Warning: Permanently added '10.128.1.48' (ED25519) to the list of known hosts. [ 34.523864][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.526365][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.528490][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.530749][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.532876][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 34.534795][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 34.692170][ T6096] [ 34.692716][ T6096] ====================================================== [ 34.694308][ T6096] WARNING: possible circular locking dependency detected [ 34.696034][ T6096] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 34.697552][ T6096] ------------------------------------------------------ [ 34.699137][ T6096] syz-executor323/6096 is trying to acquire lock: [ 34.700561][ T6096] ffff0000daa8ce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 34.703020][ T6096] [ 34.703020][ T6096] but task is already holding lock: [ 34.704872][ T6096] ffff0000daa8d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.707238][ T6096] [ 34.707238][ T6096] which lock already depends on the new lock. [ 34.707238][ T6096] [ 34.709767][ T6096] [ 34.709767][ T6096] the existing dependency chain (in reverse order) is: [ 34.711947][ T6096] [ 34.711947][ T6096] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 34.713912][ T6096] __mutex_lock_common+0x190/0x21a0 [ 34.715337][ T6096] mutex_lock_nested+0x2c/0x38 [ 34.716637][ T6096] hci_rfkill_set_block+0xe8/0x20c [ 34.718055][ T6096] rfkill_set_block+0x18c/0x37c [ 34.719304][ T6096] rfkill_fop_write+0x578/0x734 [ 34.720561][ T6096] vfs_write+0x2a0/0x910 [ 34.721800][ T6096] ksys_write+0x15c/0x26c [ 34.722956][ T6096] __arm64_sys_write+0x7c/0x90 [ 34.724225][ T6096] invoke_syscall+0x98/0x2b8 [ 34.725049][ T6096] el0_svc_common+0x130/0x23c [ 34.726312][ T6096] do_el0_svc+0x48/0x58 [ 34.727470][ T6096] el0_svc+0x54/0x158 [ 34.728590][ T6096] el0t_64_sync_handler+0x84/0xfc [ 34.729975][ T6096] el0t_64_sync+0x190/0x194 [ 34.731194][ T6096] [ 34.731194][ T6096] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 34.733247][ T6096] __mutex_lock_common+0x190/0x21a0 [ 34.734589][ T6096] mutex_lock_nested+0x2c/0x38 [ 34.735868][ T6096] rfkill_register+0x44/0x7d4 [ 34.737143][ T6096] hci_register_dev+0x3e0/0x954 [ 34.738420][ T6096] vhci_create_device+0x358/0x6c4 [ 34.739771][ T6096] vhci_write+0x318/0x3b8 [ 34.740874][ T6096] vfs_write+0x610/0x910 [ 34.741991][ T6096] ksys_write+0x15c/0x26c [ 34.743180][ T6096] __arm64_sys_write+0x7c/0x90 [ 34.744467][ T6096] invoke_syscall+0x98/0x2b8 [ 34.745654][ T6096] el0_svc_common+0x130/0x23c [ 34.746949][ T6096] do_el0_svc+0x48/0x58 [ 34.748114][ T6096] el0_svc+0x54/0x158 [ 34.749197][ T6096] el0t_64_sync_handler+0x84/0xfc [ 34.750583][ T6096] el0t_64_sync+0x190/0x194 [ 34.751799][ T6096] [ 34.751799][ T6096] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 34.753682][ T6096] __mutex_lock_common+0x190/0x21a0 [ 34.755172][ T6096] mutex_lock_nested+0x2c/0x38 [ 34.756434][ T6096] vhci_send_frame+0x8c/0x10c [ 34.757709][ T6096] hci_send_frame+0x1c4/0x35c [ 34.759029][ T6096] hci_tx_work+0xba0/0x18e4 [ 34.760306][ T6096] process_one_work+0x694/0x1204 [ 34.761672][ T6096] worker_thread+0x938/0xef4 [ 34.762894][ T6096] kthread+0x288/0x310 [ 34.763985][ T6096] ret_from_fork+0x10/0x20 [ 34.765201][ T6096] [ 34.765201][ T6096] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 34.767456][ T6096] __lock_acquire+0x3384/0x763c [ 34.768782][ T6096] lock_acquire+0x23c/0x71c [ 34.770069][ T6096] __flush_work+0xf8/0x1c0 [ 34.771390][ T6096] flush_work+0x24/0x38 [ 34.772531][ T6096] hci_dev_close_sync+0x1c8/0xf30 [ 34.773860][ T6096] hci_rfkill_set_block+0xf0/0x20c [ 34.775296][ T6096] rfkill_set_block+0x18c/0x37c [ 34.776696][ T6096] rfkill_fop_write+0x578/0x734 [ 34.778033][ T6096] vfs_write+0x2a0/0x910 [ 34.779162][ T6096] ksys_write+0x15c/0x26c [ 34.780356][ T6096] __arm64_sys_write+0x7c/0x90 [ 34.781684][ T6096] invoke_syscall+0x98/0x2b8 [ 34.782878][ T6096] el0_svc_common+0x130/0x23c [ 34.784162][ T6096] do_el0_svc+0x48/0x58 [ 34.785277][ T6096] el0_svc+0x54/0x158 [ 34.786328][ T6096] el0t_64_sync_handler+0x84/0xfc [ 34.787550][ T6096] el0t_64_sync+0x190/0x194 [ 34.788743][ T6096] [ 34.788743][ T6096] other info that might help us debug this: [ 34.788743][ T6096] [ 34.791292][ T6096] Chain exists of: [ 34.791292][ T6096] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 34.791292][ T6096] [ 34.794895][ T6096] Possible unsafe locking scenario: [ 34.794895][ T6096] [ 34.796662][ T6096] CPU0 CPU1 [ 34.797948][ T6096] ---- ---- [ 34.799274][ T6096] lock(&hdev->req_lock); [ 34.800365][ T6096] lock(rfkill_global_mutex); [ 34.802102][ T6096] lock(&hdev->req_lock); [ 34.803742][ T6096] lock((work_completion)(&hdev->tx_work)); [ 34.805179][ T6096] [ 34.805179][ T6096] *** DEADLOCK *** [ 34.805179][ T6096] [ 34.807084][ T6096] 2 locks held by syz-executor323/6096: [ 34.808382][ T6096] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 34.810906][ T6096] #1: ffff0000daa8d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.813335][ T6096] [ 34.813335][ T6096] stack backtrace: [ 34.814871][ T6096] CPU: 0 PID: 6096 Comm: syz-executor323 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 34.817275][ T6096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 34.819685][ T6096] Call trace: [ 34.820453][ T6096] dump_backtrace+0x1b8/0x1e4 [ 34.821481][ T6096] show_stack+0x2c/0x3c [ 34.822494][ T6096] dump_stack_lvl+0xd0/0x124 [ 34.823548][ T6096] dump_stack+0x1c/0x28 [ 34.824572][ T6096] print_circular_bug+0x150/0x1b8 [ 34.825751][ T6096] check_noncircular+0x310/0x404 [ 34.826934][ T6096] __lock_acquire+0x3384/0x763c [ 34.828117][ T6096] lock_acquire+0x23c/0x71c [ 34.829224][ T6096] __flush_work+0xf8/0x1c0 [ 34.830260][ T6096] flush_work+0x24/0x38 [ 34.831328][ T6096] hci_dev_close_sync+0x1c8/0xf30 [ 34.832553][ T6096] hci_rfkill_set_block+0xf0/0x20c [ 34.833805][ T6096] rfkill_set_block+0x18c/0x37c [ 34.834959][ T6096] rfkill_fop_write+0x578/0x734 [ 34.836073][ T6096] vfs_write+0x2a0/0x910 [ 34.837111][ T6096] ksys_write+0x15c/0x26c [ 34.838137][ T6096] __arm64_sys_write+0x7c/0x90 [ 34.839302][ T6096] invoke_syscall+0x98/0x2b8 [ 34.840498][ T6096] el0_svc_common+0x130/0x23c [ 34.841649][ T6096] do_el0_svc+0x48/0x58 [ 34.842536][ T6096] el0_svc+0x54/0x158 [ 34.843489][ T6096] el0t_64_sync_handler+0x84/0xfc [ 34.844734][ T6096] el0t_64_sync+0x190/0x194