Warning: Permanently added '10.128.0.46' (ED25519) to the list of known hosts. [ 33.080918][ T6095] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.083958][ T6095] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.086625][ T6095] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.089539][ T6095] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.092036][ T6095] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 33.094207][ T6095] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 33.237808][ T6092] [ 33.238432][ T6092] ====================================================== [ 33.240359][ T6092] WARNING: possible circular locking dependency detected [ 33.242272][ T6092] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 33.243818][ T6092] ------------------------------------------------------ [ 33.245803][ T6092] syz-executor220/6092 is trying to acquire lock: [ 33.247622][ T6092] ffff0000d37ece10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 33.250617][ T6092] [ 33.250617][ T6092] but task is already holding lock: [ 33.252558][ T6092] ffff0000d37ed108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.255074][ T6092] [ 33.255074][ T6092] which lock already depends on the new lock. [ 33.255074][ T6092] [ 33.257740][ T6092] [ 33.257740][ T6092] the existing dependency chain (in reverse order) is: [ 33.260202][ T6092] [ 33.260202][ T6092] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 33.262327][ T6092] __mutex_lock_common+0x190/0x21a0 [ 33.263880][ T6092] mutex_lock_nested+0x2c/0x38 [ 33.265388][ T6092] hci_rfkill_set_block+0xe8/0x20c [ 33.266887][ T6092] rfkill_set_block+0x18c/0x37c [ 33.268388][ T6092] rfkill_fop_write+0x578/0x734 [ 33.269879][ T6092] vfs_write+0x2a0/0x910 [ 33.271193][ T6092] ksys_write+0x15c/0x26c [ 33.272500][ T6092] __arm64_sys_write+0x7c/0x90 [ 33.273844][ T6092] invoke_syscall+0x98/0x2b8 [ 33.275280][ T6092] el0_svc_common+0x130/0x23c [ 33.276597][ T6092] do_el0_svc+0x48/0x58 [ 33.277873][ T6092] el0_svc+0x54/0x158 [ 33.278988][ T6092] el0t_64_sync_handler+0x84/0xfc [ 33.280604][ T6092] el0t_64_sync+0x190/0x194 [ 33.282059][ T6092] [ 33.282059][ T6092] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 33.284233][ T6092] __mutex_lock_common+0x190/0x21a0 [ 33.285651][ T6092] mutex_lock_nested+0x2c/0x38 [ 33.287162][ T6092] rfkill_register+0x44/0x7d4 [ 33.288501][ T6092] hci_register_dev+0x3e0/0x954 [ 33.289900][ T6092] vhci_create_device+0x358/0x6c4 [ 33.291331][ T6092] vhci_write+0x318/0x3b8 [ 33.292692][ T6092] vfs_write+0x610/0x910 [ 33.293957][ T6092] ksys_write+0x15c/0x26c [ 33.295248][ T6092] __arm64_sys_write+0x7c/0x90 [ 33.296706][ T6092] invoke_syscall+0x98/0x2b8 [ 33.298038][ T6092] el0_svc_common+0x130/0x23c [ 33.299479][ T6092] do_el0_svc+0x48/0x58 [ 33.300659][ T6092] el0_svc+0x54/0x158 [ 33.302043][ T6092] el0t_64_sync_handler+0x84/0xfc [ 33.303451][ T6092] el0t_64_sync+0x190/0x194 [ 33.304839][ T6092] [ 33.304839][ T6092] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 33.306869][ T6092] __mutex_lock_common+0x190/0x21a0 [ 33.308455][ T6092] mutex_lock_nested+0x2c/0x38 [ 33.309803][ T6092] vhci_send_frame+0x8c/0x10c [ 33.311112][ T6092] hci_send_frame+0x1c4/0x35c [ 33.312479][ T6092] hci_tx_work+0xba0/0x18e4 [ 33.313833][ T6092] process_one_work+0x694/0x1204 [ 33.315197][ T6092] worker_thread+0x938/0xef4 [ 33.316537][ T6092] kthread+0x288/0x310 [ 33.317750][ T6092] ret_from_fork+0x10/0x20 [ 33.319034][ T6092] [ 33.319034][ T6092] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 33.321464][ T6092] __lock_acquire+0x3384/0x763c [ 33.322807][ T6092] lock_acquire+0x23c/0x71c [ 33.324126][ T6092] __flush_work+0xf8/0x1c0 [ 33.325368][ T6092] flush_work+0x24/0x38 [ 33.326657][ T6092] hci_dev_close_sync+0x1c8/0xf30 [ 33.328055][ T6092] hci_rfkill_set_block+0xf0/0x20c [ 33.329461][ T6092] rfkill_set_block+0x18c/0x37c [ 33.330895][ T6092] rfkill_fop_write+0x578/0x734 [ 33.332401][ T6092] vfs_write+0x2a0/0x910 [ 33.333609][ T6092] ksys_write+0x15c/0x26c [ 33.334458][ T6092] __arm64_sys_write+0x7c/0x90 [ 33.335396][ T6092] invoke_syscall+0x98/0x2b8 [ 33.336640][ T6092] el0_svc_common+0x130/0x23c [ 33.337860][ T6092] do_el0_svc+0x48/0x58 [ 33.339201][ T6092] el0_svc+0x54/0x158 [ 33.340405][ T6092] el0t_64_sync_handler+0x84/0xfc [ 33.341874][ T6092] el0t_64_sync+0x190/0x194 [ 33.343209][ T6092] [ 33.343209][ T6092] other info that might help us debug this: [ 33.343209][ T6092] [ 33.345749][ T6092] Chain exists of: [ 33.345749][ T6092] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 33.345749][ T6092] [ 33.349657][ T6092] Possible unsafe locking scenario: [ 33.349657][ T6092] [ 33.351599][ T6092] CPU0 CPU1 [ 33.352933][ T6092] ---- ---- [ 33.354303][ T6092] lock(&hdev->req_lock); [ 33.355521][ T6092] lock(rfkill_global_mutex); [ 33.357442][ T6092] lock(&hdev->req_lock); [ 33.359229][ T6092] lock((work_completion)(&hdev->tx_work)); [ 33.360782][ T6092] [ 33.360782][ T6092] *** DEADLOCK *** [ 33.360782][ T6092] [ 33.362748][ T6092] 2 locks held by syz-executor220/6092: [ 33.364206][ T6092] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 33.366823][ T6092] #1: ffff0000d37ed108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.369355][ T6092] [ 33.369355][ T6092] stack backtrace: [ 33.370890][ T6092] CPU: 1 PID: 6092 Comm: syz-executor220 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 33.373543][ T6092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 33.376212][ T6092] Call trace: [ 33.377045][ T6092] dump_backtrace+0x1b8/0x1e4 [ 33.378249][ T6092] show_stack+0x2c/0x3c [ 33.379324][ T6092] dump_stack_lvl+0xd0/0x124 [ 33.380555][ T6092] dump_stack+0x1c/0x28 [ 33.381624][ T6092] print_circular_bug+0x150/0x1b8 [ 33.382905][ T6092] check_noncircular+0x310/0x404 [ 33.384185][ T6092] __lock_acquire+0x3384/0x763c [ 33.385450][ T6092] lock_acquire+0x23c/0x71c [ 33.386635][ T6092] __flush_work+0xf8/0x1c0 [ 33.387708][ T6092] flush_work+0x24/0x38 [ 33.388733][ T6092] hci_dev_close_sync+0x1c8/0xf30 [ 33.389956][ T6092] hci_rfkill_set_block+0xf0/0x20c [ 33.391292][ T6092] rfkill_set_block+0x18c/0x37c [ 33.392675][ T6092] rfkill_fop_write+0x578/0x734 [ 33.393973][ T6092] vfs_write+0x2a0/0x910 [ 33.395075][ T6092] ksys_write+0x15c/0x26c [ 33.396230][ T6092] __arm64_sys_write+0x7c/0x90 [ 33.397431][ T6092] invoke_syscall+0x98/0x2b8 [ 33.398568][ T6092] el0_svc_common+0x130/0x23c [ 33.399767][ T6092] do_el0_svc+0x48/0x58 [ 33.400797][ T6092] el0_svc+0x54/0x158 [ 33.401832][ T6092] el0t_64_sync_handler+0x84/0xfc [ 33.403038][ T6092] el0t_64_sync+0x190/0x194