Warning: Permanently added '10.128.1.125' (ED25519) to the list of known hosts. [ 34.139240][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.141479][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.143601][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.145928][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.148003][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 34.149984][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 34.300544][ T6094] [ 34.301062][ T6094] ====================================================== [ 34.302696][ T6094] WARNING: possible circular locking dependency detected [ 34.304320][ T6094] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 34.305861][ T6094] ------------------------------------------------------ [ 34.307537][ T6094] syz-executor419/6094 is trying to acquire lock: [ 34.308862][ T6094] ffff0000d95d4e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 34.311270][ T6094] [ 34.311270][ T6094] but task is already holding lock: [ 34.313009][ T6094] ffff0000d95d5108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.315409][ T6094] [ 34.315409][ T6094] which lock already depends on the new lock. [ 34.315409][ T6094] [ 34.317984][ T6094] [ 34.317984][ T6094] the existing dependency chain (in reverse order) is: [ 34.320121][ T6094] [ 34.320121][ T6094] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 34.321954][ T6094] __mutex_lock_common+0x190/0x21a0 [ 34.323351][ T6094] mutex_lock_nested+0x2c/0x38 [ 34.324664][ T6094] hci_rfkill_set_block+0xe8/0x20c [ 34.325960][ T6094] rfkill_set_block+0x18c/0x37c [ 34.327324][ T6094] rfkill_fop_write+0x578/0x734 [ 34.328638][ T6094] vfs_write+0x2a0/0x910 [ 34.329797][ T6094] ksys_write+0x15c/0x26c [ 34.331096][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.332532][ T6094] invoke_syscall+0x98/0x2b8 [ 34.333925][ T6094] el0_svc_common+0x130/0x23c [ 34.335337][ T6094] do_el0_svc+0x48/0x58 [ 34.336605][ T6094] el0_svc+0x54/0x158 [ 34.337636][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.338969][ T6094] el0t_64_sync+0x190/0x194 [ 34.340278][ T6094] [ 34.340278][ T6094] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 34.342304][ T6094] __mutex_lock_common+0x190/0x21a0 [ 34.343762][ T6094] mutex_lock_nested+0x2c/0x38 [ 34.345095][ T6094] rfkill_register+0x44/0x7d4 [ 34.346441][ T6094] hci_register_dev+0x3e0/0x954 [ 34.347733][ T6094] vhci_create_device+0x358/0x6c4 [ 34.349101][ T6094] vhci_write+0x318/0x3b8 [ 34.350330][ T6094] vfs_write+0x610/0x910 [ 34.351520][ T6094] ksys_write+0x15c/0x26c [ 34.352769][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.354146][ T6094] invoke_syscall+0x98/0x2b8 [ 34.355428][ T6094] el0_svc_common+0x130/0x23c [ 34.356701][ T6094] do_el0_svc+0x48/0x58 [ 34.357857][ T6094] el0_svc+0x54/0x158 [ 34.359016][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.360457][ T6094] el0t_64_sync+0x190/0x194 [ 34.361796][ T6094] [ 34.361796][ T6094] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 34.363820][ T6094] __mutex_lock_common+0x190/0x21a0 [ 34.365232][ T6094] mutex_lock_nested+0x2c/0x38 [ 34.366473][ T6094] vhci_send_frame+0x8c/0x10c [ 34.367802][ T6094] hci_send_frame+0x1c4/0x35c [ 34.369098][ T6094] hci_tx_work+0xba0/0x18e4 [ 34.370386][ T6094] process_one_work+0x694/0x1204 [ 34.371796][ T6094] worker_thread+0x938/0xef4 [ 34.373136][ T6094] kthread+0x288/0x310 [ 34.374334][ T6094] ret_from_fork+0x10/0x20 [ 34.375434][ T6094] [ 34.375434][ T6094] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 34.377856][ T6094] __lock_acquire+0x3384/0x763c [ 34.379223][ T6094] lock_acquire+0x23c/0x71c [ 34.380543][ T6094] __flush_work+0xf8/0x1c0 [ 34.381826][ T6094] flush_work+0x24/0x38 [ 34.383172][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 34.384463][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 34.385892][ T6094] rfkill_set_block+0x18c/0x37c [ 34.387270][ T6094] rfkill_fop_write+0x578/0x734 [ 34.388670][ T6094] vfs_write+0x2a0/0x910 [ 34.389882][ T6094] ksys_write+0x15c/0x26c [ 34.391115][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.392490][ T6094] invoke_syscall+0x98/0x2b8 [ 34.393769][ T6094] el0_svc_common+0x130/0x23c [ 34.395121][ T6094] do_el0_svc+0x48/0x58 [ 34.396309][ T6094] el0_svc+0x54/0x158 [ 34.397481][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.398874][ T6094] el0t_64_sync+0x190/0x194 [ 34.400170][ T6094] [ 34.400170][ T6094] other info that might help us debug this: [ 34.400170][ T6094] [ 34.402760][ T6094] Chain exists of: [ 34.402760][ T6094] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 34.402760][ T6094] [ 34.406588][ T6094] Possible unsafe locking scenario: [ 34.406588][ T6094] [ 34.408474][ T6094] CPU0 CPU1 [ 34.409772][ T6094] ---- ---- [ 34.411078][ T6094] lock(&hdev->req_lock); [ 34.412168][ T6094] lock(rfkill_global_mutex); [ 34.413985][ T6094] lock(&hdev->req_lock); [ 34.415773][ T6094] lock((work_completion)(&hdev->tx_work)); [ 34.417289][ T6094] [ 34.417289][ T6094] *** DEADLOCK *** [ 34.417289][ T6094] [ 34.419275][ T6094] 2 locks held by syz-executor419/6094: [ 34.420487][ T6094] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 34.423080][ T6094] #1: ffff0000d95d5108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.425645][ T6094] [ 34.425645][ T6094] stack backtrace: [ 34.427166][ T6094] CPU: 0 PID: 6094 Comm: syz-executor419 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 34.429601][ T6094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 34.432248][ T6094] Call trace: [ 34.433078][ T6094] dump_backtrace+0x1b8/0x1e4 [ 34.434291][ T6094] show_stack+0x2c/0x3c [ 34.435361][ T6094] dump_stack_lvl+0xd0/0x124 [ 34.436512][ T6094] dump_stack+0x1c/0x28 [ 34.437473][ T6094] print_circular_bug+0x150/0x1b8 [ 34.438810][ T6094] check_noncircular+0x310/0x404 [ 34.440069][ T6094] __lock_acquire+0x3384/0x763c [ 34.441299][ T6094] lock_acquire+0x23c/0x71c [ 34.442436][ T6094] __flush_work+0xf8/0x1c0 [ 34.443553][ T6094] flush_work+0x24/0x38 [ 34.444599][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 34.445802][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 34.447033][ T6094] rfkill_set_block+0x18c/0x37c [ 34.448286][ T6094] rfkill_fop_write+0x578/0x734 [ 34.449538][ T6094] vfs_write+0x2a0/0x910 [ 34.450609][ T6094] ksys_write+0x15c/0x26c [ 34.451711][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.452922][ T6094] invoke_syscall+0x98/0x2b8 [ 34.454098][ T6094] el0_svc_common+0x130/0x23c [ 34.455270][ T6094] do_el0_svc+0x48/0x58 [ 34.456251][ T6094] el0_svc+0x54/0x158 [ 34.457309][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.458555][ T6094] el0t_64_sync+0x190/0x194