program: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@local}) inotify_init1(0x80000) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="07000000040000001800000001"], 0x50) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xfffdffffffffffff, 0x9, 0x3, 0xf, 0x80000006}, 0x0, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0x8}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) close_range(r0, 0xffffffffffffffff, 0x0) [ 94.685502][ T44] Bluetooth: hci0: command tx timeout [ 94.857021][ T5327] [ 94.858227][ T5327] ============================================ [ 94.860844][ T5327] WARNING: possible recursive locking detected [ 94.863409][ T5327] syzkaller #0 Not tainted [ 94.865549][ T5327] -------------------------------------------- [ 94.868570][ T5327] syz.0.0/5327 is trying to acquire lock: [ 94.871081][ T5327] ffffffff8f62c8b0 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0xe9/0xec0 [ 94.875615][ T5327] [ 94.875615][ T5327] but task is already holding lock: [ 94.879243][ T5327] ffffffff8f62c8b0 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0xe9/0xec0 [ 94.883687][ T5327] [ 94.883687][ T5327] other info that might help us debug this: [ 94.887422][ T5327] Possible unsafe locking scenario: [ 94.887422][ T5327] [ 94.891296][ T5327] CPU0 [ 94.893147][ T5327] ---- [ 94.894955][ T5327] lock(qp_broker_list.mutex); [ 94.897392][ T5327] lock(qp_broker_list.mutex); [ 94.899923][ T5327] [ 94.899923][ T5327] *** DEADLOCK *** [ 94.899923][ T5327] [ 94.904220][ T5327] May be due to missing lock nesting notation [ 94.904220][ T5327] [ 94.908606][ T5327] 1 lock held by syz.0.0/5327: [ 94.910752][ T5327] #0: ffffffff8f62c8b0 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0xe9/0xec0 [ 94.916018][ T5327] [ 94.916018][ T5327] stack backtrace: [ 94.918995][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.919017][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.919027][ T5327] Call Trace: [ 94.919035][ T5327] [ 94.919043][ T5327] dump_stack_lvl+0xe8/0x150 [ 94.919072][ T5327] print_deadlock_bug+0x279/0x290 [ 94.919094][ T5327] __lock_acquire+0x24df/0x2cf0 [ 94.919112][ T5327] ? kernel_text_address+0xa5/0xe0 [ 94.919130][ T5327] ? __kernel_text_address+0xd/0x30 [ 94.919146][ T5327] ? stack_depot_save_flags+0x28b/0x800 [ 94.919158][ T5327] ? lock_acquire+0x106/0x350 [ 94.919173][ T5327] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.919189][ T5327] lock_acquire+0x106/0x350 [ 94.919202][ T5327] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.919234][ T5327] __mutex_lock+0x19d/0x1550 [ 94.919341][ T5327] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.919356][ T5327] ? kasan_save_track+0x3e/0x80 [ 94.919372][ T5327] ? kasan_save_free_info+0x40/0x50 [ 94.919390][ T5327] ? __kasan_slab_free+0x5c/0x80 [ 94.919404][ T5327] ? kfree+0x1c5/0x640 [ 94.919414][ T5327] ? vmci_ctx_put+0x5ba/0xc00 [ 94.919430][ T5327] ? vmci_ctx_enqueue_datagram+0x3c3/0x440 [ 94.919445][ T5327] ? vmci_datagram_dispatch+0x450/0xc80 [ 94.919455][ T5327] ? vmci_qp_broker_detach+0x887/0xec0 [ 94.919468][ T5327] ? vmci_ctx_put+0x619/0xc00 [ 94.919482][ T5327] ? vmci_host_close+0x8e/0x140 [ 94.919495][ T5327] ? __fput+0x418/0xa50 [ 94.919507][ T5327] ? exit_to_user_mode_loop+0x1fa/0x730 [ 94.919522][ T5327] ? do_syscall_64+0x353/0x580 [ 94.919538][ T5327] ? vmci_qp_broker_detach+0xe9/0xec0 [ 94.919551][ T5327] ? __pfx___mutex_lock+0x10/0x10 [ 94.919575][ T5327] vmci_qp_broker_detach+0xe9/0xec0 [ 94.919592][ T5327] ? __pfx_vmci_qp_broker_detach+0x10/0x10 [ 94.919605][ T5327] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.919617][ T5327] ? lockdep_hardirqs_on+0x7a/0x110 [ 94.919633][ T5327] ? kfree+0x1c5/0x640 [ 94.919642][ T5327] ? vmci_ctx_put+0x5ba/0xc00 [ 94.919657][ T5327] ? vmci_ctx_put+0x13e/0xc00 [ 94.919674][ T5327] vmci_ctx_put+0x619/0xc00 [ 94.919691][ T5327] ? vmci_ctx_put+0x13e/0xc00 [ 94.919707][ T5327] ? __pfx_vmci_ctx_put+0x10/0x10 [ 94.919721][ T5327] ? preempt_schedule_thunk+0x16/0x40 [ 94.919736][ T5327] ? preempt_schedule_common+0x82/0xd0 [ 94.919750][ T5327] ? preempt_schedule_thunk+0x16/0x40 [ 94.919765][ T5327] vmci_ctx_enqueue_datagram+0x3c3/0x440 [ 94.919783][ T5327] vmci_datagram_dispatch+0x450/0xc80 [ 94.919795][ T5327] ? __pfx_vmci_datagram_dispatch+0x10/0x10 [ 94.919808][ T5327] vmci_qp_broker_detach+0x887/0xec0 [ 94.919825][ T5327] ? __pfx_vmci_qp_broker_detach+0x10/0x10 [ 94.919838][ T5327] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.919851][ T5327] ? kfree+0x1c5/0x640 [ 94.919860][ T5327] ? vmci_ctx_put+0x5ba/0xc00 [ 94.919875][ T5327] ? vmci_ctx_put+0x13e/0xc00 [ 94.919891][ T5327] vmci_ctx_put+0x619/0xc00 [ 94.919907][ T5327] ? vmci_ctx_put+0x13e/0xc00 [ 94.919923][ T5327] ? __pfx_vmci_ctx_put+0x10/0x10 [ 94.919942][ T5327] vmci_host_close+0x8e/0x140 [ 94.919955][ T5327] ? __pfx_vmci_host_close+0x10/0x10 [ 94.919968][ T5327] __fput+0x418/0xa50 [ 94.919983][ T5327] task_work_run+0x1d9/0x270 [ 94.920000][ T5327] ? __pfx_task_work_run+0x10/0x10 [ 94.920020][ T5327] exit_to_user_mode_loop+0x1fa/0x730 [ 94.920036][ T5327] ? rcu_is_watching+0x15/0xb0 [ 94.920054][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.920066][ T5327] do_syscall_64+0x353/0x580 [ 94.920082][ T5327] ? trace_irq_disable+0x3b/0x140 [ 94.920098][ T5327] ? clear_bhb_loop+0x40/0x90 [ 94.920112][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.920122][ T5327] RIP: 0033:0x7fc31b39de59 [ 94.920133][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.920144][ T5327] RSP: 002b:00007fc31c17dfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 94.920159][ T5327] RAX: 0000000000000000 RBX: 00007fc31b626090 RCX: 00007fc31b39de59 [ 94.920167][ T5327] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000006 [ 94.920175][ T5327] RBP: 00007fc31b433e6f R08: 0000000000000000 R09: 0000000000000000 [ 94.920184][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.920191][ T5327] R13: 00007fc31b626128 R14: 00007fc31b626090 R15: 00007ffede74d2a8 [ 94.920205][ T5327] [ 96.694999][ T44] Bluetooth: hci0: command tx timeout [ 98.774550][ T44] Bluetooth: hci0: command tx timeout