Warning: Permanently added '10.128.1.16' (ED25519) to the list of known hosts. [ 34.197220][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.199682][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.202401][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.204701][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.206923][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 34.208831][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 34.379636][ T6093] [ 34.380226][ T6093] ====================================================== [ 34.382004][ T6093] WARNING: possible circular locking dependency detected [ 34.383849][ T6093] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 34.385515][ T6093] ------------------------------------------------------ [ 34.387342][ T6093] syz-executor255/6093 is trying to acquire lock: [ 34.389057][ T6093] ffff0000c7520e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 34.391809][ T6093] [ 34.391809][ T6093] but task is already holding lock: [ 34.393684][ T6093] ffff0000c7521108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.396212][ T6093] [ 34.396212][ T6093] which lock already depends on the new lock. [ 34.396212][ T6093] [ 34.398874][ T6093] [ 34.398874][ T6093] the existing dependency chain (in reverse order) is: [ 34.401219][ T6093] [ 34.401219][ T6093] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 34.403135][ T6093] __mutex_lock_common+0x190/0x21a0 [ 34.404641][ T6093] mutex_lock_nested+0x2c/0x38 [ 34.405928][ T6093] hci_rfkill_set_block+0xe8/0x20c [ 34.407366][ T6093] rfkill_set_block+0x18c/0x37c [ 34.408725][ T6093] rfkill_fop_write+0x578/0x734 [ 34.410076][ T6093] vfs_write+0x2a0/0x910 [ 34.411342][ T6093] ksys_write+0x15c/0x26c [ 34.412641][ T6093] __arm64_sys_write+0x7c/0x90 [ 34.414010][ T6093] invoke_syscall+0x98/0x2b8 [ 34.415256][ T6093] el0_svc_common+0x130/0x23c [ 34.416615][ T6093] do_el0_svc+0x48/0x58 [ 34.417719][ T6093] el0_svc+0x54/0x158 [ 34.418806][ T6093] el0t_64_sync_handler+0x84/0xfc [ 34.420267][ T6093] el0t_64_sync+0x190/0x194 [ 34.421633][ T6093] [ 34.421633][ T6093] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 34.423717][ T6093] __mutex_lock_common+0x190/0x21a0 [ 34.425183][ T6093] mutex_lock_nested+0x2c/0x38 [ 34.426567][ T6093] rfkill_register+0x44/0x7d4 [ 34.427915][ T6093] hci_register_dev+0x3e0/0x954 [ 34.429275][ T6093] vhci_create_device+0x358/0x6c4 [ 34.430626][ T6093] vhci_write+0x318/0x3b8 [ 34.431932][ T6093] vfs_write+0x610/0x910 [ 34.433147][ T6093] ksys_write+0x15c/0x26c [ 34.434396][ T6093] __arm64_sys_write+0x7c/0x90 [ 34.435758][ T6093] invoke_syscall+0x98/0x2b8 [ 34.437045][ T6093] el0_svc_common+0x130/0x23c [ 34.438357][ T6093] do_el0_svc+0x48/0x58 [ 34.439528][ T6093] el0_svc+0x54/0x158 [ 34.440662][ T6093] el0t_64_sync_handler+0x84/0xfc [ 34.442128][ T6093] el0t_64_sync+0x190/0x194 [ 34.443432][ T6093] [ 34.443432][ T6093] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 34.445412][ T6093] __mutex_lock_common+0x190/0x21a0 [ 34.446958][ T6093] mutex_lock_nested+0x2c/0x38 [ 34.448312][ T6093] vhci_send_frame+0x8c/0x10c [ 34.449630][ T6093] hci_send_frame+0x1c4/0x35c [ 34.451008][ T6093] hci_tx_work+0xba0/0x18e4 [ 34.452324][ T6093] process_one_work+0x694/0x1204 [ 34.453840][ T6093] worker_thread+0x938/0xef4 [ 34.455161][ T6093] kthread+0x288/0x310 [ 34.456310][ T6093] ret_from_fork+0x10/0x20 [ 34.457583][ T6093] [ 34.457583][ T6093] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 34.459893][ T6093] __lock_acquire+0x3384/0x763c [ 34.461320][ T6093] lock_acquire+0x23c/0x71c [ 34.462658][ T6093] __flush_work+0xf8/0x1c0 [ 34.463848][ T6093] flush_work+0x24/0x38 [ 34.464999][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 34.466320][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 34.467768][ T6093] rfkill_set_block+0x18c/0x37c [ 34.469098][ T6093] rfkill_fop_write+0x578/0x734 [ 34.470516][ T6093] vfs_write+0x2a0/0x910 [ 34.471766][ T6093] ksys_write+0x15c/0x26c [ 34.473037][ T6093] __arm64_sys_write+0x7c/0x90 [ 34.474375][ T6093] invoke_syscall+0x98/0x2b8 [ 34.475699][ T6093] el0_svc_common+0x130/0x23c [ 34.476966][ T6093] do_el0_svc+0x48/0x58 [ 34.478169][ T6093] el0_svc+0x54/0x158 [ 34.479318][ T6093] el0t_64_sync_handler+0x84/0xfc [ 34.480743][ T6093] el0t_64_sync+0x190/0x194 [ 34.482060][ T6093] [ 34.482060][ T6093] other info that might help us debug this: [ 34.482060][ T6093] [ 34.484722][ T6093] Chain exists of: [ 34.484722][ T6093] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 34.484722][ T6093] [ 34.488596][ T6093] Possible unsafe locking scenario: [ 34.488596][ T6093] [ 34.490573][ T6093] CPU0 CPU1 [ 34.491993][ T6093] ---- ---- [ 34.493328][ T6093] lock(&hdev->req_lock); [ 34.494409][ T6093] lock(rfkill_global_mutex); [ 34.496407][ T6093] lock(&hdev->req_lock); [ 34.498188][ T6093] lock((work_completion)(&hdev->tx_work)); [ 34.499744][ T6093] [ 34.499744][ T6093] *** DEADLOCK *** [ 34.499744][ T6093] [ 34.501844][ T6093] 2 locks held by syz-executor255/6093: [ 34.503277][ T6093] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 34.505814][ T6093] #1: ffff0000c7521108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.508281][ T6093] [ 34.508281][ T6093] stack backtrace: [ 34.509691][ T6093] CPU: 1 PID: 6093 Comm: syz-executor255 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 34.512263][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 34.514826][ T6093] Call trace: [ 34.515636][ T6093] dump_backtrace+0x1b8/0x1e4 [ 34.516872][ T6093] show_stack+0x2c/0x3c [ 34.517919][ T6093] dump_stack_lvl+0xd0/0x124 [ 34.519072][ T6093] dump_stack+0x1c/0x28 [ 34.520072][ T6093] print_circular_bug+0x150/0x1b8 [ 34.521439][ T6093] check_noncircular+0x310/0x404 [ 34.522701][ T6093] __lock_acquire+0x3384/0x763c [ 34.523950][ T6093] lock_acquire+0x23c/0x71c [ 34.525096][ T6093] __flush_work+0xf8/0x1c0 [ 34.526179][ T6093] flush_work+0x24/0x38 [ 34.527278][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 34.528531][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 34.529971][ T6093] rfkill_set_block+0x18c/0x37c [ 34.531211][ T6093] rfkill_fop_write+0x578/0x734 [ 34.532387][ T6093] vfs_write+0x2a0/0x910 [ 34.533494][ T6093] ksys_write+0x15c/0x26c [ 34.534580][ T6093] __arm64_sys_write+0x7c/0x90 [ 34.535848][ T6093] invoke_syscall+0x98/0x2b8 [ 34.537045][ T6093] el0_svc_common+0x130/0x23c [ 34.538222][ T6093] do_el0_svc+0x48/0x58 [ 34.539346][ T6093] el0_svc+0x54/0x158 [ 34.540347][ T6093] el0t_64_sync_handler+0x84/0xfc [ 34.541643][ T6093] el0t_64_sync+0x190/0x194