Warning: Permanently added '10.128.0.195' (ED25519) to the list of known hosts. [ 35.284343][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.287092][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.289350][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.291783][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.293943][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 35.296821][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 35.440979][ T6103] [ 35.441705][ T6103] ====================================================== [ 35.443439][ T6103] WARNING: possible circular locking dependency detected [ 35.445145][ T6103] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 35.446909][ T6103] ------------------------------------------------------ [ 35.448624][ T6103] syz-executor140/6103 is trying to acquire lock: [ 35.450128][ T6103] ffff0000cb0f8e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 35.452605][ T6103] [ 35.452605][ T6103] but task is already holding lock: [ 35.454476][ T6103] ffff0000cb0f9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.456912][ T6103] [ 35.456912][ T6103] which lock already depends on the new lock. [ 35.456912][ T6103] [ 35.459573][ T6103] [ 35.459573][ T6103] the existing dependency chain (in reverse order) is: [ 35.461816][ T6103] [ 35.461816][ T6103] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 35.463756][ T6103] __mutex_lock_common+0x190/0x21a0 [ 35.465247][ T6103] mutex_lock_nested+0x2c/0x38 [ 35.466625][ T6103] hci_rfkill_set_block+0xe8/0x20c [ 35.468083][ T6103] rfkill_set_block+0x18c/0x37c [ 35.469524][ T6103] rfkill_fop_write+0x578/0x734 [ 35.470771][ T6103] vfs_write+0x2a0/0x910 [ 35.472034][ T6103] ksys_write+0x15c/0x26c [ 35.473315][ T6103] __arm64_sys_write+0x7c/0x90 [ 35.474651][ T6103] invoke_syscall+0x98/0x2b8 [ 35.475968][ T6103] el0_svc_common+0x130/0x23c [ 35.477279][ T6103] do_el0_svc+0x48/0x58 [ 35.478502][ T6103] el0_svc+0x54/0x158 [ 35.479694][ T6103] el0t_64_sync_handler+0x84/0xfc [ 35.481101][ T6103] el0t_64_sync+0x190/0x194 [ 35.482378][ T6103] [ 35.482378][ T6103] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 35.484331][ T6103] __mutex_lock_common+0x190/0x21a0 [ 35.485686][ T6103] mutex_lock_nested+0x2c/0x38 [ 35.487023][ T6103] rfkill_register+0x44/0x7d4 [ 35.488301][ T6103] hci_register_dev+0x3e0/0x954 [ 35.489666][ T6103] vhci_create_device+0x358/0x6c4 [ 35.491045][ T6103] vhci_write+0x318/0x3b8 [ 35.492276][ T6103] vfs_write+0x610/0x910 [ 35.493495][ T6103] ksys_write+0x15c/0x26c [ 35.494697][ T6103] __arm64_sys_write+0x7c/0x90 [ 35.496043][ T6103] invoke_syscall+0x98/0x2b8 [ 35.497343][ T6103] el0_svc_common+0x130/0x23c [ 35.498633][ T6103] do_el0_svc+0x48/0x58 [ 35.499819][ T6103] el0_svc+0x54/0x158 [ 35.500852][ T6103] el0t_64_sync_handler+0x84/0xfc [ 35.502264][ T6103] el0t_64_sync+0x190/0x194 [ 35.503537][ T6103] [ 35.503537][ T6103] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 35.505553][ T6103] __mutex_lock_common+0x190/0x21a0 [ 35.506914][ T6103] mutex_lock_nested+0x2c/0x38 [ 35.508339][ T6103] vhci_send_frame+0x8c/0x10c [ 35.509678][ T6103] hci_send_frame+0x1c4/0x35c [ 35.511146][ T6103] hci_tx_work+0xba0/0x18e4 [ 35.512449][ T6103] process_one_work+0x694/0x1204 [ 35.513885][ T6103] worker_thread+0x938/0xef4 [ 35.515247][ T6103] kthread+0x288/0x310 [ 35.516482][ T6103] ret_from_fork+0x10/0x20 [ 35.517708][ T6103] [ 35.517708][ T6103] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 35.519926][ T6103] __lock_acquire+0x3384/0x763c [ 35.521252][ T6103] lock_acquire+0x23c/0x71c [ 35.522712][ T6103] __flush_work+0xf8/0x1c0 [ 35.523949][ T6103] flush_work+0x24/0x38 [ 35.525157][ T6103] hci_dev_close_sync+0x1c8/0xf30 [ 35.526615][ T6103] hci_rfkill_set_block+0xf0/0x20c [ 35.528065][ T6103] rfkill_set_block+0x18c/0x37c [ 35.529403][ T6103] rfkill_fop_write+0x578/0x734 [ 35.530768][ T6103] vfs_write+0x2a0/0x910 [ 35.531950][ T6103] ksys_write+0x15c/0x26c [ 35.533176][ T6103] __arm64_sys_write+0x7c/0x90 [ 35.534549][ T6103] invoke_syscall+0x98/0x2b8 [ 35.535793][ T6103] el0_svc_common+0x130/0x23c [ 35.537130][ T6103] do_el0_svc+0x48/0x58 [ 35.538365][ T6103] el0_svc+0x54/0x158 [ 35.539522][ T6103] el0t_64_sync_handler+0x84/0xfc [ 35.540961][ T6103] el0t_64_sync+0x190/0x194 [ 35.542154][ T6103] [ 35.542154][ T6103] other info that might help us debug this: [ 35.542154][ T6103] [ 35.544702][ T6103] Chain exists of: [ 35.544702][ T6103] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 35.544702][ T6103] [ 35.548407][ T6103] Possible unsafe locking scenario: [ 35.548407][ T6103] [ 35.550237][ T6103] CPU0 CPU1 [ 35.551483][ T6103] ---- ---- [ 35.552830][ T6103] lock(&hdev->req_lock); [ 35.553987][ T6103] lock(rfkill_global_mutex); [ 35.555878][ T6103] lock(&hdev->req_lock); [ 35.557631][ T6103] lock((work_completion)(&hdev->tx_work)); [ 35.559226][ T6103] [ 35.559226][ T6103] *** DEADLOCK *** [ 35.559226][ T6103] [ 35.561174][ T6103] 2 locks held by syz-executor140/6103: [ 35.562521][ T6103] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 35.565035][ T6103] #1: ffff0000cb0f9108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.567570][ T6103] [ 35.567570][ T6103] stack backtrace: [ 35.568984][ T6103] CPU: 0 PID: 6103 Comm: syz-executor140 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 35.571363][ T6103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 35.573855][ T6103] Call trace: [ 35.574649][ T6103] dump_backtrace+0x1b8/0x1e4 [ 35.575895][ T6103] show_stack+0x2c/0x3c [ 35.576874][ T6103] dump_stack_lvl+0xd0/0x124 [ 35.578004][ T6103] dump_stack+0x1c/0x28 [ 35.579231][ T6103] print_circular_bug+0x150/0x1b8 [ 35.580531][ T6103] check_noncircular+0x310/0x404 [ 35.581782][ T6103] __lock_acquire+0x3384/0x763c [ 35.583117][ T6103] lock_acquire+0x23c/0x71c [ 35.584484][ T6103] __flush_work+0xf8/0x1c0 [ 35.585584][ T6103] flush_work+0x24/0x38 [ 35.586619][ T6103] hci_dev_close_sync+0x1c8/0xf30 [ 35.587871][ T6103] hci_rfkill_set_block+0xf0/0x20c [ 35.589167][ T6103] rfkill_set_block+0x18c/0x37c [ 35.590332][ T6103] rfkill_fop_write+0x578/0x734 [ 35.591596][ T6103] vfs_write+0x2a0/0x910 [ 35.592730][ T6103] ksys_write+0x15c/0x26c [ 35.593801][ T6103] __arm64_sys_write+0x7c/0x90 [ 35.595011][ T6103] invoke_syscall+0x98/0x2b8 [ 35.596146][ T6103] el0_svc_common+0x130/0x23c [ 35.597277][ T6103] do_el0_svc+0x48/0x58 [ 35.598291][ T6103] el0_svc+0x54/0x158 [ 35.599278][ T6103] el0t_64_sync_handler+0x84/0xfc [ 35.600536][ T6103] el0t_64_sync+0x190/0x194