Warning: Permanently added '10.128.1.20' (ED25519) to the list of known hosts. [ 33.407495][ T6097] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.410033][ T6097] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.412023][ T6097] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.414250][ T6097] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.416214][ T6097] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 33.418056][ T6097] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 33.550253][ T6095] [ 33.550796][ T6095] ====================================================== [ 33.552327][ T6095] WARNING: possible circular locking dependency detected [ 33.553851][ T6095] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 33.555290][ T6095] ------------------------------------------------------ [ 33.556703][ T6095] syz-executor306/6095 is trying to acquire lock: [ 33.558078][ T6095] ffff0000da474e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 33.560538][ T6095] [ 33.560538][ T6095] but task is already holding lock: [ 33.562213][ T6095] ffff0000da475108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.564714][ T6095] [ 33.564714][ T6095] which lock already depends on the new lock. [ 33.564714][ T6095] [ 33.567274][ T6095] [ 33.567274][ T6095] the existing dependency chain (in reverse order) is: [ 33.569538][ T6095] [ 33.569538][ T6095] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 33.571312][ T6095] __mutex_lock_common+0x190/0x21a0 [ 33.572636][ T6095] mutex_lock_nested+0x2c/0x38 [ 33.573846][ T6095] hci_rfkill_set_block+0xe8/0x20c [ 33.575119][ T6095] rfkill_set_block+0x18c/0x37c [ 33.576244][ T6095] rfkill_fop_write+0x578/0x734 [ 33.577504][ T6095] vfs_write+0x2a0/0x910 [ 33.578589][ T6095] ksys_write+0x15c/0x26c [ 33.579706][ T6095] __arm64_sys_write+0x7c/0x90 [ 33.580942][ T6095] invoke_syscall+0x98/0x2b8 [ 33.582168][ T6095] el0_svc_common+0x130/0x23c [ 33.583365][ T6095] do_el0_svc+0x48/0x58 [ 33.584490][ T6095] el0_svc+0x54/0x158 [ 33.585560][ T6095] el0t_64_sync_handler+0x84/0xfc [ 33.586751][ T6095] el0t_64_sync+0x190/0x194 [ 33.587862][ T6095] [ 33.587862][ T6095] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 33.589676][ T6095] __mutex_lock_common+0x190/0x21a0 [ 33.590987][ T6095] mutex_lock_nested+0x2c/0x38 [ 33.592199][ T6095] rfkill_register+0x44/0x7d4 [ 33.593373][ T6095] hci_register_dev+0x3e0/0x954 [ 33.594690][ T6095] vhci_create_device+0x358/0x6c4 [ 33.595999][ T6095] vhci_write+0x318/0x3b8 [ 33.597155][ T6095] vfs_write+0x610/0x910 [ 33.598144][ T6095] ksys_write+0x15c/0x26c [ 33.599373][ T6095] __arm64_sys_write+0x7c/0x90 [ 33.600565][ T6095] invoke_syscall+0x98/0x2b8 [ 33.601681][ T6095] el0_svc_common+0x130/0x23c [ 33.602855][ T6095] do_el0_svc+0x48/0x58 [ 33.603861][ T6095] el0_svc+0x54/0x158 [ 33.604955][ T6095] el0t_64_sync_handler+0x84/0xfc [ 33.606320][ T6095] el0t_64_sync+0x190/0x194 [ 33.607520][ T6095] [ 33.607520][ T6095] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 33.609380][ T6095] __mutex_lock_common+0x190/0x21a0 [ 33.610796][ T6095] mutex_lock_nested+0x2c/0x38 [ 33.612012][ T6095] vhci_send_frame+0x8c/0x10c [ 33.613305][ T6095] hci_send_frame+0x1c4/0x35c [ 33.614518][ T6095] hci_tx_work+0xba0/0x18e4 [ 33.615739][ T6095] process_one_work+0x694/0x1204 [ 33.616926][ T6095] worker_thread+0x938/0xef4 [ 33.618065][ T6095] kthread+0x288/0x310 [ 33.619136][ T6095] ret_from_fork+0x10/0x20 [ 33.620294][ T6095] [ 33.620294][ T6095] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 33.622350][ T6095] __lock_acquire+0x3384/0x763c [ 33.623603][ T6095] lock_acquire+0x23c/0x71c [ 33.624765][ T6095] __flush_work+0xf8/0x1c0 [ 33.626003][ T6095] flush_work+0x24/0x38 [ 33.627063][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 33.628351][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 33.629649][ T6095] rfkill_set_block+0x18c/0x37c [ 33.630899][ T6095] rfkill_fop_write+0x578/0x734 [ 33.632108][ T6095] vfs_write+0x2a0/0x910 [ 33.633165][ T6095] ksys_write+0x15c/0x26c [ 33.634275][ T6095] __arm64_sys_write+0x7c/0x90 [ 33.635586][ T6095] invoke_syscall+0x98/0x2b8 [ 33.636853][ T6095] el0_svc_common+0x130/0x23c [ 33.638032][ T6095] do_el0_svc+0x48/0x58 [ 33.639123][ T6095] el0_svc+0x54/0x158 [ 33.640260][ T6095] el0t_64_sync_handler+0x84/0xfc [ 33.641572][ T6095] el0t_64_sync+0x190/0x194 [ 33.642726][ T6095] [ 33.642726][ T6095] other info that might help us debug this: [ 33.642726][ T6095] [ 33.645201][ T6095] Chain exists of: [ 33.645201][ T6095] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 33.645201][ T6095] [ 33.648865][ T6095] Possible unsafe locking scenario: [ 33.648865][ T6095] [ 33.650567][ T6095] CPU0 CPU1 [ 33.651806][ T6095] ---- ---- [ 33.653055][ T6095] lock(&hdev->req_lock); [ 33.654076][ T6095] lock(rfkill_global_mutex); [ 33.655798][ T6095] lock(&hdev->req_lock); [ 33.657442][ T6095] lock((work_completion)(&hdev->tx_work)); [ 33.658782][ T6095] [ 33.658782][ T6095] *** DEADLOCK *** [ 33.658782][ T6095] [ 33.660691][ T6095] 2 locks held by syz-executor306/6095: [ 33.661986][ T6095] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 33.664541][ T6095] #1: ffff0000da475108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.667031][ T6095] [ 33.667031][ T6095] stack backtrace: [ 33.668394][ T6095] CPU: 1 PID: 6095 Comm: syz-executor306 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 33.670805][ T6095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 33.673235][ T6095] Call trace: [ 33.674000][ T6095] dump_backtrace+0x1b8/0x1e4 [ 33.675091][ T6095] show_stack+0x2c/0x3c [ 33.676069][ T6095] dump_stack_lvl+0xd0/0x124 [ 33.677148][ T6095] dump_stack+0x1c/0x28 [ 33.678224][ T6095] print_circular_bug+0x150/0x1b8 [ 33.679459][ T6095] check_noncircular+0x310/0x404 [ 33.680679][ T6095] __lock_acquire+0x3384/0x763c [ 33.681834][ T6095] lock_acquire+0x23c/0x71c [ 33.682862][ T6095] __flush_work+0xf8/0x1c0 [ 33.683957][ T6095] flush_work+0x24/0x38 [ 33.685005][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 33.686173][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 33.687358][ T6095] rfkill_set_block+0x18c/0x37c [ 33.688429][ T6095] rfkill_fop_write+0x578/0x734 [ 33.689668][ T6095] vfs_write+0x2a0/0x910 [ 33.690669][ T6095] ksys_write+0x15c/0x26c [ 33.691611][ T6095] __arm64_sys_write+0x7c/0x90 [ 33.692800][ T6095] invoke_syscall+0x98/0x2b8 [ 33.693850][ T6095] el0_svc_common+0x130/0x23c [ 33.694900][ T6095] do_el0_svc+0x48/0x58 [ 33.695871][ T6095] el0_svc+0x54/0x158 [ 33.696826][ T6095] el0t_64_sync_handler+0x84/0xfc [ 33.698033][ T6095] el0t_64_sync+0x190/0x194