Warning: Permanently added '10.128.1.153' (ED25519) to the list of known hosts. [ 32.492372][ T6097] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 32.495458][ T6097] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 32.497482][ T6097] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 32.499980][ T6097] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 32.502230][ T6097] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 32.504479][ T6097] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 32.639745][ T6095] [ 32.640350][ T6095] ====================================================== [ 32.641981][ T6095] WARNING: possible circular locking dependency detected [ 32.643897][ T6095] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 32.645531][ T6095] ------------------------------------------------------ [ 32.647247][ T6095] syz-executor428/6095 is trying to acquire lock: [ 32.648809][ T6095] ffff0000d25bce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 32.651477][ T6095] [ 32.651477][ T6095] but task is already holding lock: [ 32.653431][ T6095] ffff0000d25bd108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.655943][ T6095] [ 32.655943][ T6095] which lock already depends on the new lock. [ 32.655943][ T6095] [ 32.658488][ T6095] [ 32.658488][ T6095] the existing dependency chain (in reverse order) is: [ 32.660647][ T6095] [ 32.660647][ T6095] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 32.662618][ T6095] __mutex_lock_common+0x190/0x21a0 [ 32.663987][ T6095] mutex_lock_nested+0x2c/0x38 [ 32.665254][ T6095] hci_rfkill_set_block+0xe8/0x20c [ 32.666681][ T6095] rfkill_set_block+0x18c/0x37c [ 32.667943][ T6095] rfkill_fop_write+0x578/0x734 [ 32.669272][ T6095] vfs_write+0x2a0/0x910 [ 32.670442][ T6095] ksys_write+0x15c/0x26c [ 32.671600][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.672843][ T6095] invoke_syscall+0x98/0x2b8 [ 32.674177][ T6095] el0_svc_common+0x130/0x23c [ 32.675461][ T6095] do_el0_svc+0x48/0x58 [ 32.676608][ T6095] el0_svc+0x54/0x158 [ 32.677767][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.679051][ T6095] el0t_64_sync+0x190/0x194 [ 32.680291][ T6095] [ 32.680291][ T6095] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 32.682260][ T6095] __mutex_lock_common+0x190/0x21a0 [ 32.683691][ T6095] mutex_lock_nested+0x2c/0x38 [ 32.684953][ T6095] rfkill_register+0x44/0x7d4 [ 32.686191][ T6095] hci_register_dev+0x3e0/0x954 [ 32.687555][ T6095] vhci_create_device+0x358/0x6c4 [ 32.688996][ T6095] vhci_write+0x318/0x3b8 [ 32.690271][ T6095] vfs_write+0x610/0x910 [ 32.691450][ T6095] ksys_write+0x15c/0x26c [ 32.692718][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.694032][ T6095] invoke_syscall+0x98/0x2b8 [ 32.695319][ T6095] el0_svc_common+0x130/0x23c [ 32.696609][ T6095] do_el0_svc+0x48/0x58 [ 32.697789][ T6095] el0_svc+0x54/0x158 [ 32.698953][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.700311][ T6095] el0t_64_sync+0x190/0x194 [ 32.701613][ T6095] [ 32.701613][ T6095] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 32.703525][ T6095] __mutex_lock_common+0x190/0x21a0 [ 32.705016][ T6095] mutex_lock_nested+0x2c/0x38 [ 32.706351][ T6095] vhci_send_frame+0x8c/0x10c [ 32.707624][ T6095] hci_send_frame+0x1c4/0x35c [ 32.708874][ T6095] hci_tx_work+0xba0/0x18e4 [ 32.710112][ T6095] process_one_work+0x694/0x1204 [ 32.711476][ T6095] worker_thread+0x938/0xef4 [ 32.712685][ T6095] kthread+0x288/0x310 [ 32.713816][ T6095] ret_from_fork+0x10/0x20 [ 32.715082][ T6095] [ 32.715082][ T6095] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 32.717467][ T6095] __lock_acquire+0x3384/0x763c [ 32.718783][ T6095] lock_acquire+0x23c/0x71c [ 32.720027][ T6095] __flush_work+0xf8/0x1c0 [ 32.721225][ T6095] flush_work+0x24/0x38 [ 32.722370][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 32.723706][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 32.725070][ T6095] rfkill_set_block+0x18c/0x37c [ 32.726455][ T6095] rfkill_fop_write+0x578/0x734 [ 32.727815][ T6095] vfs_write+0x2a0/0x910 [ 32.729024][ T6095] ksys_write+0x15c/0x26c [ 32.730316][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.731641][ T6095] invoke_syscall+0x98/0x2b8 [ 32.732927][ T6095] el0_svc_common+0x130/0x23c [ 32.734203][ T6095] do_el0_svc+0x48/0x58 [ 32.735370][ T6095] el0_svc+0x54/0x158 [ 32.736471][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.737949][ T6095] el0t_64_sync+0x190/0x194 [ 32.739273][ T6095] [ 32.739273][ T6095] other info that might help us debug this: [ 32.739273][ T6095] [ 32.741459][ T6095] Chain exists of: [ 32.741459][ T6095] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 32.741459][ T6095] [ 32.744003][ T6095] Possible unsafe locking scenario: [ 32.744003][ T6095] [ 32.745245][ T6095] CPU0 CPU1 [ 32.746158][ T6095] ---- ---- [ 32.747067][ T6095] lock(&hdev->req_lock); [ 32.747810][ T6095] lock(rfkill_global_mutex); [ 32.749033][ T6095] lock(&hdev->req_lock); [ 32.750222][ T6095] lock((work_completion)(&hdev->tx_work)); [ 32.751248][ T6095] [ 32.751248][ T6095] *** DEADLOCK *** [ 32.751248][ T6095] [ 32.752622][ T6095] 2 locks held by syz-executor428/6095: [ 32.753555][ T6095] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 32.755751][ T6095] #1: ffff0000d25bd108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.758102][ T6095] [ 32.758102][ T6095] stack backtrace: [ 32.759473][ T6095] CPU: 0 PID: 6095 Comm: syz-executor428 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 32.761896][ T6095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 32.764433][ T6095] Call trace: [ 32.765258][ T6095] dump_backtrace+0x1b8/0x1e4 [ 32.766401][ T6095] show_stack+0x2c/0x3c [ 32.767470][ T6095] dump_stack_lvl+0xd0/0x124 [ 32.768615][ T6095] dump_stack+0x1c/0x28 [ 32.769722][ T6095] print_circular_bug+0x150/0x1b8 [ 32.770975][ T6095] check_noncircular+0x310/0x404 [ 32.772188][ T6095] __lock_acquire+0x3384/0x763c [ 32.773390][ T6095] lock_acquire+0x23c/0x71c [ 32.774586][ T6095] __flush_work+0xf8/0x1c0 [ 32.775717][ T6095] flush_work+0x24/0x38 [ 32.776731][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 32.777946][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 32.779266][ T6095] rfkill_set_block+0x18c/0x37c [ 32.780404][ T6095] rfkill_fop_write+0x578/0x734 [ 32.781598][ T6095] vfs_write+0x2a0/0x910 [ 32.782629][ T6095] ksys_write+0x15c/0x26c [ 32.783743][ T6095] __arm64_sys_write+0x7c/0x90 [ 32.784970][ T6095] invoke_syscall+0x98/0x2b8 [ 32.786040][ T6095] el0_svc_common+0x130/0x23c [ 32.787075][ T6095] do_el0_svc+0x48/0x58 [ 32.788110][ T6095] el0_svc+0x54/0x158 [ 32.789128][ T6095] el0t_64_sync_handler+0x84/0xfc [ 32.790382][ T6095] el0t_64_sync+0x190/0x194