[v6.1] possible deadlock in __flush_workqueue

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 61adba85cc40 Linux 6.1.81
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1618003a180000
kernel config: https://syzkaller.appspot.com/x/.config?x=41dc7343796eb054
dashboard link: https://syzkaller.appspot.com/bug?extid=3c62604ff542518d26c2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bce1b8db2435/disk-61adba85.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/488c5d1c7e73/vmlinux-61adba85.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b0821e919f99/bzImage-61adba85.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3c6260...@syzkaller.appspotmail.com

Bluetooth: hci4: Opcode 0x0c03 failed: -110
Bluetooth: hci4: hardware error 0x00
============================================
WARNING: possible recursive locking detected
6.1.81-syzkaller #0 Not tainted
--------------------------------------------
kworker/u5:2/3569 is trying to acquire lock:
ffff88802a36d138 ((wq_completion)hci4){+.+.}-{0:0}, at: __flush_workqueue+0x157/0x1610 kernel/workqueue.c:2812

but task is already holding lock:
ffff88802a36d138 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock((wq_completion)hci4);
lock((wq_completion)hci4);

*** DEADLOCK ***

May be due to missing lock nesting notation

2 locks held by kworker/u5:2/3569:
#0: ffff88802a36d138 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
#1: ffffc90003f1fd20 ((work_completion)(&hdev->error_reset)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267

stack backtrace:
CPU: 0 PID: 3569 Comm: kworker/u5:2 Not tainted 6.1.81-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: hci4 hci_error_reset
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_deadlock_bug kernel/locking/lockdep.c:2983 [inline]
check_deadlock kernel/locking/lockdep.c:3026 [inline]
validate_chain+0x4711/0x5950 kernel/locking/lockdep.c:3812
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__flush_workqueue+0x170/0x1610 kernel/workqueue.c:2812
drain_workqueue+0xc5/0x390 kernel/workqueue.c:2977
destroy_workqueue+0x7b/0xae0 kernel/workqueue.c:4423
hci_release_dev+0x165/0x1670 net/bluetooth/hci_core.c:2772
bt_host_release+0x7f/0x90 net/bluetooth/hci_sysfs.c:92
device_release+0x91/0x1c0
kobject_cleanup lib/kobject.c:681 [inline]
kobject_release lib/kobject.c:712 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x224/0x460 lib/kobject.c:729
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup