Warning: Permanently added '10.128.1.29' (ED25519) to the list of known hosts. executing program [ 44.137421][ T4018] [ 44.138070][ T4018] ====================================================== [ 44.139776][ T4018] WARNING: possible circular locking dependency detected [ 44.141564][ T4018] 5.15.164-syzkaller #0 Not tainted [ 44.142868][ T4018] ------------------------------------------------------ [ 44.144675][ T4018] syz-executor333/4018 is trying to acquire lock: [ 44.146273][ T4018] ffff0000ca73cb98 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 44.148866][ T4018] [ 44.148866][ T4018] but task is already holding lock: [ 44.150675][ T4018] ffff0000ca73cff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 44.153063][ T4018] [ 44.153063][ T4018] which lock already depends on the new lock. [ 44.153063][ T4018] [ 44.155645][ T4018] [ 44.155645][ T4018] the existing dependency chain (in reverse order) is: [ 44.157846][ T4018] [ 44.157846][ T4018] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 44.159824][ T4018] __mutex_lock_common+0x194/0x2154 [ 44.161340][ T4018] mutex_lock_nested+0xa4/0xf8 [ 44.162684][ T4018] hci_dev_do_close+0x64/0x1060 [ 44.164002][ T4018] hci_rfkill_set_block+0xdc/0x1d0 [ 44.165498][ T4018] rfkill_set_block+0x18c/0x37c [ 44.166840][ T4018] rfkill_fop_write+0x594/0x750 [ 44.168155][ T4018] vfs_write+0x280/0xb44 [ 44.169342][ T4018] ksys_write+0x15c/0x26c [ 44.170529][ T4018] __arm64_sys_write+0x7c/0x90 [ 44.171844][ T4018] invoke_syscall+0x98/0x2b8 [ 44.173116][ T4018] el0_svc_common+0x138/0x258 [ 44.174460][ T4018] do_el0_svc+0x58/0x14c [ 44.175713][ T4018] el0_svc+0x7c/0x1f0 [ 44.176842][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 44.178185][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 44.179430][ T4018] [ 44.179430][ T4018] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 44.181444][ T4018] __mutex_lock_common+0x194/0x2154 [ 44.182869][ T4018] mutex_lock_nested+0xa4/0xf8 [ 44.184198][ T4018] rfkill_register+0x44/0x7a4 [ 44.185479][ T4018] hci_register_dev+0x3e0/0x880 [ 44.186841][ T4018] vhci_create_device+0x2c4/0x568 [ 44.188206][ T4018] vhci_write+0x318/0x3b8 [ 44.189410][ T4018] vfs_write+0x884/0xb44 [ 44.190639][ T4018] ksys_write+0x15c/0x26c [ 44.191840][ T4018] __arm64_sys_write+0x7c/0x90 [ 44.193231][ T4018] invoke_syscall+0x98/0x2b8 [ 44.194521][ T4018] el0_svc_common+0x138/0x258 [ 44.195850][ T4018] do_el0_svc+0x58/0x14c [ 44.197049][ T4018] el0_svc+0x7c/0x1f0 [ 44.198201][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 44.199595][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 44.200850][ T4018] [ 44.200850][ T4018] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 44.202879][ T4018] __mutex_lock_common+0x194/0x2154 [ 44.204320][ T4018] mutex_lock_nested+0xa4/0xf8 [ 44.205628][ T4018] vhci_send_frame+0x8c/0x10c [ 44.206963][ T4018] hci_send_frame+0x194/0x2f0 [ 44.208241][ T4018] hci_tx_work+0x8d8/0x157c [ 44.209472][ T4018] process_one_work+0x790/0x11b8 [ 44.210876][ T4018] worker_thread+0x910/0x1034 [ 44.212157][ T4018] kthread+0x37c/0x45c [ 44.213326][ T4018] ret_from_fork+0x10/0x20 [ 44.214563][ T4018] [ 44.214563][ T4018] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 44.216926][ T4018] __lock_acquire+0x32d4/0x7638 [ 44.218245][ T4018] lock_acquire+0x240/0x77c [ 44.219509][ T4018] __flush_work+0xf8/0x1c0 [ 44.220782][ T4018] flush_work+0x24/0x38 [ 44.221945][ T4018] hci_dev_do_close+0x16c/0x1060 [ 44.223264][ T4018] hci_rfkill_set_block+0xdc/0x1d0 [ 44.224694][ T4018] rfkill_set_block+0x18c/0x37c [ 44.226043][ T4018] rfkill_fop_write+0x594/0x750 [ 44.227438][ T4018] vfs_write+0x280/0xb44 [ 44.228639][ T4018] ksys_write+0x15c/0x26c [ 44.229906][ T4018] __arm64_sys_write+0x7c/0x90 [ 44.231203][ T4018] invoke_syscall+0x98/0x2b8 [ 44.232445][ T4018] el0_svc_common+0x138/0x258 [ 44.233733][ T4018] do_el0_svc+0x58/0x14c [ 44.234906][ T4018] el0_svc+0x7c/0x1f0 [ 44.236074][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 44.237504][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 44.238768][ T4018] [ 44.238768][ T4018] other info that might help us debug this: [ 44.238768][ T4018] [ 44.241318][ T4018] Chain exists of: [ 44.241318][ T4018] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 44.241318][ T4018] [ 44.245157][ T4018] Possible unsafe locking scenario: [ 44.245157][ T4018] [ 44.247019][ T4018] CPU0 CPU1 [ 44.248346][ T4018] ---- ---- [ 44.249697][ T4018] lock(&hdev->req_lock); [ 44.250778][ T4018] lock(rfkill_global_mutex); [ 44.252592][ T4018] lock(&hdev->req_lock); [ 44.254358][ T4018] lock((work_completion)(&hdev->tx_work)); [ 44.255848][ T4018] [ 44.255848][ T4018] *** DEADLOCK *** [ 44.255848][ T4018] [ 44.257955][ T4018] 2 locks held by syz-executor333/4018: [ 44.259369][ T4018] #0: ffff800016e77788 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x250/0x750 [ 44.261937][ T4018] #1: ffff0000ca73cff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 44.264411][ T4018] [ 44.264411][ T4018] stack backtrace: [ 44.265944][ T4018] CPU: 1 PID: 4018 Comm: syz-executor333 Not tainted 5.15.164-syzkaller #0 [ 44.268078][ T4018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 44.270636][ T4018] Call trace: [ 44.271457][ T4018] dump_backtrace+0x0/0x530 [ 44.272584][ T4018] show_stack+0x2c/0x3c [ 44.273626][ T4018] dump_stack_lvl+0x108/0x170 [ 44.274851][ T4018] dump_stack+0x1c/0x58 [ 44.275890][ T4018] print_circular_bug+0x150/0x1b8 [ 44.277136][ T4018] check_noncircular+0x2cc/0x378 [ 44.278380][ T4018] __lock_acquire+0x32d4/0x7638 [ 44.279647][ T4018] lock_acquire+0x240/0x77c [ 44.280794][ T4018] __flush_work+0xf8/0x1c0 [ 44.281903][ T4018] flush_work+0x24/0x38 [ 44.282935][ T4018] hci_dev_do_close+0x16c/0x1060 [ 44.284172][ T4018] hci_rfkill_set_block+0xdc/0x1d0 [ 44.285484][ T4018] rfkill_set_block+0x18c/0x37c [ 44.286762][ T4018] rfkill_fop_write+0x594/0x750 [ 44.288033][ T4018] vfs_write+0x280/0xb44 [ 44.289081][ T4018] ksys_write+0x15c/0x26c [ 44.290253][ T4018] __arm64_sys_write+0x7c/0x90 [ 44.291502][ T4018] invoke_syscall+0x98/0x2b8 [ 44.292691][ T4018] el0_svc_common+0x138/0x258 [ 44.293931][ T4018] do_el0_svc+0x58/0x14c [ 44.295045][ T4018] el0_svc+0x7c/0x1f0 [ 44.296041][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 44.297297][ T4018] el0t_64_sync+0x1a0/0x1a4