Warning: Permanently added '10.128.0.109' (ED25519) to the list of known hosts. [ 29.865887][ T5672] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.868061][ T5672] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.869852][ T5672] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.871873][ T5672] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.873737][ T5672] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 29.875471][ T5672] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 30.034047][ T6100] [ 30.034574][ T6100] ====================================================== [ 30.036205][ T6100] WARNING: possible circular locking dependency detected [ 30.037792][ T6100] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 30.039211][ T6100] ------------------------------------------------------ [ 30.040792][ T6100] syz-executor283/6100 is trying to acquire lock: [ 30.042235][ T6100] ffff0000c8688e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 30.044556][ T6100] [ 30.044556][ T6100] but task is already holding lock: [ 30.046142][ T6100] ffff0000c8689108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.048319][ T6100] [ 30.048319][ T6100] which lock already depends on the new lock. [ 30.048319][ T6100] [ 30.050605][ T6100] [ 30.050605][ T6100] the existing dependency chain (in reverse order) is: [ 30.052763][ T6100] [ 30.052763][ T6100] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 30.054615][ T6100] __mutex_lock_common+0x190/0x21a0 [ 30.055982][ T6100] mutex_lock_nested+0x2c/0x38 [ 30.057158][ T6100] hci_rfkill_set_block+0xe8/0x20c [ 30.058494][ T6100] rfkill_set_block+0x18c/0x37c [ 30.059765][ T6100] rfkill_fop_write+0x578/0x734 [ 30.061006][ T6100] vfs_write+0x2a0/0x910 [ 30.062063][ T6100] ksys_write+0x15c/0x26c [ 30.063106][ T6100] __arm64_sys_write+0x7c/0x90 [ 30.064307][ T6100] invoke_syscall+0x98/0x2b8 [ 30.065617][ T6100] el0_svc_common+0x130/0x23c [ 30.066835][ T6100] do_el0_svc+0x48/0x58 [ 30.067918][ T6100] el0_svc+0x54/0x158 [ 30.068924][ T6100] el0t_64_sync_handler+0x84/0xfc [ 30.070146][ T6100] el0t_64_sync+0x190/0x194 [ 30.071360][ T6100] [ 30.071360][ T6100] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 30.073187][ T6100] __mutex_lock_common+0x190/0x21a0 [ 30.074485][ T6100] mutex_lock_nested+0x2c/0x38 [ 30.075665][ T6100] rfkill_register+0x44/0x7d4 [ 30.076728][ T6100] hci_register_dev+0x3e0/0x954 [ 30.078026][ T6100] vhci_create_device+0x358/0x6c4 [ 30.079283][ T6100] vhci_write+0x318/0x3b8 [ 30.080362][ T6100] vfs_write+0x610/0x910 [ 30.081423][ T6100] ksys_write+0x15c/0x26c [ 30.082543][ T6100] __arm64_sys_write+0x7c/0x90 [ 30.083791][ T6100] invoke_syscall+0x98/0x2b8 [ 30.084996][ T6100] el0_svc_common+0x130/0x23c [ 30.086245][ T6100] do_el0_svc+0x48/0x58 [ 30.087338][ T6100] el0_svc+0x54/0x158 [ 30.088339][ T6100] el0t_64_sync_handler+0x84/0xfc [ 30.089638][ T6100] el0t_64_sync+0x190/0x194 [ 30.090652][ T6100] [ 30.090652][ T6100] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 30.092501][ T6100] __mutex_lock_common+0x190/0x21a0 [ 30.093791][ T6100] mutex_lock_nested+0x2c/0x38 [ 30.095032][ T6100] vhci_send_frame+0x8c/0x10c [ 30.096176][ T6100] hci_send_frame+0x1c4/0x35c [ 30.097337][ T6100] hci_tx_work+0xba0/0x18e4 [ 30.098586][ T6100] process_one_work+0x694/0x1204 [ 30.099883][ T6100] worker_thread+0x938/0xef4 [ 30.101082][ T6100] kthread+0x288/0x310 [ 30.102060][ T6100] ret_from_fork+0x10/0x20 [ 30.103197][ T6100] [ 30.103197][ T6100] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 30.105227][ T6100] __lock_acquire+0x3384/0x763c [ 30.106533][ T6100] lock_acquire+0x23c/0x71c [ 30.107624][ T6100] __flush_work+0xf8/0x1c0 [ 30.108751][ T6100] flush_work+0x24/0x38 [ 30.109766][ T6100] hci_dev_close_sync+0x1c8/0xf30 [ 30.111051][ T6100] hci_rfkill_set_block+0xf0/0x20c [ 30.112311][ T6100] rfkill_set_block+0x18c/0x37c [ 30.113468][ T6100] rfkill_fop_write+0x578/0x734 [ 30.114684][ T6100] vfs_write+0x2a0/0x910 [ 30.115719][ T6100] ksys_write+0x15c/0x26c [ 30.116806][ T6100] __arm64_sys_write+0x7c/0x90 [ 30.117945][ T6100] invoke_syscall+0x98/0x2b8 [ 30.119055][ T6100] el0_svc_common+0x130/0x23c [ 30.120258][ T6100] do_el0_svc+0x48/0x58 [ 30.121374][ T6100] el0_svc+0x54/0x158 [ 30.122331][ T6100] el0t_64_sync_handler+0x84/0xfc [ 30.123570][ T6100] el0t_64_sync+0x190/0x194 [ 30.124684][ T6100] [ 30.124684][ T6100] other info that might help us debug this: [ 30.124684][ T6100] [ 30.127002][ T6100] Chain exists of: [ 30.127002][ T6100] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 30.127002][ T6100] [ 30.130333][ T6100] Possible unsafe locking scenario: [ 30.130333][ T6100] [ 30.131985][ T6100] CPU0 CPU1 [ 30.133091][ T6100] ---- ---- [ 30.134336][ T6100] lock(&hdev->req_lock); [ 30.135320][ T6100] lock(rfkill_global_mutex); [ 30.136966][ T6100] lock(&hdev->req_lock); [ 30.138538][ T6100] lock((work_completion)(&hdev->tx_work)); [ 30.139911][ T6100] [ 30.139911][ T6100] *** DEADLOCK *** [ 30.139911][ T6100] [ 30.141762][ T6100] 2 locks held by syz-executor283/6100: [ 30.143165][ T6100] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 30.145482][ T6100] #1: ffff0000c8689108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.147804][ T6100] [ 30.147804][ T6100] stack backtrace: [ 30.149211][ T6100] CPU: 1 PID: 6100 Comm: syz-executor283 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 30.151391][ T6100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 30.153565][ T6100] Call trace: [ 30.154291][ T6100] dump_backtrace+0x1b8/0x1e4 [ 30.155290][ T6100] show_stack+0x2c/0x3c [ 30.156334][ T6100] dump_stack_lvl+0xd0/0x124 [ 30.157345][ T6100] dump_stack+0x1c/0x28 [ 30.158303][ T6100] print_circular_bug+0x150/0x1b8 [ 30.159457][ T6100] check_noncircular+0x310/0x404 [ 30.160662][ T6100] __lock_acquire+0x3384/0x763c [ 30.161769][ T6100] lock_acquire+0x23c/0x71c [ 30.162858][ T6100] __flush_work+0xf8/0x1c0 [ 30.163846][ T6100] flush_work+0x24/0x38 [ 30.164801][ T6100] hci_dev_close_sync+0x1c8/0xf30 [ 30.165896][ T6100] hci_rfkill_set_block+0xf0/0x20c [ 30.167094][ T6100] rfkill_set_block+0x18c/0x37c [ 30.168163][ T6100] rfkill_fop_write+0x578/0x734 [ 30.169267][ T6100] vfs_write+0x2a0/0x910 [ 30.170273][ T6100] ksys_write+0x15c/0x26c [ 30.171232][ T6100] __arm64_sys_write+0x7c/0x90 [ 30.172260][ T6100] invoke_syscall+0x98/0x2b8 [ 30.173262][ T6100] el0_svc_common+0x130/0x23c [ 30.174305][ T6100] do_el0_svc+0x48/0x58 [ 30.175340][ T6100] el0_svc+0x54/0x158 [ 30.176252][ T6100] el0t_64_sync_handler+0x84/0xfc [ 30.177374][ T6100] el0t_64_sync+0x190/0x194