Warning: Permanently added '10.128.0.40' (ED25519) to the list of known hosts. [ 33.003039][ T5671] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.005688][ T5671] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.008939][ T5671] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.011313][ T5671] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.013588][ T5671] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 33.015946][ T5671] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 33.052439][ T6093] [ 33.053091][ T6093] ====================================================== [ 33.054884][ T6093] WARNING: possible circular locking dependency detected [ 33.056664][ T6093] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 33.058275][ T6093] ------------------------------------------------------ [ 33.059982][ T6093] syz-executor218/6093 is trying to acquire lock: [ 33.061587][ T6093] ffff0000d3948e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 33.064257][ T6093] [ 33.064257][ T6093] but task is already holding lock: [ 33.066110][ T6093] ffff0000d3949108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.068659][ T6093] [ 33.068659][ T6093] which lock already depends on the new lock. [ 33.068659][ T6093] [ 33.071270][ T6093] [ 33.071270][ T6093] the existing dependency chain (in reverse order) is: [ 33.073550][ T6093] [ 33.073550][ T6093] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 33.075401][ T6093] __mutex_lock_common+0x190/0x21a0 [ 33.076911][ T6093] mutex_lock_nested+0x2c/0x38 [ 33.078296][ T6093] hci_rfkill_set_block+0xe8/0x20c [ 33.079789][ T6093] rfkill_set_block+0x18c/0x37c [ 33.081152][ T6093] rfkill_fop_write+0x578/0x734 [ 33.082536][ T6093] vfs_write+0x2a0/0x910 [ 33.083711][ T6093] ksys_write+0x15c/0x26c [ 33.085001][ T6093] __arm64_sys_write+0x7c/0x90 [ 33.086380][ T6093] invoke_syscall+0x98/0x2b8 [ 33.087611][ T6093] el0_svc_common+0x130/0x23c [ 33.088902][ T6093] do_el0_svc+0x48/0x58 [ 33.090105][ T6093] el0_svc+0x54/0x158 [ 33.091344][ T6093] el0t_64_sync_handler+0x84/0xfc [ 33.092749][ T6093] el0t_64_sync+0x190/0x194 [ 33.094026][ T6093] [ 33.094026][ T6093] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 33.096078][ T6093] __mutex_lock_common+0x190/0x21a0 [ 33.097551][ T6093] mutex_lock_nested+0x2c/0x38 [ 33.098924][ T6093] rfkill_register+0x44/0x7d4 [ 33.100305][ T6093] hci_register_dev+0x3e0/0x954 [ 33.101786][ T6093] vhci_create_device+0x358/0x6c4 [ 33.103208][ T6093] vhci_write+0x318/0x3b8 [ 33.104414][ T6093] vfs_write+0x610/0x910 [ 33.105641][ T6093] ksys_write+0x15c/0x26c [ 33.106802][ T6093] __arm64_sys_write+0x7c/0x90 [ 33.108084][ T6093] invoke_syscall+0x98/0x2b8 [ 33.109340][ T6093] el0_svc_common+0x130/0x23c [ 33.110671][ T6093] do_el0_svc+0x48/0x58 [ 33.111882][ T6093] el0_svc+0x54/0x158 [ 33.113044][ T6093] el0t_64_sync_handler+0x84/0xfc [ 33.114448][ T6093] el0t_64_sync+0x190/0x194 [ 33.115669][ T6093] [ 33.115669][ T6093] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 33.117682][ T6093] __mutex_lock_common+0x190/0x21a0 [ 33.119185][ T6093] mutex_lock_nested+0x2c/0x38 [ 33.120538][ T6093] vhci_send_frame+0x8c/0x10c [ 33.121863][ T6093] hci_send_frame+0x1c4/0x35c [ 33.123149][ T6093] hci_tx_work+0xba0/0x18e4 [ 33.124456][ T6093] process_one_work+0x694/0x1204 [ 33.125873][ T6093] worker_thread+0x938/0xef4 [ 33.127163][ T6093] kthread+0x288/0x310 [ 33.128309][ T6093] ret_from_fork+0x10/0x20 [ 33.129593][ T6093] [ 33.129593][ T6093] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 33.131971][ T6093] __lock_acquire+0x3384/0x763c [ 33.133257][ T6093] lock_acquire+0x23c/0x71c [ 33.134533][ T6093] __flush_work+0xf8/0x1c0 [ 33.135806][ T6093] flush_work+0x24/0x38 [ 33.136980][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 33.138386][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 33.139736][ T6093] rfkill_set_block+0x18c/0x37c [ 33.141161][ T6093] rfkill_fop_write+0x578/0x734 [ 33.142602][ T6093] vfs_write+0x2a0/0x910 [ 33.143843][ T6093] ksys_write+0x15c/0x26c [ 33.145094][ T6093] __arm64_sys_write+0x7c/0x90 [ 33.146389][ T6093] invoke_syscall+0x98/0x2b8 [ 33.147752][ T6093] el0_svc_common+0x130/0x23c [ 33.149063][ T6093] do_el0_svc+0x48/0x58 [ 33.150269][ T6093] el0_svc+0x54/0x158 [ 33.151419][ T6093] el0t_64_sync_handler+0x84/0xfc [ 33.152724][ T6093] el0t_64_sync+0x190/0x194 [ 33.154010][ T6093] [ 33.154010][ T6093] other info that might help us debug this: [ 33.154010][ T6093] [ 33.156638][ T6093] Chain exists of: [ 33.156638][ T6093] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 33.156638][ T6093] [ 33.160391][ T6093] Possible unsafe locking scenario: [ 33.160391][ T6093] [ 33.162253][ T6093] CPU0 CPU1 [ 33.163612][ T6093] ---- ---- [ 33.165001][ T6093] lock(&hdev->req_lock); [ 33.166026][ T6093] lock(rfkill_global_mutex); [ 33.167814][ T6093] lock(&hdev->req_lock); [ 33.169646][ T6093] lock((work_completion)(&hdev->tx_work)); [ 33.171170][ T6093] [ 33.171170][ T6093] *** DEADLOCK *** [ 33.171170][ T6093] [ 33.173295][ T6093] 2 locks held by syz-executor218/6093: [ 33.174695][ T6093] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 33.177271][ T6093] #1: ffff0000d3949108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.179807][ T6093] [ 33.179807][ T6093] stack backtrace: [ 33.181257][ T6093] CPU: 1 PID: 6093 Comm: syz-executor218 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 33.183718][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 33.186263][ T6093] Call trace: [ 33.187032][ T6093] dump_backtrace+0x1b8/0x1e4 [ 33.188186][ T6093] show_stack+0x2c/0x3c [ 33.189237][ T6093] dump_stack_lvl+0xd0/0x124 [ 33.190415][ T6093] dump_stack+0x1c/0x28 [ 33.191482][ T6093] print_circular_bug+0x150/0x1b8 [ 33.192692][ T6093] check_noncircular+0x310/0x404 [ 33.193955][ T6093] __lock_acquire+0x3384/0x763c [ 33.195157][ T6093] lock_acquire+0x23c/0x71c [ 33.196249][ T6093] __flush_work+0xf8/0x1c0 [ 33.197394][ T6093] flush_work+0x24/0x38 [ 33.198450][ T6093] hci_dev_close_sync+0x1c8/0xf30 [ 33.199752][ T6093] hci_rfkill_set_block+0xf0/0x20c [ 33.201066][ T6093] rfkill_set_block+0x18c/0x37c [ 33.202235][ T6093] rfkill_fop_write+0x578/0x734 [ 33.203398][ T6093] vfs_write+0x2a0/0x910 [ 33.204449][ T6093] ksys_write+0x15c/0x26c [ 33.205418][ T6093] __arm64_sys_write+0x7c/0x90 [ 33.206644][ T6093] invoke_syscall+0x98/0x2b8 [ 33.207715][ T6093] el0_svc_common+0x130/0x23c [ 33.208869][ T6093] do_el0_svc+0x48/0x58 [ 33.209927][ T6093] el0_svc+0x54/0x158 [ 33.210892][ T6093] el0t_64_sync_handler+0x84/0xfc [ 33.212187][ T6093] el0t_64_sync+0x190/0x194