[v5.15] possible deadlock in hci_dev_do_open

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: cc5ec8769306 Linux 5.15.196
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14f2f0b4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e1bb6d24ef2164eb
dashboard link: https://syzkaller.appspot.com/bug?extid=662dfd0005c04516bac9
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c71c660545b2/disk-cc5ec876.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4f011826cca6/vmlinux-cc5ec876.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8ccd1a2c3f8c/bzImage-cc5ec876.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+662dfd...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kworker/u5:7/4200 is trying to acquire lock:
ffff88801fc50b98 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xc1/0x1b0 kernel/workqueue.c:3090

but task is already holding lock:
ffff88801fc50ff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_open+0xa4/0x1270 net/bluetooth/hci_core.c:1446

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&hdev->req_lock){+.+.}-{3:3}:
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
hci_dev_do_close+0x5f/0x1030 net/bluetooth/hci_core.c:1737
hci_rfkill_set_block+0x10a/0x190 net/bluetooth/hci_core.c:2235
rfkill_set_block+0x1c6/0x420 net/rfkill/core.c:345
rfkill_epo+0x75/0x170 net/rfkill/core.c:454
__rfkill_handle_global_op net/rfkill/input.c:60 [inline]
rfkill_op_handler+0x76/0x220 net/rfkill/input.c:108
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

-> #2 (rfkill_global_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
rfkill_register+0x33/0x8a0 net/rfkill/core.c:1045
hci_register_dev+0x452/0x970 net/bluetooth/hci_core.c:3960
__vhci_create_device drivers/bluetooth/hci_vhci.c:129 [inline]
vhci_create_device+0x32c/0x5c0 drivers/bluetooth/hci_vhci.c:153
vhci_get_user drivers/bluetooth/hci_vhci.c:210 [inline]
vhci_write+0x391/0x450 drivers/bluetooth/hci_vhci.c:290
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x712/0xd00 fs/read_write.c:594
ksys_write+0x14d/0x250 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

-> #1 (&data->open_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
vhci_send_frame+0x88/0x100 drivers/bluetooth/hci_vhci.c:71
hci_send_frame+0x1a9/0x2e0 net/bluetooth/hci_core.c:4256
hci_sched_acl_pkt net/bluetooth/hci_core.c:4781 [inline]
hci_sched_acl net/bluetooth/hci_core.c:4866 [inline]
hci_tx_work+0x9f9/0x1710 net/bluetooth/hci_core.c:4932
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

-> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__flush_work+0xdd/0x1b0 kernel/workqueue.c:3090
hci_dev_do_open+0xc58/0x1270 net/bluetooth/hci_core.c:1619
hci_power_on+0x1c1/0x610 net/bluetooth/hci_core.c:2265
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

other info that might help us debug this:

Chain exists of:
(work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&hdev->req_lock);
lock(rfkill_global_mutex);
lock(&hdev->req_lock);
lock((work_completion)(&hdev->tx_work));

*** DEADLOCK ***

3 locks held by kworker/u5:7/4200:
#0: ffff88801f9db938 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1: ffffc9000302fd00 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffff88801fc50ff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_open+0xa4/0x1270 net/bluetooth/hci_core.c:1446

stack backtrace:
CPU: 1 PID: 4200 Comm: kworker/u5:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: hci5 hci_power_on
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012
lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623
__flush_work+0xdd/0x1b0 kernel/workqueue.c:3090
hci_dev_do_open+0xc58/0x1270 net/bluetooth/hci_core.c:1619
hci_power_on+0x1c1/0x610 net/bluetooth/hci_core.c:2265
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup