Warning: Permanently added '10.128.0.150' (ED25519) to the list of known hosts. executing program [ 43.075554][ T4016] [ 43.076263][ T4016] ====================================================== [ 43.077898][ T4016] WARNING: possible circular locking dependency detected [ 43.079583][ T4016] 5.15.165-syzkaller #0 Not tainted [ 43.080928][ T4016] ------------------------------------------------------ [ 43.082605][ T4016] syz-executor214/4016 is trying to acquire lock: [ 43.084241][ T4016] ffff0000ca2ccb98 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 43.086853][ T4016] [ 43.086853][ T4016] but task is already holding lock: [ 43.088672][ T4016] ffff0000ca2ccff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 43.090968][ T4016] [ 43.090968][ T4016] which lock already depends on the new lock. [ 43.090968][ T4016] [ 43.093556][ T4016] [ 43.093556][ T4016] the existing dependency chain (in reverse order) is: [ 43.095773][ T4016] [ 43.095773][ T4016] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 43.097687][ T4016] __mutex_lock_common+0x194/0x2154 [ 43.099100][ T4016] mutex_lock_nested+0xa4/0xf8 [ 43.100416][ T4016] hci_dev_do_close+0x64/0x1060 [ 43.101721][ T4016] hci_rfkill_set_block+0xdc/0x1d0 [ 43.103180][ T4016] rfkill_set_block+0x18c/0x37c [ 43.104513][ T4016] rfkill_fop_write+0x594/0x750 [ 43.105887][ T4016] vfs_write+0x280/0xb44 [ 43.107055][ T4016] ksys_write+0x15c/0x26c [ 43.108325][ T4016] __arm64_sys_write+0x7c/0x90 [ 43.109598][ T4016] invoke_syscall+0x98/0x2b8 [ 43.110845][ T4016] el0_svc_common+0x138/0x258 [ 43.112084][ T4016] do_el0_svc+0x58/0x14c [ 43.113266][ T4016] el0_svc+0x7c/0x1f0 [ 43.114362][ T4016] el0t_64_sync_handler+0x84/0xe4 [ 43.115766][ T4016] el0t_64_sync+0x1a0/0x1a4 [ 43.117135][ T4016] [ 43.117135][ T4016] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 43.119070][ T4016] __mutex_lock_common+0x194/0x2154 [ 43.120427][ T4016] mutex_lock_nested+0xa4/0xf8 [ 43.121792][ T4016] rfkill_register+0x44/0x7a4 [ 43.123068][ T4016] hci_register_dev+0x3e0/0x880 [ 43.124436][ T4016] vhci_create_device+0x2c4/0x568 [ 43.125809][ T4016] vhci_write+0x318/0x3b8 [ 43.127049][ T4016] vfs_write+0x884/0xb44 [ 43.128255][ T4016] ksys_write+0x15c/0x26c [ 43.129518][ T4016] __arm64_sys_write+0x7c/0x90 [ 43.130858][ T4016] invoke_syscall+0x98/0x2b8 [ 43.132106][ T4016] el0_svc_common+0x138/0x258 [ 43.133403][ T4016] do_el0_svc+0x58/0x14c [ 43.134561][ T4016] el0_svc+0x7c/0x1f0 [ 43.135674][ T4016] el0t_64_sync_handler+0x84/0xe4 [ 43.137049][ T4016] el0t_64_sync+0x1a0/0x1a4 [ 43.138337][ T4016] [ 43.138337][ T4016] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 43.140255][ T4016] __mutex_lock_common+0x194/0x2154 [ 43.141728][ T4016] mutex_lock_nested+0xa4/0xf8 [ 43.143093][ T4016] vhci_send_frame+0x8c/0x10c [ 43.144438][ T4016] hci_send_frame+0x194/0x2f0 [ 43.145775][ T4016] hci_tx_work+0x8d8/0x157c [ 43.146988][ T4016] process_one_work+0x790/0x11b8 [ 43.148388][ T4016] worker_thread+0x910/0x1034 [ 43.149726][ T4016] kthread+0x37c/0x45c [ 43.150870][ T4016] ret_from_fork+0x10/0x20 [ 43.152094][ T4016] [ 43.152094][ T4016] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 43.154457][ T4016] __lock_acquire+0x32d4/0x7638 [ 43.155792][ T4016] lock_acquire+0x240/0x77c [ 43.157059][ T4016] __flush_work+0xf8/0x1c0 [ 43.158255][ T4016] flush_work+0x24/0x38 [ 43.159397][ T4016] hci_dev_do_close+0x16c/0x1060 [ 43.160743][ T4016] hci_rfkill_set_block+0xdc/0x1d0 [ 43.162106][ T4016] rfkill_set_block+0x18c/0x37c [ 43.163409][ T4016] rfkill_fop_write+0x594/0x750 [ 43.164855][ T4016] vfs_write+0x280/0xb44 [ 43.165992][ T4016] ksys_write+0x15c/0x26c [ 43.167227][ T4016] __arm64_sys_write+0x7c/0x90 [ 43.168574][ T4016] invoke_syscall+0x98/0x2b8 [ 43.169839][ T4016] el0_svc_common+0x138/0x258 [ 43.171179][ T4016] do_el0_svc+0x58/0x14c [ 43.172427][ T4016] el0_svc+0x7c/0x1f0 [ 43.173558][ T4016] el0t_64_sync_handler+0x84/0xe4 [ 43.175017][ T4016] el0t_64_sync+0x1a0/0x1a4 [ 43.176257][ T4016] [ 43.176257][ T4016] other info that might help us debug this: [ 43.176257][ T4016] [ 43.178775][ T4016] Chain exists of: [ 43.178775][ T4016] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 43.178775][ T4016] [ 43.182616][ T4016] Possible unsafe locking scenario: [ 43.182616][ T4016] [ 43.184492][ T4016] CPU0 CPU1 [ 43.185857][ T4016] ---- ---- [ 43.187138][ T4016] lock(&hdev->req_lock); [ 43.188190][ T4016] lock(rfkill_global_mutex); [ 43.189930][ T4016] lock(&hdev->req_lock); [ 43.191659][ T4016] lock((work_completion)(&hdev->tx_work)); [ 43.193106][ T4016] [ 43.193106][ T4016] *** DEADLOCK *** [ 43.193106][ T4016] [ 43.195114][ T4016] 2 locks held by syz-executor214/4016: [ 43.196445][ T4016] #0: ffff800016e77d28 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x250/0x750 [ 43.199036][ T4016] #1: ffff0000ca2ccff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 43.201530][ T4016] [ 43.201530][ T4016] stack backtrace: [ 43.202960][ T4016] CPU: 1 PID: 4016 Comm: syz-executor214 Not tainted 5.15.165-syzkaller #0 [ 43.205109][ T4016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 43.207587][ T4016] Call trace: [ 43.208394][ T4016] dump_backtrace+0x0/0x530 [ 43.209532][ T4016] show_stack+0x2c/0x3c [ 43.210554][ T4016] dump_stack_lvl+0x108/0x170 [ 43.211749][ T4016] dump_stack+0x1c/0x58 [ 43.212811][ T4016] print_circular_bug+0x150/0x1b8 [ 43.214094][ T4016] check_noncircular+0x2cc/0x378 [ 43.215325][ T4016] __lock_acquire+0x32d4/0x7638 [ 43.216544][ T4016] lock_acquire+0x240/0x77c [ 43.217629][ T4016] __flush_work+0xf8/0x1c0 [ 43.218714][ T4016] flush_work+0x24/0x38 [ 43.219737][ T4016] hci_dev_do_close+0x16c/0x1060 [ 43.220942][ T4016] hci_rfkill_set_block+0xdc/0x1d0 [ 43.222156][ T4016] rfkill_set_block+0x18c/0x37c [ 43.223341][ T4016] rfkill_fop_write+0x594/0x750 [ 43.224492][ T4016] vfs_write+0x280/0xb44 [ 43.225591][ T4016] ksys_write+0x15c/0x26c [ 43.226635][ T4016] __arm64_sys_write+0x7c/0x90 [ 43.227874][ T4016] invoke_syscall+0x98/0x2b8 [ 43.228986][ T4016] el0_svc_common+0x138/0x258 [ 43.230159][ T4016] do_el0_svc+0x58/0x14c [ 43.231256][ T4016] el0_svc+0x7c/0x1f0 [ 43.232231][ T4016] el0t_64_sync_handler+0x84/0xe4 [ 43.233472][ T4016] el0t_64_sync+0x1a0/0x1a4