Warning: Permanently added '10.128.1.106' (ED25519) to the list of known hosts. [ 35.652645][ T6094] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.654966][ T6094] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.657055][ T6094] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.659634][ T6094] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.661835][ T6094] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 35.663831][ T6094] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 35.824200][ T6093] [ 35.824822][ T6093] ====================================================== [ 35.826514][ T6093] WARNING: possible circular locking dependency detected [ 35.828217][ T6093] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 35.829819][ T6093] ------------------------------------------------------ [ 35.831711][ T6093] syz-executor421/6093 is trying to acquire lock: [ 35.833486][ T6093] ffff0000cfbe8e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 35.836291][ T6093] [ 35.836291][ T6093] but task is already holding lock: [ 35.838133][ T6093] ffff0000cfbe9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.840669][ T6093] [ 35.840669][ T6093] which lock already depends on the new lock. [ 35.840669][ T6093] [ 35.843295][ T6093] [ 35.843295][ T6093] the existing dependency chain (in reverse order) is: [ 35.845643][ T6093] [ 35.845643][ T6093] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 35.847647][ T6093] __mutex_lock_common+0x190/0x21a0 [ 35.849147][ T6093] mutex_lock_nested+0x2c/0x38 [ 35.850563][ T6093] hci_rfkill_set_block+0xe8/0x20c [ 35.852058][ T6093] rfkill_set_block+0x18c/0x37c [ 35.853482][ T6093] rfkill_fop_write+0x578/0x734 [ 35.854898][ T6093] vfs_write+0x2a0/0x910 [ 35.856115][ T6093] ksys_write+0x15c/0x26c [ 35.857312][ T6093] __arm64_sys_write+0x7c/0x90 [ 35.858583][ T6093] invoke_syscall+0x98/0x2b8 [ 35.859876][ T6093] el0_svc_common+0x130/0x23c [ 35.861107][ T6093] do_el0_svc+0x48/0x58 [ 35.862278][ T6093] el0_svc+0x54/0x158 [ 35.863365][ T6093] el0t_64_sync_handler+0x84/0xfc [ 35.864613][ T6093] el0t_64_sync+0x190/0x194 [ 35.865803][ T6093] [ 35.865803][ T6093] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 35.867823][ T6093] __mutex_lock_common+0x190/0x21a0 [ 35.869197][ T6093] mutex_lock_nested+0x2c/0x38 [ 35.870491][ T6093] rfkill_register+0x44/0x7d4 [ 35.871812][ T6093] hci_register_dev+0x3e0/0x954 [ 35.873048][ T6093] vhci_create_device+0x358/0x6c4 [ 35.874401][ T6093] vhci_write+0x318/0x3b8 [ 35.875564][ T6093] vfs_write+0x610/0x910 [ 35.876708][ T6093] ksys_write+0x15c/0x26c [ 35.877842][ T6093] __arm64_sys_write+0x7c/0x90 [ 35.879147][ T6093] invoke_syscall+0x98/0x2b8 [ 35.880346][ T6093] el0_svc_common+0x130/0x23c [ 35.881694][ T6093] do_el0_svc+0x48/0x58 [ 35.882914][ T6093] el0_svc+0x54/0x158 [ 35.883993][ T6093] el0t_64_sync_handler+0x84/0xfc [ 35.885433][ T6093] el0t_64_sync+0x190/0x194 [ 35.886626][ T6093] [ 35.886626][ T6093] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 35.888564][ T6093] __mutex_lock_common+0x190/0x21a0 [ 35.889888][ T6093] mutex_lock_nested+0x2c/0x38 [ 35.891268][ T6093] vhci_send_frame+0x8c/0x10c [ 35.892560][ T6093] hci_send_frame+0x1c4/0x35c [ 35.893890][ T6093] hci_tx_work+0xba0/0x18e4 [ 35.895137][ T6093] process_one_work+0x694/0x1204 [ 35.896453][ T6093] worker_thread+0x938/0xef4 [ 35.897694][ T6093] kthread+0x288/0x310 [ 35.898740][ T6093] ret_from_fork+0x10/0x20 [ 35.899918][ T6093] [ 35.899918][ T6093] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 35.902165][ T6093] __lock_acquire+0x3384/0x763c [ 35.903440][ T6093] lock_acquire+0x23c/0x71c [ 35.904726][ T6093] __flush_work+0xf8/0x1c0 [ 35.905971][ T6093] flush_work+0x24/0x38 [ 35.907084][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 35.908400][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 35.909923][ T6093] rfkill_set_block+0x18c/0x37c [ 35.911290][ T6093] rfkill_fop_write+0x578/0x734 [ 35.912656][ T6093] vfs_write+0x2a0/0x910 [ 35.913851][ T6093] ksys_write+0x15c/0x26c [ 35.915058][ T6093] __arm64_sys_write+0x7c/0x90 [ 35.916400][ T6093] invoke_syscall+0x98/0x2b8 [ 35.917716][ T6093] el0_svc_common+0x130/0x23c [ 35.919024][ T6093] do_el0_svc+0x48/0x58 [ 35.920128][ T6093] el0_svc+0x54/0x158 [ 35.921318][ T6093] el0t_64_sync_handler+0x84/0xfc [ 35.922701][ T6093] el0t_64_sync+0x190/0x194 [ 35.923929][ T6093] [ 35.923929][ T6093] other info that might help us debug this: [ 35.923929][ T6093] [ 35.926440][ T6093] Chain exists of: [ 35.926440][ T6093] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 35.926440][ T6093] [ 35.930244][ T6093] Possible unsafe locking scenario: [ 35.930244][ T6093] [ 35.932019][ T6093] CPU0 CPU1 [ 35.933232][ T6093] ---- ---- [ 35.934511][ T6093] lock(&hdev->req_lock); [ 35.935574][ T6093] lock(rfkill_global_mutex); [ 35.937390][ T6093] lock(&hdev->req_lock); [ 35.939146][ T6093] lock((work_completion)(&hdev->tx_work)); [ 35.940670][ T6093] [ 35.940670][ T6093] *** DEADLOCK *** [ 35.940670][ T6093] [ 35.942725][ T6093] 2 locks held by syz-executor421/6093: [ 35.944109][ T6093] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 35.946596][ T6093] #1: ffff0000cfbe9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.949052][ T6093] [ 35.949052][ T6093] stack backtrace: [ 35.950473][ T6093] CPU: 0 PID: 6093 Comm: syz-executor421 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 35.952692][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 35.955311][ T6093] Call trace: [ 35.956078][ T6093] dump_backtrace+0x1b8/0x1e4 [ 35.957245][ T6093] show_stack+0x2c/0x3c [ 35.958295][ T6093] dump_stack_lvl+0xd0/0x124 [ 35.959484][ T6093] dump_stack+0x1c/0x28 [ 35.960529][ T6093] print_circular_bug+0x150/0x1b8 [ 35.961911][ T6093] check_noncircular+0x310/0x404 [ 35.963221][ T6093] __lock_acquire+0x3384/0x763c [ 35.964421][ T6093] lock_acquire+0x23c/0x71c [ 35.965527][ T6093] __flush_work+0xf8/0x1c0 [ 35.966717][ T6093] flush_work+0x24/0x38 [ 35.967782][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 35.968938][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 35.970290][ T6093] rfkill_set_block+0x18c/0x37c [ 35.971527][ T6093] rfkill_fop_write+0x578/0x734 [ 35.972762][ T6093] vfs_write+0x2a0/0x910 [ 35.973823][ T6093] ksys_write+0x15c/0x26c [ 35.974849][ T6093] __arm64_sys_write+0x7c/0x90 [ 35.976124][ T6093] invoke_syscall+0x98/0x2b8 [ 35.977220][ T6093] el0_svc_common+0x130/0x23c [ 35.978474][ T6093] do_el0_svc+0x48/0x58 [ 35.979499][ T6093] el0_svc+0x54/0x158 [ 35.980400][ T6093] el0t_64_sync_handler+0x84/0xfc [ 35.981665][ T6093] el0t_64_sync+0x190/0x194