Warning: Permanently added '10.128.1.187' (ED25519) to the list of known hosts. executing program [ 42.110492][ T3966] [ 42.111109][ T3966] ====================================================== [ 42.112719][ T3966] WARNING: possible circular locking dependency detected [ 42.114468][ T3966] 5.15.137-syzkaller #0 Not tainted [ 42.115795][ T3966] ------------------------------------------------------ [ 42.117386][ T3966] syz-executor306/3966 is trying to acquire lock: [ 42.118916][ T3966] ffff0000c8d4cb98 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 42.121546][ T3966] [ 42.121546][ T3966] but task is already holding lock: [ 42.123439][ T3966] ffff0000c8d4cff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 42.125715][ T3966] [ 42.125715][ T3966] which lock already depends on the new lock. [ 42.125715][ T3966] [ 42.128282][ T3966] [ 42.128282][ T3966] the existing dependency chain (in reverse order) is: [ 42.130467][ T3966] [ 42.130467][ T3966] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 42.132367][ T3966] __mutex_lock_common+0x194/0x2154 [ 42.133805][ T3966] mutex_lock_nested+0xa4/0xf8 [ 42.135093][ T3966] hci_dev_do_close+0x64/0x1060 [ 42.136434][ T3966] hci_rfkill_set_block+0xdc/0x1d0 [ 42.137894][ T3966] rfkill_set_block+0x18c/0x37c [ 42.139128][ T3966] rfkill_fop_write+0x594/0x750 [ 42.140444][ T3966] vfs_write+0x280/0xb3c [ 42.141627][ T3966] ksys_write+0x15c/0x26c [ 42.142819][ T3966] __arm64_sys_write+0x7c/0x90 [ 42.144158][ T3966] invoke_syscall+0x98/0x2b8 [ 42.145329][ T3966] el0_svc_common+0x138/0x258 [ 42.146626][ T3966] do_el0_svc+0x58/0x14c [ 42.147743][ T3966] el0_svc+0x7c/0x1f0 [ 42.148837][ T3966] el0t_64_sync_handler+0x84/0xe4 [ 42.150163][ T3966] el0t_64_sync+0x1a0/0x1a4 [ 42.151387][ T3966] [ 42.151387][ T3966] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 42.153392][ T3966] __mutex_lock_common+0x194/0x2154 [ 42.154800][ T3966] mutex_lock_nested+0xa4/0xf8 [ 42.156060][ T3966] rfkill_register+0x44/0x7a4 [ 42.157368][ T3966] hci_register_dev+0x3e0/0x880 [ 42.158664][ T3966] vhci_create_device+0x2c4/0x568 [ 42.159962][ T3966] vhci_write+0x318/0x3b8 [ 42.161121][ T3966] vfs_write+0x87c/0xb3c [ 42.162266][ T3966] ksys_write+0x15c/0x26c [ 42.163449][ T3966] __arm64_sys_write+0x7c/0x90 [ 42.164729][ T3966] invoke_syscall+0x98/0x2b8 [ 42.165982][ T3966] el0_svc_common+0x138/0x258 [ 42.167305][ T3966] do_el0_svc+0x58/0x14c [ 42.168434][ T3966] el0_svc+0x7c/0x1f0 [ 42.169515][ T3966] el0t_64_sync_handler+0x84/0xe4 [ 42.170862][ T3966] el0t_64_sync+0x1a0/0x1a4 [ 42.172111][ T3966] [ 42.172111][ T3966] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 42.173965][ T3966] __mutex_lock_common+0x194/0x2154 [ 42.175403][ T3966] mutex_lock_nested+0xa4/0xf8 [ 42.176697][ T3966] vhci_send_frame+0x8c/0x10c [ 42.178025][ T3966] hci_send_frame+0x194/0x2f0 [ 42.179223][ T3966] hci_tx_work+0x8d8/0x157c [ 42.180463][ T3966] process_one_work+0x790/0x11b8 [ 42.181829][ T3966] worker_thread+0x910/0x1034 [ 42.183013][ T3966] kthread+0x37c/0x45c [ 42.184126][ T3966] ret_from_fork+0x10/0x20 [ 42.185399][ T3966] [ 42.185399][ T3966] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 42.187629][ T3966] __lock_acquire+0x32cc/0x7620 [ 42.189014][ T3966] lock_acquire+0x240/0x77c [ 42.190280][ T3966] __flush_work+0xf8/0x1c0 [ 42.191412][ T3966] flush_work+0x24/0x38 [ 42.192498][ T3966] hci_dev_do_close+0x16c/0x1060 [ 42.193780][ T3966] hci_rfkill_set_block+0xdc/0x1d0 [ 42.195202][ T3966] rfkill_set_block+0x18c/0x37c [ 42.196510][ T3966] rfkill_fop_write+0x594/0x750 [ 42.197778][ T3966] vfs_write+0x280/0xb3c [ 42.198624][ T3966] ksys_write+0x15c/0x26c [ 42.199491][ T3966] __arm64_sys_write+0x7c/0x90 [ 42.200429][ T3966] invoke_syscall+0x98/0x2b8 [ 42.201327][ T3966] el0_svc_common+0x138/0x258 [ 42.202274][ T3966] do_el0_svc+0x58/0x14c [ 42.203318][ T3966] el0_svc+0x7c/0x1f0 [ 42.204422][ T3966] el0t_64_sync_handler+0x84/0xe4 [ 42.205775][ T3966] el0t_64_sync+0x1a0/0x1a4 [ 42.206989][ T3966] [ 42.206989][ T3966] other info that might help us debug this: [ 42.206989][ T3966] [ 42.209458][ T3966] Chain exists of: [ 42.209458][ T3966] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 42.209458][ T3966] [ 42.212834][ T3966] Possible unsafe locking scenario: [ 42.212834][ T3966] [ 42.214629][ T3966] CPU0 CPU1 [ 42.215964][ T3966] ---- ---- [ 42.217232][ T3966] lock(&hdev->req_lock); [ 42.218240][ T3966] lock(rfkill_global_mutex); [ 42.219984][ T3966] lock(&hdev->req_lock); [ 42.221616][ T3966] lock((work_completion)(&hdev->tx_work)); [ 42.223080][ T3966] [ 42.223080][ T3966] *** DEADLOCK *** [ 42.223080][ T3966] [ 42.225025][ T3966] 2 locks held by syz-executor306/3966: [ 42.226429][ T3966] #0: ffff800016c8cc08 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x250/0x750 [ 42.228923][ T3966] #1: ffff0000c8d4cff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 42.231247][ T3966] [ 42.231247][ T3966] stack backtrace: [ 42.232630][ T3966] CPU: 1 PID: 3966 Comm: syz-executor306 Not tainted 5.15.137-syzkaller #0 [ 42.234614][ T3966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 42.237089][ T3966] Call trace: [ 42.237867][ T3966] dump_backtrace+0x0/0x530 [ 42.238924][ T3966] show_stack+0x2c/0x3c [ 42.239898][ T3966] dump_stack_lvl+0x108/0x170 [ 42.241128][ T3966] dump_stack+0x1c/0x58 [ 42.242118][ T3966] print_circular_bug+0x150/0x1b8 [ 42.243258][ T3966] check_noncircular+0x2cc/0x378 [ 42.244464][ T3966] __lock_acquire+0x32cc/0x7620 [ 42.245632][ T3966] lock_acquire+0x240/0x77c [ 42.246728][ T3966] __flush_work+0xf8/0x1c0 [ 42.247799][ T3966] flush_work+0x24/0x38 [ 42.248764][ T3966] hci_dev_do_close+0x16c/0x1060 [ 42.249986][ T3966] hci_rfkill_set_block+0xdc/0x1d0 [ 42.251126][ T3966] rfkill_set_block+0x18c/0x37c [ 42.252274][ T3966] rfkill_fop_write+0x594/0x750 [ 42.253373][ T3966] vfs_write+0x280/0xb3c [ 42.254422][ T3966] ksys_write+0x15c/0x26c [ 42.255460][ T3966] __arm64_sys_write+0x7c/0x90 [ 42.256575][ T3966] invoke_syscall+0x98/0x2b8 [ 42.257676][ T3966] el0_svc_common+0x138/0x258 [ 42.258747][ T3966] do_el0_svc+0x58/0x14c [ 42.259769][ T3966] el0_svc+0x7c/0x1f0 [ 42.260668][ T3966] el0t_64_sync_handler+0x84/0xe4 [ 42.261961][ T3966] el0t_64_sync+0x1a0/0x1a4