Warning: Permanently added '10.128.1.119' (ED25519) to the list of known hosts. [ 30.289422][ T6096] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.292029][ T6096] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.294156][ T6096] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.297293][ T6096] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.299393][ T6096] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 30.301343][ T6096] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 30.461402][ T6093] [ 30.462014][ T6093] ====================================================== [ 30.463701][ T6093] WARNING: possible circular locking dependency detected [ 30.465372][ T6093] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 30.466747][ T6093] ------------------------------------------------------ [ 30.468375][ T6093] syz-executor285/6093 is trying to acquire lock: [ 30.469899][ T6093] ffff0000d41cce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 30.472334][ T6093] [ 30.472334][ T6093] but task is already holding lock: [ 30.474079][ T6093] ffff0000d41cd108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.476263][ T6093] [ 30.476263][ T6093] which lock already depends on the new lock. [ 30.476263][ T6093] [ 30.478819][ T6093] [ 30.478819][ T6093] the existing dependency chain (in reverse order) is: [ 30.480958][ T6093] [ 30.480958][ T6093] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 30.482829][ T6093] __mutex_lock_common+0x190/0x21a0 [ 30.484204][ T6093] mutex_lock_nested+0x2c/0x38 [ 30.485538][ T6093] hci_rfkill_set_block+0xe8/0x20c [ 30.486859][ T6093] rfkill_set_block+0x18c/0x37c [ 30.488211][ T6093] rfkill_fop_write+0x578/0x734 [ 30.489619][ T6093] vfs_write+0x2a0/0x910 [ 30.490709][ T6093] ksys_write+0x15c/0x26c [ 30.491867][ T6093] __arm64_sys_write+0x7c/0x90 [ 30.493023][ T6093] invoke_syscall+0x98/0x2b8 [ 30.494223][ T6093] el0_svc_common+0x130/0x23c [ 30.495402][ T6093] do_el0_svc+0x48/0x58 [ 30.496546][ T6093] el0_svc+0x54/0x158 [ 30.497606][ T6093] el0t_64_sync_handler+0x84/0xfc [ 30.498955][ T6093] el0t_64_sync+0x190/0x194 [ 30.500083][ T6093] [ 30.500083][ T6093] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 30.501917][ T6093] __mutex_lock_common+0x190/0x21a0 [ 30.503323][ T6093] mutex_lock_nested+0x2c/0x38 [ 30.504630][ T6093] rfkill_register+0x44/0x7d4 [ 30.505844][ T6093] hci_register_dev+0x3e0/0x954 [ 30.507137][ T6093] vhci_create_device+0x358/0x6c4 [ 30.508450][ T6093] vhci_write+0x318/0x3b8 [ 30.509563][ T6093] vfs_write+0x610/0x910 [ 30.510688][ T6093] ksys_write+0x15c/0x26c [ 30.511798][ T6093] __arm64_sys_write+0x7c/0x90 [ 30.513165][ T6093] invoke_syscall+0x98/0x2b8 [ 30.514313][ T6093] el0_svc_common+0x130/0x23c [ 30.515484][ T6093] do_el0_svc+0x48/0x58 [ 30.516589][ T6093] el0_svc+0x54/0x158 [ 30.517695][ T6093] el0t_64_sync_handler+0x84/0xfc [ 30.519048][ T6093] el0t_64_sync+0x190/0x194 [ 30.520270][ T6093] [ 30.520270][ T6093] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 30.522183][ T6093] __mutex_lock_common+0x190/0x21a0 [ 30.523514][ T6093] mutex_lock_nested+0x2c/0x38 [ 30.524736][ T6093] vhci_send_frame+0x8c/0x10c [ 30.525938][ T6093] hci_send_frame+0x1c4/0x35c [ 30.527227][ T6093] hci_tx_work+0xba0/0x18e4 [ 30.528396][ T6093] process_one_work+0x694/0x1204 [ 30.529701][ T6093] worker_thread+0x938/0xef4 [ 30.530834][ T6093] kthread+0x288/0x310 [ 30.531906][ T6093] ret_from_fork+0x10/0x20 [ 30.533061][ T6093] [ 30.533061][ T6093] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 30.535223][ T6093] __lock_acquire+0x3384/0x763c [ 30.536503][ T6093] lock_acquire+0x23c/0x71c [ 30.537599][ T6093] __flush_work+0xf8/0x1c0 [ 30.538878][ T6093] flush_work+0x24/0x38 [ 30.540060][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 30.541459][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 30.542767][ T6093] rfkill_set_block+0x18c/0x37c [ 30.544024][ T6093] rfkill_fop_write+0x578/0x734 [ 30.545231][ T6093] vfs_write+0x2a0/0x910 [ 30.546268][ T6093] ksys_write+0x15c/0x26c [ 30.547396][ T6093] __arm64_sys_write+0x7c/0x90 [ 30.548642][ T6093] invoke_syscall+0x98/0x2b8 [ 30.549901][ T6093] el0_svc_common+0x130/0x23c [ 30.551072][ T6093] do_el0_svc+0x48/0x58 [ 30.552142][ T6093] el0_svc+0x54/0x158 [ 30.553174][ T6093] el0t_64_sync_handler+0x84/0xfc [ 30.554482][ T6093] el0t_64_sync+0x190/0x194 [ 30.555698][ T6093] [ 30.555698][ T6093] other info that might help us debug this: [ 30.555698][ T6093] [ 30.558064][ T6093] Chain exists of: [ 30.558064][ T6093] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 30.558064][ T6093] [ 30.561650][ T6093] Possible unsafe locking scenario: [ 30.561650][ T6093] [ 30.563436][ T6093] CPU0 CPU1 [ 30.564741][ T6093] ---- ---- [ 30.565990][ T6093] lock(&hdev->req_lock); [ 30.566993][ T6093] lock(rfkill_global_mutex); [ 30.568723][ T6093] lock(&hdev->req_lock); [ 30.570335][ T6093] lock((work_completion)(&hdev->tx_work)); [ 30.571788][ T6093] [ 30.571788][ T6093] *** DEADLOCK *** [ 30.571788][ T6093] [ 30.573645][ T6093] 2 locks held by syz-executor285/6093: [ 30.574993][ T6093] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 30.577505][ T6093] #1: ffff0000d41cd108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.579838][ T6093] [ 30.579838][ T6093] stack backtrace: [ 30.581247][ T6093] CPU: 0 PID: 6093 Comm: syz-executor285 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 30.583561][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 30.585972][ T6093] Call trace: [ 30.586783][ T6093] dump_backtrace+0x1b8/0x1e4 [ 30.587902][ T6093] show_stack+0x2c/0x3c [ 30.588909][ T6093] dump_stack_lvl+0xd0/0x124 [ 30.590051][ T6093] dump_stack+0x1c/0x28 [ 30.591000][ T6093] print_circular_bug+0x150/0x1b8 [ 30.592248][ T6093] check_noncircular+0x310/0x404 [ 30.593429][ T6093] __lock_acquire+0x3384/0x763c [ 30.594636][ T6093] lock_acquire+0x23c/0x71c [ 30.595630][ T6093] __flush_work+0xf8/0x1c0 [ 30.596633][ T6093] flush_work+0x24/0x38 [ 30.597627][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 30.598848][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 30.600137][ T6093] rfkill_set_block+0x18c/0x37c [ 30.601254][ T6093] rfkill_fop_write+0x578/0x734 [ 30.602420][ T6093] vfs_write+0x2a0/0x910 [ 30.603400][ T6093] ksys_write+0x15c/0x26c [ 30.604408][ T6093] __arm64_sys_write+0x7c/0x90 [ 30.605579][ T6093] invoke_syscall+0x98/0x2b8 [ 30.606676][ T6093] el0_svc_common+0x130/0x23c [ 30.607799][ T6093] do_el0_svc+0x48/0x58 [ 30.608837][ T6093] el0_svc+0x54/0x158 [ 30.609808][ T6093] el0t_64_sync_handler+0x84/0xfc [ 30.610905][ T6093] el0t_64_sync+0x190/0x194