program: r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket(0x2b, 0x1, 0x1) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) (fail_nth: 1) [ 84.185960][ T5282] Bluetooth: hci0: command tx timeout [ 84.338230][ T5320] [ 84.339330][ T5320] ====================================================== [ 84.342455][ T5320] WARNING: possible circular locking dependency detected [ 84.345472][ T5320] syzkaller #0 Not tainted [ 84.347377][ T5320] ------------------------------------------------------ [ 84.350339][ T5320] syz.0.0/5320 is trying to acquire lock: [ 84.353161][ T5320] ffff888040750a68 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x101/0xca0 [ 84.358628][ T5320] [ 84.358628][ T5320] but task is already holding lock: [ 84.361857][ T5320] ffff888040750ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 84.365847][ T5320] [ 84.365847][ T5320] which lock already depends on the new lock. [ 84.365847][ T5320] [ 84.370406][ T5320] [ 84.370406][ T5320] the existing dependency chain (in reverse order) is: [ 84.374121][ T5320] [ 84.374121][ T5320] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 84.377420][ T5320] lock_sock_nested+0x41/0x100 [ 84.380045][ T5320] smc_listen_out+0x105/0x3c0 [ 84.382570][ T5320] smc_listen_work+0x81d/0x1410 [ 84.384871][ T5320] process_scheduled_works+0xa8e/0x14e0 [ 84.387471][ T5320] worker_thread+0xa47/0xfb0 [ 84.389868][ T5320] kthread+0x388/0x470 [ 84.391908][ T5320] ret_from_fork+0x514/0xb70 [ 84.394259][ T5320] ret_from_fork_asm+0x1a/0x30 [ 84.396766][ T5320] [ 84.396766][ T5320] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 84.400896][ T5320] __lock_acquire+0x1520/0x2cf0 [ 84.402965][ T5320] lock_acquire+0x106/0x350 [ 84.405143][ T5320] __flush_work+0x74c/0xca0 [ 84.407454][ T5320] __cancel_work_sync+0xbe/0x110 [ 84.410350][ T5320] smc_clcsock_release+0x60/0xf0 [ 84.412969][ T5320] __smc_release+0x64e/0x7c0 [ 84.415233][ T5320] smc_close_non_accepted+0xd5/0x1f0 [ 84.417561][ T5320] smc_close_active+0xb42/0xf30 [ 84.419990][ T5320] __smc_release+0x9c/0x7c0 [ 84.422428][ T5320] smc_release+0x2c5/0x550 [ 84.425131][ T5320] sock_close+0xad/0x220 [ 84.427418][ T5320] __fput+0x418/0xa50 [ 84.429634][ T5320] task_work_run+0x1d9/0x270 [ 84.431970][ T5320] exit_to_user_mode_loop+0x1fa/0x730 [ 84.434690][ T5320] do_syscall_64+0x353/0x580 [ 84.436791][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.439860][ T5320] [ 84.439860][ T5320] other info that might help us debug this: [ 84.439860][ T5320] [ 84.445080][ T5320] Possible unsafe locking scenario: [ 84.445080][ T5320] [ 84.448265][ T5320] CPU0 CPU1 [ 84.450573][ T5320] ---- ---- [ 84.452896][ T5320] lock(sk_lock-AF_SMC/1); [ 84.455168][ T5320] lock((work_completion)(&new_smc->smc_listen_work)); [ 84.460781][ T5320] lock(sk_lock-AF_SMC/1); [ 84.463966][ T5320] lock((work_completion)(&new_smc->smc_listen_work)); [ 84.466872][ T5320] [ 84.466872][ T5320] *** DEADLOCK *** [ 84.466872][ T5320] [ 84.470364][ T5320] 3 locks held by syz.0.0/5320: [ 84.473073][ T5320] #0: ffff8880450b3bc0 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x82/0x220 [ 84.478420][ T5320] #1: ffff888040750ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 84.482453][ T5320] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x101/0xca0 [ 84.486336][ T5320] [ 84.486336][ T5320] stack backtrace: [ 84.488892][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 84.488911][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.488924][ T5320] Call Trace: [ 84.488952][ T5320] [ 84.488959][ T5320] dump_stack_lvl+0xe8/0x150 [ 84.488980][ T5320] print_circular_bug+0x2e1/0x300 [ 84.488998][ T5320] check_noncircular+0x12e/0x150 [ 84.489009][ T5320] __lock_acquire+0x1520/0x2cf0 [ 84.489026][ T5320] ? do_raw_spin_unlock+0x4d/0x210 [ 84.489038][ T5320] ? __flush_work+0x101/0xca0 [ 84.489050][ T5320] lock_acquire+0x106/0x350 [ 84.489063][ T5320] ? __flush_work+0x101/0xca0 [ 84.489077][ T5320] ? __flush_work+0x101/0xca0 [ 84.489089][ T5320] __flush_work+0x74c/0xca0 [ 84.489102][ T5320] ? __flush_work+0x101/0xca0 [ 84.489114][ T5320] ? __flush_work+0x101/0xca0 [ 84.489125][ T5320] ? __pfx___flush_work+0x10/0x10 [ 84.489137][ T5320] ? __pfx_wq_barrier_func+0x10/0x10 [ 84.489151][ T5320] ? __cancel_work_sync+0x5c/0x110 [ 84.489164][ T5320] __cancel_work_sync+0xbe/0x110 [ 84.489184][ T5320] smc_clcsock_release+0x60/0xf0 [ 84.489209][ T5320] __smc_release+0x64e/0x7c0 [ 84.489223][ T5320] smc_close_non_accepted+0xd5/0x1f0 [ 84.489235][ T5320] smc_close_active+0xb42/0xf30 [ 84.489248][ T5320] ? __pfx_sock_def_readable+0x10/0x10 [ 84.489259][ T5320] __smc_release+0x9c/0x7c0 [ 84.489269][ T5320] ? __local_bh_enable_ip+0xd0/0x130 [ 84.489282][ T5320] smc_release+0x2c5/0x550 [ 84.489294][ T5320] sock_close+0xad/0x220 [ 84.489313][ T5320] ? __pfx_sock_close+0x10/0x10 [ 84.489323][ T5320] __fput+0x418/0xa50 [ 84.489332][ T5320] task_work_run+0x1d9/0x270 [ 84.489346][ T5320] ? __pfx_task_work_run+0x10/0x10 [ 84.489360][ T5320] exit_to_user_mode_loop+0x1fa/0x730 [ 84.489374][ T5320] ? rcu_is_watching+0x15/0xb0 [ 84.489388][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.489398][ T5320] do_syscall_64+0x353/0x580 [ 84.489412][ T5320] ? trace_irq_disable+0x3b/0x140 [ 84.489425][ T5320] ? clear_bhb_loop+0x40/0x90 [ 84.489435][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.489446][ T5320] RIP: 0033:0x7fb93a99de59 [ 84.489470][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.489479][ T5320] RSP: 002b:00007fb93b8f0fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 84.489490][ T5320] RAX: 0000000000000000 RBX: 00007fb93ac26090 RCX: 00007fb93a99de59 [ 84.489497][ T5320] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 [ 84.489504][ T5320] RBP: 00007fb93b8f1050 R08: 0000000000000000 R09: 0000000000000000 [ 84.489510][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 84.489516][ T5320] R13: 00007fb93ac26128 R14: 00007fb93ac26090 R15: 00007ffd928274e8 [ 84.489525][ T5320] [ 84.672306][ T5320] failed to read /proc/thread-self/fail-nth [ 84.672342][ T5320] (errno 9)