Warning: Permanently added '10.128.10.22' (ED25519) to the list of known hosts. [ 32.293748][ T6098] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 32.297027][ T6098] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 32.299173][ T6098] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 32.301620][ T6098] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 32.303868][ T6098] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 32.305787][ T6098] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 32.340860][ T6097] [ 32.341495][ T6097] ====================================================== [ 32.343146][ T6097] WARNING: possible circular locking dependency detected [ 32.344678][ T6097] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 32.346156][ T6097] ------------------------------------------------------ [ 32.347879][ T6097] syz-executor266/6097 is trying to acquire lock: [ 32.349517][ T6097] ffff0000d3f10e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 32.352080][ T6097] [ 32.352080][ T6097] but task is already holding lock: [ 32.353932][ T6097] ffff0000d3f11108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.356299][ T6097] [ 32.356299][ T6097] which lock already depends on the new lock. [ 32.356299][ T6097] [ 32.358906][ T6097] [ 32.358906][ T6097] the existing dependency chain (in reverse order) is: [ 32.361030][ T6097] [ 32.361030][ T6097] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 32.363028][ T6097] __mutex_lock_common+0x190/0x21a0 [ 32.364362][ T6097] mutex_lock_nested+0x2c/0x38 [ 32.365711][ T6097] hci_rfkill_set_block+0xe8/0x20c [ 32.367031][ T6097] rfkill_set_block+0x18c/0x37c [ 32.368338][ T6097] rfkill_fop_write+0x578/0x734 [ 32.369653][ T6097] vfs_write+0x2a0/0x910 [ 32.370883][ T6097] ksys_write+0x15c/0x26c [ 32.372078][ T6097] __arm64_sys_write+0x7c/0x90 [ 32.373374][ T6097] invoke_syscall+0x98/0x2b8 [ 32.374624][ T6097] el0_svc_common+0x130/0x23c [ 32.375836][ T6097] do_el0_svc+0x48/0x58 [ 32.376941][ T6097] el0_svc+0x54/0x158 [ 32.378044][ T6097] el0t_64_sync_handler+0x84/0xfc [ 32.379431][ T6097] el0t_64_sync+0x190/0x194 [ 32.380705][ T6097] [ 32.380705][ T6097] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 32.382687][ T6097] __mutex_lock_common+0x190/0x21a0 [ 32.384022][ T6097] mutex_lock_nested+0x2c/0x38 [ 32.385333][ T6097] rfkill_register+0x44/0x7d4 [ 32.386543][ T6097] hci_register_dev+0x3e0/0x954 [ 32.387892][ T6097] vhci_create_device+0x358/0x6c4 [ 32.389218][ T6097] vhci_write+0x318/0x3b8 [ 32.390410][ T6097] vfs_write+0x610/0x910 [ 32.391667][ T6097] ksys_write+0x15c/0x26c [ 32.392826][ T6097] __arm64_sys_write+0x7c/0x90 [ 32.394123][ T6097] invoke_syscall+0x98/0x2b8 [ 32.395373][ T6097] el0_svc_common+0x130/0x23c [ 32.396619][ T6097] do_el0_svc+0x48/0x58 [ 32.397705][ T6097] el0_svc+0x54/0x158 [ 32.398790][ T6097] el0t_64_sync_handler+0x84/0xfc [ 32.400212][ T6097] el0t_64_sync+0x190/0x194 [ 32.401478][ T6097] [ 32.401478][ T6097] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 32.403449][ T6097] __mutex_lock_common+0x190/0x21a0 [ 32.404872][ T6097] mutex_lock_nested+0x2c/0x38 [ 32.406147][ T6097] vhci_send_frame+0x8c/0x10c [ 32.407347][ T6097] hci_send_frame+0x1c4/0x35c [ 32.408649][ T6097] hci_tx_work+0xba0/0x18e4 [ 32.409866][ T6097] process_one_work+0x694/0x1204 [ 32.411189][ T6097] worker_thread+0x938/0xef4 [ 32.412480][ T6097] kthread+0x288/0x310 [ 32.413640][ T6097] ret_from_fork+0x10/0x20 [ 32.414817][ T6097] [ 32.414817][ T6097] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 32.417101][ T6097] __lock_acquire+0x3384/0x763c [ 32.418297][ T6097] lock_acquire+0x23c/0x71c [ 32.419535][ T6097] __flush_work+0xf8/0x1c0 [ 32.420765][ T6097] flush_work+0x24/0x38 [ 32.421980][ T6097] hci_dev_close_sync+0x1c8/0xf30 [ 32.423306][ T6097] hci_rfkill_set_block+0xf0/0x20c [ 32.424656][ T6097] rfkill_set_block+0x18c/0x37c [ 32.425894][ T6097] rfkill_fop_write+0x578/0x734 [ 32.427181][ T6097] vfs_write+0x2a0/0x910 [ 32.428303][ T6097] ksys_write+0x15c/0x26c [ 32.429419][ T6097] __arm64_sys_write+0x7c/0x90 [ 32.430642][ T6097] invoke_syscall+0x98/0x2b8 [ 32.431759][ T6097] el0_svc_common+0x130/0x23c [ 32.433009][ T6097] do_el0_svc+0x48/0x58 [ 32.434111][ T6097] el0_svc+0x54/0x158 [ 32.435243][ T6097] el0t_64_sync_handler+0x84/0xfc [ 32.436621][ T6097] el0t_64_sync+0x190/0x194 [ 32.437767][ T6097] [ 32.437767][ T6097] other info that might help us debug this: [ 32.437767][ T6097] [ 32.440329][ T6097] Chain exists of: [ 32.440329][ T6097] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 32.440329][ T6097] [ 32.443970][ T6097] Possible unsafe locking scenario: [ 32.443970][ T6097] [ 32.445747][ T6097] CPU0 CPU1 [ 32.447054][ T6097] ---- ---- [ 32.448354][ T6097] lock(&hdev->req_lock); [ 32.449404][ T6097] lock(rfkill_global_mutex); [ 32.451151][ T6097] lock(&hdev->req_lock); [ 32.452735][ T6097] lock((work_completion)(&hdev->tx_work)); [ 32.454248][ T6097] [ 32.454248][ T6097] *** DEADLOCK *** [ 32.454248][ T6097] [ 32.456217][ T6097] 2 locks held by syz-executor266/6097: [ 32.457535][ T6097] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 32.459970][ T6097] #1: ffff0000d3f11108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.462393][ T6097] [ 32.462393][ T6097] stack backtrace: [ 32.463844][ T6097] CPU: 1 PID: 6097 Comm: syz-executor266 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 32.466239][ T6097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 32.468718][ T6097] Call trace: [ 32.469540][ T6097] dump_backtrace+0x1b8/0x1e4 [ 32.470700][ T6097] show_stack+0x2c/0x3c [ 32.471747][ T6097] dump_stack_lvl+0xd0/0x124 [ 32.472883][ T6097] dump_stack+0x1c/0x28 [ 32.473956][ T6097] print_circular_bug+0x150/0x1b8 [ 32.475153][ T6097] check_noncircular+0x310/0x404 [ 32.476378][ T6097] __lock_acquire+0x3384/0x763c [ 32.477645][ T6097] lock_acquire+0x23c/0x71c [ 32.478720][ T6097] __flush_work+0xf8/0x1c0 [ 32.479787][ T6097] flush_work+0x24/0x38 [ 32.480770][ T6097] hci_dev_close_sync+0x1c8/0xf30 [ 32.481917][ T6097] hci_rfkill_set_block+0xf0/0x20c [ 32.483256][ T6097] rfkill_set_block+0x18c/0x37c [ 32.484499][ T6097] rfkill_fop_write+0x578/0x734 [ 32.485758][ T6097] vfs_write+0x2a0/0x910 [ 32.486875][ T6097] ksys_write+0x15c/0x26c [ 32.487930][ T6097] __arm64_sys_write+0x7c/0x90 [ 32.489031][ T6097] invoke_syscall+0x98/0x2b8 [ 32.490082][ T6097] el0_svc_common+0x130/0x23c [ 32.491229][ T6097] do_el0_svc+0x48/0x58 [ 32.492263][ T6097] el0_svc+0x54/0x158 [ 32.493226][ T6097] el0t_64_sync_handler+0x84/0xfc [ 32.494445][ T6097] el0t_64_sync+0x190/0x194