Warning: Permanently added '10.128.0.197' (ED25519) to the list of known hosts. [ 33.273455][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.276035][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.278225][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.280513][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.282439][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 33.284099][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 33.422776][ T6094] [ 33.423369][ T6094] ====================================================== [ 33.425148][ T6094] WARNING: possible circular locking dependency detected [ 33.426862][ T6094] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 33.428361][ T6094] ------------------------------------------------------ [ 33.430054][ T6094] syz-executor160/6094 is trying to acquire lock: [ 33.431498][ T6094] ffff0000d26c4e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 33.433983][ T6094] [ 33.433983][ T6094] but task is already holding lock: [ 33.435767][ T6094] ffff0000d26c5108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.438031][ T6094] [ 33.438031][ T6094] which lock already depends on the new lock. [ 33.438031][ T6094] [ 33.440513][ T6094] [ 33.440513][ T6094] the existing dependency chain (in reverse order) is: [ 33.442766][ T6094] [ 33.442766][ T6094] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 33.444620][ T6094] __mutex_lock_common+0x190/0x21a0 [ 33.446013][ T6094] mutex_lock_nested+0x2c/0x38 [ 33.447292][ T6094] hci_rfkill_set_block+0xe8/0x20c [ 33.448650][ T6094] rfkill_set_block+0x18c/0x37c [ 33.449906][ T6094] rfkill_fop_write+0x578/0x734 [ 33.451216][ T6094] vfs_write+0x2a0/0x910 [ 33.452289][ T6094] ksys_write+0x15c/0x26c [ 33.453497][ T6094] __arm64_sys_write+0x7c/0x90 [ 33.454791][ T6094] invoke_syscall+0x98/0x2b8 [ 33.456050][ T6094] el0_svc_common+0x130/0x23c [ 33.457313][ T6094] do_el0_svc+0x48/0x58 [ 33.458429][ T6094] el0_svc+0x54/0x158 [ 33.459490][ T6094] el0t_64_sync_handler+0x84/0xfc [ 33.460821][ T6094] el0t_64_sync+0x190/0x194 [ 33.462057][ T6094] [ 33.462057][ T6094] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 33.463915][ T6094] __mutex_lock_common+0x190/0x21a0 [ 33.465205][ T6094] mutex_lock_nested+0x2c/0x38 [ 33.466439][ T6094] rfkill_register+0x44/0x7d4 [ 33.467811][ T6094] hci_register_dev+0x3e0/0x954 [ 33.469139][ T6094] vhci_create_device+0x358/0x6c4 [ 33.470412][ T6094] vhci_write+0x318/0x3b8 [ 33.471600][ T6094] vfs_write+0x610/0x910 [ 33.472742][ T6094] ksys_write+0x15c/0x26c [ 33.473889][ T6094] __arm64_sys_write+0x7c/0x90 [ 33.475148][ T6094] invoke_syscall+0x98/0x2b8 [ 33.476369][ T6094] el0_svc_common+0x130/0x23c [ 33.477674][ T6094] do_el0_svc+0x48/0x58 [ 33.478851][ T6094] el0_svc+0x54/0x158 [ 33.479959][ T6094] el0t_64_sync_handler+0x84/0xfc [ 33.481269][ T6094] el0t_64_sync+0x190/0x194 [ 33.482421][ T6094] [ 33.482421][ T6094] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 33.484374][ T6094] __mutex_lock_common+0x190/0x21a0 [ 33.485755][ T6094] mutex_lock_nested+0x2c/0x38 [ 33.487040][ T6094] vhci_send_frame+0x8c/0x10c [ 33.488316][ T6094] hci_send_frame+0x1c4/0x35c [ 33.489545][ T6094] hci_tx_work+0xba0/0x18e4 [ 33.490690][ T6094] process_one_work+0x694/0x1204 [ 33.491973][ T6094] worker_thread+0x938/0xef4 [ 33.493242][ T6094] kthread+0x288/0x310 [ 33.494329][ T6094] ret_from_fork+0x10/0x20 [ 33.495542][ T6094] [ 33.495542][ T6094] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 33.497775][ T6094] __lock_acquire+0x3384/0x763c [ 33.499101][ T6094] lock_acquire+0x23c/0x71c [ 33.500236][ T6094] __flush_work+0xf8/0x1c0 [ 33.501428][ T6094] flush_work+0x24/0x38 [ 33.502477][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 33.503799][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 33.505101][ T6094] rfkill_set_block+0x18c/0x37c [ 33.506375][ T6094] rfkill_fop_write+0x578/0x734 [ 33.507645][ T6094] vfs_write+0x2a0/0x910 [ 33.508804][ T6094] ksys_write+0x15c/0x26c [ 33.510015][ T6094] __arm64_sys_write+0x7c/0x90 [ 33.511305][ T6094] invoke_syscall+0x98/0x2b8 [ 33.512505][ T6094] el0_svc_common+0x130/0x23c [ 33.513870][ T6094] do_el0_svc+0x48/0x58 [ 33.514958][ T6094] el0_svc+0x54/0x158 [ 33.516101][ T6094] el0t_64_sync_handler+0x84/0xfc [ 33.517484][ T6094] el0t_64_sync+0x190/0x194 [ 33.518767][ T6094] [ 33.518767][ T6094] other info that might help us debug this: [ 33.518767][ T6094] [ 33.521180][ T6094] Chain exists of: [ 33.521180][ T6094] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 33.521180][ T6094] [ 33.524700][ T6094] Possible unsafe locking scenario: [ 33.524700][ T6094] [ 33.526437][ T6094] CPU0 CPU1 [ 33.527707][ T6094] ---- ---- [ 33.528943][ T6094] lock(&hdev->req_lock); [ 33.529909][ T6094] lock(rfkill_global_mutex); [ 33.531599][ T6094] lock(&hdev->req_lock); [ 33.533338][ T6094] lock((work_completion)(&hdev->tx_work)); [ 33.534721][ T6094] [ 33.534721][ T6094] *** DEADLOCK *** [ 33.534721][ T6094] [ 33.536637][ T6094] 2 locks held by syz-executor160/6094: [ 33.538017][ T6094] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 33.540605][ T6094] #1: ffff0000d26c5108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.542952][ T6094] [ 33.542952][ T6094] stack backtrace: [ 33.544419][ T6094] CPU: 1 PID: 6094 Comm: syz-executor160 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 33.546832][ T6094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 33.549170][ T6094] Call trace: [ 33.550017][ T6094] dump_backtrace+0x1b8/0x1e4 [ 33.551135][ T6094] show_stack+0x2c/0x3c [ 33.552179][ T6094] dump_stack_lvl+0xd0/0x124 [ 33.553369][ T6094] dump_stack+0x1c/0x28 [ 33.554354][ T6094] print_circular_bug+0x150/0x1b8 [ 33.555492][ T6094] check_noncircular+0x310/0x404 [ 33.556706][ T6094] __lock_acquire+0x3384/0x763c [ 33.557973][ T6094] lock_acquire+0x23c/0x71c [ 33.559099][ T6094] __flush_work+0xf8/0x1c0 [ 33.560152][ T6094] flush_work+0x24/0x38 [ 33.561084][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 33.562319][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 33.563599][ T6094] rfkill_set_block+0x18c/0x37c [ 33.564863][ T6094] rfkill_fop_write+0x578/0x734 [ 33.566054][ T6094] vfs_write+0x2a0/0x910 [ 33.567112][ T6094] ksys_write+0x15c/0x26c [ 33.568169][ T6094] __arm64_sys_write+0x7c/0x90 [ 33.569353][ T6094] invoke_syscall+0x98/0x2b8 [ 33.570429][ T6094] el0_svc_common+0x130/0x23c [ 33.571599][ T6094] do_el0_svc+0x48/0x58 [ 33.572585][ T6094] el0_svc+0x54/0x158 [ 33.573567][ T6094] el0t_64_sync_handler+0x84/0xfc [ 33.574646][ T6094] el0t_64_sync+0x190/0x194