Warning: Permanently added '10.128.0.90' (ED25519) to the list of known hosts. [ 36.894027][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.896194][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.898045][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.900082][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.901927][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 36.904264][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 37.044987][ T6094] [ 37.045484][ T6094] ====================================================== [ 37.046880][ T6094] WARNING: possible circular locking dependency detected [ 37.048438][ T6094] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 37.049893][ T6094] ------------------------------------------------------ [ 37.051375][ T6094] syz-executor262/6094 is trying to acquire lock: [ 37.052764][ T6094] ffff0000cb9b8e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 37.055099][ T6094] [ 37.055099][ T6094] but task is already holding lock: [ 37.056720][ T6094] ffff0000cb9b9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 37.058908][ T6094] [ 37.058908][ T6094] which lock already depends on the new lock. [ 37.058908][ T6094] [ 37.061238][ T6094] [ 37.061238][ T6094] the existing dependency chain (in reverse order) is: [ 37.063272][ T6094] [ 37.063272][ T6094] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 37.065077][ T6094] __mutex_lock_common+0x190/0x21a0 [ 37.066328][ T6094] mutex_lock_nested+0x2c/0x38 [ 37.067437][ T6094] hci_rfkill_set_block+0xe8/0x20c [ 37.068637][ T6094] rfkill_set_block+0x18c/0x37c [ 37.069863][ T6094] rfkill_fop_write+0x578/0x734 [ 37.071089][ T6094] vfs_write+0x2a0/0x910 [ 37.072209][ T6094] ksys_write+0x15c/0x26c [ 37.073316][ T6094] __arm64_sys_write+0x7c/0x90 [ 37.074513][ T6094] invoke_syscall+0x98/0x2b8 [ 37.075728][ T6094] el0_svc_common+0x130/0x23c [ 37.076907][ T6094] do_el0_svc+0x48/0x58 [ 37.078009][ T6094] el0_svc+0x54/0x158 [ 37.079142][ T6094] el0t_64_sync_handler+0x84/0xfc [ 37.080497][ T6094] el0t_64_sync+0x190/0x194 [ 37.081691][ T6094] [ 37.081691][ T6094] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 37.083475][ T6094] __mutex_lock_common+0x190/0x21a0 [ 37.084762][ T6094] mutex_lock_nested+0x2c/0x38 [ 37.085891][ T6094] rfkill_register+0x44/0x7d4 [ 37.087033][ T6094] hci_register_dev+0x3e0/0x954 [ 37.088265][ T6094] vhci_create_device+0x358/0x6c4 [ 37.089536][ T6094] vhci_write+0x318/0x3b8 [ 37.090612][ T6094] vfs_write+0x610/0x910 [ 37.091685][ T6094] ksys_write+0x15c/0x26c [ 37.092821][ T6094] __arm64_sys_write+0x7c/0x90 [ 37.093971][ T6094] invoke_syscall+0x98/0x2b8 [ 37.095122][ T6094] el0_svc_common+0x130/0x23c [ 37.096249][ T6094] do_el0_svc+0x48/0x58 [ 37.097259][ T6094] el0_svc+0x54/0x158 [ 37.098454][ T6094] el0t_64_sync_handler+0x84/0xfc [ 37.099760][ T6094] el0t_64_sync+0x190/0x194 [ 37.100918][ T6094] [ 37.100918][ T6094] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 37.102692][ T6094] __mutex_lock_common+0x190/0x21a0 [ 37.103942][ T6094] mutex_lock_nested+0x2c/0x38 [ 37.105130][ T6094] vhci_send_frame+0x8c/0x10c [ 37.106327][ T6094] hci_send_frame+0x1c4/0x35c [ 37.107411][ T6094] hci_tx_work+0xba0/0x18e4 [ 37.108558][ T6094] process_one_work+0x694/0x1204 [ 37.109922][ T6094] worker_thread+0x938/0xef4 [ 37.111176][ T6094] kthread+0x288/0x310 [ 37.112261][ T6094] ret_from_fork+0x10/0x20 [ 37.113395][ T6094] [ 37.113395][ T6094] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 37.115575][ T6094] __lock_acquire+0x3384/0x763c [ 37.116854][ T6094] lock_acquire+0x23c/0x71c [ 37.118096][ T6094] __flush_work+0xf8/0x1c0 [ 37.119241][ T6094] flush_work+0x24/0x38 [ 37.120296][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 37.121688][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 37.123010][ T6094] rfkill_set_block+0x18c/0x37c [ 37.124273][ T6094] rfkill_fop_write+0x578/0x734 [ 37.125476][ T6094] vfs_write+0x2a0/0x910 [ 37.126562][ T6094] ksys_write+0x15c/0x26c [ 37.127691][ T6094] __arm64_sys_write+0x7c/0x90 [ 37.128883][ T6094] invoke_syscall+0x98/0x2b8 [ 37.130142][ T6094] el0_svc_common+0x130/0x23c [ 37.131352][ T6094] do_el0_svc+0x48/0x58 [ 37.132356][ T6094] el0_svc+0x54/0x158 [ 37.133414][ T6094] el0t_64_sync_handler+0x84/0xfc [ 37.134646][ T6094] el0t_64_sync+0x190/0x194 [ 37.135817][ T6094] [ 37.135817][ T6094] other info that might help us debug this: [ 37.135817][ T6094] [ 37.138048][ T6094] Chain exists of: [ 37.138048][ T6094] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 37.138048][ T6094] [ 37.141434][ T6094] Possible unsafe locking scenario: [ 37.141434][ T6094] [ 37.143123][ T6094] CPU0 CPU1 [ 37.144378][ T6094] ---- ---- [ 37.145632][ T6094] lock(&hdev->req_lock); [ 37.146644][ T6094] lock(rfkill_global_mutex); [ 37.148373][ T6094] lock(&hdev->req_lock); [ 37.150186][ T6094] lock((work_completion)(&hdev->tx_work)); [ 37.151641][ T6094] [ 37.151641][ T6094] *** DEADLOCK *** [ 37.151641][ T6094] [ 37.153569][ T6094] 2 locks held by syz-executor262/6094: [ 37.154793][ T6094] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 37.157305][ T6094] #1: ffff0000cb9b9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 37.159665][ T6094] [ 37.159665][ T6094] stack backtrace: [ 37.160949][ T6094] CPU: 1 PID: 6094 Comm: syz-executor262 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 37.163194][ T6094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 37.165485][ T6094] Call trace: [ 37.166204][ T6094] dump_backtrace+0x1b8/0x1e4 [ 37.167314][ T6094] show_stack+0x2c/0x3c [ 37.168290][ T6094] dump_stack_lvl+0xd0/0x124 [ 37.169296][ T6094] dump_stack+0x1c/0x28 [ 37.170263][ T6094] print_circular_bug+0x150/0x1b8 [ 37.171393][ T6094] check_noncircular+0x310/0x404 [ 37.172572][ T6094] __lock_acquire+0x3384/0x763c [ 37.173750][ T6094] lock_acquire+0x23c/0x71c [ 37.174872][ T6094] __flush_work+0xf8/0x1c0 [ 37.175833][ T6094] flush_work+0x24/0x38 [ 37.176525][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 37.177355][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 37.178187][ T6094] rfkill_set_block+0x18c/0x37c [ 37.178980][ T6094] rfkill_fop_write+0x578/0x734 [ 37.179783][ T6094] vfs_write+0x2a0/0x910 [ 37.180525][ T6094] ksys_write+0x15c/0x26c [ 37.181452][ T6094] __arm64_sys_write+0x7c/0x90 [ 37.182610][ T6094] invoke_syscall+0x98/0x2b8 [ 37.183733][ T6094] el0_svc_common+0x130/0x23c [ 37.184780][ T6094] do_el0_svc+0x48/0x58 [ 37.185780][ T6094] el0_svc+0x54/0x158 [ 37.186702][ T6094] el0t_64_sync_handler+0x84/0xfc [ 37.187848][ T6094] el0t_64_sync+0x190/0x194