New: rfcomm: WARNING: possible circular locking dependency detected: rfcomm_sk_state_change <-> rfcomm_run

https://bugzilla.kernel.org/show_bug.cgi?id=215746

            Bug ID: 215746
           Summary: rfcomm: WARNING: possible circular locking dependency
                    detected: rfcomm_sk_state_change <-> rfcomm_run
           Product: Drivers
           Version: 2.5
    Kernel Version: 5.17
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Bluetooth
          Assignee: [email protected]
          Reporter: [email protected]
        Regression: No

Created attachment 300617
--> https://bugzilla.kernel.org/attachment.cgi?id=300617&action=edit
my changes on 5.17

I have this kernel trace often while connecting bluetooth headphones:

     WARNING: possible circular locking dependency detected
     5.17.0+ #1 Tainted: G        W        
     ------------------------------------------------------
     krfcommd/2671 is trying to acquire lock:
     ffff9c11062c7940 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at:

rfcomm_sk_state_change+0x4d/0x120 [rfcomm]

but task is already holding lock:
ffff9c10a0360f40 (&d->lock){+.+.}-{3:3}, at: rfcomm_run+0x1342/0x1860
[rfcomm]

     which lock already depends on the new lock.


     the existing dependency chain (in reverse order) is:

     -> #2 (&d->lock){+.+.}-{3:3}:
            __mutex_lock+0x93/0x840
            rfcomm_run+0x1342/0x1860 [rfcomm]
            kthread+0xf5/0x120
            ret_from_fork+0x22/0x30

     -> #1 (rfcomm_mutex){+.+.}-{3:3}:
            __mutex_lock+0x93/0x840
            rfcomm_dlc_open+0x30/0x340 [rfcomm]
            rfcomm_sock_connect+0xd5/0x130 [rfcomm]
            __sys_connect+0xb9/0xe0
            __x64_sys_connect+0x14/0x20
            do_syscall_64+0x3a/0x80
            entry_SYSCALL_64_after_hwframe+0x44/0xae

     -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}:
            __lock_acquire+0x1429/0x2410
            lock_acquire+0xc3/0x2c0
            lock_sock_nested+0x2e/0x80
            rfcomm_sk_state_change+0x4d/0x120 [rfcomm]
            rfcomm_run+0x135e/0x1860 [rfcomm]
            kthread+0xf5/0x120
            ret_from_fork+0x22/0x30

     other info that might help us debug this:

     Chain exists of:
       sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM --> rfcomm_mutex --> &d->lock

      Possible unsafe locking scenario:

            CPU0                    CPU1
            ----                    ----
       lock(&d->lock);
                                    lock(rfcomm_mutex);
                                    lock(&d->lock);
       lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);

      *** DEADLOCK ***

     2 locks held by krfcommd/2671:
      #0: ffffffffc0acf130 (rfcomm_mutex){+.+.}-{3:3}, at:
rfcomm_run+0x135/0x1860 [rfcomm]
      #1: ffff9c10a0360f40 (&d->lock){+.+.}-{3:3}, at: rfcomm_run+0x1342/0x1860

[rfcomm]

     stack backtrace:
     CPU: 5 PID: 2671 Comm: krfcommd Tainted: G        W         5.17.0+ #1
     Hardware name: ASUS System Product Name/TUF GAMING B550M-PLUS, BIOS 2423
08/10/2021
     Call Trace:
      <TASK>
      dump_stack_lvl+0x4c/0x60
      check_noncircular+0xe0/0x100
      __lock_acquire+0x1429/0x2410
      lock_acquire+0xc3/0x2c0
      ? rfcomm_sk_state_change+0x4d/0x120 [rfcomm]
      ? rfcomm_run+0x1342/0x1860 [rfcomm]
      lock_sock_nested+0x2e/0x80
      ? rfcomm_sk_state_change+0x4d/0x120 [rfcomm]
      rfcomm_sk_state_change+0x4d/0x120 [rfcomm]
      rfcomm_run+0x135e/0x1860 [rfcomm]
      ? __init_waitqueue_head+0x60/0x60
      ? _raw_spin_unlock_irqrestore+0x3b/0x60
      ? rfcomm_check_accept+0xa0/0xa0 [rfcomm]
      kthread+0xf5/0x120
      ? kthread_complete_and_exit+0x20/0x20
      ret_from_fork+0x22/0x30
      </TASK>

Kernel is tainted because of another bug:
https://bugzilla.kernel.org/show_bug.cgi?id=215740

BT hardware: ID 0b05:17cb ASUSTek Computer, Inc. Broadcom BCM20702A0 Bluetooth

Kernel is built from
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
at v5.17 tag (f443e374ae131c168a065ea1748feac6b2e76613) with couple of simple changes, adding them here just in case.

Also reproduces for my distro kernel:
https://bugzilla.redhat.com/show_bug.cgi?id=1948294

You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=215746

Andrew ([email protected]) changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]

--- Comment #1 from Andrew ([email protected]) ---
Created attachment 300618
--> https://bugzilla.kernel.org/attachment.cgi?id=300618&action=edit
full dmesg log with the warning

You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.