Warning: Permanently added '10.128.0.49' (ED25519) to the list of known hosts. [ 36.017140][ T6096] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.019954][ T6096] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.022263][ T6096] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.026039][ T6096] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.028397][ T6096] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 36.030446][ T6096] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 36.066917][ T6094] [ 36.067600][ T6094] ====================================================== [ 36.069446][ T6094] WARNING: possible circular locking dependency detected [ 36.071391][ T6094] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 36.073137][ T6094] ------------------------------------------------------ [ 36.074933][ T6094] syz-executor372/6094 is trying to acquire lock: [ 36.076572][ T6094] ffff0000db9dce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 36.079189][ T6094] [ 36.079189][ T6094] but task is already holding lock: [ 36.081036][ T6094] ffff0000db9dd108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 36.083553][ T6094] [ 36.083553][ T6094] which lock already depends on the new lock. [ 36.083553][ T6094] [ 36.086214][ T6094] [ 36.086214][ T6094] the existing dependency chain (in reverse order) is: [ 36.088553][ T6094] [ 36.088553][ T6094] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 36.090589][ T6094] __mutex_lock_common+0x190/0x21a0 [ 36.092103][ T6094] mutex_lock_nested+0x2c/0x38 [ 36.093499][ T6094] hci_rfkill_set_block+0xe8/0x20c [ 36.094900][ T6094] rfkill_set_block+0x18c/0x37c [ 36.096213][ T6094] rfkill_fop_write+0x578/0x734 [ 36.097562][ T6094] vfs_write+0x2a0/0x910 [ 36.098777][ T6094] ksys_write+0x15c/0x26c [ 36.100051][ T6094] __arm64_sys_write+0x7c/0x90 [ 36.101468][ T6094] invoke_syscall+0x98/0x2b8 [ 36.102795][ T6094] el0_svc_common+0x130/0x23c [ 36.104158][ T6094] do_el0_svc+0x48/0x58 [ 36.105396][ T6094] el0_svc+0x54/0x158 [ 36.106561][ T6094] el0t_64_sync_handler+0x84/0xfc [ 36.107972][ T6094] el0t_64_sync+0x190/0x194 [ 36.109367][ T6094] [ 36.109367][ T6094] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 36.111367][ T6094] __mutex_lock_common+0x190/0x21a0 [ 36.112924][ T6094] mutex_lock_nested+0x2c/0x38 [ 36.114300][ T6094] rfkill_register+0x44/0x7d4 [ 36.115659][ T6094] hci_register_dev+0x3e0/0x954 [ 36.117075][ T6094] vhci_create_device+0x358/0x6c4 [ 36.118515][ T6094] vhci_write+0x318/0x3b8 [ 36.119754][ T6094] vfs_write+0x610/0x910 [ 36.120963][ T6094] ksys_write+0x15c/0x26c [ 36.122237][ T6094] __arm64_sys_write+0x7c/0x90 [ 36.123653][ T6094] invoke_syscall+0x98/0x2b8 [ 36.125008][ T6094] el0_svc_common+0x130/0x23c [ 36.126290][ T6094] do_el0_svc+0x48/0x58 [ 36.127520][ T6094] el0_svc+0x54/0x158 [ 36.128641][ T6094] el0t_64_sync_handler+0x84/0xfc [ 36.130163][ T6094] el0t_64_sync+0x190/0x194 [ 36.131475][ T6094] [ 36.131475][ T6094] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 36.133486][ T6094] __mutex_lock_common+0x190/0x21a0 [ 36.135044][ T6094] mutex_lock_nested+0x2c/0x38 [ 36.136426][ T6094] vhci_send_frame+0x8c/0x10c [ 36.137791][ T6094] hci_send_frame+0x1c4/0x35c [ 36.139048][ T6094] hci_tx_work+0xba0/0x18e4 [ 36.140375][ T6094] process_one_work+0x694/0x1204 [ 36.141818][ T6094] worker_thread+0x938/0xef4 [ 36.143145][ T6094] kthread+0x288/0x310 [ 36.144163][ T6094] ret_from_fork+0x10/0x20 [ 36.145053][ T6094] [ 36.145053][ T6094] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 36.146697][ T6094] __lock_acquire+0x3384/0x763c [ 36.147659][ T6094] lock_acquire+0x23c/0x71c [ 36.148561][ T6094] __flush_work+0xf8/0x1c0 [ 36.149847][ T6094] flush_work+0x24/0x38 [ 36.151107][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 36.152611][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 36.154134][ T6094] rfkill_set_block+0x18c/0x37c [ 36.155610][ T6094] rfkill_fop_write+0x578/0x734 [ 36.157056][ T6094] vfs_write+0x2a0/0x910 [ 36.158349][ T6094] ksys_write+0x15c/0x26c [ 36.159593][ T6094] __arm64_sys_write+0x7c/0x90 [ 36.161065][ T6094] invoke_syscall+0x98/0x2b8 [ 36.162480][ T6094] el0_svc_common+0x130/0x23c [ 36.163806][ T6094] do_el0_svc+0x48/0x58 [ 36.165046][ T6094] el0_svc+0x54/0x158 [ 36.166250][ T6094] el0t_64_sync_handler+0x84/0xfc [ 36.167654][ T6094] el0t_64_sync+0x190/0x194 [ 36.168978][ T6094] [ 36.168978][ T6094] other info that might help us debug this: [ 36.168978][ T6094] [ 36.171685][ T6094] Chain exists of: [ 36.171685][ T6094] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 36.171685][ T6094] [ 36.175703][ T6094] Possible unsafe locking scenario: [ 36.175703][ T6094] [ 36.177676][ T6094] CPU0 CPU1 [ 36.179039][ T6094] ---- ---- [ 36.180417][ T6094] lock(&hdev->req_lock); [ 36.181612][ T6094] lock(rfkill_global_mutex); [ 36.183496][ T6094] lock(&hdev->req_lock); [ 36.185316][ T6094] lock((work_completion)(&hdev->tx_work)); [ 36.186851][ T6094] [ 36.186851][ T6094] *** DEADLOCK *** [ 36.186851][ T6094] [ 36.188980][ T6094] 2 locks held by syz-executor372/6094: [ 36.190459][ T6094] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 36.193100][ T6094] #1: ffff0000db9dd108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 36.195784][ T6094] [ 36.195784][ T6094] stack backtrace: [ 36.197341][ T6094] CPU: 0 PID: 6094 Comm: syz-executor372 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 36.199834][ T6094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 36.201959][ T6094] Call trace: [ 36.202538][ T6094] dump_backtrace+0x1b8/0x1e4 [ 36.203385][ T6094] show_stack+0x2c/0x3c [ 36.204134][ T6094] dump_stack_lvl+0xd0/0x124 [ 36.204983][ T6094] dump_stack+0x1c/0x28 [ 36.205730][ T6094] print_circular_bug+0x150/0x1b8 [ 36.207060][ T6094] check_noncircular+0x310/0x404 [ 36.208284][ T6094] __lock_acquire+0x3384/0x763c [ 36.209522][ T6094] lock_acquire+0x23c/0x71c [ 36.210714][ T6094] __flush_work+0xf8/0x1c0 [ 36.211862][ T6094] flush_work+0x24/0x38 [ 36.212920][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 36.214224][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 36.215569][ T6094] rfkill_set_block+0x18c/0x37c [ 36.216867][ T6094] rfkill_fop_write+0x578/0x734 [ 36.218207][ T6094] vfs_write+0x2a0/0x910 [ 36.219289][ T6094] ksys_write+0x15c/0x26c [ 36.220446][ T6094] __arm64_sys_write+0x7c/0x90 [ 36.221693][ T6094] invoke_syscall+0x98/0x2b8 [ 36.222922][ T6094] el0_svc_common+0x130/0x23c [ 36.224118][ T6094] do_el0_svc+0x48/0x58 [ 36.225209][ T6094] el0_svc+0x54/0x158 [ 36.226213][ T6094] el0t_64_sync_handler+0x84/0xfc [ 36.227556][ T6094] el0t_64_sync+0x190/0x194