hci_core.c:4585 [inline] hci_sched_acl net/bluetooth/hci_core.c:4670 [inline] hci_tx_work+0x10af/0x1660 net/bluetooth/hci_core.c:4741 process_one_work+0x9a9/0x14b0 kernel/workqueue.c:2282 worker_thread+0x61d/0x1310 kernel/workqueue.c:2428 kthread+0x38f/0x470 kernel/kthread.c:313 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299 -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: __flush_work+0x105/0xa90 kernel/workqueue.c:3053 hci_dev_do_close+0x131/0x1240 net/bluetooth/hci_core.c:1745 hci_unregister_dev+0x149/0x430 net/bluetooth/hci_core.c:3849 vhci_release+0x70/0xf0 drivers/bluetooth/hci_vhci.c:345 __fput+0x285/0x980 fs/file_table.c:281 task_work_run+0xe2/0x1a0 kernel/task_work.c:161 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xb6f/0x2600 kernel/exit.c:858 do_group_exit+0x125/0x310 kernel/exit.c:980 __do_sys_exit_group kernel/exit.c:991 [inline] __se_sys_exit_group kernel/exit.c:989 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:989 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x62/0xc7 -> #1 (&hdev->req_lock){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:968 [inline] __mutex_lock+0x13d/0x10b0 kernel/locking/mutex.c:1109 hci_req_sync net/bluetooth/hci_request.c:275 [inline] bg_scan_update+0x82/0x500 net/bluetooth/hci_request.c:2895 process_one_work+0x9a9/0x14b0 kernel/workqueue.c:2282 worker_thread+0x61d/0x1310 kernel/workqueue.c:2428 kthread+0x38f/0x470 kernel/kthread.c:313 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299 -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain kernel/locking/lockdep.c:3728 [inline] __lock_acquire+0x29e7/0x5b00 kernel/locking/lockdep.c:4954 lock_acquire kernel/locking/lockdep.c:5565 [inline] lock_acquire+0x197/0x470 kernel/locking/lockdep.c:5530 __flush_work+0x105/0xa90 kernel/workqueue.c:3053 __cancel_work_timer+0x368/0x4c0 kernel/workqueue.c:3144 hci_request_cancel_all+0x73/0x230 net/bluetooth/hci_request.c:3438 hci_dev_do_close+0xd9/0x1240 net/bluetooth/hci_core.c:1733 hci_rfkill_set_block+0x166/0x1a0 net/bluetooth/hci_core.c:2223 rfkill_set_block+0x1fd/0x540 net/rfkill/core.c:341 rfkill_fop_write+0x253/0x4b0 net/rfkill/core.c:1240 vfs_write+0x29a/0xa70 fs/read_write.c:603 ksys_write+0x1f6/0x260 fs/read_write.c:658 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x62/0xc7 other info that might help us debug this: Chain exists of: (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rfkill_global_mutex); lock(&data->open_mutex); lock(rfkill_global_mutex); lock((work_completion)(&hdev->bg_scan_update)); *** DEADLOCK *** 1 lock held by syz-executor.4/16080: #0: ffffffff85619468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0xff/0x4b0 net/rfkill/core.c:1232 stack backtrace: CPU: 1 PID: 16080 Comm: syz-executor.4 Not tainted 5.10.200 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 check_noncircular+0x263/0x2e0 kernel/locking/lockdep.c:2123 check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain kernel/locking/lockdep.c:3728 [inline] __lock_acquire+0x29e7/0x5b00 kernel/locking/lockdep.c:4954 lock_acquire kernel/locking/lockdep.c:5565 [inline] lock_acquire+0x197/0x470 kernel/locking/lockdep.c:5530 __flush_work+0x105/0xa90 kernel/workqueue.c:3053 __cancel_work_timer+0x368/0x4c0 kernel/workqueue.c:3144 hci_request_cancel_all+0x73/0x230 net/bluetooth/hci_request.c:3438 hci_dev_do_close+0xd9/0x1240 net/bluetooth/hci_core.c:1733 hci_rfkill_set_block+0x166/0x1a0 net/bluetooth/hci_core.c:2223 rfkill_set_block+0x1fd/0x540 net/rfkill/core.c:341 rfkill_fop_write+0x253/0x4b0 net/rfkill/core.c:1240 vfs_write+0x29a/0xa70 fs/read_write.c:603 ksys_write+0x1f6/0x260 fs/read_write.c:658 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x62/0xc7 RIP: 0033:0x7f9de46cfb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9de1c45188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f9de47e2f60 RCX: 00007f9de46cfb19 RDX: 0000000000000008 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007f9de4729f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc494440ef R14: 00007f9de1c45300 R15: 0000000000022000 audit: type=1326 audit(1700324792.906:263): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16098 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324792.951:264): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16098 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324792.956:265): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16098 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324792.957:266): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16098 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324792.957:267): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16098 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324792.962:268): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16098 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324792.962:269): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16098 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324793.079:270): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16124 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324793.082:271): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16124 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 audit: type=1326 audit(1700324793.085:272): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16124 comm="syz-executor.2" exe="/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4b6111b19 code=0x7ffc0000 Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed 9pnet: Could not find request transport: fd¤Ü§fŽ‡ Process accounting resumed Process accounting resumed Process accounting resumed 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ 9pnet: Could not find request transport: fd¤Ü§fŽ‡ kauditd_printk_skb: 13 callbacks suppressed audit: type=1400 audit(1700324801.952:286): avc: denied { relabelto } for pid=16487 comm="syz-executor.5" name="file0" dev="sda" ino=16076 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=dir permissive=1 audit: type=1400 audit(1700324801.959:287): avc: denied { read } for pid=16487 comm="syz-executor.5" path="/syzkaller-testdir187138039/syzkaller.OiRVvi/280/file0" dev="sda" ino=16076 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=dir permissive=1 audit: type=1400 audit(1700324801.965:288): avc: denied { open } for pid=16487 comm="syz-executor.5" path="/syzkaller-testdir187138039/syzkaller.OiRVvi/280/file0" dev="sda" ino=16076 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=dir permissive=1 audit: type=1400 audit(1700324801.965:289): avc: denied { relabelfrom } for pid=16487 comm="syz-executor.5" name="file0" dev="sda" ino=16076 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=dir permissive=1 audit: type=1400 audit(1700324802.025:290): avc: denied { getattr } for pid=6046 comm="syz-executor.5" path="/syzkaller-testdir187138039/syzkaller.OiRVvi/280/file0" dev="sda" ino=16076 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=dir permissive=1 audit: type=1400 audit(1700324802.034:291): avc: denied { rmdir } for pid=6046 comm="syz-executor.5" name="file0" dev="sda" ino=16076 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:memory_device_t:s0 tclass=dir permissive=1