Warning: Permanently added '10.128.10.55' (ED25519) to the list of known hosts. syzkaller login: [ 34.152482][ T5673] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.155052][ T5673] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.157364][ T5673] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.160383][ T5673] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.162529][ T5673] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 34.164490][ T5673] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 34.302624][ T6095] [ 34.303216][ T6095] ====================================================== [ 34.304962][ T6095] WARNING: possible circular locking dependency detected [ 34.306696][ T6095] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 34.308298][ T6095] ------------------------------------------------------ [ 34.310021][ T6095] syz-executor320/6095 is trying to acquire lock: [ 34.311642][ T6095] ffff0000d1064e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 34.314405][ T6095] [ 34.314405][ T6095] but task is already holding lock: [ 34.316317][ T6095] ffff0000d1065108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.318851][ T6095] [ 34.318851][ T6095] which lock already depends on the new lock. [ 34.318851][ T6095] [ 34.321592][ T6095] [ 34.321592][ T6095] the existing dependency chain (in reverse order) is: [ 34.324016][ T6095] [ 34.324016][ T6095] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 34.326058][ T6095] __mutex_lock_common+0x190/0x21a0 [ 34.327548][ T6095] mutex_lock_nested+0x2c/0x38 [ 34.328945][ T6095] hci_rfkill_set_block+0xe8/0x20c [ 34.330468][ T6095] rfkill_set_block+0x18c/0x37c [ 34.331907][ T6095] rfkill_fop_write+0x578/0x734 [ 34.333376][ T6095] vfs_write+0x2a0/0x910 [ 34.334656][ T6095] ksys_write+0x15c/0x26c [ 34.335972][ T6095] __arm64_sys_write+0x7c/0x90 [ 34.337343][ T6095] invoke_syscall+0x98/0x2b8 [ 34.338702][ T6095] el0_svc_common+0x130/0x23c [ 34.340104][ T6095] do_el0_svc+0x48/0x58 [ 34.341381][ T6095] el0_svc+0x54/0x158 [ 34.342556][ T6095] el0t_64_sync_handler+0x84/0xfc [ 34.344004][ T6095] el0t_64_sync+0x190/0x194 [ 34.345370][ T6095] [ 34.345370][ T6095] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 34.347503][ T6095] __mutex_lock_common+0x190/0x21a0 [ 34.348972][ T6095] mutex_lock_nested+0x2c/0x38 [ 34.350386][ T6095] rfkill_register+0x44/0x7d4 [ 34.351754][ T6095] hci_register_dev+0x3e0/0x954 [ 34.353172][ T6095] vhci_create_device+0x358/0x6c4 [ 34.354673][ T6095] vhci_write+0x318/0x3b8 [ 34.355970][ T6095] vfs_write+0x610/0x910 [ 34.357158][ T6095] ksys_write+0x15c/0x26c [ 34.358441][ T6095] __arm64_sys_write+0x7c/0x90 [ 34.359735][ T6095] invoke_syscall+0x98/0x2b8 [ 34.361015][ T6095] el0_svc_common+0x130/0x23c [ 34.362379][ T6095] do_el0_svc+0x48/0x58 [ 34.363562][ T6095] el0_svc+0x54/0x158 [ 34.364735][ T6095] el0t_64_sync_handler+0x84/0xfc [ 34.366158][ T6095] el0t_64_sync+0x190/0x194 [ 34.367416][ T6095] [ 34.367416][ T6095] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 34.369517][ T6095] __mutex_lock_common+0x190/0x21a0 [ 34.370973][ T6095] mutex_lock_nested+0x2c/0x38 [ 34.372298][ T6095] vhci_send_frame+0x8c/0x10c [ 34.373527][ T6095] hci_send_frame+0x1c4/0x35c [ 34.374883][ T6095] hci_tx_work+0xba0/0x18e4 [ 34.376232][ T6095] process_one_work+0x694/0x1204 [ 34.377613][ T6095] worker_thread+0x938/0xef4 [ 34.378927][ T6095] kthread+0x288/0x310 [ 34.380043][ T6095] ret_from_fork+0x10/0x20 [ 34.381319][ T6095] [ 34.381319][ T6095] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 34.383739][ T6095] __lock_acquire+0x3384/0x763c [ 34.385135][ T6095] lock_acquire+0x23c/0x71c [ 34.386491][ T6095] __flush_work+0xf8/0x1c0 [ 34.387867][ T6095] flush_work+0x24/0x38 [ 34.389060][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 34.390541][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 34.391889][ T6095] rfkill_set_block+0x18c/0x37c [ 34.393280][ T6095] rfkill_fop_write+0x578/0x734 [ 34.394619][ T6095] vfs_write+0x2a0/0x910 [ 34.395900][ T6095] ksys_write+0x15c/0x26c [ 34.397208][ T6095] __arm64_sys_write+0x7c/0x90 [ 34.398594][ T6095] invoke_syscall+0x98/0x2b8 [ 34.399910][ T6095] el0_svc_common+0x130/0x23c [ 34.401263][ T6095] do_el0_svc+0x48/0x58 [ 34.402478][ T6095] el0_svc+0x54/0x158 [ 34.403709][ T6095] el0t_64_sync_handler+0x84/0xfc [ 34.405159][ T6095] el0t_64_sync+0x190/0x194 [ 34.406514][ T6095] [ 34.406514][ T6095] other info that might help us debug this: [ 34.406514][ T6095] [ 34.409032][ T6095] Chain exists of: [ 34.409032][ T6095] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 34.409032][ T6095] [ 34.412890][ T6095] Possible unsafe locking scenario: [ 34.412890][ T6095] [ 34.414781][ T6095] CPU0 CPU1 [ 34.416167][ T6095] ---- ---- [ 34.417622][ T6095] lock(&hdev->req_lock); [ 34.418709][ T6095] lock(rfkill_global_mutex); [ 34.420662][ T6095] lock(&hdev->req_lock); [ 34.422296][ T6095] lock((work_completion)(&hdev->tx_work)); [ 34.423814][ T6095] [ 34.423814][ T6095] *** DEADLOCK *** [ 34.423814][ T6095] [ 34.425811][ T6095] 2 locks held by syz-executor320/6095: [ 34.427177][ T6095] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 34.429764][ T6095] #1: ffff0000d1065108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.432388][ T6095] [ 34.432388][ T6095] stack backtrace: [ 34.433924][ T6095] CPU: 0 PID: 6095 Comm: syz-executor320 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 34.436391][ T6095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 34.439075][ T6095] Call trace: [ 34.439863][ T6095] dump_backtrace+0x1b8/0x1e4 [ 34.440989][ T6095] show_stack+0x2c/0x3c [ 34.442067][ T6095] dump_stack_lvl+0xd0/0x124 [ 34.443252][ T6095] dump_stack+0x1c/0x28 [ 34.444287][ T6095] print_circular_bug+0x150/0x1b8 [ 34.445614][ T6095] check_noncircular+0x310/0x404 [ 34.446888][ T6095] __lock_acquire+0x3384/0x763c [ 34.448132][ T6095] lock_acquire+0x23c/0x71c [ 34.449376][ T6095] __flush_work+0xf8/0x1c0 [ 34.450587][ T6095] flush_work+0x24/0x38 [ 34.451618][ T6095] hci_dev_close_sync+0x1c8/0xf30 [ 34.452913][ T6095] hci_rfkill_set_block+0xf0/0x20c [ 34.454248][ T6095] rfkill_set_block+0x18c/0x37c [ 34.455509][ T6095] rfkill_fop_write+0x578/0x734 [ 34.456779][ T6095] vfs_write+0x2a0/0x910 [ 34.457864][ T6095] ksys_write+0x15c/0x26c [ 34.458968][ T6095] __arm64_sys_write+0x7c/0x90 [ 34.460176][ T6095] invoke_syscall+0x98/0x2b8 [ 34.461370][ T6095] el0_svc_common+0x130/0x23c [ 34.462679][ T6095] do_el0_svc+0x48/0x58 [ 34.463777][ T6095] el0_svc+0x54/0x158 [ 34.464810][ T6095] el0t_64_sync_handler+0x84/0xfc [ 34.466116][ T6095] el0t_64_sync+0x190/0x194