Warning: Permanently added '10.128.0.128' (ED25519) to the list of known hosts. [ 33.125716][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.127967][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.130618][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.132991][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.135126][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 33.136994][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 33.276756][ T6104] [ 33.277306][ T6104] ====================================================== [ 33.278965][ T6104] WARNING: possible circular locking dependency detected [ 33.280711][ T6104] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 33.282273][ T6104] ------------------------------------------------------ [ 33.284025][ T6104] syz-executor388/6104 is trying to acquire lock: [ 33.285626][ T6104] ffff0000d03f8e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 33.288294][ T6104] [ 33.288294][ T6104] but task is already holding lock: [ 33.290035][ T6104] ffff0000d03f9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.292401][ T6104] [ 33.292401][ T6104] which lock already depends on the new lock. [ 33.292401][ T6104] [ 33.294971][ T6104] [ 33.294971][ T6104] the existing dependency chain (in reverse order) is: [ 33.297163][ T6104] [ 33.297163][ T6104] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 33.299092][ T6104] __mutex_lock_common+0x190/0x21a0 [ 33.300464][ T6104] mutex_lock_nested+0x2c/0x38 [ 33.301758][ T6104] hci_rfkill_set_block+0xe8/0x20c [ 33.303217][ T6104] rfkill_set_block+0x18c/0x37c [ 33.304499][ T6104] rfkill_fop_write+0x578/0x734 [ 33.305785][ T6104] vfs_write+0x2a0/0x910 [ 33.306975][ T6104] ksys_write+0x15c/0x26c [ 33.308125][ T6104] __arm64_sys_write+0x7c/0x90 [ 33.309473][ T6104] invoke_syscall+0x98/0x2b8 [ 33.310821][ T6104] el0_svc_common+0x130/0x23c [ 33.312157][ T6104] do_el0_svc+0x48/0x58 [ 33.313279][ T6104] el0_svc+0x54/0x158 [ 33.314377][ T6104] el0t_64_sync_handler+0x84/0xfc [ 33.315801][ T6104] el0t_64_sync+0x190/0x194 [ 33.317029][ T6104] [ 33.317029][ T6104] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 33.318994][ T6104] __mutex_lock_common+0x190/0x21a0 [ 33.320391][ T6104] mutex_lock_nested+0x2c/0x38 [ 33.321685][ T6104] rfkill_register+0x44/0x7d4 [ 33.323019][ T6104] hci_register_dev+0x3e0/0x954 [ 33.324345][ T6104] vhci_create_device+0x358/0x6c4 [ 33.325820][ T6104] vhci_write+0x318/0x3b8 [ 33.327078][ T6104] vfs_write+0x610/0x910 [ 33.328251][ T6104] ksys_write+0x15c/0x26c [ 33.329490][ T6104] __arm64_sys_write+0x7c/0x90 [ 33.330792][ T6104] invoke_syscall+0x98/0x2b8 [ 33.332024][ T6104] el0_svc_common+0x130/0x23c [ 33.333298][ T6104] do_el0_svc+0x48/0x58 [ 33.334405][ T6104] el0_svc+0x54/0x158 [ 33.335535][ T6104] el0t_64_sync_handler+0x84/0xfc [ 33.336970][ T6104] el0t_64_sync+0x190/0x194 [ 33.338237][ T6104] [ 33.338237][ T6104] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 33.340245][ T6104] __mutex_lock_common+0x190/0x21a0 [ 33.341698][ T6104] mutex_lock_nested+0x2c/0x38 [ 33.343000][ T6104] vhci_send_frame+0x8c/0x10c [ 33.344390][ T6104] hci_send_frame+0x1c4/0x35c [ 33.345729][ T6104] hci_tx_work+0xba0/0x18e4 [ 33.346996][ T6104] process_one_work+0x694/0x1204 [ 33.348362][ T6104] worker_thread+0x938/0xef4 [ 33.349572][ T6104] kthread+0x288/0x310 [ 33.350695][ T6104] ret_from_fork+0x10/0x20 [ 33.351914][ T6104] [ 33.351914][ T6104] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 33.354195][ T6104] __lock_acquire+0x3384/0x763c [ 33.355508][ T6104] lock_acquire+0x23c/0x71c [ 33.356714][ T6104] __flush_work+0xf8/0x1c0 [ 33.357971][ T6104] flush_work+0x24/0x38 [ 33.359194][ T6104] hci_dev_close_sync+0x1c8/0xf30 [ 33.360571][ T6104] hci_rfkill_set_block+0xf0/0x20c [ 33.362015][ T6104] rfkill_set_block+0x18c/0x37c [ 33.363324][ T6104] rfkill_fop_write+0x578/0x734 [ 33.364400][ T6104] vfs_write+0x2a0/0x910 [ 33.365232][ T6104] ksys_write+0x15c/0x26c [ 33.366080][ T6104] __arm64_sys_write+0x7c/0x90 [ 33.367001][ T6104] invoke_syscall+0x98/0x2b8 [ 33.367892][ T6104] el0_svc_common+0x130/0x23c [ 33.368795][ T6104] do_el0_svc+0x48/0x58 [ 33.369968][ T6104] el0_svc+0x54/0x158 [ 33.371068][ T6104] el0t_64_sync_handler+0x84/0xfc [ 33.372398][ T6104] el0t_64_sync+0x190/0x194 [ 33.373706][ T6104] [ 33.373706][ T6104] other info that might help us debug this: [ 33.373706][ T6104] [ 33.376215][ T6104] Chain exists of: [ 33.376215][ T6104] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 33.376215][ T6104] [ 33.379894][ T6104] Possible unsafe locking scenario: [ 33.379894][ T6104] [ 33.381759][ T6104] CPU0 CPU1 [ 33.383125][ T6104] ---- ---- [ 33.384469][ T6104] lock(&hdev->req_lock); [ 33.385553][ T6104] lock(rfkill_global_mutex); [ 33.387400][ T6104] lock(&hdev->req_lock); [ 33.389161][ T6104] lock((work_completion)(&hdev->tx_work)); [ 33.390625][ T6104] [ 33.390625][ T6104] *** DEADLOCK *** [ 33.390625][ T6104] [ 33.392654][ T6104] 2 locks held by syz-executor388/6104: [ 33.394069][ T6104] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 33.396639][ T6104] #1: ffff0000d03f9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.399044][ T6104] [ 33.399044][ T6104] stack backtrace: [ 33.400597][ T6104] CPU: 0 PID: 6104 Comm: syz-executor388 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 33.402982][ T6104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 33.405503][ T6104] Call trace: [ 33.406291][ T6104] dump_backtrace+0x1b8/0x1e4 [ 33.407433][ T6104] show_stack+0x2c/0x3c [ 33.408546][ T6104] dump_stack_lvl+0xd0/0x124 [ 33.409722][ T6104] dump_stack+0x1c/0x28 [ 33.410742][ T6104] print_circular_bug+0x150/0x1b8 [ 33.411966][ T6104] check_noncircular+0x310/0x404 [ 33.413257][ T6104] __lock_acquire+0x3384/0x763c [ 33.414413][ T6104] lock_acquire+0x23c/0x71c [ 33.415549][ T6104] __flush_work+0xf8/0x1c0 [ 33.416649][ T6104] flush_work+0x24/0x38 [ 33.417682][ T6104] hci_dev_close_sync+0x1c8/0xf30 [ 33.418917][ T6104] hci_rfkill_set_block+0xf0/0x20c [ 33.420188][ T6104] rfkill_set_block+0x18c/0x37c [ 33.421387][ T6104] rfkill_fop_write+0x578/0x734 [ 33.422596][ T6104] vfs_write+0x2a0/0x910 [ 33.423692][ T6104] ksys_write+0x15c/0x26c [ 33.424863][ T6104] __arm64_sys_write+0x7c/0x90 [ 33.426051][ T6104] invoke_syscall+0x98/0x2b8 [ 33.427262][ T6104] el0_svc_common+0x130/0x23c [ 33.428474][ T6104] do_el0_svc+0x48/0x58 [ 33.429492][ T6104] el0_svc+0x54/0x158 [ 33.430524][ T6104] el0t_64_sync_handler+0x84/0xfc [ 33.431825][ T6104] el0t_64_sync+0x190/0x194