Warning: Permanently added '10.128.0.2' (ED25519) to the list of known hosts. executing program [ 64.790498][ T4017] [ 64.791249][ T4017] ====================================================== [ 64.793117][ T4017] WARNING: possible circular locking dependency detected [ 64.795188][ T4017] 5.15.164-syzkaller #0 Not tainted [ 64.796688][ T4017] ------------------------------------------------------ [ 64.798408][ T4017] syz-executor185/4017 is trying to acquire lock: [ 64.800133][ T4017] ffff0000ca6d8b98 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 64.802911][ T4017] [ 64.802911][ T4017] but task is already holding lock: [ 64.804857][ T4017] ffff0000ca6d8ff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 64.807221][ T4017] [ 64.807221][ T4017] which lock already depends on the new lock. [ 64.807221][ T4017] [ 64.809902][ T4017] [ 64.809902][ T4017] the existing dependency chain (in reverse order) is: [ 64.812258][ T4017] [ 64.812258][ T4017] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 64.814348][ T4017] __mutex_lock_common+0x194/0x2154 [ 64.815850][ T4017] mutex_lock_nested+0xa4/0xf8 [ 64.817150][ T4017] hci_dev_do_close+0x64/0x1060 [ 64.818528][ T4017] hci_rfkill_set_block+0xdc/0x1d0 [ 64.820057][ T4017] rfkill_set_block+0x18c/0x37c [ 64.821501][ T4017] rfkill_fop_write+0x594/0x750 [ 64.823003][ T4017] vfs_write+0x280/0xb44 [ 64.824265][ T4017] ksys_write+0x15c/0x26c [ 64.825551][ T4017] __arm64_sys_write+0x7c/0x90 [ 64.826941][ T4017] invoke_syscall+0x98/0x2b8 [ 64.828249][ T4017] el0_svc_common+0x138/0x258 [ 64.829615][ T4017] do_el0_svc+0x58/0x14c [ 64.830951][ T4017] el0_svc+0x7c/0x1f0 [ 64.832238][ T4017] el0t_64_sync_handler+0x84/0xe4 [ 64.833822][ T4017] el0t_64_sync+0x1a0/0x1a4 [ 64.835403][ T4017] [ 64.835403][ T4017] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 64.837588][ T4017] __mutex_lock_common+0x194/0x2154 [ 64.839144][ T4017] mutex_lock_nested+0xa4/0xf8 [ 64.840588][ T4017] rfkill_register+0x44/0x7a4 [ 64.841963][ T4017] hci_register_dev+0x3e0/0x880 [ 64.843356][ T4017] vhci_create_device+0x2c4/0x568 [ 64.844866][ T4017] vhci_write+0x318/0x3b8 [ 64.846036][ T4017] vfs_write+0x884/0xb44 [ 64.847350][ T4017] ksys_write+0x15c/0x26c [ 64.848663][ T4017] __arm64_sys_write+0x7c/0x90 [ 64.850119][ T4017] invoke_syscall+0x98/0x2b8 [ 64.851425][ T4017] el0_svc_common+0x138/0x258 [ 64.852765][ T4017] do_el0_svc+0x58/0x14c [ 64.854014][ T4017] el0_svc+0x7c/0x1f0 [ 64.855241][ T4017] el0t_64_sync_handler+0x84/0xe4 [ 64.856649][ T4017] el0t_64_sync+0x1a0/0x1a4 [ 64.857949][ T4017] [ 64.857949][ T4017] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 64.859959][ T4017] __mutex_lock_common+0x194/0x2154 [ 64.861485][ T4017] mutex_lock_nested+0xa4/0xf8 [ 64.862875][ T4017] vhci_send_frame+0x8c/0x10c [ 64.864246][ T4017] hci_send_frame+0x194/0x2f0 [ 64.865630][ T4017] hci_tx_work+0x8d8/0x157c [ 64.866996][ T4017] process_one_work+0x790/0x11b8 [ 64.868446][ T4017] worker_thread+0x910/0x1034 [ 64.869838][ T4017] kthread+0x37c/0x45c [ 64.871072][ T4017] ret_from_fork+0x10/0x20 [ 64.872375][ T4017] [ 64.872375][ T4017] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 64.874741][ T4017] __lock_acquire+0x32d4/0x7638 [ 64.876186][ T4017] lock_acquire+0x240/0x77c [ 64.877661][ T4017] __flush_work+0xf8/0x1c0 [ 64.879080][ T4017] flush_work+0x24/0x38 [ 64.880333][ T4017] hci_dev_do_close+0x16c/0x1060 [ 64.881843][ T4017] hci_rfkill_set_block+0xdc/0x1d0 [ 64.883469][ T4017] rfkill_set_block+0x18c/0x37c [ 64.884987][ T4017] rfkill_fop_write+0x594/0x750 [ 64.886431][ T4017] vfs_write+0x280/0xb44 [ 64.887917][ T4017] ksys_write+0x15c/0x26c [ 64.889240][ T4017] __arm64_sys_write+0x7c/0x90 [ 64.890634][ T4017] invoke_syscall+0x98/0x2b8 [ 64.891989][ T4017] el0_svc_common+0x138/0x258 [ 64.893460][ T4017] do_el0_svc+0x58/0x14c [ 64.894811][ T4017] el0_svc+0x7c/0x1f0 [ 64.895983][ T4017] el0t_64_sync_handler+0x84/0xe4 [ 64.897615][ T4017] el0t_64_sync+0x1a0/0x1a4 [ 64.899076][ T4017] [ 64.899076][ T4017] other info that might help us debug this: [ 64.899076][ T4017] [ 64.901892][ T4017] Chain exists of: [ 64.901892][ T4017] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 64.901892][ T4017] [ 64.905818][ T4017] Possible unsafe locking scenario: [ 64.905818][ T4017] [ 64.907765][ T4017] CPU0 CPU1 [ 64.909211][ T4017] ---- ---- [ 64.910650][ T4017] lock(&hdev->req_lock); [ 64.911805][ T4017] lock(rfkill_global_mutex); [ 64.913832][ T4017] lock(&hdev->req_lock); [ 64.915637][ T4017] lock((work_completion)(&hdev->tx_work)); [ 64.917389][ T4017] [ 64.917389][ T4017] *** DEADLOCK *** [ 64.917389][ T4017] [ 64.919526][ T4017] 2 locks held by syz-executor185/4017: [ 64.921029][ T4017] #0: ffff800016e77788 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x250/0x750 [ 64.923672][ T4017] #1: ffff0000ca6d8ff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 64.926222][ T4017] [ 64.926222][ T4017] stack backtrace: [ 64.927858][ T4017] CPU: 1 PID: 4017 Comm: syz-executor185 Not tainted 5.15.164-syzkaller #0 [ 64.930131][ T4017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 64.932960][ T4017] Call trace: [ 64.933820][ T4017] dump_backtrace+0x0/0x530 [ 64.935053][ T4017] show_stack+0x2c/0x3c [ 64.936262][ T4017] dump_stack_lvl+0x108/0x170 [ 64.937558][ T4017] dump_stack+0x1c/0x58 [ 64.938586][ T4017] print_circular_bug+0x150/0x1b8 [ 64.939932][ T4017] check_noncircular+0x2cc/0x378 [ 64.941327][ T4017] __lock_acquire+0x32d4/0x7638 [ 64.942582][ T4017] lock_acquire+0x240/0x77c [ 64.943917][ T4017] __flush_work+0xf8/0x1c0 [ 64.945148][ T4017] flush_work+0x24/0x38 [ 64.946247][ T4017] hci_dev_do_close+0x16c/0x1060 [ 64.947578][ T4017] hci_rfkill_set_block+0xdc/0x1d0 [ 64.948948][ T4017] rfkill_set_block+0x18c/0x37c [ 64.950279][ T4017] rfkill_fop_write+0x594/0x750 [ 64.951569][ T4017] vfs_write+0x280/0xb44 [ 64.952715][ T4017] ksys_write+0x15c/0x26c [ 64.953878][ T4017] __arm64_sys_write+0x7c/0x90 [ 64.955257][ T4017] invoke_syscall+0x98/0x2b8 [ 64.956526][ T4017] el0_svc_common+0x138/0x258 [ 64.957831][ T4017] do_el0_svc+0x58/0x14c [ 64.959123][ T4017] el0_svc+0x7c/0x1f0 [ 64.960186][ T4017] el0t_64_sync_handler+0x84/0xe4 [ 64.961538][ T4017] el0t_64_sync+0x1a0/0x1a4