Warning: Permanently added '10.128.0.150' (ED25519) to the list of known hosts. [ 31.908782][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 31.912775][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 31.914922][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 31.917316][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 31.919584][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 31.921534][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 32.067677][ T6092] [ 32.068350][ T6092] ====================================================== [ 32.070085][ T6092] WARNING: possible circular locking dependency detected [ 32.071831][ T6092] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 32.073472][ T6092] ------------------------------------------------------ [ 32.075252][ T6092] syz-executor313/6092 is trying to acquire lock: [ 32.076914][ T6092] ffff0000d4144e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 32.079581][ T6092] [ 32.079581][ T6092] but task is already holding lock: [ 32.081497][ T6092] ffff0000d4145108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.083898][ T6092] [ 32.083898][ T6092] which lock already depends on the new lock. [ 32.083898][ T6092] [ 32.086508][ T6092] [ 32.086508][ T6092] the existing dependency chain (in reverse order) is: [ 32.088694][ T6092] [ 32.088694][ T6092] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 32.090731][ T6092] __mutex_lock_common+0x190/0x21a0 [ 32.092167][ T6092] mutex_lock_nested+0x2c/0x38 [ 32.093509][ T6092] hci_rfkill_set_block+0xe8/0x20c [ 32.094970][ T6092] rfkill_set_block+0x18c/0x37c [ 32.096348][ T6092] rfkill_fop_write+0x578/0x734 [ 32.097713][ T6092] vfs_write+0x2a0/0x910 [ 32.098964][ T6092] ksys_write+0x15c/0x26c [ 32.100251][ T6092] __arm64_sys_write+0x7c/0x90 [ 32.101683][ T6092] invoke_syscall+0x98/0x2b8 [ 32.103022][ T6092] el0_svc_common+0x130/0x23c [ 32.104358][ T6092] do_el0_svc+0x48/0x58 [ 32.105573][ T6092] el0_svc+0x54/0x158 [ 32.106689][ T6092] el0t_64_sync_handler+0x84/0xfc [ 32.108081][ T6092] el0t_64_sync+0x190/0x194 [ 32.109372][ T6092] [ 32.109372][ T6092] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 32.111424][ T6092] __mutex_lock_common+0x190/0x21a0 [ 32.112934][ T6092] mutex_lock_nested+0x2c/0x38 [ 32.114168][ T6092] rfkill_register+0x44/0x7d4 [ 32.115480][ T6092] hci_register_dev+0x3e0/0x954 [ 32.116747][ T6092] vhci_create_device+0x358/0x6c4 [ 32.118147][ T6092] vhci_write+0x318/0x3b8 [ 32.119378][ T6092] vfs_write+0x610/0x910 [ 32.120543][ T6092] ksys_write+0x15c/0x26c [ 32.121778][ T6092] __arm64_sys_write+0x7c/0x90 [ 32.123017][ T6092] invoke_syscall+0x98/0x2b8 [ 32.124198][ T6092] el0_svc_common+0x130/0x23c [ 32.125388][ T6092] do_el0_svc+0x48/0x58 [ 32.126531][ T6092] el0_svc+0x54/0x158 [ 32.127642][ T6092] el0t_64_sync_handler+0x84/0xfc [ 32.129028][ T6092] el0t_64_sync+0x190/0x194 [ 32.130145][ T6092] [ 32.130145][ T6092] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 32.132065][ T6092] __mutex_lock_common+0x190/0x21a0 [ 32.133347][ T6092] mutex_lock_nested+0x2c/0x38 [ 32.134583][ T6092] vhci_send_frame+0x8c/0x10c [ 32.135877][ T6092] hci_send_frame+0x1c4/0x35c [ 32.137127][ T6092] hci_tx_work+0xba0/0x18e4 [ 32.138275][ T6092] process_one_work+0x694/0x1204 [ 32.139471][ T6092] worker_thread+0x938/0xef4 [ 32.140780][ T6092] kthread+0x288/0x310 [ 32.141858][ T6092] ret_from_fork+0x10/0x20 [ 32.143030][ T6092] [ 32.143030][ T6092] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 32.145294][ T6092] __lock_acquire+0x3384/0x763c [ 32.146480][ T6092] lock_acquire+0x23c/0x71c [ 32.147720][ T6092] __flush_work+0xf8/0x1c0 [ 32.148859][ T6092] flush_work+0x24/0x38 [ 32.149920][ T6092] hci_dev_close_sync+0x1c8/0xf30 [ 32.151253][ T6092] hci_rfkill_set_block+0xf0/0x20c [ 32.152641][ T6092] rfkill_set_block+0x18c/0x37c [ 32.153920][ T6092] rfkill_fop_write+0x578/0x734 [ 32.155230][ T6092] vfs_write+0x2a0/0x910 [ 32.156365][ T6092] ksys_write+0x15c/0x26c [ 32.157478][ T6092] __arm64_sys_write+0x7c/0x90 [ 32.158750][ T6092] invoke_syscall+0x98/0x2b8 [ 32.160011][ T6092] el0_svc_common+0x130/0x23c [ 32.161117][ T6092] do_el0_svc+0x48/0x58 [ 32.162236][ T6092] el0_svc+0x54/0x158 [ 32.163324][ T6092] el0t_64_sync_handler+0x84/0xfc [ 32.164620][ T6092] el0t_64_sync+0x190/0x194 [ 32.165778][ T6092] [ 32.165778][ T6092] other info that might help us debug this: [ 32.165778][ T6092] [ 32.168192][ T6092] Chain exists of: [ 32.168192][ T6092] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 32.168192][ T6092] [ 32.172006][ T6092] Possible unsafe locking scenario: [ 32.172006][ T6092] [ 32.173813][ T6092] CPU0 CPU1 [ 32.175184][ T6092] ---- ---- [ 32.176487][ T6092] lock(&hdev->req_lock); [ 32.177539][ T6092] lock(rfkill_global_mutex); [ 32.179370][ T6092] lock(&hdev->req_lock); [ 32.180997][ T6092] lock((work_completion)(&hdev->tx_work)); [ 32.182478][ T6092] [ 32.182478][ T6092] *** DEADLOCK *** [ 32.182478][ T6092] [ 32.184367][ T6092] 2 locks held by syz-executor313/6092: [ 32.185743][ T6092] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 32.188120][ T6092] #1: ffff0000d4145108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.190542][ T6092] [ 32.190542][ T6092] stack backtrace: [ 32.191999][ T6092] CPU: 0 PID: 6092 Comm: syz-executor313 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 32.194349][ T6092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 32.196869][ T6092] Call trace: [ 32.197678][ T6092] dump_backtrace+0x1b8/0x1e4 [ 32.198830][ T6092] show_stack+0x2c/0x3c [ 32.199788][ T6092] dump_stack_lvl+0xd0/0x124 [ 32.200924][ T6092] dump_stack+0x1c/0x28 [ 32.201934][ T6092] print_circular_bug+0x150/0x1b8 [ 32.203171][ T6092] check_noncircular+0x310/0x404 [ 32.204329][ T6092] __lock_acquire+0x3384/0x763c [ 32.205549][ T6092] lock_acquire+0x23c/0x71c [ 32.206611][ T6092] __flush_work+0xf8/0x1c0 [ 32.207708][ T6092] flush_work+0x24/0x38 [ 32.208774][ T6092] hci_dev_close_sync+0x1c8/0xf30 [ 32.209873][ T6092] hci_rfkill_set_block+0xf0/0x20c [ 32.211087][ T6092] rfkill_set_block+0x18c/0x37c [ 32.212304][ T6092] rfkill_fop_write+0x578/0x734 [ 32.213487][ T6092] vfs_write+0x2a0/0x910 [ 32.214506][ T6092] ksys_write+0x15c/0x26c [ 32.215594][ T6092] __arm64_sys_write+0x7c/0x90 [ 32.216694][ T6092] invoke_syscall+0x98/0x2b8 [ 32.217841][ T6092] el0_svc_common+0x130/0x23c [ 32.218928][ T6092] do_el0_svc+0x48/0x58 [ 32.219926][ T6092] el0_svc+0x54/0x158 [ 32.220885][ T6092] el0t_64_sync_handler+0x84/0xfc [ 32.222089][ T6092] el0t_64_sync+0x190/0x194