Warning: Permanently added '10.128.1.48' (ED25519) to the list of known hosts. [ 36.243167][ T6104] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.245656][ T6104] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.247751][ T6104] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.250249][ T6104] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.252318][ T6104] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 36.255523][ T6104] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 36.426027][ T6100] [ 36.426705][ T6100] ====================================================== [ 36.428330][ T6100] WARNING: possible circular locking dependency detected [ 36.429947][ T6100] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 36.431398][ T6100] ------------------------------------------------------ [ 36.433095][ T6100] syz-executor367/6100 is trying to acquire lock: [ 36.434889][ T6100] ffff0000d0c24e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 36.437430][ T6100] [ 36.437430][ T6100] but task is already holding lock: [ 36.439184][ T6100] ffff0000d0c25108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 36.441509][ T6100] [ 36.441509][ T6100] which lock already depends on the new lock. [ 36.441509][ T6100] [ 36.443877][ T6100] [ 36.443877][ T6100] the existing dependency chain (in reverse order) is: [ 36.446079][ T6100] [ 36.446079][ T6100] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 36.447882][ T6100] __mutex_lock_common+0x190/0x21a0 [ 36.449293][ T6100] mutex_lock_nested+0x2c/0x38 [ 36.450597][ T6100] hci_rfkill_set_block+0xe8/0x20c [ 36.451938][ T6100] rfkill_set_block+0x18c/0x37c [ 36.453117][ T6100] rfkill_fop_write+0x578/0x734 [ 36.454505][ T6100] vfs_write+0x2a0/0x910 [ 36.455643][ T6100] ksys_write+0x15c/0x26c [ 36.456786][ T6100] __arm64_sys_write+0x7c/0x90 [ 36.458102][ T6100] invoke_syscall+0x98/0x2b8 [ 36.459368][ T6100] el0_svc_common+0x130/0x23c [ 36.460647][ T6100] do_el0_svc+0x48/0x58 [ 36.461749][ T6100] el0_svc+0x54/0x158 [ 36.462776][ T6100] el0t_64_sync_handler+0x84/0xfc [ 36.464136][ T6100] el0t_64_sync+0x190/0x194 [ 36.465379][ T6100] [ 36.465379][ T6100] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 36.467271][ T6100] __mutex_lock_common+0x190/0x21a0 [ 36.468637][ T6100] mutex_lock_nested+0x2c/0x38 [ 36.469890][ T6100] rfkill_register+0x44/0x7d4 [ 36.471106][ T6100] hci_register_dev+0x3e0/0x954 [ 36.472448][ T6100] vhci_create_device+0x358/0x6c4 [ 36.473789][ T6100] vhci_write+0x318/0x3b8 [ 36.474966][ T6100] vfs_write+0x610/0x910 [ 36.476133][ T6100] ksys_write+0x15c/0x26c [ 36.477265][ T6100] __arm64_sys_write+0x7c/0x90 [ 36.478455][ T6100] invoke_syscall+0x98/0x2b8 [ 36.479701][ T6100] el0_svc_common+0x130/0x23c [ 36.480866][ T6100] do_el0_svc+0x48/0x58 [ 36.481995][ T6100] el0_svc+0x54/0x158 [ 36.483051][ T6100] el0t_64_sync_handler+0x84/0xfc [ 36.484453][ T6100] el0t_64_sync+0x190/0x194 [ 36.485612][ T6100] [ 36.485612][ T6100] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 36.487571][ T6100] __mutex_lock_common+0x190/0x21a0 [ 36.488970][ T6100] mutex_lock_nested+0x2c/0x38 [ 36.490211][ T6100] vhci_send_frame+0x8c/0x10c [ 36.491450][ T6100] hci_send_frame+0x1c4/0x35c [ 36.492526][ T6100] hci_tx_work+0xba0/0x18e4 [ 36.493649][ T6100] process_one_work+0x694/0x1204 [ 36.494950][ T6100] worker_thread+0x938/0xef4 [ 36.496195][ T6100] kthread+0x288/0x310 [ 36.497286][ T6100] ret_from_fork+0x10/0x20 [ 36.498422][ T6100] [ 36.498422][ T6100] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 36.500623][ T6100] __lock_acquire+0x3384/0x763c [ 36.501932][ T6100] lock_acquire+0x23c/0x71c [ 36.503203][ T6100] __flush_work+0xf8/0x1c0 [ 36.504447][ T6100] flush_work+0x24/0x38 [ 36.505594][ T6100] hci_dev_close_sync+0x1c8/0xf30 [ 36.506989][ T6100] hci_rfkill_set_block+0xf0/0x20c [ 36.508417][ T6100] rfkill_set_block+0x18c/0x37c [ 36.509679][ T6100] rfkill_fop_write+0x578/0x734 [ 36.511012][ T6100] vfs_write+0x2a0/0x910 [ 36.512167][ T6100] ksys_write+0x15c/0x26c [ 36.513309][ T6100] __arm64_sys_write+0x7c/0x90 [ 36.514582][ T6100] invoke_syscall+0x98/0x2b8 [ 36.515736][ T6100] el0_svc_common+0x130/0x23c [ 36.516934][ T6100] do_el0_svc+0x48/0x58 [ 36.518157][ T6100] el0_svc+0x54/0x158 [ 36.519437][ T6100] el0t_64_sync_handler+0x84/0xfc [ 36.520761][ T6100] el0t_64_sync+0x190/0x194 [ 36.521979][ T6100] [ 36.521979][ T6100] other info that might help us debug this: [ 36.521979][ T6100] [ 36.524932][ T6100] Chain exists of: [ 36.524932][ T6100] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 36.524932][ T6100] [ 36.528544][ T6100] Possible unsafe locking scenario: [ 36.528544][ T6100] [ 36.530487][ T6100] CPU0 CPU1 [ 36.531740][ T6100] ---- ---- [ 36.533120][ T6100] lock(&hdev->req_lock); [ 36.534112][ T6100] lock(rfkill_global_mutex); [ 36.535867][ T6100] lock(&hdev->req_lock); [ 36.537458][ T6100] lock((work_completion)(&hdev->tx_work)); [ 36.538853][ T6100] [ 36.538853][ T6100] *** DEADLOCK *** [ 36.538853][ T6100] [ 36.540817][ T6100] 2 locks held by syz-executor367/6100: [ 36.542434][ T6100] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 36.545314][ T6100] #1: ffff0000d0c25108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 36.547698][ T6100] [ 36.547698][ T6100] stack backtrace: [ 36.549040][ T6100] CPU: 1 PID: 6100 Comm: syz-executor367 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 36.551481][ T6100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 36.553609][ T6100] Call trace: [ 36.554360][ T6100] dump_backtrace+0x1b8/0x1e4 [ 36.555490][ T6100] show_stack+0x2c/0x3c [ 36.556529][ T6100] dump_stack_lvl+0xd0/0x124 [ 36.557630][ T6100] dump_stack+0x1c/0x28 [ 36.558634][ T6100] print_circular_bug+0x150/0x1b8 [ 36.559845][ T6100] check_noncircular+0x310/0x404 [ 36.561033][ T6100] __lock_acquire+0x3384/0x763c [ 36.562197][ T6100] lock_acquire+0x23c/0x71c [ 36.563353][ T6100] __flush_work+0xf8/0x1c0 [ 36.564511][ T6100] flush_work+0x24/0x38 [ 36.565500][ T6100] hci_dev_close_sync+0x1c8/0xf30 [ 36.566796][ T6100] hci_rfkill_set_block+0xf0/0x20c [ 36.568058][ T6100] rfkill_set_block+0x18c/0x37c [ 36.569272][ T6100] rfkill_fop_write+0x578/0x734 [ 36.570453][ T6100] vfs_write+0x2a0/0x910 [ 36.571505][ T6100] ksys_write+0x15c/0x26c [ 36.572546][ T6100] __arm64_sys_write+0x7c/0x90 [ 36.573774][ T6100] invoke_syscall+0x98/0x2b8 [ 36.574909][ T6100] el0_svc_common+0x130/0x23c [ 36.576137][ T6100] do_el0_svc+0x48/0x58 [ 36.577115][ T6100] el0_svc+0x54/0x158 [ 36.578099][ T6100] el0t_64_sync_handler+0x84/0xfc [ 36.579400][ T6100] el0t_64_sync+0x190/0x194