Warning: Permanently added '10.128.0.108' (ED25519) to the list of known hosts. [ 35.837535][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.839771][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.841760][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.843754][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.845892][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 35.848159][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 36.002792][ T6093] [ 36.003332][ T6093] ====================================================== [ 36.004863][ T6093] WARNING: possible circular locking dependency detected [ 36.006501][ T6093] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 36.008017][ T6093] ------------------------------------------------------ [ 36.009621][ T6093] syz-executor254/6093 is trying to acquire lock: [ 36.011068][ T6093] ffff0000d0918e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 36.013565][ T6093] [ 36.013565][ T6093] but task is already holding lock: [ 36.015314][ T6093] ffff0000d0919108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 36.017524][ T6093] [ 36.017524][ T6093] which lock already depends on the new lock. [ 36.017524][ T6093] [ 36.019973][ T6093] [ 36.019973][ T6093] the existing dependency chain (in reverse order) is: [ 36.022168][ T6093] [ 36.022168][ T6093] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 36.024032][ T6093] __mutex_lock_common+0x190/0x21a0 [ 36.025534][ T6093] mutex_lock_nested+0x2c/0x38 [ 36.026790][ T6093] hci_rfkill_set_block+0xe8/0x20c [ 36.028099][ T6093] rfkill_set_block+0x18c/0x37c [ 36.029432][ T6093] rfkill_fop_write+0x578/0x734 [ 36.030598][ T6093] vfs_write+0x2a0/0x910 [ 36.031830][ T6093] ksys_write+0x15c/0x26c [ 36.032710][ T6093] __arm64_sys_write+0x7c/0x90 [ 36.033955][ T6093] invoke_syscall+0x98/0x2b8 [ 36.035229][ T6093] el0_svc_common+0x130/0x23c [ 36.036553][ T6093] do_el0_svc+0x48/0x58 [ 36.037777][ T6093] el0_svc+0x54/0x158 [ 36.038912][ T6093] el0t_64_sync_handler+0x84/0xfc [ 36.040147][ T6093] el0t_64_sync+0x190/0x194 [ 36.041455][ T6093] [ 36.041455][ T6093] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 36.043232][ T6093] __mutex_lock_common+0x190/0x21a0 [ 36.044680][ T6093] mutex_lock_nested+0x2c/0x38 [ 36.045868][ T6093] rfkill_register+0x44/0x7d4 [ 36.047024][ T6093] hci_register_dev+0x3e0/0x954 [ 36.048258][ T6093] vhci_create_device+0x358/0x6c4 [ 36.049526][ T6093] vhci_write+0x318/0x3b8 [ 36.050640][ T6093] vfs_write+0x610/0x910 [ 36.052017][ T6093] ksys_write+0x15c/0x26c [ 36.052990][ T6093] __arm64_sys_write+0x7c/0x90 [ 36.054268][ T6093] invoke_syscall+0x98/0x2b8 [ 36.055477][ T6093] el0_svc_common+0x130/0x23c [ 36.056631][ T6093] do_el0_svc+0x48/0x58 [ 36.057656][ T6093] el0_svc+0x54/0x158 [ 36.058903][ T6093] el0t_64_sync_handler+0x84/0xfc [ 36.060244][ T6093] el0t_64_sync+0x190/0x194 [ 36.061623][ T6093] [ 36.061623][ T6093] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 36.063481][ T6093] __mutex_lock_common+0x190/0x21a0 [ 36.064834][ T6093] mutex_lock_nested+0x2c/0x38 [ 36.066233][ T6093] vhci_send_frame+0x8c/0x10c [ 36.067439][ T6093] hci_send_frame+0x1c4/0x35c [ 36.068658][ T6093] hci_tx_work+0xba0/0x18e4 [ 36.069843][ T6093] process_one_work+0x694/0x1204 [ 36.071069][ T6093] worker_thread+0x938/0xef4 [ 36.072169][ T6093] kthread+0x288/0x310 [ 36.073222][ T6093] ret_from_fork+0x10/0x20 [ 36.074340][ T6093] [ 36.074340][ T6093] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 36.076555][ T6093] __lock_acquire+0x3384/0x763c [ 36.077839][ T6093] lock_acquire+0x23c/0x71c [ 36.078979][ T6093] __flush_work+0xf8/0x1c0 [ 36.080318][ T6093] flush_work+0x24/0x38 [ 36.081320][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 36.082476][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 36.083751][ T6093] rfkill_set_block+0x18c/0x37c [ 36.085044][ T6093] rfkill_fop_write+0x578/0x734 [ 36.086448][ T6093] vfs_write+0x2a0/0x910 [ 36.087558][ T6093] ksys_write+0x15c/0x26c [ 36.088570][ T6093] __arm64_sys_write+0x7c/0x90 [ 36.089766][ T6093] invoke_syscall+0x98/0x2b8 [ 36.090914][ T6093] el0_svc_common+0x130/0x23c [ 36.091902][ T6093] do_el0_svc+0x48/0x58 [ 36.092718][ T6093] el0_svc+0x54/0x158 [ 36.093982][ T6093] el0t_64_sync_handler+0x84/0xfc [ 36.095365][ T6093] el0t_64_sync+0x190/0x194 [ 36.096609][ T6093] [ 36.096609][ T6093] other info that might help us debug this: [ 36.096609][ T6093] [ 36.098963][ T6093] Chain exists of: [ 36.098963][ T6093] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 36.098963][ T6093] [ 36.102642][ T6093] Possible unsafe locking scenario: [ 36.102642][ T6093] [ 36.104456][ T6093] CPU0 CPU1 [ 36.105624][ T6093] ---- ---- [ 36.107010][ T6093] lock(&hdev->req_lock); [ 36.108170][ T6093] lock(rfkill_global_mutex); [ 36.109841][ T6093] lock(&hdev->req_lock); [ 36.111295][ T6093] lock((work_completion)(&hdev->tx_work)); [ 36.112688][ T6093] [ 36.112688][ T6093] *** DEADLOCK *** [ 36.112688][ T6093] [ 36.114832][ T6093] 2 locks held by syz-executor254/6093: [ 36.116086][ T6093] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 36.118493][ T6093] #1: ffff0000d0919108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 36.120956][ T6093] [ 36.120956][ T6093] stack backtrace: [ 36.122294][ T6093] CPU: 1 PID: 6093 Comm: syz-executor254 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 36.124560][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 36.126988][ T6093] Call trace: [ 36.127907][ T6093] dump_backtrace+0x1b8/0x1e4 [ 36.128985][ T6093] show_stack+0x2c/0x3c [ 36.129890][ T6093] dump_stack_lvl+0xd0/0x124 [ 36.130942][ T6093] dump_stack+0x1c/0x28 [ 36.131931][ T6093] print_circular_bug+0x150/0x1b8 [ 36.133175][ T6093] check_noncircular+0x310/0x404 [ 36.134502][ T6093] __lock_acquire+0x3384/0x763c [ 36.135684][ T6093] lock_acquire+0x23c/0x71c [ 36.136718][ T6093] __flush_work+0xf8/0x1c0 [ 36.137733][ T6093] flush_work+0x24/0x38 [ 36.138673][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 36.139868][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 36.141130][ T6093] rfkill_set_block+0x18c/0x37c [ 36.142290][ T6093] rfkill_fop_write+0x578/0x734 [ 36.143356][ T6093] vfs_write+0x2a0/0x910 [ 36.144359][ T6093] ksys_write+0x15c/0x26c [ 36.145431][ T6093] __arm64_sys_write+0x7c/0x90 [ 36.146487][ T6093] invoke_syscall+0x98/0x2b8 [ 36.147619][ T6093] el0_svc_common+0x130/0x23c [ 36.148806][ T6093] do_el0_svc+0x48/0x58 [ 36.149737][ T6093] el0_svc+0x54/0x158 [ 36.150718][ T6093] el0t_64_sync_handler+0x84/0xfc [ 36.151942][ T6093] el0t_64_sync+0x190/0x194