Warning: Permanently added '10.128.1.39' (ED25519) to the list of known hosts. [ 34.267060][ T6096] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.270061][ T6096] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.272094][ T6096] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.274677][ T6096] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.277061][ T6096] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 34.278887][ T6096] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 34.421746][ T6094] [ 34.422300][ T6094] ====================================================== [ 34.423930][ T6094] WARNING: possible circular locking dependency detected [ 34.425545][ T6094] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 34.427166][ T6094] ------------------------------------------------------ [ 34.428786][ T6094] syz-executor634/6094 is trying to acquire lock: [ 34.430278][ T6094] ffff0000d212ce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 34.432893][ T6094] [ 34.432893][ T6094] but task is already holding lock: [ 34.434757][ T6094] ffff0000d212d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.437097][ T6094] [ 34.437097][ T6094] which lock already depends on the new lock. [ 34.437097][ T6094] [ 34.439575][ T6094] [ 34.439575][ T6094] the existing dependency chain (in reverse order) is: [ 34.441660][ T6094] [ 34.441660][ T6094] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 34.443485][ T6094] __mutex_lock_common+0x190/0x21a0 [ 34.444920][ T6094] mutex_lock_nested+0x2c/0x38 [ 34.446200][ T6094] hci_rfkill_set_block+0xe8/0x20c [ 34.447513][ T6094] rfkill_set_block+0x18c/0x37c [ 34.448885][ T6094] rfkill_fop_write+0x578/0x734 [ 34.450189][ T6094] vfs_write+0x2a0/0x910 [ 34.451284][ T6094] ksys_write+0x15c/0x26c [ 34.452382][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.453601][ T6094] invoke_syscall+0x98/0x2b8 [ 34.454864][ T6094] el0_svc_common+0x130/0x23c [ 34.456166][ T6094] do_el0_svc+0x48/0x58 [ 34.457179][ T6094] el0_svc+0x54/0x158 [ 34.458147][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.459480][ T6094] el0t_64_sync+0x190/0x194 [ 34.460737][ T6094] [ 34.460737][ T6094] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 34.462705][ T6094] __mutex_lock_common+0x190/0x21a0 [ 34.464041][ T6094] mutex_lock_nested+0x2c/0x38 [ 34.465364][ T6094] rfkill_register+0x44/0x7d4 [ 34.466630][ T6094] hci_register_dev+0x3e0/0x954 [ 34.467944][ T6094] vhci_create_device+0x358/0x6c4 [ 34.469271][ T6094] vhci_write+0x318/0x3b8 [ 34.470384][ T6094] vfs_write+0x610/0x910 [ 34.471565][ T6094] ksys_write+0x15c/0x26c [ 34.472748][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.473995][ T6094] invoke_syscall+0x98/0x2b8 [ 34.475237][ T6094] el0_svc_common+0x130/0x23c [ 34.476551][ T6094] do_el0_svc+0x48/0x58 [ 34.477793][ T6094] el0_svc+0x54/0x158 [ 34.478907][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.480180][ T6094] el0t_64_sync+0x190/0x194 [ 34.481371][ T6094] [ 34.481371][ T6094] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 34.483241][ T6094] __mutex_lock_common+0x190/0x21a0 [ 34.484721][ T6094] mutex_lock_nested+0x2c/0x38 [ 34.485994][ T6094] vhci_send_frame+0x8c/0x10c [ 34.487222][ T6094] hci_send_frame+0x1c4/0x35c [ 34.488551][ T6094] hci_tx_work+0xba0/0x18e4 [ 34.489690][ T6094] process_one_work+0x694/0x1204 [ 34.491035][ T6094] worker_thread+0x938/0xef4 [ 34.492292][ T6094] kthread+0x288/0x310 [ 34.493501][ T6094] ret_from_fork+0x10/0x20 [ 34.494677][ T6094] [ 34.494677][ T6094] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 34.496892][ T6094] __lock_acquire+0x3384/0x763c [ 34.498267][ T6094] lock_acquire+0x23c/0x71c [ 34.499373][ T6094] __flush_work+0xf8/0x1c0 [ 34.500590][ T6094] flush_work+0x24/0x38 [ 34.501681][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 34.503009][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 34.504448][ T6094] rfkill_set_block+0x18c/0x37c [ 34.505833][ T6094] rfkill_fop_write+0x578/0x734 [ 34.507152][ T6094] vfs_write+0x2a0/0x910 [ 34.508352][ T6094] ksys_write+0x15c/0x26c [ 34.509578][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.510868][ T6094] invoke_syscall+0x98/0x2b8 [ 34.512155][ T6094] el0_svc_common+0x130/0x23c [ 34.513486][ T6094] do_el0_svc+0x48/0x58 [ 34.514610][ T6094] el0_svc+0x54/0x158 [ 34.515792][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.517080][ T6094] el0t_64_sync+0x190/0x194 [ 34.518219][ T6094] [ 34.518219][ T6094] other info that might help us debug this: [ 34.518219][ T6094] [ 34.520769][ T6094] Chain exists of: [ 34.520769][ T6094] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 34.520769][ T6094] [ 34.524432][ T6094] Possible unsafe locking scenario: [ 34.524432][ T6094] [ 34.526229][ T6094] CPU0 CPU1 [ 34.527508][ T6094] ---- ---- [ 34.528825][ T6094] lock(&hdev->req_lock); [ 34.529845][ T6094] lock(rfkill_global_mutex); [ 34.531604][ T6094] lock(&hdev->req_lock); [ 34.533290][ T6094] lock((work_completion)(&hdev->tx_work)); [ 34.534731][ T6094] [ 34.534731][ T6094] *** DEADLOCK *** [ 34.534731][ T6094] [ 34.536702][ T6094] 2 locks held by syz-executor634/6094: [ 34.538054][ T6094] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 34.540484][ T6094] #1: ffff0000d212d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.542743][ T6094] [ 34.542743][ T6094] stack backtrace: [ 34.544111][ T6094] CPU: 1 PID: 6094 Comm: syz-executor634 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 34.546451][ T6094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 34.548865][ T6094] Call trace: [ 34.549708][ T6094] dump_backtrace+0x1b8/0x1e4 [ 34.550792][ T6094] show_stack+0x2c/0x3c [ 34.551831][ T6094] dump_stack_lvl+0xd0/0x124 [ 34.552886][ T6094] dump_stack+0x1c/0x28 [ 34.553805][ T6094] print_circular_bug+0x150/0x1b8 [ 34.555105][ T6094] check_noncircular+0x310/0x404 [ 34.556303][ T6094] __lock_acquire+0x3384/0x763c [ 34.557461][ T6094] lock_acquire+0x23c/0x71c [ 34.558623][ T6094] __flush_work+0xf8/0x1c0 [ 34.559700][ T6094] flush_work+0x24/0x38 [ 34.560742][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 34.561920][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 34.563114][ T6094] rfkill_set_block+0x18c/0x37c [ 34.564255][ T6094] rfkill_fop_write+0x578/0x734 [ 34.565383][ T6094] vfs_write+0x2a0/0x910 [ 34.566500][ T6094] ksys_write+0x15c/0x26c [ 34.567621][ T6094] __arm64_sys_write+0x7c/0x90 [ 34.568792][ T6094] invoke_syscall+0x98/0x2b8 [ 34.569948][ T6094] el0_svc_common+0x130/0x23c [ 34.571050][ T6094] do_el0_svc+0x48/0x58 [ 34.572079][ T6094] el0_svc+0x54/0x158 [ 34.573054][ T6094] el0t_64_sync_handler+0x84/0xfc [ 34.574286][ T6094] el0t_64_sync+0x190/0x194