Warning: Permanently added '10.128.0.25' (ED25519) to the list of known hosts. [ 32.572684][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 32.574860][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 32.576840][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 32.578954][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 32.582081][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 32.583798][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 32.753164][ T6102] [ 32.753800][ T6102] ====================================================== [ 32.755342][ T6102] WARNING: possible circular locking dependency detected [ 32.757077][ T6102] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 32.758635][ T6102] ------------------------------------------------------ [ 32.760211][ T6102] syz-executor236/6102 is trying to acquire lock: [ 32.761700][ T6102] ffff0000d0720e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 32.764246][ T6102] [ 32.764246][ T6102] but task is already holding lock: [ 32.766003][ T6102] ffff0000d0721108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.768326][ T6102] [ 32.768326][ T6102] which lock already depends on the new lock. [ 32.768326][ T6102] [ 32.770860][ T6102] [ 32.770860][ T6102] the existing dependency chain (in reverse order) is: [ 32.773087][ T6102] [ 32.773087][ T6102] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 32.774830][ T6102] __mutex_lock_common+0x190/0x21a0 [ 32.776302][ T6102] mutex_lock_nested+0x2c/0x38 [ 32.777643][ T6102] hci_rfkill_set_block+0xe8/0x20c [ 32.778951][ T6102] rfkill_set_block+0x18c/0x37c [ 32.780155][ T6102] rfkill_fop_write+0x578/0x734 [ 32.781436][ T6102] vfs_write+0x2a0/0x910 [ 32.782519][ T6102] ksys_write+0x15c/0x26c [ 32.783665][ T6102] __arm64_sys_write+0x7c/0x90 [ 32.784910][ T6102] invoke_syscall+0x98/0x2b8 [ 32.786128][ T6102] el0_svc_common+0x130/0x23c [ 32.787406][ T6102] do_el0_svc+0x48/0x58 [ 32.788527][ T6102] el0_svc+0x54/0x158 [ 32.789571][ T6102] el0t_64_sync_handler+0x84/0xfc [ 32.790928][ T6102] el0t_64_sync+0x190/0x194 [ 32.792141][ T6102] [ 32.792141][ T6102] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 32.794034][ T6102] __mutex_lock_common+0x190/0x21a0 [ 32.795340][ T6102] mutex_lock_nested+0x2c/0x38 [ 32.796598][ T6102] rfkill_register+0x44/0x7d4 [ 32.797845][ T6102] hci_register_dev+0x3e0/0x954 [ 32.799114][ T6102] vhci_create_device+0x358/0x6c4 [ 32.800500][ T6102] vhci_write+0x318/0x3b8 [ 32.801591][ T6102] vfs_write+0x610/0x910 [ 32.802742][ T6102] ksys_write+0x15c/0x26c [ 32.803953][ T6102] __arm64_sys_write+0x7c/0x90 [ 32.805300][ T6102] invoke_syscall+0x98/0x2b8 [ 32.806521][ T6102] el0_svc_common+0x130/0x23c [ 32.807741][ T6102] do_el0_svc+0x48/0x58 [ 32.808853][ T6102] el0_svc+0x54/0x158 [ 32.809955][ T6102] el0t_64_sync_handler+0x84/0xfc [ 32.811256][ T6102] el0t_64_sync+0x190/0x194 [ 32.812523][ T6102] [ 32.812523][ T6102] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 32.814603][ T6102] __mutex_lock_common+0x190/0x21a0 [ 32.816075][ T6102] mutex_lock_nested+0x2c/0x38 [ 32.817330][ T6102] vhci_send_frame+0x8c/0x10c [ 32.818618][ T6102] hci_send_frame+0x1c4/0x35c [ 32.819917][ T6102] hci_tx_work+0xba0/0x18e4 [ 32.821152][ T6102] process_one_work+0x694/0x1204 [ 32.822446][ T6102] worker_thread+0x938/0xef4 [ 32.823688][ T6102] kthread+0x288/0x310 [ 32.824859][ T6102] ret_from_fork+0x10/0x20 [ 32.826022][ T6102] [ 32.826022][ T6102] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 32.828271][ T6102] __lock_acquire+0x3384/0x763c [ 32.829621][ T6102] lock_acquire+0x23c/0x71c [ 32.830792][ T6102] __flush_work+0xf8/0x1c0 [ 32.832031][ T6102] flush_work+0x24/0x38 [ 32.833181][ T6102] hci_dev_close_sync+0x1c8/0xf30 [ 32.834712][ T6102] hci_rfkill_set_block+0xf0/0x20c [ 32.836043][ T6102] rfkill_set_block+0x18c/0x37c [ 32.837282][ T6102] rfkill_fop_write+0x578/0x734 [ 32.838530][ T6102] vfs_write+0x2a0/0x910 [ 32.839702][ T6102] ksys_write+0x15c/0x26c [ 32.840952][ T6102] __arm64_sys_write+0x7c/0x90 [ 32.842286][ T6102] invoke_syscall+0x98/0x2b8 [ 32.843547][ T6102] el0_svc_common+0x130/0x23c [ 32.844743][ T6102] do_el0_svc+0x48/0x58 [ 32.845842][ T6102] el0_svc+0x54/0x158 [ 32.846864][ T6102] el0t_64_sync_handler+0x84/0xfc [ 32.848266][ T6102] el0t_64_sync+0x190/0x194 [ 32.849415][ T6102] [ 32.849415][ T6102] other info that might help us debug this: [ 32.849415][ T6102] [ 32.851932][ T6102] Chain exists of: [ 32.851932][ T6102] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 32.851932][ T6102] [ 32.855466][ T6102] Possible unsafe locking scenario: [ 32.855466][ T6102] [ 32.857165][ T6102] CPU0 CPU1 [ 32.858366][ T6102] ---- ---- [ 32.859703][ T6102] lock(&hdev->req_lock); [ 32.860689][ T6102] lock(rfkill_global_mutex); [ 32.862450][ T6102] lock(&hdev->req_lock); [ 32.864130][ T6102] lock((work_completion)(&hdev->tx_work)); [ 32.865497][ T6102] [ 32.865497][ T6102] *** DEADLOCK *** [ 32.865497][ T6102] [ 32.867486][ T6102] 2 locks held by syz-executor236/6102: [ 32.868845][ T6102] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 32.871315][ T6102] #1: ffff0000d0721108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.873699][ T6102] [ 32.873699][ T6102] stack backtrace: [ 32.875126][ T6102] CPU: 1 PID: 6102 Comm: syz-executor236 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 32.877446][ T6102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 32.879769][ T6102] Call trace: [ 32.880505][ T6102] dump_backtrace+0x1b8/0x1e4 [ 32.881640][ T6102] show_stack+0x2c/0x3c [ 32.882631][ T6102] dump_stack_lvl+0xd0/0x124 [ 32.883674][ T6102] dump_stack+0x1c/0x28 [ 32.884643][ T6102] print_circular_bug+0x150/0x1b8 [ 32.885865][ T6102] check_noncircular+0x310/0x404 [ 32.887067][ T6102] __lock_acquire+0x3384/0x763c [ 32.888235][ T6102] lock_acquire+0x23c/0x71c [ 32.889201][ T6102] __flush_work+0xf8/0x1c0 [ 32.890201][ T6102] flush_work+0x24/0x38 [ 32.891235][ T6102] hci_dev_close_sync+0x1c8/0xf30 [ 32.892435][ T6102] hci_rfkill_set_block+0xf0/0x20c [ 32.893660][ T6102] rfkill_set_block+0x18c/0x37c [ 32.894836][ T6102] rfkill_fop_write+0x578/0x734 [ 32.895868][ T6102] vfs_write+0x2a0/0x910 [ 32.896795][ T6102] ksys_write+0x15c/0x26c [ 32.897834][ T6102] __arm64_sys_write+0x7c/0x90 [ 32.898885][ T6102] invoke_syscall+0x98/0x2b8 [ 32.900003][ T6102] el0_svc_common+0x130/0x23c [ 32.901027][ T6102] do_el0_svc+0x48/0x58 [ 32.901955][ T6102] el0_svc+0x54/0x158 [ 32.902982][ T6102] el0t_64_sync_handler+0x84/0xfc [ 32.904115][ T6102] el0t_64_sync+0x190/0x194