Warning: Permanently added '10.128.1.59' (ED25519) to the list of known hosts. [ 34.793222][ T6100] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.796092][ T6100] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.798532][ T6100] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.800969][ T6100] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.803249][ T6100] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 34.805331][ T6100] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 34.979920][ T6099] [ 34.980496][ T6099] ====================================================== [ 34.982138][ T6099] WARNING: possible circular locking dependency detected [ 34.983868][ T6099] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 34.985463][ T6099] ------------------------------------------------------ [ 34.987174][ T6099] syz-executor334/6099 is trying to acquire lock: [ 34.988801][ T6099] ffff0000ccf0ce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 34.991324][ T6099] [ 34.991324][ T6099] but task is already holding lock: [ 34.993234][ T6099] ffff0000ccf0d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 34.995568][ T6099] [ 34.995568][ T6099] which lock already depends on the new lock. [ 34.995568][ T6099] [ 34.998116][ T6099] [ 34.998116][ T6099] the existing dependency chain (in reverse order) is: [ 35.000273][ T6099] [ 35.000273][ T6099] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 35.002299][ T6099] __mutex_lock_common+0x190/0x21a0 [ 35.003773][ T6099] mutex_lock_nested+0x2c/0x38 [ 35.005106][ T6099] hci_rfkill_set_block+0xe8/0x20c [ 35.006551][ T6099] rfkill_set_block+0x18c/0x37c [ 35.007892][ T6099] rfkill_fop_write+0x578/0x734 [ 35.009237][ T6099] vfs_write+0x2a0/0x910 [ 35.010497][ T6099] ksys_write+0x15c/0x26c [ 35.011734][ T6099] __arm64_sys_write+0x7c/0x90 [ 35.013177][ T6099] invoke_syscall+0x98/0x2b8 [ 35.014437][ T6099] el0_svc_common+0x130/0x23c [ 35.015717][ T6099] do_el0_svc+0x48/0x58 [ 35.016855][ T6099] el0_svc+0x54/0x158 [ 35.018060][ T6099] el0t_64_sync_handler+0x84/0xfc [ 35.019492][ T6099] el0t_64_sync+0x190/0x194 [ 35.020829][ T6099] [ 35.020829][ T6099] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 35.022826][ T6099] __mutex_lock_common+0x190/0x21a0 [ 35.024265][ T6099] mutex_lock_nested+0x2c/0x38 [ 35.025676][ T6099] rfkill_register+0x44/0x7d4 [ 35.026950][ T6099] hci_register_dev+0x3e0/0x954 [ 35.028378][ T6099] vhci_create_device+0x358/0x6c4 [ 35.029751][ T6099] vhci_write+0x318/0x3b8 [ 35.030998][ T6099] vfs_write+0x610/0x910 [ 35.032160][ T6099] ksys_write+0x15c/0x26c [ 35.033359][ T6099] __arm64_sys_write+0x7c/0x90 [ 35.034725][ T6099] invoke_syscall+0x98/0x2b8 [ 35.036029][ T6099] el0_svc_common+0x130/0x23c [ 35.037286][ T6099] do_el0_svc+0x48/0x58 [ 35.038450][ T6099] el0_svc+0x54/0x158 [ 35.039550][ T6099] el0t_64_sync_handler+0x84/0xfc [ 35.040977][ T6099] el0t_64_sync+0x190/0x194 [ 35.042234][ T6099] [ 35.042234][ T6099] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 35.044267][ T6099] __mutex_lock_common+0x190/0x21a0 [ 35.045687][ T6099] mutex_lock_nested+0x2c/0x38 [ 35.046961][ T6099] vhci_send_frame+0x8c/0x10c [ 35.048266][ T6099] hci_send_frame+0x1c4/0x35c [ 35.049595][ T6099] hci_tx_work+0xba0/0x18e4 [ 35.050847][ T6099] process_one_work+0x694/0x1204 [ 35.052293][ T6099] worker_thread+0x938/0xef4 [ 35.053629][ T6099] kthread+0x288/0x310 [ 35.054842][ T6099] ret_from_fork+0x10/0x20 [ 35.056137][ T6099] [ 35.056137][ T6099] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 35.058549][ T6099] __lock_acquire+0x3384/0x763c [ 35.059909][ T6099] lock_acquire+0x23c/0x71c [ 35.061171][ T6099] __flush_work+0xf8/0x1c0 [ 35.062470][ T6099] flush_work+0x24/0x38 [ 35.063645][ T6099] hci_dev_close_sync+0x1c8/0xf30 [ 35.065064][ T6099] hci_rfkill_set_block+0xf0/0x20c [ 35.066487][ T6099] rfkill_set_block+0x18c/0x37c [ 35.067896][ T6099] rfkill_fop_write+0x578/0x734 [ 35.069176][ T6099] vfs_write+0x2a0/0x910 [ 35.070330][ T6099] ksys_write+0x15c/0x26c [ 35.071627][ T6099] __arm64_sys_write+0x7c/0x90 [ 35.072967][ T6099] invoke_syscall+0x98/0x2b8 [ 35.074228][ T6099] el0_svc_common+0x130/0x23c [ 35.075599][ T6099] do_el0_svc+0x48/0x58 [ 35.076761][ T6099] el0_svc+0x54/0x158 [ 35.077945][ T6099] el0t_64_sync_handler+0x84/0xfc [ 35.079272][ T6099] el0t_64_sync+0x190/0x194 [ 35.080524][ T6099] [ 35.080524][ T6099] other info that might help us debug this: [ 35.080524][ T6099] [ 35.083109][ T6099] Chain exists of: [ 35.083109][ T6099] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 35.083109][ T6099] [ 35.086974][ T6099] Possible unsafe locking scenario: [ 35.086974][ T6099] [ 35.088920][ T6099] CPU0 CPU1 [ 35.090218][ T6099] ---- ---- [ 35.091537][ T6099] lock(&hdev->req_lock); [ 35.092708][ T6099] lock(rfkill_global_mutex); [ 35.094548][ T6099] lock(&hdev->req_lock); [ 35.096269][ T6099] lock((work_completion)(&hdev->tx_work)); [ 35.097798][ T6099] [ 35.097798][ T6099] *** DEADLOCK *** [ 35.097798][ T6099] [ 35.099859][ T6099] 2 locks held by syz-executor334/6099: [ 35.101259][ T6099] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 35.103914][ T6099] #1: ffff0000ccf0d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.106406][ T6099] [ 35.106406][ T6099] stack backtrace: [ 35.107957][ T6099] CPU: 1 PID: 6099 Comm: syz-executor334 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 35.110478][ T6099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 35.112984][ T6099] Call trace: [ 35.113800][ T6099] dump_backtrace+0x1b8/0x1e4 [ 35.114950][ T6099] show_stack+0x2c/0x3c [ 35.116005][ T6099] dump_stack_lvl+0xd0/0x124 [ 35.117176][ T6099] dump_stack+0x1c/0x28 [ 35.118263][ T6099] print_circular_bug+0x150/0x1b8 [ 35.119545][ T6099] check_noncircular+0x310/0x404 [ 35.120833][ T6099] __lock_acquire+0x3384/0x763c [ 35.122029][ T6099] lock_acquire+0x23c/0x71c [ 35.123204][ T6099] __flush_work+0xf8/0x1c0 [ 35.124319][ T6099] flush_work+0x24/0x38 [ 35.125352][ T6099] hci_dev_close_sync+0x1c8/0xf30 [ 35.126636][ T6099] hci_rfkill_set_block+0xf0/0x20c [ 35.127969][ T6099] rfkill_set_block+0x18c/0x37c [ 35.129137][ T6099] rfkill_fop_write+0x578/0x734 [ 35.130386][ T6099] vfs_write+0x2a0/0x910 [ 35.131410][ T6099] ksys_write+0x15c/0x26c [ 35.132511][ T6099] __arm64_sys_write+0x7c/0x90 [ 35.133737][ T6099] invoke_syscall+0x98/0x2b8 [ 35.134914][ T6099] el0_svc_common+0x130/0x23c [ 35.136020][ T6099] do_el0_svc+0x48/0x58 [ 35.137118][ T6099] el0_svc+0x54/0x158 [ 35.138132][ T6099] el0t_64_sync_handler+0x84/0xfc [ 35.139353][ T6099] el0t_64_sync+0x190/0x194