Warning: Permanently added '10.128.1.116' (ED25519) to the list of known hosts. [ 30.113430][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.115674][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.117837][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.120458][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.122517][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 30.124843][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 30.272683][ T6101] [ 30.273316][ T6101] ====================================================== [ 30.275052][ T6101] WARNING: possible circular locking dependency detected [ 30.276789][ T6101] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 30.278353][ T6101] ------------------------------------------------------ [ 30.280057][ T6101] syz-executor111/6101 is trying to acquire lock: [ 30.281631][ T6101] ffff0000da82ce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 30.284163][ T6101] [ 30.284163][ T6101] but task is already holding lock: [ 30.285953][ T6101] ffff0000da82d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.288387][ T6101] [ 30.288387][ T6101] which lock already depends on the new lock. [ 30.288387][ T6101] [ 30.290977][ T6101] [ 30.290977][ T6101] the existing dependency chain (in reverse order) is: [ 30.293238][ T6101] [ 30.293238][ T6101] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 30.294992][ T6101] __mutex_lock_common+0x190/0x21a0 [ 30.296468][ T6101] mutex_lock_nested+0x2c/0x38 [ 30.297669][ T6101] hci_rfkill_set_block+0xe8/0x20c [ 30.299151][ T6101] rfkill_set_block+0x18c/0x37c [ 30.300389][ T6101] rfkill_fop_write+0x578/0x734 [ 30.301748][ T6101] vfs_write+0x2a0/0x910 [ 30.302871][ T6101] ksys_write+0x15c/0x26c [ 30.304079][ T6101] __arm64_sys_write+0x7c/0x90 [ 30.305366][ T6101] invoke_syscall+0x98/0x2b8 [ 30.306607][ T6101] el0_svc_common+0x130/0x23c [ 30.307849][ T6101] do_el0_svc+0x48/0x58 [ 30.308918][ T6101] el0_svc+0x54/0x158 [ 30.310043][ T6101] el0t_64_sync_handler+0x84/0xfc [ 30.311471][ T6101] el0t_64_sync+0x190/0x194 [ 30.312798][ T6101] [ 30.312798][ T6101] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 30.314737][ T6101] __mutex_lock_common+0x190/0x21a0 [ 30.316165][ T6101] mutex_lock_nested+0x2c/0x38 [ 30.317380][ T6101] rfkill_register+0x44/0x7d4 [ 30.318650][ T6101] hci_register_dev+0x3e0/0x954 [ 30.320003][ T6101] vhci_create_device+0x358/0x6c4 [ 30.321424][ T6101] vhci_write+0x318/0x3b8 [ 30.322650][ T6101] vfs_write+0x610/0x910 [ 30.323778][ T6101] ksys_write+0x15c/0x26c [ 30.324944][ T6101] __arm64_sys_write+0x7c/0x90 [ 30.326240][ T6101] invoke_syscall+0x98/0x2b8 [ 30.327502][ T6101] el0_svc_common+0x130/0x23c [ 30.328857][ T6101] do_el0_svc+0x48/0x58 [ 30.330023][ T6101] el0_svc+0x54/0x158 [ 30.331142][ T6101] el0t_64_sync_handler+0x84/0xfc [ 30.332461][ T6101] el0t_64_sync+0x190/0x194 [ 30.333720][ T6101] [ 30.333720][ T6101] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 30.335608][ T6101] __mutex_lock_common+0x190/0x21a0 [ 30.337075][ T6101] mutex_lock_nested+0x2c/0x38 [ 30.338354][ T6101] vhci_send_frame+0x8c/0x10c [ 30.339691][ T6101] hci_send_frame+0x1c4/0x35c [ 30.340980][ T6101] hci_tx_work+0xba0/0x18e4 [ 30.342283][ T6101] process_one_work+0x694/0x1204 [ 30.343636][ T6101] worker_thread+0x938/0xef4 [ 30.344983][ T6101] kthread+0x288/0x310 [ 30.346127][ T6101] ret_from_fork+0x10/0x20 [ 30.347358][ T6101] [ 30.347358][ T6101] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 30.349718][ T6101] __lock_acquire+0x3384/0x763c [ 30.351076][ T6101] lock_acquire+0x23c/0x71c [ 30.352253][ T6101] __flush_work+0xf8/0x1c0 [ 30.353469][ T6101] flush_work+0x24/0x38 [ 30.354605][ T6101] hci_dev_close_sync+0x1c8/0xf30 [ 30.355997][ T6101] hci_rfkill_set_block+0xf0/0x20c [ 30.357367][ T6101] rfkill_set_block+0x18c/0x37c [ 30.358710][ T6101] rfkill_fop_write+0x578/0x734 [ 30.360045][ T6101] vfs_write+0x2a0/0x910 [ 30.361249][ T6101] ksys_write+0x15c/0x26c [ 30.362433][ T6101] __arm64_sys_write+0x7c/0x90 [ 30.363774][ T6101] invoke_syscall+0x98/0x2b8 [ 30.365052][ T6101] el0_svc_common+0x130/0x23c [ 30.366284][ T6101] do_el0_svc+0x48/0x58 [ 30.367420][ T6101] el0_svc+0x54/0x158 [ 30.368606][ T6101] el0t_64_sync_handler+0x84/0xfc [ 30.369914][ T6101] el0t_64_sync+0x190/0x194 [ 30.371130][ T6101] [ 30.371130][ T6101] other info that might help us debug this: [ 30.371130][ T6101] [ 30.373658][ T6101] Chain exists of: [ 30.373658][ T6101] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 30.373658][ T6101] [ 30.377131][ T6101] Possible unsafe locking scenario: [ 30.377131][ T6101] [ 30.378986][ T6101] CPU0 CPU1 [ 30.380280][ T6101] ---- ---- [ 30.381659][ T6101] lock(&hdev->req_lock); [ 30.382698][ T6101] lock(rfkill_global_mutex); [ 30.384480][ T6101] lock(&hdev->req_lock); [ 30.386207][ T6101] lock((work_completion)(&hdev->tx_work)); [ 30.387910][ T6101] [ 30.387910][ T6101] *** DEADLOCK *** [ 30.387910][ T6101] [ 30.389966][ T6101] 2 locks held by syz-executor111/6101: [ 30.391358][ T6101] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 30.393899][ T6101] #1: ffff0000da82d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.396343][ T6101] [ 30.396343][ T6101] stack backtrace: [ 30.397896][ T6101] CPU: 0 PID: 6101 Comm: syz-executor111 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 30.400287][ T6101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 30.402767][ T6101] Call trace: [ 30.403629][ T6101] dump_backtrace+0x1b8/0x1e4 [ 30.404806][ T6101] show_stack+0x2c/0x3c [ 30.405808][ T6101] dump_stack_lvl+0xd0/0x124 [ 30.406976][ T6101] dump_stack+0x1c/0x28 [ 30.408041][ T6101] print_circular_bug+0x150/0x1b8 [ 30.409310][ T6101] check_noncircular+0x310/0x404 [ 30.410544][ T6101] __lock_acquire+0x3384/0x763c [ 30.411780][ T6101] lock_acquire+0x23c/0x71c [ 30.412895][ T6101] __flush_work+0xf8/0x1c0 [ 30.414051][ T6101] flush_work+0x24/0x38 [ 30.415024][ T6101] hci_dev_close_sync+0x1c8/0xf30 [ 30.416206][ T6101] hci_rfkill_set_block+0xf0/0x20c [ 30.417371][ T6101] rfkill_set_block+0x18c/0x37c [ 30.418557][ T6101] rfkill_fop_write+0x578/0x734 [ 30.419842][ T6101] vfs_write+0x2a0/0x910 [ 30.420945][ T6101] ksys_write+0x15c/0x26c [ 30.422024][ T6101] __arm64_sys_write+0x7c/0x90 [ 30.423165][ T6101] invoke_syscall+0x98/0x2b8 [ 30.424311][ T6101] el0_svc_common+0x130/0x23c [ 30.425377][ T6101] do_el0_svc+0x48/0x58 [ 30.426337][ T6101] el0_svc+0x54/0x158 [ 30.427402][ T6101] el0t_64_sync_handler+0x84/0xfc [ 30.428618][ T6101] el0t_64_sync+0x190/0x194