Warning: Permanently added '10.128.0.225' (ED25519) to the list of known hosts. [ 32.286094][ T6096] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 32.288863][ T6096] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 32.291273][ T6096] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 32.293893][ T6096] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 32.296179][ T6096] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 32.298255][ T6096] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 32.437520][ T6095] [ 32.438121][ T6095] ====================================================== [ 32.439900][ T6095] WARNING: possible circular locking dependency detected [ 32.441642][ T6095] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 32.443254][ T6095] ------------------------------------------------------ [ 32.444995][ T6095] syz-executor388/6095 is trying to acquire lock: [ 32.446615][ T6095] ffff0000d1a24e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 32.449242][ T6095] [ 32.449242][ T6095] but task is already holding lock: [ 32.451157][ T6095] ffff0000d1a25108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.453661][ T6095] [ 32.453661][ T6095] which lock already depends on the new lock. [ 32.453661][ T6095] [ 32.456234][ T6095] [ 32.456234][ T6095] the existing dependency chain (in reverse order) is: [ 32.458513][ T6095] [ 32.458513][ T6095] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 32.460465][ T6095] __mutex_lock_common+0x190/0x21a0 [ 32.461932][ T6095] mutex_lock_nested+0x2c/0x38 [ 32.463288][ T6095] hci_rfkill_set_block+0xe8/0x20c [ 32.464681][ T6095] rfkill_set_block+0x18c/0x37c [ 32.466038][ T6095] rfkill_fop_write+0x578/0x734 [ 32.467416][ T6095] vfs_write+0x2a0/0x910 [ 32.468586][ T6095] ksys_write+0x15c/0x26c [ 32.469861][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.471200][ T6095] invoke_syscall+0x98/0x2b8 [ 32.472464][ T6095] el0_svc_common+0x130/0x23c [ 32.473778][ T6095] do_el0_svc+0x48/0x58 [ 32.474937][ T6095] el0_svc+0x54/0x158 [ 32.476031][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.477368][ T6095] el0t_64_sync+0x190/0x194 [ 32.478650][ T6095] [ 32.478650][ T6095] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 32.480703][ T6095] __mutex_lock_common+0x190/0x21a0 [ 32.482137][ T6095] mutex_lock_nested+0x2c/0x38 [ 32.483436][ T6095] rfkill_register+0x44/0x7d4 [ 32.484729][ T6095] hci_register_dev+0x3e0/0x954 [ 32.486044][ T6095] vhci_create_device+0x358/0x6c4 [ 32.487407][ T6095] vhci_write+0x318/0x3b8 [ 32.488624][ T6095] vfs_write+0x610/0x910 [ 32.489850][ T6095] ksys_write+0x15c/0x26c [ 32.491094][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.492396][ T6095] invoke_syscall+0x98/0x2b8 [ 32.493632][ T6095] el0_svc_common+0x130/0x23c [ 32.494945][ T6095] do_el0_svc+0x48/0x58 [ 32.496068][ T6095] el0_svc+0x54/0x158 [ 32.497248][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.498497][ T6095] el0t_64_sync+0x190/0x194 [ 32.499730][ T6095] [ 32.499730][ T6095] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 32.501767][ T6095] __mutex_lock_common+0x190/0x21a0 [ 32.503231][ T6095] mutex_lock_nested+0x2c/0x38 [ 32.504584][ T6095] vhci_send_frame+0x8c/0x10c [ 32.505892][ T6095] hci_send_frame+0x1c4/0x35c [ 32.507131][ T6095] hci_tx_work+0xba0/0x18e4 [ 32.508392][ T6095] process_one_work+0x694/0x1204 [ 32.509769][ T6095] worker_thread+0x938/0xef4 [ 32.511050][ T6095] kthread+0x288/0x310 [ 32.512174][ T6095] ret_from_fork+0x10/0x20 [ 32.513283][ T6095] [ 32.513283][ T6095] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 32.515539][ T6095] __lock_acquire+0x3384/0x763c [ 32.516978][ T6095] lock_acquire+0x23c/0x71c [ 32.518220][ T6095] __flush_work+0xf8/0x1c0 [ 32.519469][ T6095] flush_work+0x24/0x38 [ 32.520611][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 32.521925][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 32.523313][ T6095] rfkill_set_block+0x18c/0x37c [ 32.524636][ T6095] rfkill_fop_write+0x578/0x734 [ 32.525884][ T6095] vfs_write+0x2a0/0x910 [ 32.527018][ T6095] ksys_write+0x15c/0x26c [ 32.528164][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.529483][ T6095] invoke_syscall+0x98/0x2b8 [ 32.530767][ T6095] el0_svc_common+0x130/0x23c [ 32.532043][ T6095] do_el0_svc+0x48/0x58 [ 32.533131][ T6095] el0_svc+0x54/0x158 [ 32.534191][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.535492][ T6095] el0t_64_sync+0x190/0x194 [ 32.536715][ T6095] [ 32.536715][ T6095] other info that might help us debug this: [ 32.536715][ T6095] [ 32.539199][ T6095] Chain exists of: [ 32.539199][ T6095] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 32.539199][ T6095] [ 32.543010][ T6095] Possible unsafe locking scenario: [ 32.543010][ T6095] [ 32.544898][ T6095] CPU0 CPU1 [ 32.546272][ T6095] ---- ---- [ 32.547544][ T6095] lock(&hdev->req_lock); [ 32.548575][ T6095] lock(rfkill_global_mutex); [ 32.550307][ T6095] lock(&hdev->req_lock); [ 32.551992][ T6095] lock((work_completion)(&hdev->tx_work)); [ 32.553482][ T6095] [ 32.553482][ T6095] *** DEADLOCK *** [ 32.553482][ T6095] [ 32.555454][ T6095] 2 locks held by syz-executor388/6095: [ 32.556849][ T6095] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 32.559290][ T6095] #1: ffff0000d1a25108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.561707][ T6095] [ 32.561707][ T6095] stack backtrace: [ 32.563121][ T6095] CPU: 0 PID: 6095 Comm: syz-executor388 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 32.565502][ T6095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 32.567884][ T6095] Call trace: [ 32.568732][ T6095] dump_backtrace+0x1b8/0x1e4 [ 32.569857][ T6095] show_stack+0x2c/0x3c [ 32.570893][ T6095] dump_stack_lvl+0xd0/0x124 [ 32.572018][ T6095] dump_stack+0x1c/0x28 [ 32.573061][ T6095] print_circular_bug+0x150/0x1b8 [ 32.574431][ T6095] check_noncircular+0x310/0x404 [ 32.575660][ T6095] __lock_acquire+0x3384/0x763c [ 32.576816][ T6095] lock_acquire+0x23c/0x71c [ 32.577937][ T6095] __flush_work+0xf8/0x1c0 [ 32.579089][ T6095] flush_work+0x24/0x38 [ 32.580091][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 32.581252][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 32.582538][ T6095] rfkill_set_block+0x18c/0x37c [ 32.583801][ T6095] rfkill_fop_write+0x578/0x734 [ 32.584985][ T6095] vfs_write+0x2a0/0x910 [ 32.586050][ T6095] ksys_write+0x15c/0x26c [ 32.587116][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.588295][ T6095] invoke_syscall+0x98/0x2b8 [ 32.589457][ T6095] el0_svc_common+0x130/0x23c [ 32.590616][ T6095] do_el0_svc+0x48/0x58 [ 32.591686][ T6095] el0_svc+0x54/0x158 [ 32.592688][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.593897][ T6095] el0t_64_sync+0x190/0x194