program: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1a08}, [@IFLA_MTU={0x8, 0x4, 0x5e0}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) [ 74.809127][ T5301] Bluetooth: hci0: command tx timeout [ 74.975973][ T5316] lo: entered allmulticast mode [ 74.989996][ T5316] bond0: entered allmulticast mode [ 74.998459][ T5316] dummy0: entered allmulticast mode [ 75.012141][ T5316] eql: entered allmulticast mode [ 75.019513][ T5316] ifb0: entered allmulticast mode [ 75.033356][ T5316] ifb1: entered allmulticast mode [ 75.228241][ T9] e1000 0000:00:06.0 eth0: Reset adapter [ 75.238706][ T5316] [ 75.239686][ T5316] ====================================================== [ 75.242384][ T5316] WARNING: possible circular locking dependency detected [ 75.244993][ T5316] 6.15.0-syzkaller-01972-g914873bc7df9 #0 Not tainted [ 75.247521][ T5316] ------------------------------------------------------ [ 75.250276][ T5316] syz.0.0/5316 is trying to acquire lock: [ 75.252651][ T5316] ffff8880335516f0 ((work_completion)(&adapter->reset_task)){+.+.}-{0:0}, at: __flush_work+0xd2/0xbc0 [ 75.256895][ T5316] [ 75.256895][ T5316] but task is already holding lock: [ 75.259513][ T5316] ffffffff8f503588 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 75.262919][ T5316] [ 75.262919][ T5316] which lock already depends on the new lock. [ 75.262919][ T5316] [ 75.266893][ T5316] [ 75.266893][ T5316] the existing dependency chain (in reverse order) is: [ 75.270603][ T5316] [ 75.270603][ T5316] -> #1 (rtnl_mutex){+.+.}-{4:4}: [ 75.273648][ T5316] lock_acquire+0x120/0x360 [ 75.275784][ T5316] __mutex_lock+0x182/0xe80 [ 75.277987][ T5316] e1000_reset_task+0x56/0xc0 [ 75.280249][ T5316] process_scheduled_works+0xade/0x17a0 [ 75.282696][ T5316] worker_thread+0x8a0/0xda0 [ 75.284912][ T5316] kthread+0x70e/0x8a0 [ 75.286915][ T5316] ret_from_fork+0x4e/0x80 [ 75.289245][ T5316] ret_from_fork_asm+0x1a/0x30 [ 75.291466][ T5316] [ 75.291466][ T5316] -> #0 ((work_completion)(&adapter->reset_task)){+.+.}-{0:0}: [ 75.295679][ T5316] validate_chain+0xb9b/0x2140 [ 75.297939][ T5316] __lock_acquire+0xab9/0xd20 [ 75.300178][ T5316] lock_acquire+0x120/0x360 [ 75.302335][ T5316] __flush_work+0x6b8/0xbc0 [ 75.304443][ T5316] __cancel_work_sync+0xbe/0x110 [ 75.306614][ T5316] e1000_down+0x402/0x6b0 [ 75.308592][ T5316] e1000_close+0x17b/0xa10 [ 75.310802][ T5316] __dev_close_many+0x364/0x6f0 [ 75.313124][ T5316] __dev_change_flags+0x2c7/0x6d0 [ 75.315440][ T5316] netif_change_flags+0x88/0x1a0 [ 75.317794][ T5316] do_setlink+0xcb9/0x40d0 [ 75.319979][ T5316] rtnl_newlink+0x149f/0x1c70 [ 75.322184][ T5316] rtnetlink_rcv_msg+0x7cf/0xb70 [ 75.324427][ T5316] netlink_rcv_skb+0x21c/0x490 [ 75.326669][ T5316] netlink_unicast+0x758/0x8d0 [ 75.328835][ T5316] netlink_sendmsg+0x805/0xb30 [ 75.331019][ T5316] __sock_sendmsg+0x21c/0x270 [ 75.333204][ T5316] ____sys_sendmsg+0x505/0x830 [ 75.335458][ T5316] ___sys_sendmsg+0x21f/0x2a0 [ 75.337647][ T5316] __x64_sys_sendmsg+0x19b/0x260 [ 75.340008][ T5316] do_syscall_64+0xf6/0x220 [ 75.342085][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.344451][ T5316] [ 75.344451][ T5316] other info that might help us debug this: [ 75.344451][ T5316] [ 75.348712][ T5316] Possible unsafe locking scenario: [ 75.348712][ T5316] [ 75.351886][ T5316] CPU0 CPU1 [ 75.354157][ T5316] ---- ---- [ 75.356726][ T5316] lock(rtnl_mutex); [ 75.358446][ T5316] lock((work_completion)(&adapter->reset_task)); [ 75.362256][ T5316] lock(rtnl_mutex); [ 75.365101][ T5316] lock((work_completion)(&adapter->reset_task)); [ 75.367882][ T5316] [ 75.367882][ T5316] *** DEADLOCK *** [ 75.367882][ T5316] [ 75.371911][ T5316] 2 locks held by syz.0.0/5316: [ 75.374274][ T5316] #0: ffffffff8f503588 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 75.378710][ T5316] #1: ffffffff8e13c9a0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xd2/0xbc0 [ 75.383230][ T5316] [ 75.383230][ T5316] stack backtrace: [ 75.386007][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted 6.15.0-syzkaller-01972-g914873bc7df9 #0 PREEMPT(full) [ 75.386024][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.386032][ T5316] Call Trace: [ 75.386039][ T5316] [ 75.386046][ T5316] dump_stack_lvl+0x189/0x250 [ 75.386069][ T5316] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.386086][ T5316] ? __pfx__printk+0x10/0x10 [ 75.386097][ T5316] ? print_lock_name+0xde/0x100 [ 75.386108][ T5316] print_circular_bug+0x2ee/0x310 [ 75.386124][ T5316] check_noncircular+0x134/0x160 [ 75.386140][ T5316] validate_chain+0xb9b/0x2140 [ 75.386153][ T5316] ? do_raw_spin_lock+0x121/0x290 [ 75.386169][ T5316] ? look_up_lock_class+0x74/0x170 [ 75.386182][ T5316] ? register_lock_class+0x51/0x320 [ 75.386195][ T5316] __lock_acquire+0xab9/0xd20 [ 75.386209][ T5316] ? __flush_work+0xd2/0xbc0 [ 75.386226][ T5316] lock_acquire+0x120/0x360 [ 75.386237][ T5316] ? __flush_work+0xd2/0xbc0 [ 75.386253][ T5316] ? _raw_spin_unlock_irq+0x23/0x50 [ 75.386264][ T5316] ? __flush_work+0xd2/0xbc0 [ 75.386279][ T5316] __flush_work+0x6b8/0xbc0 [ 75.386293][ T5316] ? __flush_work+0xd2/0xbc0 [ 75.386309][ T5316] ? __flush_work+0xd2/0xbc0 [ 75.386325][ T5316] ? __pfx___flush_work+0x10/0x10 [ 75.386342][ T5316] ? __pfx_wq_barrier_func+0x10/0x10 [ 75.386358][ T5316] ? __pfx___cancel_work+0x10/0x10 [ 75.386376][ T5316] __cancel_work_sync+0xbe/0x110 [ 75.386391][ T5316] e1000_down+0x402/0x6b0 [ 75.386407][ T5316] ? e1000_down+0xb2/0x6b0 [ 75.386427][ T5316] ? e1000_free_all_tx_resources+0x200/0x280 [ 75.386443][ T5316] e1000_close+0x17b/0xa10 [ 75.386457][ T5316] ? do_raw_spin_unlock+0x4d/0x240 [ 75.386473][ T5316] ? dev_deactivate_many+0xb82/0xd40 [ 75.386487][ T5316] ? __pfx_e1000_close+0x10/0x10 [ 75.386502][ T5316] ? dev_deactivate_many+0x258/0xd40 [ 75.386513][ T5316] ? __pfx_e1000_close+0x10/0x10 [ 75.386527][ T5316] __dev_close_many+0x364/0x6f0 [ 75.386539][ T5316] ? __pfx___dev_close_many+0x10/0x10 [ 75.386552][ T5316] __dev_change_flags+0x2c7/0x6d0 [ 75.386565][ T5316] ? __pfx_netif_set_mtu_ext+0x10/0x10 [ 75.386578][ T5316] ? __pfx___dev_change_flags+0x10/0x10 [ 75.386590][ T5316] ? netif_state_change+0x256/0x3a0 [ 75.386600][ T5316] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 75.386616][ T5316] netif_change_flags+0x88/0x1a0 [ 75.386630][ T5316] do_setlink+0xcb9/0x40d0 [ 75.386644][ T5316] ? __lock_acquire+0xab9/0xd20 [ 75.386656][ T5316] ? __pfx_do_setlink+0x10/0x10 [ 75.386667][ T5316] ? do_raw_spin_lock+0x121/0x290 [ 75.386685][ T5316] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.386702][ T5316] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 75.386712][ T5316] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 75.386724][ T5316] ? rcu_is_watching+0x15/0xb0 [ 75.386740][ T5316] ? __mutex_lock+0xa6d/0xe80 [ 75.386754][ T5316] ? __mutex_lock+0x51b/0xe80 [ 75.386768][ T5316] ? rtnl_newlink+0x8db/0x1c70 [ 75.386779][ T5316] ? __pfx___mutex_lock+0x10/0x10 [ 75.386792][ T5316] ? ns_capable+0x8a/0xf0 [ 75.386805][ T5316] ? rtnl_link_get_net_capable+0x16a/0x350 [ 75.386818][ T5316] rtnl_newlink+0x149f/0x1c70 [ 75.386831][ T5316] ? __pfx_rtnl_newlink+0x10/0x10 [ 75.386842][ T5316] ? is_bpf_text_address+0x26/0x2b0 [ 75.386857][ T5316] ? __lock_acquire+0xab9/0xd20 [ 75.386871][ T5316] ? __lock_acquire+0xab9/0xd20 [ 75.386887][ T5316] ? is_bpf_text_address+0x26/0x2b0 [ 75.386900][ T5316] ? is_bpf_text_address+0x292/0x2b0 [ 75.386913][ T5316] ? is_bpf_text_address+0x26/0x2b0 [ 75.386928][ T5316] ? __lock_acquire+0xab9/0xd20 [ 75.386946][ T5316] ? __pfx_rtnl_newlink+0x10/0x10 [ 75.386956][ T5316] rtnetlink_rcv_msg+0x7cf/0xb70 [ 75.386967][ T5316] ? kasan_save_track+0x4f/0x80 [ 75.387023][ T5316] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 75.387034][ T5316] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 75.387046][ T5316] ? __lock_acquire+0xab9/0xd20 [ 75.387063][ T5316] netlink_rcv_skb+0x21c/0x490 [ 75.387076][ T5316] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 75.387088][ T5316] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 75.387104][ T5316] ? netlink_deliver_tap+0x2e/0x1b0 [ 75.387116][ T5316] ? netlink_deliver_tap+0x2e/0x1b0 [ 75.387130][ T5316] netlink_unicast+0x758/0x8d0 [ 75.387143][ T5316] netlink_sendmsg+0x805/0xb30 [ 75.387157][ T5316] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.387168][ T5316] ? aa_sock_msg_perm+0x94/0x160 [ 75.387182][ T5316] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 75.387192][ T5316] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.387203][ T5316] __sock_sendmsg+0x21c/0x270 [ 75.387220][ T5316] ____sys_sendmsg+0x505/0x830 [ 75.387235][ T5316] ? __pfx_____sys_sendmsg+0x10/0x10 [ 75.387251][ T5316] ? import_iovec+0x74/0xa0 [ 75.387263][ T5316] ___sys_sendmsg+0x21f/0x2a0 [ 75.387277][ T5316] ? __pfx____sys_sendmsg+0x10/0x10 [ 75.387297][ T5316] ? __fget_files+0x2a/0x420 [ 75.387309][ T5316] ? __fget_files+0x3a0/0x420 [ 75.387323][ T5316] __x64_sys_sendmsg+0x19b/0x260 [ 75.387336][ T5316] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 75.387353][ T5316] ? do_syscall_64+0xba/0x220 [ 75.387367][ T5316] do_syscall_64+0xf6/0x220 [ 75.387380][ T5316] ? clear_bhb_loop+0x60/0xb0 [ 75.387391][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.387403][ T5316] RIP: 0033:0x7f3391f8e969 [ 75.387422][ T5316] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.387433][ T5316] RSP: 002b:00007f3392d56038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 75.387446][ T5316] RAX: ffffffffffffffda RBX: 00007f33921b5fa0 RCX: 00007f3391f8e969 [ 75.387454][ T5316] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 75.387462][ T5316] RBP: 00007f3392010ab1 R08: 0000000000000000 R09: 0000000000000000 [ 75.387469][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.387476][ T5316] R13: 0000000000000000 R14: 00007f33921b5fa0 R15: 00007fff4927f028 [ 75.387487][ T5316] [ 76.448361][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.451120][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.847394][ T5301] Bluetooth: hci0: command tx timeout [ 78.927495][ T5301] Bluetooth: hci0: command tx timeout [ 81.007200][ T5301] Bluetooth: hci0: command tx timeout