[v6.1] INFO: task hung in hci_remote_features_evt (2)
0 views
Skip to first unread message
syzbot
Dec 31, 2025, 6:22:21 AM (2 days ago) 12/31/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 50cbba13faa2 Linux 6.1.159
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=169a07da580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31ea1cecaf34f0db
dashboard link: https://syzkaller.appspot.com/bug?extid=e3727c0c054372b07101
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172db29a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ad0bd66715a/disk-50cbba13.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3284d626258e/vmlinux-50cbba13.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a1f92ca7bbfc/Image-50cbba13.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e3727c...@syzkaller.appspotmail.com
INFO: task kworker/u5:4:4469 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u5:4 state:D stack:0 pid:4469 ppid:2 flags:0x00000008
Workqueue: hci15 hci_rx_work
Call trace:
__switch_to+0x2f4/0x568 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5244 [inline]
__schedule+0xddc/0x1b18 kernel/sched/core.c:6561
schedule+0xc4/0x170 kernel/sched/core.c:6637
schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6696
__mutex_lock_common+0xad4/0x1f38 kernel/locking/mutex.c:679
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
hci_event_func net/bluetooth/hci_event.c:7415 [inline]
hci_event_packet+0x6f4/0xf08 net/bluetooth/hci_event.c:7467
hci_rx_work+0x324/0xaa0 net/bluetooth/hci_core.c:4083
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
INFO: task syz.1.32:4601 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.32 state:D stack:0 pid:4601 ppid:4465 flags:0x0000000c
Call trace:
__switch_to+0x2f4/0x568 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5244 [inline]
__schedule+0xddc/0x1b18 kernel/sched/core.c:6561
schedule+0xc4/0x170 kernel/sched/core.c:6637
schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6696
__mutex_lock_common+0xad4/0x1f38 kernel/locking/mutex.c:679
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
hci_dev_close_sync+0x7d8/0xf18 net/bluetooth/hci_sync.c:5246
hci_dev_do_close net/bluetooth/hci_core.c:510 [inline]
hci_unregister_dev+0x1f8/0x4b4 net/bluetooth/hci_core.c:2705
vhci_release+0x7c/0xcc drivers/bluetooth/hci_vhci.c:573
__fput+0x1bc/0x7c0 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x1ec/0x270 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x54c/0x19a8 kernel/exit.c:880
do_group_exit+0x194/0x22c kernel/exit.c:1022
get_signal+0x11d0/0x1310 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1081 [inline]
do_notify_resume+0x34c/0x2b28 arch/arm64/kernel/signal.c:1134
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x98/0x138 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Showing all locks held in the system:
4 locks held by kworker/u4:0/9:
1 lock held by rcu_tasks_kthre/12:
#0: ffff800015227d70 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xbb4 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffff800015228590 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xbb4 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
#0: ffff800015227400 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
4 locks held by kworker/u5:0/47:
#0: ffff0000ef99c938 ((wq_completion)hci16#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff80001cd97c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000df5a4078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
2 locks held by getty/4079:
#0: ffff0000d6e5d098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
#1: ffff8000207db2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x2ec/0xf9c drivers/tty/n_tty.c:2198
4 locks held by kworker/u5:1/4411:
#0: ffff0000dc008938 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021027c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cd41c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:2/4414:
#0: ffff0000eed41138 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000210f7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cac88078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
3 locks held by kworker/0:10/4444:
#0: ffff0000d6463938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021297c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by kworker/0:12/4447:
#0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000212e7c20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
2 locks held by kworker/0:13/4448:
#0: ffff0000c0021938 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000212f7c20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
2 locks held by kworker/u4:5/4454:
4 locks held by kworker/u5:3/4467:
#0: ffff0000db848938 ((wq_completion)hci24#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800020fc7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cc614078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:4/4469:
#0: ffff0000dc991938 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000213d7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000c32d8078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
3 locks held by syz-executor/4471:
#0: ffff0000d49710b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d49710b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d4970078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
4 locks held by kworker/u4:6/4504:
2 locks held by kworker/1:10/4509:
#0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021597c20 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
3 locks held by kworker/1:11/4510:
#0: ffff0000d6463938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000215a7c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by syz.3.20/4599:
#0: ffff0000f1d050b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000f1d050b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000f1d04078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz.1.32/4601:
#0: ffff0000ef5190b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000ef5190b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000ef518078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
1 lock held by syz.0.33/4603:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by syz.2.34/4607:
#0: ffff0000d807d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d807d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d807c078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4614:
#0: ffff0000ef2010b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000ef2010b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000ef200078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4623:
#0: ffff0000dde550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000dde550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000dde54078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4627:
#0: ffff0000f23f90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000f23f90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000f23f8078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4633:
#0: ffff0000f25810b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000f25810b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000f2580078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
2 locks held by syz-executor/4641:
#0: ffff0000dd7550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000dd7550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000dd754078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
3 locks held by kworker/u4:7/4647:
#0: ffff0000c0029138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021947c20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by syz-executor/4650:
#0: ffff0000d35090b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d35090b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d3508078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4664:
#0: ffff0000d50150b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d50150b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d5014078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4668:
#0: ffff0000dd3290b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000dd3290b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000dd328078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4676:
#0: ffff0000db5d10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000db5d10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000db5d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4681:
#0: ffff0000d32910b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d32910b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d3290078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
1 lock held by syz-executor/4732:
#0: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
#0: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a8/0x6f0 kernel/rcu/tree_exp.h:962
1 lock held by syz-executor/4733:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
2 locks held by syz-executor/4741:
#0: ffff8000176af090 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x298/0x588 net/core/net_namespace.c:504
#1: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
4 locks held by kworker/u5:5/4743:
#0: ffff0000df0da138 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021c47c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cb814078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4752:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:6/4753:
#0: ffff0000eadac938 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021c77c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000ddf28078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4784:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:7/4787:
#0: ffff0000ddd3a938 ((wq_completion)hci20#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021d77c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000dbb3c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4793:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:8/4794:
#0: ffff0000f053c938 ((wq_completion)hci21#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021db7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000c4434078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4802:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:9/4803:
#0: ffff0000ce8cc938 ((wq_completion)hci22#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021df7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000c6070078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4808:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:10/4810:
#0: ffff0000dd16b138 ((wq_completion)hci23#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021997c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000dc71c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4820:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
1 lock held by syz-executor/4829:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
1 lock held by syz-executor/4836:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:13/4838:
#0: ffff0000efc3b138 ((wq_completion)hci25#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000222c7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000dd66c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4842:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:14/4844:
#0: ffff0000dadd4938 ((wq_completion)hci26#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800022317c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000f1b3c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4849:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:15/4850:
#0: ffff0000dc997138 ((wq_completion)hci27#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800022347c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000d430c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by dhcpcd/4852:
#0: ffff0000f34a9410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
#0: ffff0000f34a9410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline]
#0: ffff0000f34a9410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: sock_close+0x7c/0x1f8 net/socket.c:1400
2 locks held by dhcpcd/4854:
#0: ffff0000cf75e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1792 [inline]
#0: ffff0000cf75e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x48/0xb2c net/packet/af_packet.c:3248
#1: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
#1: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x264/0x6f0 kernel/rcu/tree_exp.h:962
1 lock held by dhcpcd/4855:
#0: ffff0000df078130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1792 [inline]
#0: ffff0000df078130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x48/0xb2c net/packet/af_packet.c:3248
1 lock held by dhcpcd/4857:
#0: ffff0000d2faa130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1792 [inline]
#0: ffff0000d2faa130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x48/0xb2c net/packet/af_packet.c:3248
=============================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 50cbba13faa2 Linux 6.1.159
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=169a07da580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31ea1cecaf34f0db
dashboard link: https://syzkaller.appspot.com/bug?extid=e3727c0c054372b07101
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172db29a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ad0bd66715a/disk-50cbba13.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3284d626258e/vmlinux-50cbba13.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a1f92ca7bbfc/Image-50cbba13.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e3727c...@syzkaller.appspotmail.com
INFO: task kworker/u5:4:4469 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u5:4 state:D stack:0 pid:4469 ppid:2 flags:0x00000008
Workqueue: hci15 hci_rx_work
Call trace:
__switch_to+0x2f4/0x568 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5244 [inline]
__schedule+0xddc/0x1b18 kernel/sched/core.c:6561
schedule+0xc4/0x170 kernel/sched/core.c:6637
schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6696
__mutex_lock_common+0xad4/0x1f38 kernel/locking/mutex.c:679
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
hci_event_func net/bluetooth/hci_event.c:7415 [inline]
hci_event_packet+0x6f4/0xf08 net/bluetooth/hci_event.c:7467
hci_rx_work+0x324/0xaa0 net/bluetooth/hci_core.c:4083
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
INFO: task syz.1.32:4601 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.32 state:D stack:0 pid:4601 ppid:4465 flags:0x0000000c
Call trace:
__switch_to+0x2f4/0x568 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5244 [inline]
__schedule+0xddc/0x1b18 kernel/sched/core.c:6561
schedule+0xc4/0x170 kernel/sched/core.c:6637
schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6696
__mutex_lock_common+0xad4/0x1f38 kernel/locking/mutex.c:679
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
hci_dev_close_sync+0x7d8/0xf18 net/bluetooth/hci_sync.c:5246
hci_dev_do_close net/bluetooth/hci_core.c:510 [inline]
hci_unregister_dev+0x1f8/0x4b4 net/bluetooth/hci_core.c:2705
vhci_release+0x7c/0xcc drivers/bluetooth/hci_vhci.c:573
__fput+0x1bc/0x7c0 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x1ec/0x270 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x54c/0x19a8 kernel/exit.c:880
do_group_exit+0x194/0x22c kernel/exit.c:1022
get_signal+0x11d0/0x1310 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1081 [inline]
do_notify_resume+0x34c/0x2b28 arch/arm64/kernel/signal.c:1134
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x98/0x138 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Showing all locks held in the system:
4 locks held by kworker/u4:0/9:
1 lock held by rcu_tasks_kthre/12:
#0: ffff800015227d70 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xbb4 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffff800015228590 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xbb4 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
#0: ffff800015227400 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
4 locks held by kworker/u5:0/47:
#0: ffff0000ef99c938 ((wq_completion)hci16#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff80001cd97c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000df5a4078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
2 locks held by getty/4079:
#0: ffff0000d6e5d098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
#1: ffff8000207db2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x2ec/0xf9c drivers/tty/n_tty.c:2198
4 locks held by kworker/u5:1/4411:
#0: ffff0000dc008938 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021027c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cd41c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:2/4414:
#0: ffff0000eed41138 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000210f7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cac88078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
3 locks held by kworker/0:10/4444:
#0: ffff0000d6463938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021297c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by kworker/0:12/4447:
#0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000212e7c20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
2 locks held by kworker/0:13/4448:
#0: ffff0000c0021938 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000212f7c20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
2 locks held by kworker/u4:5/4454:
4 locks held by kworker/u5:3/4467:
#0: ffff0000db848938 ((wq_completion)hci24#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800020fc7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cc614078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
4 locks held by kworker/u5:4/4469:
#0: ffff0000dc991938 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000213d7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000c32d8078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
3 locks held by syz-executor/4471:
#0: ffff0000d49710b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d49710b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d4970078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
4 locks held by kworker/u4:6/4504:
2 locks held by kworker/1:10/4509:
#0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021597c20 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
3 locks held by kworker/1:11/4510:
#0: ffff0000d6463938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000215a7c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by syz.3.20/4599:
#0: ffff0000f1d050b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000f1d050b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000f1d04078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz.1.32/4601:
#0: ffff0000ef5190b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000ef5190b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000ef518078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
1 lock held by syz.0.33/4603:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by syz.2.34/4607:
#0: ffff0000d807d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d807d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d807c078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4614:
#0: ffff0000ef2010b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000ef2010b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000ef200078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4623:
#0: ffff0000dde550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000dde550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000dde54078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4627:
#0: ffff0000f23f90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000f23f90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000f23f8078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4633:
#0: ffff0000f25810b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000f25810b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000f2580078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
2 locks held by syz-executor/4641:
#0: ffff0000dd7550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000dd7550b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000dd754078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
3 locks held by kworker/u4:7/4647:
#0: ffff0000c0029138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021947c20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
3 locks held by syz-executor/4650:
#0: ffff0000d35090b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d35090b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d3508078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4664:
#0: ffff0000d50150b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d50150b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d5014078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4668:
#0: ffff0000dd3290b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000dd3290b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000dd328078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4676:
#0: ffff0000db5d10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000db5d10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000db5d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
3 locks held by syz-executor/4681:
#0: ffff0000d32910b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline]
#0: ffff0000d32910b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f0/0x4b4 net/bluetooth/hci_core.c:2705
#1: ffff0000d3290078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x398/0xf18 net/bluetooth/hci_sync.c:5233
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1826 [inline]
#2: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x270 net/bluetooth/hci_conn.c:2504
1 lock held by syz-executor/4732:
#0: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
#0: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a8/0x6f0 kernel/rcu/tree_exp.h:962
1 lock held by syz-executor/4733:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
2 locks held by syz-executor/4741:
#0: ffff8000176af090 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x298/0x588 net/core/net_namespace.c:504
#1: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
4 locks held by kworker/u5:5/4743:
#0: ffff0000df0da138 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021c47c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000cb814078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4752:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:6/4753:
#0: ffff0000eadac938 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021c77c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000ddf28078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4784:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:7/4787:
#0: ffff0000ddd3a938 ((wq_completion)hci20#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021d77c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000dbb3c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4793:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:8/4794:
#0: ffff0000f053c938 ((wq_completion)hci21#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021db7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000c4434078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4802:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:9/4803:
#0: ffff0000ce8cc938 ((wq_completion)hci22#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021df7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000c6070078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4808:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:10/4810:
#0: ffff0000dd16b138 ((wq_completion)hci23#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800021997c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000dc71c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4820:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
1 lock held by syz-executor/4829:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
1 lock held by syz-executor/4836:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:13/4838:
#0: ffff0000efc3b138 ((wq_completion)hci25#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff8000222c7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000dd66c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4842:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:14/4844:
#0: ffff0000dadd4938 ((wq_completion)hci26#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800022317c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000f1b3c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by syz-executor/4849:
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffff8000176bb748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6ec/0xce4 net/core/rtnetlink.c:6147
4 locks held by kworker/u5:15/4850:
#0: ffff0000dc997138 ((wq_completion)hci27#2){+.+.}-{0:0}, at: process_one_work+0x6b4/0x13a8 kernel/workqueue.c:2265
#1: ffff800022347c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6f8/0x13a8 kernel/workqueue.c:2267
#2: ffff0000d430c078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x838 net/bluetooth/hci_event.c:3763
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1811 [inline]
#3: ffff8000178102a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x3f8/0x838 net/bluetooth/hci_event.c:3796
1 lock held by dhcpcd/4852:
#0: ffff0000f34a9410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
#0: ffff0000f34a9410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline]
#0: ffff0000f34a9410 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: sock_close+0x7c/0x1f8 net/socket.c:1400
2 locks held by dhcpcd/4854:
#0: ffff0000cf75e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1792 [inline]
#0: ffff0000cf75e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x48/0xb2c net/packet/af_packet.c:3248
#1: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
#1: ffff80001522d0b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x264/0x6f0 kernel/rcu/tree_exp.h:962
1 lock held by dhcpcd/4855:
#0: ffff0000df078130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1792 [inline]
#0: ffff0000df078130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x48/0xb2c net/packet/af_packet.c:3248
1 lock held by dhcpcd/4857:
#0: ffff0000d2faa130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1792 [inline]
#0: ffff0000d2faa130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x48/0xb2c net/packet/af_packet.c:3248
=============================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages