Warning: Permanently added '10.128.1.91' (ED25519) to the list of known hosts. [ 34.545725][ T4226] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.548083][ T4226] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.550286][ T4226] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.552779][ T4226] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.554961][ T4226] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 34.556724][ T4226] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 34.702422][ T4222] [ 34.703069][ T4222] ====================================================== [ 34.704598][ T4222] WARNING: possible circular locking dependency detected [ 34.706089][ T4222] 6.1.60-syzkaller #0 Not tainted [ 34.707180][ T4222] ------------------------------------------------------ [ 34.708694][ T4222] syz-executor477/4222 is trying to acquire lock: [ 34.710031][ T4222] ffff0000cf8c8dc0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 34.712393][ T4222] [ 34.712393][ T4222] but task is already holding lock: [ 34.714077][ T4222] ffff0000cf8c90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.716200][ T4222] [ 34.716200][ T4222] which lock already depends on the new lock. [ 34.716200][ T4222] [ 34.718572][ T4222] [ 34.718572][ T4222] the existing dependency chain (in reverse order) is: [ 34.720764][ T4222] [ 34.720764][ T4222] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 34.722621][ T4222] __mutex_lock_common+0x190/0x21a0 [ 34.723998][ T4222] mutex_lock_nested+0x38/0x44 [ 34.725202][ T4222] hci_rfkill_set_block+0xe8/0x20c [ 34.726496][ T4222] rfkill_set_block+0x18c/0x37c [ 34.727734][ T4222] rfkill_fop_write+0x578/0x734 [ 34.728949][ T4222] vfs_write+0x2a4/0x914 [ 34.729963][ T4222] ksys_write+0x15c/0x26c [ 34.731106][ T4222] __arm64_sys_write+0x7c/0x90 [ 34.732366][ T4222] invoke_syscall+0x98/0x2c0 [ 34.733486][ T4222] el0_svc_common+0x138/0x258 [ 34.734602][ T4222] do_el0_svc+0x64/0x218 [ 34.735686][ T4222] el0_svc+0x58/0x168 [ 34.736718][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 34.737994][ T4222] el0t_64_sync+0x18c/0x190 [ 34.739259][ T4222] [ 34.739259][ T4222] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 34.741158][ T4222] __mutex_lock_common+0x190/0x21a0 [ 34.742474][ T4222] mutex_lock_nested+0x38/0x44 [ 34.743633][ T4222] rfkill_register+0x44/0x7a4 [ 34.744812][ T4222] hci_register_dev+0x3e0/0x954 [ 34.746052][ T4222] vhci_create_device+0x358/0x694 [ 34.747246][ T4222] vhci_write+0x318/0x3b8 [ 34.748362][ T4222] vfs_write+0x610/0x914 [ 34.749407][ T4222] ksys_write+0x15c/0x26c [ 34.750569][ T4222] __arm64_sys_write+0x7c/0x90 [ 34.751853][ T4222] invoke_syscall+0x98/0x2c0 [ 34.753114][ T4222] el0_svc_common+0x138/0x258 [ 34.754270][ T4222] do_el0_svc+0x64/0x218 [ 34.755384][ T4222] el0_svc+0x58/0x168 [ 34.756407][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 34.757697][ T4222] el0t_64_sync+0x18c/0x190 [ 34.758959][ T4222] [ 34.758959][ T4222] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 34.760839][ T4222] __mutex_lock_common+0x190/0x21a0 [ 34.762226][ T4222] mutex_lock_nested+0x38/0x44 [ 34.763484][ T4222] vhci_send_frame+0x8c/0x10c [ 34.764669][ T4222] hci_send_frame+0x1c4/0x35c [ 34.765881][ T4222] hci_tx_work+0xba0/0x18e4 [ 34.767090][ T4222] process_one_work+0x7ac/0x1404 [ 34.768385][ T4222] worker_thread+0x8e4/0xfec [ 34.769620][ T4222] kthread+0x250/0x2d8 [ 34.770640][ T4222] ret_from_fork+0x10/0x20 [ 34.771861][ T4222] [ 34.771861][ T4222] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 34.773974][ T4222] __lock_acquire+0x3338/0x764c [ 34.775233][ T4222] lock_acquire+0x26c/0x7cc [ 34.776387][ T4222] __flush_work+0xf8/0x1c0 [ 34.777483][ T4222] flush_work+0x24/0x38 [ 34.778554][ T4222] hci_dev_close_sync+0x1c8/0xf1c [ 34.779863][ T4222] hci_rfkill_set_block+0xf0/0x20c [ 34.781108][ T4222] rfkill_set_block+0x18c/0x37c [ 34.782357][ T4222] rfkill_fop_write+0x578/0x734 [ 34.783675][ T4222] vfs_write+0x2a4/0x914 [ 34.784725][ T4222] ksys_write+0x15c/0x26c [ 34.785866][ T4222] __arm64_sys_write+0x7c/0x90 [ 34.787060][ T4222] invoke_syscall+0x98/0x2c0 [ 34.788250][ T4222] el0_svc_common+0x138/0x258 [ 34.789468][ T4222] do_el0_svc+0x64/0x218 [ 34.790686][ T4222] el0_svc+0x58/0x168 [ 34.791845][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 34.793204][ T4222] el0t_64_sync+0x18c/0x190 [ 34.794350][ T4222] [ 34.794350][ T4222] other info that might help us debug this: [ 34.794350][ T4222] [ 34.796725][ T4222] Chain exists of: [ 34.796725][ T4222] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 34.796725][ T4222] [ 34.800175][ T4222] Possible unsafe locking scenario: [ 34.800175][ T4222] [ 34.801940][ T4222] CPU0 CPU1 [ 34.803138][ T4222] ---- ---- [ 34.804355][ T4222] lock(&hdev->req_lock); [ 34.805452][ T4222] lock(rfkill_global_mutex); [ 34.807077][ T4222] lock(&hdev->req_lock); [ 34.808647][ T4222] lock((work_completion)(&hdev->tx_work)); [ 34.810092][ T4222] [ 34.810092][ T4222] *** DEADLOCK *** [ 34.810092][ T4222] [ 34.811951][ T4222] 2 locks held by syz-executor477/4222: [ 34.813286][ T4222] #0: ffff80001808ab48 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 34.815098][ T4222] #1: ffff0000cf8c90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.817391][ T4222] [ 34.817391][ T4222] stack backtrace: [ 34.818657][ T4222] CPU: 0 PID: 4222 Comm: syz-executor477 Not tainted 6.1.60-syzkaller #0 [ 34.820551][ T4222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 34.822828][ T4222] Call trace: [ 34.823597][ T4222] dump_backtrace+0x1c8/0x1f4 [ 34.824832][ T4222] show_stack+0x2c/0x3c [ 34.825746][ T4222] dump_stack_lvl+0x108/0x170 [ 34.826757][ T4222] dump_stack+0x1c/0x58 [ 34.827631][ T4222] print_circular_bug+0x150/0x1b8 [ 34.828892][ T4222] check_noncircular+0x2cc/0x378 [ 34.830064][ T4222] __lock_acquire+0x3338/0x764c [ 34.831191][ T4222] lock_acquire+0x26c/0x7cc [ 34.832230][ T4222] __flush_work+0xf8/0x1c0 [ 34.833267][ T4222] flush_work+0x24/0x38 [ 34.834230][ T4222] hci_dev_close_sync+0x1c8/0xf1c [ 34.835394][ T4222] hci_rfkill_set_block+0xf0/0x20c [ 34.836545][ T4222] rfkill_set_block+0x18c/0x37c [ 34.837659][ T4222] rfkill_fop_write+0x578/0x734 [ 34.838746][ T4222] vfs_write+0x2a4/0x914 [ 34.839750][ T4222] ksys_write+0x15c/0x26c [ 34.840769][ T4222] __arm64_sys_write+0x7c/0x90 [ 34.841821][ T4222] invoke_syscall+0x98/0x2c0 [ 34.842908][ T4222] el0_svc_common+0x138/0x258 [ 34.843903][ T4222] do_el0_svc+0x64/0x218 [ 34.844874][ T4222] el0_svc+0x58/0x168 [ 34.845879][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 34.847082][ T4222] el0t_64_sync+0x18c/0x190