Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u9:2/4711 is trying to acquire lock: ffff0000c1919210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x290/0x370 fs/kernfs/dir.c:411 but task is already holding lock: ffff0000c1919180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x40/0x398 fs/kernfs/dir.c:825 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #8 (&root->kernfs_rwsem){++++}-{4:4}: down_write+0x50/0xc0 kernel/locking/rwsem.c:1631 kernfs_add_one+0x40/0x398 fs/kernfs/dir.c:825 kernfs_create_dir_ns+0xe0/0x138 fs/kernfs/dir.c:1130 sysfs_create_dir_ns+0x120/0x1f4 fs/sysfs/dir.c:59 create_dir lib/kobject.c:73 [inline] kobject_add_internal+0x290/0x6f0 lib/kobject.c:240 kobject_add_varg+0x9c/0xe8 lib/kobject.c:374 kobject_add+0x110/0x1c8 lib/kobject.c:426 device_add+0x394/0x9e0 drivers/base/core.c:3695 device_register+0x28/0x38 drivers/base/core.c:3854 register_cpu+0x28c/0x57c drivers/base/cpu.c:431 arch_register_cpu+0x160/0x224 arch/arm64/kernel/smp.c:532 acpi_processor_hotadd_init drivers/acpi/acpi_processor.c:248 [inline] acpi_processor_get_info drivers/acpi/acpi_processor.c:370 [inline] acpi_processor_add+0x8f0/0x13f0 drivers/acpi/acpi_processor.c:441 acpi_scan_attach_handler drivers/acpi/scan.c:2325 [inline] acpi_bus_attach+0x464/0x7e0 drivers/acpi/scan.c:2374 acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1278 device_for_each_child+0xf4/0x184 drivers/base/core.c:4101 acpi_dev_for_each_child+0x98/0xe4 drivers/acpi/bus.c:1290 acpi_bus_attach+0x20c/0x7e0 drivers/acpi/scan.c:2395 acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1278 device_for_each_child+0xf4/0x184 drivers/base/core.c:4101 acpi_dev_for_each_child+0x98/0xe4 drivers/acpi/bus.c:1290 acpi_bus_attach+0x20c/0x7e0 drivers/acpi/scan.c:2395 acpi_bus_scan+0x104/0x310 drivers/acpi/scan.c:2745 acpi_scan_init+0x168/0x3cc drivers/acpi/scan.c:2871 acpi_init+0x15c/0x1f4 drivers/acpi/bus.c:1605 do_one_initcall+0x274/0xc38 init/main.c:1347 do_initcall_level+0x12c/0x1c4 init/main.c:1409 do_initcalls+0x70/0xd0 init/main.c:1425 do_basic_setup+0x7c/0x90 init/main.c:1445 kernel_init_freeable+0x268/0x3a8 init/main.c:1658 kernel_init+0x24/0x1dc init/main.c:1548 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 -> #7 (cpu_hotplug_lock){++++}-{0:0}: percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline] percpu_down_read include/linux/percpu-rwsem.h:77 [inline] cpus_read_lock+0x58/0x25c kernel/cpu.c:490 static_key_slow_inc+0x1c/0x40 kernel/jump_label.c:190 sk_set_memalloc+0x6c/0xa0 net/core/sock.c:306 nbd_reconnect_socket drivers/block/nbd.c:1379 [inline] nbd_genl_reconfigure+0xb50/0x1430 drivers/block/nbd.c:2468 genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x43c/0x620 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556 genl_rcv+0x38/0x50 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg+0xc8/0x17c net/socket.c:790 ____sys_sendmsg+0x3d0/0x6c8 net/socket.c:2684 ___sys_sendmsg+0x198/0x224 net/socket.c:2738 __sys_sendmsg+0x158/0x204 net/socket.c:2770 __do_sys_sendmsg net/socket.c:2775 [inline] __se_sys_sendmsg net/socket.c:2773 [inline] __arm64_sys_sendmsg+0x88/0x9c net/socket.c:2773 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 -> #6 (&nsock->tx_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 nbd_handle_cmd drivers/block/nbd.c:1143 [inline] nbd_queue_rq+0x1f4/0xbd8 drivers/block/nbd.c:1207 blk_mq_dispatch_rq_list+0x3d4/0x13a8 block/blk-mq.c:2117 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline] __blk_mq_sched_dispatch_requests+0xa48/0x10e8 block/blk-mq-sched.c:307 blk_mq_sched_dispatch_requests+0xa8/0x158 block/blk-mq-sched.c:329 blk_mq_run_work_fn+0x154/0x2e4 block/blk-mq.c:2532 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 -> #5 (&cmd->lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 nbd_queue_rq+0xb0/0xbd8 drivers/block/nbd.c:1199 blk_mq_dispatch_rq_list+0x3d4/0x13a8 block/blk-mq.c:2117 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline] __blk_mq_sched_dispatch_requests+0xa48/0x10e8 block/blk-mq-sched.c:307 blk_mq_sched_dispatch_requests+0xa8/0x158 block/blk-mq-sched.c:329 blk_mq_run_work_fn+0x154/0x2e4 block/blk-mq.c:2532 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 -> #4 (set->srcu){.+.+}-{0:0}: srcu_lock_sync include/linux/srcu.h:199 [inline] __synchronize_srcu+0xc8/0x268 kernel/rcu/srcutree.c:1481 synchronize_srcu+0x41c/0x5d4 kernel/rcu/srcutree.c:-1 blk_mq_wait_quiesce_done+0x88/0xac block/blk-mq.c:284 blk_mq_quiesce_queue+0x70/0x8c block/blk-mq.c:304 elevator_switch+0x128/0x38c block/elevator.c:576 elevator_change+0x204/0x35c block/elevator.c:681 elevator_set_default+0x190/0x2b0 block/elevator.c:754 blk_register_queue+0x2fc/0x3d4 block/blk-sysfs.c:992 __add_disk+0x558/0xb44 block/genhd.c:524 add_disk_fwnode+0xd4/0x340 block/genhd.c:593 device_add_disk+0x38/0x4c block/genhd.c:623 add_disk include/linux/blkdev.h:800 [inline] nbd_dev_add+0x598/0x880 drivers/block/nbd.c:2021 nbd_init+0x15c/0x174 drivers/block/nbd.c:2729 do_one_initcall+0x274/0xc38 init/main.c:1347 do_initcall_level+0x12c/0x1c4 init/main.c:1409 do_initcalls+0x70/0xd0 init/main.c:1425 do_basic_setup+0x7c/0x90 init/main.c:1445 kernel_init_freeable+0x268/0x3a8 init/main.c:1658 kernel_init+0x24/0x1dc init/main.c:1548 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 -> #3 (&q->elevator_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 elevator_change+0x188/0x35c block/elevator.c:679 elevator_set_none+0xa8/0x13c block/elevator.c:769 blk_mq_elv_switch_none block/blk-mq.c:5101 [inline] __blk_mq_update_nr_hw_queues block/blk-mq.c:5146 [inline] blk_mq_update_nr_hw_queues+0x4c4/0x11e0 block/blk-mq.c:5211 nbd_start_device+0x15c/0xa44 drivers/block/nbd.c:1526 nbd_genl_connect+0xffc/0x15d4 drivers/block/nbd.c:2276 genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x43c/0x620 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556 genl_rcv+0x38/0x50 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg+0xc8/0x17c net/socket.c:790 ____sys_sendmsg+0x3d0/0x6c8 net/socket.c:2684 ___sys_sendmsg+0x198/0x224 net/socket.c:2738 __sys_sendmsg+0x158/0x204 net/socket.c:2770 __do_sys_sendmsg net/socket.c:2775 [inline] __se_sys_sendmsg net/socket.c:2773 [inline] __arm64_sys_sendmsg+0x88/0x9c net/socket.c:2773 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 -> #2 (&q->q_usage_counter(io)#36){++++}-{0:0}: blk_alloc_queue+0x488/0x590 block/blk-core.c:504 blk_mq_alloc_queue+0x148/0x284 block/blk-mq.c:4420 __blk_mq_alloc_disk+0x38/0x10c block/blk-mq.c:4467 nbd_dev_add+0x3d0/0x880 drivers/block/nbd.c:1991 nbd_init+0x15c/0x174 drivers/block/nbd.c:2729 do_one_initcall+0x274/0xc38 init/main.c:1347 do_initcall_level+0x12c/0x1c4 init/main.c:1409 do_initcalls+0x70/0xd0 init/main.c:1425 do_basic_setup+0x7c/0x90 init/main.c:1445 kernel_init_freeable+0x268/0x3a8 init/main.c:1658 kernel_init+0x24/0x1dc init/main.c:1548 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 -> #1 (fs_reclaim){+.+.}-{0:0}: __fs_reclaim_acquire mm/page_alloc.c:4329 [inline] fs_reclaim_acquire+0x90/0x110 mm/page_alloc.c:4343 might_alloc include/linux/sched/mm.h:317 [inline] slab_pre_alloc_hook mm/slub.c:4537 [inline] slab_alloc_node mm/slub.c:4897 [inline] kmem_cache_alloc_noprof+0x60/0x5d8 mm/slub.c:4931 __kernfs_iattrs+0xd8/0x310 fs/kernfs/inode.c:36 kernfs_iattrs fs/kernfs/inode.c:60 [inline] __kernfs_setattr+0x48/0x2ac fs/kernfs/inode.c:73 kernfs_iop_setattr+0xc4/0x11c fs/kernfs/inode.c:127 notify_change+0x928/0xb7c fs/attr.c:556 do_truncate+0x1a8/0x22c fs/open.c:68 handle_truncate fs/namei.c:4305 [inline] do_open fs/namei.c:4704 [inline] path_openat+0x2368/0x2a60 fs/namei.c:4863 do_file_open+0x1c8/0x2e8 fs/namei.c:4892 do_sys_openat2+0x114/0x1e8 fs/open.c:1368 do_sys_open+0xb0/0xe0 fs/open.c:1374 __do_sys_openat fs/open.c:1390 [inline] __se_sys_openat fs/open.c:1385 [inline] __arm64_sys_openat+0xa8/0xc4 fs/open.c:1385 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x17c0/0x2ebc kernel/locking/lockdep.c:5237 lock_acquire+0x140/0x364 kernel/locking/lockdep.c:5868 down_write+0x50/0xc0 kernel/locking/rwsem.c:1631 kernfs_link_sibling+0x290/0x370 fs/kernfs/dir.c:411 kernfs_add_one+0x1d4/0x398 fs/kernfs/dir.c:844 kernfs_create_dir_ns+0xe0/0x138 fs/kernfs/dir.c:1130 sysfs_create_dir_ns+0x120/0x1f4 fs/sysfs/dir.c:59 create_dir lib/kobject.c:73 [inline] kobject_add_internal+0x290/0x6f0 lib/kobject.c:240 kobject_add_varg+0x9c/0xe8 lib/kobject.c:374 kobject_add+0x110/0x1c8 lib/kobject.c:426 device_add+0x394/0x9e0 drivers/base/core.c:3695 hci_conn_add_sysfs+0xbc/0x1e8 net/bluetooth/hci_sysfs.c:48 hci_conn_complete_evt+0x6ec/0xe04 net/bluetooth/hci_event.c:3204 hci_event_func net/bluetooth/hci_event.c:7784 [inline] hci_event_packet+0x4e0/0x9c8 net/bluetooth/hci_event.c:7835 hci_rx_work+0x2f4/0xd78 net/bluetooth/hci_core.c:4039 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 other info that might help us debug this: Chain exists of: &root->kernfs_iattr_rwsem --> cpu_hotplug_lock --> &root->kernfs_rwsem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&root->kernfs_rwsem); lock(cpu_hotplug_lock); lock(&root->kernfs_rwsem); lock(&root->kernfs_iattr_rwsem); *** DEADLOCK *** 4 locks held by kworker/u9:2/4711: #0: ffff0000f7e3e140 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000f7e3e140 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff800094347c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff800094347c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff0000caa380b8 (&hdev->lock){+.+.}-{4:4}, at: hci_conn_complete_evt+0xa4/0xe04 net/bluetooth/hci_event.c:3121 #3: ffff0000c1919180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x40/0x398 fs/kernfs/dir.c:825 stack backtrace: CPU: 0 UID: 0 PID: 4711 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Workqueue: hci0 hci_rx_work Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x328/0x330 kernel/locking/lockdep.c:2043 check_noncircular+0x158/0x174 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x17c0/0x2ebc kernel/locking/lockdep.c:5237 lock_acquire+0x140/0x364 kernel/locking/lockdep.c:5868 down_write+0x50/0xc0 kernel/locking/rwsem.c:1631 kernfs_link_sibling+0x290/0x370 fs/kernfs/dir.c:411 kernfs_add_one+0x1d4/0x398 fs/kernfs/dir.c:844 kernfs_create_dir_ns+0xe0/0x138 fs/kernfs/dir.c:1130 sysfs_create_dir_ns+0x120/0x1f4 fs/sysfs/dir.c:59 create_dir lib/kobject.c:73 [inline] kobject_add_internal+0x290/0x6f0 lib/kobject.c:240 kobject_add_varg+0x9c/0xe8 lib/kobject.c:374 kobject_add+0x110/0x1c8 lib/kobject.c:426 device_add+0x394/0x9e0 drivers/base/core.c:3695 hci_conn_add_sysfs+0xbc/0x1e8 net/bluetooth/hci_sysfs.c:48 hci_conn_complete_evt+0x6ec/0xe04 net/bluetooth/hci_event.c:3204 hci_event_func net/bluetooth/hci_event.c:7784 [inline] hci_event_packet+0x4e0/0x9c8 net/bluetooth/hci_event.c:7835 hci_rx_work+0x2f4/0xd78 net/bluetooth/hci_core.c:4039 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838