Warning: Permanently added '10.128.1.29' (ED25519) to the list of known hosts. [ 51.059008][ T3567] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 51.061790][ T3568] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 51.066766][ T3567] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 51.074974][ T3568] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 51.088485][ T3567] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 51.089272][ T3568] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 51.097777][ T3567] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 51.103983][ T3568] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 51.110354][ T3567] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 51.117252][ T3568] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 51.124430][ T3567] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 51.131031][ T3568] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 51.138141][ T3567] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 51.145194][ T3568] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 51.151913][ T3567] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 51.159054][ T3568] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 51.165703][ T3567] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 51.172760][ T3568] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 51.188956][ T3567] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 51.189686][ T3568] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 51.196529][ T3567] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 51.203595][ T3568] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 51.210457][ T3567] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 51.218539][ T3568] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 51.225088][ T3567] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 51.231145][ T3568] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 51.238525][ T3567] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 51.246319][ T3568] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 51.253032][ T3567] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 51.260256][ T3568] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 51.266917][ T3567] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 51.274492][ T3568] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 51.280689][ T3567] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 51.289507][ T3555] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 51.297037][ T3567] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 51.302191][ T48] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 53.394022][ T3569] Bluetooth: hci0: command 0x0409 tx timeout [ 53.394055][ T3570] Bluetooth: hci1: command 0x0409 tx timeout [ 53.400245][ T3569] Bluetooth: hci3: command 0x0409 tx timeout [ 53.406611][ T3570] Bluetooth: hci2: command 0x0409 tx timeout [ 53.412714][ T3567] Bluetooth: hci5: command 0x0409 tx timeout [ 53.419150][ T3570] Bluetooth: hci4: command 0x0409 tx timeout executing program executing program executing program executing program executing program [ 55.474055][ T3570] Bluetooth: hci4: command 0x041b tx timeout [ 55.474087][ T3569] Bluetooth: hci3: command 0x041b tx timeout [ 55.474127][ T3570] Bluetooth: hci5: command 0x041b tx timeout [ 55.480111][ T3569] Bluetooth: hci2: command 0x041b tx timeout [ 55.480140][ T3569] Bluetooth: hci1: command 0x041b tx timeout [ 55.480165][ T3569] Bluetooth: hci0: command 0x041b tx timeout executing program [ 56.407596][ T3573] [ 56.409970][ T3573] ====================================================== [ 56.416989][ T3573] WARNING: possible circular locking dependency detected [ 56.424036][ T3573] 6.1.60-syzkaller #0 Not tainted [ 56.429063][ T3573] ------------------------------------------------------ [ 56.436084][ T3573] syz-executor970/3573 is trying to acquire lock: [ 56.442497][ T3573] ffff8880770bc130 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x57/0x300 [ 56.454083][ T3573] [ 56.454083][ T3573] but task is already holding lock: [ 56.461449][ T3573] ffff88801f291928 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x259/0x6d0 [ 56.470346][ T3573] [ 56.470346][ T3573] which lock already depends on the new lock. [ 56.470346][ T3573] [ 56.480756][ T3573] [ 56.480756][ T3573] the existing dependency chain (in reverse order) is: [ 56.489861][ T3573] [ 56.489861][ T3573] -> #3 (&d->lock){+.+.}-{3:3}: [ 56.496917][ T3573] lock_acquire+0x1f8/0x5a0 [ 56.502043][ T3573] __mutex_lock+0x132/0xd80 executing program [ 56.507079][ T3573] __rfcomm_dlc_close+0x259/0x6d0 [ 56.512637][ T3573] rfcomm_dlc_close+0xed/0x180 [ 56.517928][ T3573] __rfcomm_sock_close+0x104/0x220 [ 56.523571][ T3573] rfcomm_sock_shutdown+0xb4/0x230 [ 56.529217][ T3573] rfcomm_sock_release+0x55/0x110 [ 56.534771][ T3573] sock_close+0xcd/0x230 [ 56.539541][ T3573] __fput+0x3b7/0x890 [ 56.544050][ T3573] task_work_run+0x246/0x300 [ 56.549165][ T3573] do_exit+0xa73/0x26a0 [ 56.553857][ T3573] do_group_exit+0x202/0x2b0 [ 56.559420][ T3573] get_signal+0x16f7/0x17d0 [ 56.564459][ T3573] arch_do_signal_or_restart+0xb0/0x1a10 [ 56.570643][ T3573] exit_to_user_mode_loop+0x6a/0x100 [ 56.576564][ T3573] exit_to_user_mode_prepare+0xb1/0x140 [ 56.582675][ T3573] syscall_exit_to_user_mode+0x60/0x270 [ 56.588756][ T3573] do_syscall_64+0x49/0xb0 [ 56.593705][ T3573] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.600127][ T3573] [ 56.600127][ T3573] -> #2 (rfcomm_mutex){+.+.}-{3:3}: [ 56.607533][ T3573] lock_acquire+0x1f8/0x5a0 [ 56.612572][ T3573] __mutex_lock+0x132/0xd80 [ 56.617610][ T3573] rfcomm_dlc_exists+0xa2/0x370 [ 56.622988][ T3573] rfcomm_dev_ioctl+0xb2d/0x2180 [ 56.628461][ T3573] rfcomm_sock_ioctl+0x82/0xc0 [ 56.633759][ T3573] sock_do_ioctl+0x152/0x450 [ 56.638882][ T3573] sock_ioctl+0x47f/0x770 [ 56.643753][ T3573] __se_sys_ioctl+0xf1/0x160 [ 56.648872][ T3573] do_syscall_64+0x3d/0xb0 [ 56.653816][ T3573] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.660242][ T3573] [ 56.660242][ T3573] -> #1 (rfcomm_ioctl_mutex){+.+.}-{3:3}: [ 56.668160][ T3573] lock_acquire+0x1f8/0x5a0 [ 56.673206][ T3573] __mutex_lock+0x132/0xd80 [ 56.678248][ T3573] rfcomm_dev_ioctl+0x233/0x2180 [ 56.683732][ T3573] rfcomm_sock_ioctl+0x82/0xc0 [ 56.689029][ T3573] sock_do_ioctl+0x152/0x450 [ 56.694154][ T3573] sock_ioctl+0x47f/0x770 [ 56.699022][ T3573] __se_sys_ioctl+0xf1/0x160 [ 56.704147][ T3573] do_syscall_64+0x3d/0xb0 [ 56.709185][ T3573] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.715676][ T3573] [ 56.715676][ T3573] -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}: [ 56.725088][ T3573] validate_chain+0x1667/0x58e0 [ 56.730572][ T3573] __lock_acquire+0x125b/0x1f80 [ 56.735961][ T3573] lock_acquire+0x1f8/0x5a0 [ 56.741006][ T3573] lock_sock_nested+0x44/0x100 [ 56.746299][ T3573] rfcomm_sk_state_change+0x57/0x300 [ 56.752111][ T3573] __rfcomm_dlc_close+0x2b2/0x6d0 [ 56.757660][ T3573] rfcomm_dlc_close+0xed/0x180 [ 56.762963][ T3573] __rfcomm_sock_close+0x104/0x220 [ 56.768610][ T3573] rfcomm_sock_shutdown+0xb4/0x230 [ 56.774250][ T3573] rfcomm_sock_release+0x55/0x110 [ 56.779800][ T3573] sock_close+0xcd/0x230 [ 56.784571][ T3573] __fput+0x3b7/0x890 [ 56.789087][ T3573] task_work_run+0x246/0x300 [ 56.794206][ T3573] do_exit+0xa73/0x26a0 [ 56.798895][ T3573] do_group_exit+0x202/0x2b0 [ 56.804013][ T3573] get_signal+0x16f7/0x17d0 [ 56.809055][ T3573] arch_do_signal_or_restart+0xb0/0x1a10 [ 56.815218][ T3573] exit_to_user_mode_loop+0x6a/0x100 [ 56.821032][ T3573] exit_to_user_mode_prepare+0xb1/0x140 [ 56.827115][ T3573] syscall_exit_to_user_mode+0x60/0x270 [ 56.833192][ T3573] do_syscall_64+0x49/0xb0 [ 56.838136][ T3573] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.844557][ T3573] [ 56.844557][ T3573] other info that might help us debug this: [ 56.844557][ T3573] [ 56.854797][ T3573] Chain exists of: [ 56.854797][ T3573] sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM --> rfcomm_mutex --> &d->lock [ 56.854797][ T3573] [ 56.868815][ T3573] Possible unsafe locking scenario: [ 56.868815][ T3573] [ 56.876266][ T3573] CPU0 CPU1 [ 56.881629][ T3573] ---- ---- [ 56.886990][ T3573] lock(&d->lock); [ 56.890803][ T3573] lock(rfcomm_mutex); [ 56.897501][ T3573] lock(&d->lock); [ 56.904099][ T3573] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM); [ 56.910258][ T3573] [ 56.910258][ T3573] *** DEADLOCK *** [ 56.910258][ T3573] [ 56.918395][ T3573] 3 locks held by syz-executor970/3573: [ 56.923935][ T3573] #0: ffff888070c81a10 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: sock_close+0x98/0x230 [ 56.934229][ T3573] #1: ffffffff8e40fec8 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_close+0x37/0x180 [ 56.943642][ T3573] #2: ffff88801f291928 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x259/0x6d0 [ 56.952966][ T3573] [ 56.952966][ T3573] stack backtrace: [ 56.959067][ T3573] CPU: 1 PID: 3573 Comm: syz-executor970 Not tainted 6.1.60-syzkaller #0 [ 56.968627][ T3573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 56.978779][ T3573] Call Trace: [ 56.982067][ T3573] [ 56.984998][ T3573] dump_stack_lvl+0x1e3/0x2cb [ 56.989688][ T3573] ? nf_tcp_handle_invalid+0x642/0x642 [ 56.995156][ T3573] ? print_circular_bug+0x12b/0x1a0 [ 57.000364][ T3573] check_noncircular+0x2fa/0x3b0 [ 57.005311][ T3573] ? add_chain_block+0x850/0x850 [ 57.010344][ T3573] ? lockdep_lock+0x11f/0x2a0 [ 57.015031][ T3573] ? _find_first_zero_bit+0xd0/0x100 [ 57.020325][ T3573] validate_chain+0x1667/0x58e0 [ 57.025190][ T3573] ? reacquire_held_locks+0x660/0x660 [ 57.030586][ T3573] ? register_lock_class+0x100/0x990 [ 57.036168][ T3573] ? reacquire_held_locks+0x660/0x660 [ 57.041558][ T3573] ? is_dynamic_key+0x260/0x260 [ 57.046503][ T3573] ? mark_lock+0x9a/0x340 [ 57.050847][ T3573] ? __lock_acquire+0x125b/0x1f80 [ 57.055884][ T3573] ? mark_lock+0x9a/0x340 [ 57.060321][ T3573] __lock_acquire+0x125b/0x1f80 [ 57.065192][ T3573] lock_acquire+0x1f8/0x5a0 [ 57.069702][ T3573] ? rfcomm_sk_state_change+0x57/0x300 [ 57.075175][ T3573] ? rcu_is_watching+0x11/0xb0 [ 57.079939][ T3573] ? read_lock_is_recursive+0x10/0x10 [ 57.085409][ T3573] ? __mutex_lock+0x2f7/0xd80 [ 57.090188][ T3573] ? rcu_is_watching+0x11/0xb0 [ 57.095088][ T3573] ? detach_timer+0x17d/0x380 [ 57.099859][ T3573] ? __rfcomm_dlc_close+0x259/0x6d0 [ 57.105158][ T3573] ? mutex_lock_nested+0x10/0x10 [ 57.110107][ T3573] lock_sock_nested+0x44/0x100 [ 57.114888][ T3573] ? rfcomm_sk_state_change+0x57/0x300 [ 57.120469][ T3573] rfcomm_sk_state_change+0x57/0x300 [ 57.125766][ T3573] __rfcomm_dlc_close+0x2b2/0x6d0 [ 57.130797][ T3573] rfcomm_dlc_close+0xed/0x180 [ 57.135656][ T3573] __rfcomm_sock_close+0x104/0x220 [ 57.140775][ T3573] rfcomm_sock_shutdown+0xb4/0x230 [ 57.145935][ T3573] rfcomm_sock_release+0x55/0x110 [ 57.151230][ T3573] sock_close+0xcd/0x230 [ 57.155486][ T3573] ? sock_mmap+0x90/0x90 [ 57.159740][ T3573] __fput+0x3b7/0x890 [ 57.163731][ T3573] task_work_run+0x246/0x300 [ 57.168331][ T3573] ? kasan_quarantine_put+0xd4/0x220 [ 57.173624][ T3573] ? task_work_cancel+0x2b0/0x2b0 [ 57.178656][ T3573] ? kmem_cache_free+0x292/0x510 [ 57.183600][ T3573] ? do_exit+0xa6e/0x26a0 [ 57.187945][ T3573] do_exit+0xa73/0x26a0 [ 57.192114][ T3573] ? put_task_struct+0x80/0x80 [ 57.196887][ T3573] ? get_signal+0x137e/0x17d0 [ 57.201571][ T3573] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 57.207561][ T3573] ? print_irqtrace_events+0x210/0x210 [ 57.213029][ T3573] ? _raw_spin_lock_irq+0xdb/0x110 [ 57.218148][ T3573] do_group_exit+0x202/0x2b0 [ 57.222750][ T3573] ? _raw_spin_unlock_irq+0x1f/0x40 [ 57.227957][ T3573] ? lockdep_hardirqs_on+0x94/0x130 [ 57.233169][ T3573] get_signal+0x16f7/0x17d0 [ 57.237687][ T3573] ? ptrace_notify+0x370/0x370 [ 57.242463][ T3573] ? print_irqtrace_events+0x210/0x210 [ 57.247947][ T3573] ? rfcomm_sock_connect+0x400/0x600 [ 57.253243][ T3573] arch_do_signal_or_restart+0xb0/0x1a10 [ 57.258894][ T3573] ? __local_bh_enable_ip+0x164/0x1f0 [ 57.264467][ T3573] ? rfcomm_sock_connect+0x400/0x600 [ 57.269789][ T3573] ? _local_bh_enable+0xa0/0xa0 [ 57.274685][ T3573] ? do_raw_spin_unlock+0x137/0x8a0 [ 57.279897][ T3573] ? rfcomm_sock_connect+0x44d/0x600 [ 57.285369][ T3573] ? get_sigframe_size+0x10/0x10 [ 57.290315][ T3573] ? rfcomm_sock_bind+0x5a0/0x5a0 [ 57.295348][ T3573] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 57.301348][ T3573] ? exit_to_user_mode_loop+0x39/0x100 [ 57.306828][ T3573] exit_to_user_mode_loop+0x6a/0x100 [ 57.312128][ T3573] exit_to_user_mode_prepare+0xb1/0x140 [ 57.317690][ T3573] syscall_exit_to_user_mode+0x60/0x270 [ 57.323257][ T3573] do_syscall_64+0x49/0xb0 [ 57.327682][ T3573] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.333589][ T3573] RIP: 0033:0x7f9645deeff9 [ 57.338007][ T3573] Code: Unable to access opcode bytes at 0x7f9645deefcf. [ 57.345026][ T3573] RSP: 002b:00007fffb516b458 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 57.353451][ T3573] RAX: fffffffffffffffc RBX: 0000000000000000 RCX: 00007f9645deeff9 executing program executing program executing program [ 57.361470][ T3573] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000004 [ 57.369469][ T3573] RBP: 00000000000f4240 R08: 0000000000000000 R09: 0000000000000000 [ 57.377538][ T3573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000555557515370 [ 57.385521][ T3573] R13: 0000000000000005 R14: 00007fffb516b4d0 R15: 00007fffb516b4c0 [ 57.393594][ T3573] executing program [ 57.553607][ T3569] Bluetooth: hci5: command 0x040f tx timeout [ 57.560105][ T3569] Bluetooth: hci0: command 0x040f tx timeout [ 57.566151][ T3567] Bluetooth: hci1: command 0x040f tx timeout [ 57.566166][ T3570] Bluetooth: hci2: command 0x040f tx timeout [ 57.572130][ T3567] Bluetooth: hci3: command 0x040f tx timeout [ 57.578450][ T3562] Bluetooth: hci4: command 0x040f tx timeout executing program executing program executing program executing program executing program executing program executing program executing program [ 59.633696][ T3570] Bluetooth: hci3: command 0x0419 tx timeout [ 59.639796][ T3570] Bluetooth: hci2: command 0x0419 tx timeout [ 59.645903][ T3568] Bluetooth: hci0: command 0x0419 tx timeout [ 59.652000][ T3568] Bluetooth: hci4: command 0x0419 tx timeout [ 59.653617][ T3562] Bluetooth: hci1: command 0x0419 tx timeout [ 59.658196][ T3568] Bluetooth: hci5: command 0x0419 tx timeout executing program executing program executing program executing program executing program executing program executing program [ 61.723624][ T3568] Bluetooth: hci5: command 0x0405 tx timeout executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program