Warning: Permanently added '10.128.0.73' (ED25519) to the list of known hosts. [ 30.710065][ T5670] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.712397][ T5670] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.714530][ T5670] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.717030][ T5670] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.719086][ T5670] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 30.721779][ T5670] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 30.877294][ T6092] [ 30.877905][ T6092] ====================================================== [ 30.879727][ T6092] WARNING: possible circular locking dependency detected [ 30.881495][ T6092] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 30.883061][ T6092] ------------------------------------------------------ [ 30.884746][ T6092] syz-executor521/6092 is trying to acquire lock: [ 30.886340][ T6092] ffff0000da8ece10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 30.888991][ T6092] [ 30.888991][ T6092] but task is already holding lock: [ 30.890647][ T6092] ffff0000da8ed108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.893006][ T6092] [ 30.893006][ T6092] which lock already depends on the new lock. [ 30.893006][ T6092] [ 30.895562][ T6092] [ 30.895562][ T6092] the existing dependency chain (in reverse order) is: [ 30.897678][ T6092] [ 30.897678][ T6092] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 30.899575][ T6092] __mutex_lock_common+0x190/0x21a0 [ 30.900992][ T6092] mutex_lock_nested+0x2c/0x38 [ 30.902294][ T6092] hci_rfkill_set_block+0xe8/0x20c [ 30.903615][ T6092] rfkill_set_block+0x18c/0x37c [ 30.904906][ T6092] rfkill_fop_write+0x578/0x734 [ 30.906256][ T6092] vfs_write+0x2a0/0x910 [ 30.907418][ T6092] ksys_write+0x15c/0x26c [ 30.908676][ T6092] __arm64_sys_write+0x7c/0x90 [ 30.909967][ T6092] invoke_syscall+0x98/0x2b8 [ 30.911231][ T6092] el0_svc_common+0x130/0x23c [ 30.912449][ T6092] do_el0_svc+0x48/0x58 [ 30.913569][ T6092] el0_svc+0x54/0x158 [ 30.914632][ T6092] el0t_64_sync_handler+0x84/0xfc [ 30.915965][ T6092] el0t_64_sync+0x190/0x194 [ 30.917166][ T6092] [ 30.917166][ T6092] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 30.919105][ T6092] __mutex_lock_common+0x190/0x21a0 [ 30.920474][ T6092] mutex_lock_nested+0x2c/0x38 [ 30.921727][ T6092] rfkill_register+0x44/0x7d4 [ 30.922994][ T6092] hci_register_dev+0x3e0/0x954 [ 30.924243][ T6092] vhci_create_device+0x358/0x6c4 [ 30.925574][ T6092] vhci_write+0x318/0x3b8 [ 30.926775][ T6092] vfs_write+0x610/0x910 [ 30.927938][ T6092] ksys_write+0x15c/0x26c [ 30.929065][ T6092] __arm64_sys_write+0x7c/0x90 [ 30.930423][ T6092] invoke_syscall+0x98/0x2b8 [ 30.931654][ T6092] el0_svc_common+0x130/0x23c [ 30.932933][ T6092] do_el0_svc+0x48/0x58 [ 30.934102][ T6092] el0_svc+0x54/0x158 [ 30.935294][ T6092] el0t_64_sync_handler+0x84/0xfc [ 30.936670][ T6092] el0t_64_sync+0x190/0x194 [ 30.937903][ T6092] [ 30.937903][ T6092] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 30.939623][ T6092] __mutex_lock_common+0x190/0x21a0 [ 30.941059][ T6092] mutex_lock_nested+0x2c/0x38 [ 30.942301][ T6092] vhci_send_frame+0x8c/0x10c [ 30.943480][ T6092] hci_send_frame+0x1c4/0x35c [ 30.944709][ T6092] hci_tx_work+0xba0/0x18e4 [ 30.945925][ T6092] process_one_work+0x694/0x1204 [ 30.947209][ T6092] worker_thread+0x938/0xef4 [ 30.948407][ T6092] kthread+0x288/0x310 [ 30.949566][ T6092] ret_from_fork+0x10/0x20 [ 30.950697][ T6092] [ 30.950697][ T6092] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 30.953003][ T6092] __lock_acquire+0x3384/0x763c [ 30.954328][ T6092] lock_acquire+0x23c/0x71c [ 30.955677][ T6092] __flush_work+0xf8/0x1c0 [ 30.956875][ T6092] flush_work+0x24/0x38 [ 30.958037][ T6092] hci_dev_close_sync+0x1c8/0xf30 [ 30.959390][ T6092] hci_rfkill_set_block+0xf0/0x20c [ 30.960788][ T6092] rfkill_set_block+0x18c/0x37c [ 30.962132][ T6092] rfkill_fop_write+0x578/0x734 [ 30.963495][ T6092] vfs_write+0x2a0/0x910 [ 30.964677][ T6092] ksys_write+0x15c/0x26c [ 30.965886][ T6092] __arm64_sys_write+0x7c/0x90 [ 30.967156][ T6092] invoke_syscall+0x98/0x2b8 [ 30.968376][ T6092] el0_svc_common+0x130/0x23c [ 30.969603][ T6092] do_el0_svc+0x48/0x58 [ 30.970718][ T6092] el0_svc+0x54/0x158 [ 30.971794][ T6092] el0t_64_sync_handler+0x84/0xfc [ 30.973032][ T6092] el0t_64_sync+0x190/0x194 [ 30.974366][ T6092] [ 30.974366][ T6092] other info that might help us debug this: [ 30.974366][ T6092] [ 30.976834][ T6092] Chain exists of: [ 30.976834][ T6092] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 30.976834][ T6092] [ 30.980465][ T6092] Possible unsafe locking scenario: [ 30.980465][ T6092] [ 30.982249][ T6092] CPU0 CPU1 [ 30.983519][ T6092] ---- ---- [ 30.984778][ T6092] lock(&hdev->req_lock); [ 30.985856][ T6092] lock(rfkill_global_mutex); [ 30.987602][ T6092] lock(&hdev->req_lock); [ 30.989288][ T6092] lock((work_completion)(&hdev->tx_work)); [ 30.990705][ T6092] [ 30.990705][ T6092] *** DEADLOCK *** [ 30.990705][ T6092] [ 30.992620][ T6092] 2 locks held by syz-executor521/6092: [ 30.993996][ T6092] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 30.996498][ T6092] #1: ffff0000da8ed108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.998944][ T6092] [ 30.998944][ T6092] stack backtrace: [ 31.000311][ T6092] CPU: 0 PID: 6092 Comm: syz-executor521 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 31.002795][ T6092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 31.005188][ T6092] Call trace: [ 31.005937][ T6092] dump_backtrace+0x1b8/0x1e4 [ 31.007043][ T6092] show_stack+0x2c/0x3c [ 31.007970][ T6092] dump_stack_lvl+0xd0/0x124 [ 31.009036][ T6092] dump_stack+0x1c/0x28 [ 31.010005][ T6092] print_circular_bug+0x150/0x1b8 [ 31.011143][ T6092] check_noncircular+0x310/0x404 [ 31.012349][ T6092] __lock_acquire+0x3384/0x763c [ 31.013479][ T6092] lock_acquire+0x23c/0x71c [ 31.014601][ T6092] __flush_work+0xf8/0x1c0 [ 31.015679][ T6092] flush_work+0x24/0x38 [ 31.016548][ T6092] hci_dev_close_sync+0x1c8/0xf30 [ 31.017737][ T6092] hci_rfkill_set_block+0xf0/0x20c [ 31.018933][ T6092] rfkill_set_block+0x18c/0x37c [ 31.020113][ T6092] rfkill_fop_write+0x578/0x734 [ 31.021330][ T6092] vfs_write+0x2a0/0x910 [ 31.022309][ T6092] ksys_write+0x15c/0x26c [ 31.023344][ T6092] __arm64_sys_write+0x7c/0x90 [ 31.024549][ T6092] invoke_syscall+0x98/0x2b8 [ 31.025672][ T6092] el0_svc_common+0x130/0x23c [ 31.026871][ T6092] do_el0_svc+0x48/0x58 [ 31.027876][ T6092] el0_svc+0x54/0x158 [ 31.028850][ T6092] el0t_64_sync_handler+0x84/0xfc [ 31.030108][ T6092] el0t_64_sync+0x190/0x194