Bluetooth: hci1: Opcode 0x0406 failed: -4
Freezing user space processes
------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.8.2311/16032 is trying to acquire lock:
ffffffff8eb4bf80 (console_owner){-.-.}-{0:0}, at: console_flush_all+0x123/0xaf0

but task is already holding lock:
ffff88816cd5c690 (&p->pi_lock){-.-.}-{2:2}, at: task_call_func+0x42/0x260

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&p->pi_lock){-.-.}-{2:2}:
       _raw_spin_lock_irqsave+0x40/0x60
       try_to_wake_up+0x67/0x14d0
       __wake_up_common_lock+0x13a/0x1f0
       tty_port_default_wakeup+0xc8/0x100
       serial8250_tx_chars+0x70e/0x950
       serial8250_handle_irq+0x166/0x550
       serial8250_default_handle_irq+0xbf/0x1e0
       serial8250_interrupt+0x8d/0x160
       __handle_irq_event_percpu+0x216/0x9a0
       handle_irq_event+0x8b/0x1e0
       handle_edge_irq+0x1f4/0x8a0
       __common_interrupt+0x141/0x1f0
       common_interrupt+0xb6/0xe0
       asm_common_interrupt+0x26/0x40
       pv_native_safe_halt+0xf/0x20
       default_idle+0x9/0x20
       default_idle_call+0x72/0xb0
       do_idle+0x2e0/0x540
       cpu_startup_entry+0x43/0x60
       start_secondary+0x101/0x110
       common_startup_64+0x13e/0x157

-> #2 (&tty->write_wait){-.-.}-{3:3}:
       _raw_spin_lock_irqsave+0x40/0x60
       __wake_up_common_lock+0x30/0x1f0
       tty_port_default_wakeup+0xc8/0x100
       serial8250_tx_chars+0x70e/0x950
       serial8250_handle_irq+0x166/0x550
       serial8250_default_handle_irq+0xbf/0x1e0
       serial8250_interrupt+0x8d/0x160
       __handle_irq_event_percpu+0x216/0x9a0
       handle_irq_event+0x8b/0x1e0
       handle_edge_irq+0x1f4/0x8a0
       __common_interrupt+0x141/0x1f0
       common_interrupt+0xb6/0xe0
       asm_common_interrupt+0x26/0x40
       _raw_spin_unlock_irqrestore+0x47/0x80
       uart_write+0x3c0/0x9f0
       n_tty_write+0xd49/0x11e0
       file_tty_write+0x509/0x9c0
       vfs_write+0x612/0xba0
       ksys_write+0x150/0x270
       do_syscall_64+0x174/0x580
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&port_lock_key){-.-.}-{3:3}:
       _raw_spin_lock_irqsave+0x40/0x60
       serial8250_console_write+0x153/0x1ba0
       console_flush_all+0x6ea/0xaf0
       console_unlock+0xd1/0x1c0
       vprintk_emit+0x485/0x560
       _printk+0xdd/0x130
       register_console+0xbc3/0xfc0
       univ8250_console_init+0x3a/0x70
       console_init+0x10b/0x4a0
       start_kernel+0x238/0x3e0
       x86_64_start_reservations+0x24/0x30
       x86_64_start_kernel+0x137/0x1b0
       common_startup_64+0x13e/0x157

-> #0 (console_owner){-.-.}-{0:0}:
       __lock_acquire+0x15ff/0x2e50
       lock_acquire+0x115/0x350
       console_flush_all+0x693/0xaf0
       console_unlock+0xd1/0x1c0
       vprintk_emit+0x485/0x560
       _printk+0xdd/0x130
       __report_bug+0x349/0x570
       report_bug+0x16a/0x220
       handle_bug+0x9c/0x200
       exc_invalid_op+0x1a/0x50
       asm_exc_invalid_op+0x1a/0x20
       __set_task_frozen+0x260/0x340
       task_call_func+0x1aa/0x260
       freeze_task+0x229/0x3b0
       try_to_freeze_tasks+0x190/0x620
       freeze_processes+0xce/0x1e0
       pm_suspend+0x2f1/0x760
       state_store+0x206/0x290
       kernfs_fop_write_iter+0x3a4/0x540
       vfs_write+0x612/0xba0
       ksys_write+0x150/0x270
       do_syscall_64+0x174/0x580
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  console_owner --> &tty->write_wait --> &p->pi_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&p->pi_lock);
                               lock(&tty->write_wait);
                               lock(&p->pi_lock);
  lock(console_owner);

 *** DEADLOCK ***

10 locks held by syz.8.2311/16032:
 #0: ffff88816ac1fef0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320
 #1: ffff88818020c450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #2: ffff888104bff080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #3: ffff8881616acd28 (kn->active#84){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #4: ffffffff8ea02160 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x3c7/0x760
 #5: ffffffff8e80a058 (tasklist_lock){.+.+}-{3:3}, at: try_to_freeze_tasks+0xe5/0x620
 #6: ffffffff8eb7b618 (freezer_lock){....}-{3:3}, at: freeze_task+0x7e/0x3b0
 #7: ffff88816cd5c690 (&p->pi_lock){-.-.}-{2:2}, at: task_call_func+0x42/0x260
 #8: ffffffff8eb4bfe0 (console_lock){+.+.}-{0:0}, at: _printk+0xdd/0x130
 #9: ffffffff8ea33878 (console_srcu){....}-{0:0}, at: console_flush_all+0x123/0xaf0

stack backtrace:
CPU: 0 UID: 0 PID: 16032 Comm: syz.8.2311 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 print_circular_bug+0x2e2/0x300
 check_noncircular+0x12f/0x150
 __lock_acquire+0x15ff/0x2e50
 lock_acquire+0x115/0x350
 console_flush_all+0x693/0xaf0
 console_unlock+0xd1/0x1c0
 vprintk_emit+0x485/0x560
 _printk+0xdd/0x130
 __report_bug+0x349/0x570
 report_bug+0x16a/0x220
 handle_bug+0x9c/0x200
 exc_invalid_op+0x1a/0x50
 asm_exc_invalid_op+0x1a/0x20
RIP: 0010:__set_task_frozen+0x260/0x340
Code: 00 80 00 00 89 e8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 05 b0 22 0a cc e8 df 16 15 00 90 0f 0b 90 e9 f7 fe ff ff e8 d1 16 15 00 90 <0f> 0b 90 eb 93 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c c3 fd ff ff
RSP: 0018:ffffc9000400f9f0 EFLAGS: 00010087
RAX: ffffffff81b1e7ef RBX: ffff88816cd5bc00 RCX: 0000000000080000
RDX: ffffc9000834d000 RSI: 000000000000e4f5 RDI: 000000000000e4f6
RBP: 0000000000000003 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: ffffffff81b1e590 R12: ffff88816cd5bc18
R13: 1ffff1102d9ab783 R14: 0000000000000000 R15: ffff88816cd5c798
 task_call_func+0x1aa/0x260
 freeze_task+0x229/0x3b0
 try_to_freeze_tasks+0x190/0x620
 freeze_processes+0xce/0x1e0
 pm_suspend+0x2f1/0x760
 state_store+0x206/0x290
 kernfs_fop_write_iter+0x3a4/0x540
 vfs_write+0x612/0xba0
 ksys_write+0x150/0x270
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4b1dd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4b1eccd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4b1e025fa0 RCX: 00007f4b1dd9e019
RDX: 0000000000000003 RSI: 0000200000000140 RDI: 0000000000000009
RBP: 00007f4b1de3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4b1e026038 R14: 00007f4b1e025fa0 R15: 00007fff24340f58
 </TASK>
debug_locks && p->lockdep_depth
WARNING: kernel/freezer.c:139 at __set_task_frozen+0x260/0x340, CPU#0: syz.8.2311/16032
Modules linked in:
CPU: 0 UID: 0 PID: 16032 Comm: syz.8.2311 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:__set_task_frozen+0x260/0x340
Code: 00 80 00 00 89 e8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 05 b0 22 0a cc e8 df 16 15 00 90 0f 0b 90 e9 f7 fe ff ff e8 d1 16 15 00 90 <0f> 0b 90 eb 93 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c c3 fd ff ff
RSP: 0018:ffffc9000400f9f0 EFLAGS: 00010087
RAX: ffffffff81b1e7ef RBX: ffff88816cd5bc00 RCX: 0000000000080000
RDX: ffffc9000834d000 RSI: 000000000000e4f5 RDI: 000000000000e4f6
RBP: 0000000000000003 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: ffffffff81b1e590 R12: ffff88816cd5bc18
R13: 1ffff1102d9ab783 R14: 0000000000000000 R15: ffff88816cd5c798
FS:  00007f4b1eccd6c0(0000) GS:ffff88818d94d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056554315eec8 CR3: 000000011989c000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 task_call_func+0x1aa/0x260
 freeze_task+0x229/0x3b0
 try_to_freeze_tasks+0x190/0x620
 freeze_processes+0xce/0x1e0
 pm_suspend+0x2f1/0x760
 state_store+0x206/0x290
 kernfs_fop_write_iter+0x3a4/0x540
 vfs_write+0x612/0xba0
 ksys_write+0x150/0x270
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4b1dd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4b1eccd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4b1e025fa0 RCX: 00007f4b1dd9e019
RDX: 0000000000000003 RSI: 0000200000000140 RDI: 0000000000000009
RBP: 00007f4b1de3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4b1e026038 R14: 00007f4b1e025fa0 R15: 00007fff24340f58
 </TASK>
