program: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000003c0)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000480)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f"], 0x310) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x6, @mcast1}}, {{0xa, 0x0, 0x0, @empty, 0xffffffff}}}, 0x108) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r4 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r5, 0x40045b0a, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x200000000000011, 0x2, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$smc(&(0x7f0000000140), r11) sendmsg$SMC_PNETID_ADD(r11, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000700)={0x34, r12, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge_slave_0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x850c081d989709a5}, 0x40000) sendmsg$SMC_PNETID_ADD(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)={0x34, r12, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6erspan0\x00'}]}, 0x34}}, 0x800) bind$inet(r9, &(0x7f0000000880)={0x2, 0x5000, @loopback}, 0x10) listen(r9, 0xa) r13 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r13, &(0x7f00000008c0)={0x2, 0x5000, @loopback}, 0x10) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000001c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newlink={0x20, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x74, r14, 0x0, 0x11203}}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newlink={0xffffffffffffffcd, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2a005}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0xa54, 0x18}}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x50}, 0x1, 0xba01}, 0x0) [ 105.545605][ T5305] Bluetooth: hci0: command tx timeout [ 105.916123][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 106.071016][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 106.074789][ T9] usb 5-1: New USB device found: idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 106.089099][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 106.089119][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 106.089139][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 106.089152][ T9] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 106.089218][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.344483][ T9] usb 5-1: GET_CAPABILITIES returned 0 [ 106.344519][ T9] usbtmc 5-1:16.0: can't read capabilities [ 106.559379][ T5354] netlink: 'syz.0.0': attribute type 10 has an invalid length. [ 106.560970][ T5354] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.561871][ T5354] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.594547][ T5354] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.594639][ T5354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.595631][ T5354] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.595719][ T5354] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.623933][ T5354] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 106.625541][ T5355] smc: net device bridge_slave_0 applied user defined pnetid SYZ1 [ 106.665171][ T5354] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.665296][ T5354] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.682987][ T5353] [ 106.684116][ T5353] ====================================================== [ 106.687201][ T5353] WARNING: possible circular locking dependency detected [ 106.690335][ T5353] syzkaller #0 Not tainted [ 106.692404][ T5353] ------------------------------------------------------ [ 106.695594][ T5353] syz.0.0/5353 is trying to acquire lock: [ 106.698150][ T5353] ffff88803ff87af0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x101/0xd30 [ 106.703530][ T5353] [ 106.703530][ T5353] but task is already holding lock: [ 106.706698][ T5353] ffff888035b38ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 106.710640][ T5353] [ 106.710640][ T5353] which lock already depends on the new lock. [ 106.710640][ T5353] [ 106.715097][ T5353] [ 106.715097][ T5353] the existing dependency chain (in reverse order) is: [ 106.718948][ T5353] [ 106.718948][ T5353] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 106.722303][ T5353] lock_sock_nested+0x41/0x100 [ 106.724693][ T5353] smc_listen_out+0xd4/0x3d0 [ 106.726991][ T5353] smc_listen_work+0x81d/0x1410 [ 106.729323][ T5353] process_scheduled_works+0xc3d/0x1630 [ 106.732048][ T5353] worker_thread+0xa47/0xfb0 [ 106.734610][ T5353] kthread+0x38b/0x480 [ 106.737055][ T5353] ret_from_fork+0x514/0xb70 [ 106.739363][ T5353] ret_from_fork_asm+0x1a/0x30 [ 106.741721][ T5353] [ 106.741721][ T5353] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 106.745928][ T5353] __lock_acquire+0x164c/0x2de0 [ 106.748232][ T5353] lock_acquire+0x115/0x350 [ 106.750381][ T5353] __flush_work+0x7a6/0xd30 [ 106.752683][ T5353] cancel_work_sync+0xb8/0xf0 [ 106.755036][ T5353] smc_clcsock_release+0x60/0xf0 [ 106.757489][ T5353] __smc_release+0x64e/0x7c0 [ 106.759764][ T5353] smc_close_non_accepted+0xd5/0x1f0 [ 106.762426][ T5353] smc_close_active+0xbd8/0x1000 [ 106.764953][ T5353] __smc_release+0x9c/0x7c0 [ 106.767159][ T5353] smc_release+0x2c5/0x550 [ 106.769409][ T5353] __sock_release+0xa0/0x1f0 [ 106.772075][ T5353] sock_close+0x1c/0x30 [ 106.774273][ T5353] __fput+0x408/0xa40 [ 106.776458][ T5353] fput_close_sync+0x11f/0x240 [ 106.778717][ T5353] filp_close_sync+0x6e/0xa0 [ 106.780994][ T5353] __se_sys_close_range+0xa77/0xef0 [ 106.783460][ T5353] do_syscall_64+0x166/0x520 [ 106.786139][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.788973][ T5353] [ 106.788973][ T5353] other info that might help us debug this: [ 106.788973][ T5353] [ 106.793417][ T5353] Possible unsafe locking scenario: [ 106.793417][ T5353] [ 106.796603][ T5353] CPU0 CPU1 [ 106.798909][ T5353] ---- ---- [ 106.801450][ T5353] lock(sk_lock-AF_SMC/1); [ 106.803484][ T5353] lock((work_completion)(&new_smc->smc_listen_work)); [ 106.807539][ T5353] lock(sk_lock-AF_SMC/1); [ 106.810765][ T5353] lock((work_completion)(&new_smc->smc_listen_work)); [ 106.813976][ T5353] [ 106.813976][ T5353] *** DEADLOCK *** [ 106.813976][ T5353] [ 106.817573][ T5353] locks held by syz.0.0/5353: 3, last CPU#0: [ 106.820213][ T5353] #0: ffff888013414240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 [ 106.824805][ T5353] #1: ffff888035b38ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 106.828808][ T5353] #2: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x101/0xd30 [ 106.832949][ T5353] [ 106.832949][ T5353] stack backtrace: [ 106.835517][ T5353] CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 106.839387][ T5353] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 106.843775][ T5353] Call Trace: [ 106.845200][ T5353] [ 106.846568][ T5353] dump_stack_lvl+0xe8/0x150 [ 106.848623][ T5353] print_circular_bug+0x2e2/0x300 [ 106.850846][ T5353] check_noncircular+0x12f/0x150 [ 106.853147][ T5353] __lock_acquire+0x164c/0x2de0 [ 106.855358][ T5353] ? do_raw_spin_unlock+0x4d/0x200 [ 106.857588][ T5353] lock_acquire+0x115/0x350 [ 106.859716][ T5353] ? __flush_work+0x101/0xd30 [ 106.862333][ T5353] ? __flush_work+0x101/0xd30 [ 106.864666][ T5353] __flush_work+0x7a6/0xd30 [ 106.866687][ T5353] ? __flush_work+0x101/0xd30 [ 106.868761][ T5353] ? __flush_work+0x101/0xd30 [ 106.870855][ T5353] ? __pfx___flush_work+0x10/0x10 [ 106.873125][ T5353] ? __pfx_wq_barrier_func+0x10/0x10 [ 106.875313][ T5353] ? cancel_work_sync+0x5a/0xf0 [ 106.877460][ T5353] cancel_work_sync+0xb8/0xf0 [ 106.879550][ T5353] smc_clcsock_release+0x60/0xf0 [ 106.881771][ T5353] __smc_release+0x64e/0x7c0 [ 106.883819][ T5353] smc_close_non_accepted+0xd5/0x1f0 [ 106.886225][ T5353] smc_close_active+0xbd8/0x1000 [ 106.888345][ T5353] ? __pfx_sock_def_readable+0x10/0x10 [ 106.890757][ T5353] __smc_release+0x9c/0x7c0 [ 106.893189][ T5353] ? __local_bh_enable_ip+0xd6/0x140 [ 106.895976][ T5353] smc_release+0x2c5/0x550 [ 106.898279][ T5353] __sock_release+0xa0/0x1f0 [ 106.900358][ T5353] ? __pfx_sock_close+0x10/0x10 [ 106.902565][ T5353] sock_close+0x1c/0x30 [ 106.904415][ T5353] __fput+0x408/0xa40 [ 106.906180][ T5353] fput_close_sync+0x11f/0x240 [ 106.908313][ T5353] ? __pfx_fput_close_sync+0x10/0x10 [ 106.910691][ T5353] filp_close_sync+0x6e/0xa0 [ 106.912779][ T5353] __se_sys_close_range+0xa77/0xef0 [ 106.915013][ T5353] ? __pfx___se_sys_close_range+0x10/0x10 [ 106.917495][ T5353] do_syscall_64+0x166/0x520 [ 106.919502][ T5353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.922243][ T5353] ? clear_bhb_loop+0x70/0xc0 [ 106.924418][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.927018][ T5353] RIP: 0033:0x7fc4a279f559 [ 106.928940][ T5353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.937244][ T5353] RSP: 002b:00007ffdf21b4968 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 106.940822][ T5353] RAX: ffffffffffffffda RBX: 00007ffdf21b4a50 RCX: 00007fc4a279f559 [ 106.944126][ T5353] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 106.947116][ T5353] RBP: 0000000000019b98 R08: 0000000000000001 R09: 0000000000000000 [ 106.950070][ T5353] R10: 00007fc4a25ff02c R11: 0000000000000246 R12: 00007ffdf21b4a90 [ 106.953005][ T5353] R13: 00007fc4a2a25fac R14: 000000000001a031 R15: 00007fc4a2a25fa0 [ 106.955959][ T5353] [ 106.977688][ T9] usb 5-1: USB disconnect, device number 2