program:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000180)={r0, r0, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x6, 0x0, 0x8, 'syz1\x00'})
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) (fail_nth: 15)
[ 85.454600][ T5324] Bluetooth: hci0: command tx timeout
[ 85.532030][ T5347] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input5
[ 85.592728][ T5347] FAULT_INJECTION: forcing a failure.
[ 85.592728][ T5347] name failslab, interval 1, probability 0, space 0, times 1
[ 85.603069][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.603087][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 85.603094][ T5347] Call Trace:
[ 85.603100][ T5347]
[ 85.603105][ T5347] dump_stack_lvl+0x189/0x250
[ 85.603225][ T5347] ? __pfx____ratelimit+0x10/0x10
[ 85.603267][ T5347] ? __pfx_dump_stack_lvl+0x10/0x10
[ 85.603281][ T5347] ? __pfx__printk+0x10/0x10
[ 85.603302][ T5347] ? __pfx___might_resched+0x10/0x10
[ 85.603319][ T5347] should_fail_ex+0x414/0x560
[ 85.603362][ T5347] should_failslab+0xa8/0x100
[ 85.603377][ T5347] kmem_cache_alloc_noprof+0x88/0x710
[ 85.603393][ T5347] ? _raw_read_unlock_irqrestore+0xad/0x110
[ 85.603408][ T5347] ? skb_clone+0x212/0x3a0
[ 85.603448][ T5347] ? string+0x279/0x2b0
[ 85.603461][ T5347] skb_clone+0x212/0x3a0
[ 85.603475][ T5347] ? netlink_broadcast_filtered+0x6a0/0x1000
[ 85.603494][ T5347] netlink_broadcast_filtered+0x6ae/0x1000
[ 85.603526][ T5347] ? __pfx_netlink_broadcast_filtered+0x10/0x10
[ 85.603541][ T5347] ? alloc_uevent_skb+0xeb/0x230
[ 85.603553][ T5347] ? __asan_memcpy+0x40/0x70
[ 85.603570][ T5347] netlink_broadcast+0x37/0x50
[ 85.603588][ T5347] kobject_uevent_net_broadcast+0x378/0x560
[ 85.603610][ T5347] kobject_uevent_env+0x55c/0x9f0
[ 85.603629][ T5347] device_del+0x73a/0x8e0
[ 85.603655][ T5347] ? __pfx_device_del+0x10/0x10
[ 85.603666][ T5347] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 85.603679][ T5347] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 85.603698][ T5347] device_unregister+0x21/0x100
[ 85.603712][ T5347] led_classdev_unregister+0x13f/0x280
[ 85.603730][ T5347] input_leds_disconnect+0xba/0x180
[ 85.603748][ T5347] __input_unregister_device+0x3a3/0x640
[ 85.603760][ T5347] ? __cancel_work_sync+0x5c/0x110
[ 85.603777][ T5347] input_unregister_device+0x9b/0x100
[ 85.603790][ T5347] hidp_session_remove+0x135/0x260
[ 85.603811][ T5347] l2cap_conn_del+0x23c/0x5b0
[ 85.603829][ T5347] ? __pfx_l2cap_disconn_cfm+0x10/0x10
[ 85.603842][ T5347] hci_conn_hash_flush+0x10d/0x260
[ 85.603859][ T5347] hci_dev_close_sync+0x821/0x1100
[ 85.603876][ T5347] ? __pfx_hci_dev_close_sync+0x10/0x10
[ 85.603889][ T5347] ? __cancel_work_sync+0x5c/0x110
[ 85.603908][ T5347] hci_dev_close+0x108/0x270
[ 85.603922][ T5347] sock_do_ioctl+0xdc/0x300
[ 85.603936][ T5347] ? __pfx_sock_do_ioctl+0x10/0x10
[ 85.603947][ T5347] ? __mutex_unlock_slowpath+0x1a1/0x730
[ 85.603969][ T5347] sock_ioctl+0x576/0x790
[ 85.603984][ T5347] ? __pfx_sock_ioctl+0x10/0x10
[ 85.604029][ T5347] ? __fget_files+0x3a0/0x420
[ 85.604039][ T5347] ? __fget_files+0x2a/0x420
[ 85.604051][ T5347] ? bpf_lsm_file_ioctl+0x9/0x20
[ 85.604061][ T5347] ? __pfx_sock_ioctl+0x10/0x10
[ 85.604074][ T5347] __se_sys_ioctl+0xfc/0x170
[ 85.604089][ T5347] do_syscall_64+0xfa/0xf80
[ 85.604101][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.604111][ T5347] ? clear_bhb_loop+0x60/0xb0
[ 85.604124][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.604133][ T5347] RIP: 0033:0x7ff15238f7c9
[ 85.604144][ T5347] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 85.604152][ T5347] RSP: 002b:00007ff153309038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 85.604165][ T5347] RAX: ffffffffffffffda RBX: 00007ff1525e5fa0 RCX: 00007ff15238f7c9
[ 85.604171][ T5347] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000006
[ 85.604178][ T5347] RBP: 00007ff153309090 R08: 0000000000000000 R09: 0000000000000000
[ 85.604183][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 85.604189][ T5347] R13: 00007ff1525e6038 R14: 00007ff1525e5fa0 R15: 00007fff8b436e28
[ 85.604208][ T5347]
[ 86.006104][ T5347]
[ 86.007165][ T5347] ======================================================
[ 86.009984][ T5347] WARNING: possible circular locking dependency detected
[ 86.012890][ T5347] syzkaller #0 Not tainted
[ 86.014917][ T5347] ------------------------------------------------------
[ 86.017869][ T5347] syz.0.0/5347 is trying to acquire lock:
[ 86.020312][ T5347] ffff888011fc6040 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: __flush_work+0xd2/0xbc0
[ 86.025213][ T5347]
[ 86.025213][ T5347] but task is already holding lock:
[ 86.028462][ T5347] ffff888011fc6338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0
[ 86.031508][ T5347]
[ 86.031508][ T5347] which lock already depends on the new lock.
[ 86.031508][ T5347]
[ 86.035781][ T5347]
[ 86.035781][ T5347] the existing dependency chain (in reverse order) is:
[ 86.039500][ T5347]
[ 86.039500][ T5347] -> #1 (&conn->lock#2){+.+.}-{4:4}:
[ 86.042491][ T5347] __mutex_lock+0x187/0x1350
[ 86.044550][ T5347] l2cap_info_timeout+0x60/0xa0
[ 86.046763][ T5347] process_scheduled_works+0xad1/0x1770
[ 86.049284][ T5347] worker_thread+0x8a0/0xda0
[ 86.051353][ T5347] kthread+0x711/0x8a0
[ 86.053391][ T5347] ret_from_fork+0x599/0xb30
[ 86.056137][ T5347] ret_from_fork_asm+0x1a/0x30
[ 86.058425][ T5347]
[ 86.058425][ T5347] -> #0 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}:
[ 86.062565][ T5347] __lock_acquire+0x15a6/0x2cf0
[ 86.064948][ T5347] lock_acquire+0x117/0x340
[ 86.067181][ T5347] __flush_work+0x6b8/0xbc0
[ 86.069442][ T5347] __cancel_work_sync+0xbe/0x110
[ 86.071886][ T5347] l2cap_conn_del+0x402/0x5b0
[ 86.074144][ T5347] hci_conn_hash_flush+0x10d/0x260
[ 86.076544][ T5347] hci_dev_close_sync+0x821/0x1100
[ 86.078986][ T5347] hci_dev_close+0x108/0x270
[ 86.081302][ T5347] sock_do_ioctl+0xdc/0x300
[ 86.083475][ T5347] sock_ioctl+0x576/0x790
[ 86.085715][ T5347] __se_sys_ioctl+0xfc/0x170
[ 86.087929][ T5347] do_syscall_64+0xfa/0xf80
[ 86.090114][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.092929][ T5347]
[ 86.092929][ T5347] other info that might help us debug this:
[ 86.092929][ T5347]
[ 86.097293][ T5347] Possible unsafe locking scenario:
[ 86.097293][ T5347]
[ 86.100538][ T5347] CPU0 CPU1
[ 86.102897][ T5347] ---- ----
[ 86.105244][ T5347] lock(&conn->lock#2);
[ 86.107086][ T5347] lock((work_completion)(&(&conn->info_timer)->work));
[ 86.111051][ T5347] lock(&conn->lock#2);
[ 86.113781][ T5347] lock((work_completion)(&(&conn->info_timer)->work));
[ 86.116383][ T5347]
[ 86.116383][ T5347] *** DEADLOCK ***
[ 86.116383][ T5347]
[ 86.119941][ T5347] 5 locks held by syz.0.0/5347:
[ 86.121928][ T5347] #0: ffff88803fdf0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_close+0x100/0x270
[ 86.125952][ T5347] #1: ffff88803fdf00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x1100
[ 86.129753][ T5347] #2: ffffffff8f67b588 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260
[ 86.133772][ T5347] #3: ffff888011fc6338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0
[ 86.137546][ T5347] #4: ffffffff8e1419e0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xd2/0xbc0
[ 86.141041][ T5347]
[ 86.141041][ T5347] stack backtrace:
[ 86.143383][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.143396][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 86.143403][ T5347] Call Trace:
[ 86.143410][ T5347]
[ 86.143416][ T5347] dump_stack_lvl+0x189/0x250
[ 86.143432][ T5347] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.143444][ T5347] ? __pfx__printk+0x10/0x10
[ 86.143458][ T5347] ? print_lock_name+0xde/0x100
[ 86.143473][ T5347] print_circular_bug+0x2e2/0x300
[ 86.143487][ T5347] check_noncircular+0x12e/0x150
[ 86.143501][ T5347] __lock_acquire+0x15a6/0x2cf0
[ 86.143512][ T5347] ? do_raw_spin_unlock+0x4d/0x240
[ 86.143526][ T5347] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 86.143537][ T5347] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 86.143549][ T5347] ? __flush_work+0xd2/0xbc0
[ 86.143561][ T5347] lock_acquire+0x117/0x340
[ 86.143570][ T5347] ? __flush_work+0xd2/0xbc0
[ 86.143582][ T5347] ? _raw_spin_unlock_irq+0x23/0x50
[ 86.143592][ T5347] ? __flush_work+0xd2/0xbc0
[ 86.143603][ T5347] __flush_work+0x6b8/0xbc0
[ 86.143614][ T5347] ? __flush_work+0xd2/0xbc0
[ 86.143625][ T5347] ? __flush_work+0xd2/0xbc0
[ 86.143635][ T5347] ? __pfx___flush_work+0x10/0x10
[ 86.143647][ T5347] ? __pfx_wq_barrier_func+0x10/0x10
[ 86.143659][ T5347] ? __pfx___cancel_work+0x10/0x10
[ 86.143678][ T5347] ? hci_conn_drop+0x153/0x2b0
[ 86.143691][ T5347] ? __cancel_work_sync+0x5c/0x110
[ 86.143702][ T5347] __cancel_work_sync+0xbe/0x110
[ 86.143715][ T5347] l2cap_conn_del+0x402/0x5b0
[ 86.143726][ T5347] ? __pfx_l2cap_disconn_cfm+0x10/0x10
[ 86.143737][ T5347] hci_conn_hash_flush+0x10d/0x260
[ 86.143750][ T5347] hci_dev_close_sync+0x821/0x1100
[ 86.143762][ T5347] ? __pfx_hci_dev_close_sync+0x10/0x10
[ 86.143772][ T5347] ? __cancel_work_sync+0x5c/0x110
[ 86.143785][ T5347] hci_dev_close+0x108/0x270
[ 86.143795][ T5347] sock_do_ioctl+0xdc/0x300
[ 86.143805][ T5347] ? __pfx_sock_do_ioctl+0x10/0x10
[ 86.143814][ T5347] ? __mutex_unlock_slowpath+0x1a1/0x730
[ 86.143829][ T5347] sock_ioctl+0x576/0x790
[ 86.143845][ T5347] ? __pfx_sock_ioctl+0x10/0x10
[ 86.143859][ T5347] ? __fget_files+0x3a0/0x420
[ 86.143870][ T5347] ? __fget_files+0x2a/0x420
[ 86.143881][ T5347] ? bpf_lsm_file_ioctl+0x9/0x20
[ 86.143890][ T5347] ? __pfx_sock_ioctl+0x10/0x10
[ 86.143903][ T5347] __se_sys_ioctl+0xfc/0x170
[ 86.143916][ T5347] do_syscall_64+0xfa/0xf80
[ 86.143929][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.143938][ T5347] ? clear_bhb_loop+0x60/0xb0
[ 86.143949][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.143959][ T5347] RIP: 0033:0x7ff15238f7c9
[ 86.143970][ T5347] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 86.143977][ T5347] RSP: 002b:00007ff153309038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 86.144013][ T5347] RAX: ffffffffffffffda RBX: 00007ff1525e5fa0 RCX: 00007ff15238f7c9
[ 86.144021][ T5347] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000006
[ 86.144027][ T5347] RBP: 00007ff153309090 R08: 0000000000000000 R09: 0000000000000000
[ 86.144033][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 86.144039][ T5347] R13: 00007ff1525e6038 R14: 00007ff1525e5fa0 R15: 00007fff8b436e28
[ 86.144050][ T5347]
[ 87.534558][ T5324] Bluetooth: hci0: command tx timeout
[ 89.615457][ T5324] Bluetooth: hci0: command tx timeout
[ 91.695247][ T5324] Bluetooth: hci0: command tx timeout
[ 91.774732][ T10] cfg80211: failed to load regulatory.db