Warning: Permanently added '10.128.0.197' (ED25519) to the list of known hosts. [ 32.229364][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 32.232592][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 32.235006][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 32.237484][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 32.239880][ T52] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 32.242307][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 34.232376][ T52] BUG: workqueue leaked atomic, lock or RCU: kworker/u9:0[52] [ 34.232376][ T52] preempt=0x00000000 lock=0->1 RCU=0->0 workfn=hci_rx_work [ 34.236366][ T52] 1 lock held by kworker/u9:0/52: [ 34.237651][ T52] #0: ffff0000d9876518 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x610/0xc934 [ 34.240128][ T52] CPU: 1 PID: 52 Comm: kworker/u9:0 Not tainted 6.10.0-rc7-syzkaller-gef445d1539dd #0 [ 34.242588][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 34.245187][ T52] Workqueue: hci0 hci_rx_work [ 34.246395][ T52] Call trace: [ 34.247256][ T52] dump_backtrace+0x1b8/0x1e4 [ 34.248480][ T52] show_stack+0x2c/0x3c [ 34.249529][ T52] dump_stack_lvl+0xe4/0x150 [ 34.250736][ T52] dump_stack+0x1c/0x28 [ 34.251881][ T52] process_one_work+0xdc0/0x15b8 [ 34.253228][ T52] worker_thread+0x938/0xecc [ 34.254395][ T52] kthread+0x288/0x310 [ 34.255448][ T52] ret_from_fork+0x10/0x20 [ 34.257275][ T52] [ 34.257872][ T52] ====================================================== [ 34.259585][ T52] WARNING: possible circular locking dependency detected [ 34.261308][ T52] 6.10.0-rc7-syzkaller-gef445d1539dd #0 Not tainted [ 34.263044][ T52] ------------------------------------------------------ [ 34.264911][ T52] kworker/u9:0/52 is trying to acquire lock: [ 34.266452][ T52] ffff0000d385e948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x624/0x15b8 [ 34.269143][ T52] [ 34.269143][ T52] but task is already holding lock: [ 34.271093][ T52] ffff0000d9876518 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x610/0xc934 [ 34.273532][ T52] [ 34.273532][ T52] which lock already depends on the new lock. [ 34.273532][ T52] [ 34.276310][ T52] [ 34.276310][ T52] the existing dependency chain (in reverse order) is: [ 34.278792][ T52] [ 34.278792][ T52] -> #1 (&chan->lock/1){+.+.}-{3:3}: [ 34.280806][ T52] lock_release+0x334/0x9b8 [ 34.282213][ T52] process_one_work+0x8a0/0x15b8 [ 34.283754][ T52] worker_thread+0x938/0xecc [ 34.285057][ T52] kthread+0x288/0x310 [ 34.286204][ T52] ret_from_fork+0x10/0x20 [ 34.287460][ T52] [ 34.287460][ T52] -> #0 ((wq_completion)hci0#2){+.+.}-{0:0}: [ 34.289642][ T52] __lock_acquire+0x3384/0x763c [ 34.291039][ T52] lock_acquire+0x240/0x728 [ 34.292391][ T52] process_one_work+0x668/0x15b8 [ 34.293795][ T52] worker_thread+0x938/0xecc [ 34.295202][ T52] kthread+0x288/0x310 [ 34.296447][ T52] ret_from_fork+0x10/0x20 [ 34.297825][ T52] [ 34.297825][ T52] other info that might help us debug this: [ 34.297825][ T52] [ 34.300553][ T52] Possible unsafe locking scenario: [ 34.300553][ T52] [ 34.302538][ T52] CPU0 CPU1 [ 34.303964][ T52] ---- ---- [ 34.305521][ T52] lock(&chan->lock/1); [ 34.306744][ T52] lock((wq_completion)hci0#2); [ 34.308761][ T52] lock(&chan->lock/1); [ 34.310630][ T52] lock((wq_completion)hci0#2); [ 34.312008][ T52] [ 34.312008][ T52] *** DEADLOCK *** [ 34.312008][ T52] [ 34.314218][ T52] 1 lock held by kworker/u9:0/52: [ 34.315555][ T52] #0: ffff0000d9876518 (&chan->lock/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x610/0xc934 [ 34.318172][ T52] [ 34.318172][ T52] stack backtrace: [ 34.319854][ T52] CPU: 1 PID: 52 Comm: kworker/u9:0 Not tainted 6.10.0-rc7-syzkaller-gef445d1539dd #0 [ 34.322453][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 34.325308][ T52] Workqueue: hci0 hci_cmd_timeout [ 34.326765][ T52] Call trace: [ 34.327705][ T52] dump_backtrace+0x1b8/0x1e4 [ 34.328997][ T52] show_stack+0x2c/0x3c [ 34.330075][ T52] dump_stack_lvl+0xe4/0x150 [ 34.331450][ T52] dump_stack+0x1c/0x28 [ 34.332533][ T52] print_circular_bug+0x150/0x1b8 [ 34.333896][ T52] check_noncircular+0x310/0x404 [ 34.335240][ T52] __lock_acquire+0x3384/0x763c [ 34.336561][ T52] lock_acquire+0x240/0x728 [ 34.337768][ T52] process_one_work+0x668/0x15b8 [ 34.339041][ T52] worker_thread+0x938/0xecc [ 34.340314][ T52] kthread+0x288/0x310 [ 34.341390][ T52] ret_from_fork+0x10/0x20 [ 34.342696][ T52] Bluetooth: hci0: command tx timeout [ 34.344207][ T52] BUG: workqueue leaked atomic, lock or RCU: kworker/u9:0[52] [ 34.344207][ T52] preempt=0x00000000 lock=1->0 RCU=0->0 workfn=hci_cmd_timeout [ 34.348133][ T52] INFO: lockdep is turned off. [ 34.349386][ T52] CPU: 1 PID: 52 Comm: kworker/u9:0 Not tainted 6.10.0-rc7-syzkaller-gef445d1539dd #0 [ 34.351952][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 34.354663][ T52] Workqueue: hci0 hci_cmd_timeout [ 34.356037][ T52] Call trace: [ 34.356929][ T52] dump_backtrace+0x1b8/0x1e4 [ 34.358282][ T52] show_stack+0x2c/0x3c [ 34.359362][ T52] dump_stack_lvl+0xe4/0x150 [ 34.360584][ T52] dump_stack+0x1c/0x28 [ 34.361746][ T52] process_one_work+0xdc0/0x15b8 [ 34.363074][ T52] worker_thread+0x938/0xecc [ 34.364351][ T52] kthread+0x288/0x310 [ 34.365480][ T52] ret_from_fork+0x10/0x20 [ 36.411853][ T52] Bluetooth: hci0: command tx timeout [ 38.491844][ T52] Bluetooth: hci0: command tx timeout [ 40.571863][ T52] Bluetooth: hci0: command tx timeout