Warning: Permanently added '10.128.10.25' (ED25519) to the list of known hosts. [ 30.680612][ T6100] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.683133][ T6100] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.685329][ T6100] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.687687][ T6100] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.689962][ T6100] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 30.692398][ T6100] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 30.832147][ T6098] [ 30.832796][ T6098] ====================================================== [ 30.834442][ T6098] WARNING: possible circular locking dependency detected [ 30.836264][ T6098] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 30.837834][ T6098] ------------------------------------------------------ [ 30.839562][ T6098] syz-executor240/6098 is trying to acquire lock: [ 30.841193][ T6098] ffff0000da668e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 30.844038][ T6098] [ 30.844038][ T6098] but task is already holding lock: [ 30.845983][ T6098] ffff0000da669108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.848244][ T6098] [ 30.848244][ T6098] which lock already depends on the new lock. [ 30.848244][ T6098] [ 30.850958][ T6098] [ 30.850958][ T6098] the existing dependency chain (in reverse order) is: [ 30.853317][ T6098] [ 30.853317][ T6098] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 30.855385][ T6098] __mutex_lock_common+0x190/0x21a0 [ 30.856942][ T6098] mutex_lock_nested+0x2c/0x38 [ 30.858317][ T6098] hci_rfkill_set_block+0xe8/0x20c [ 30.859744][ T6098] rfkill_set_block+0x18c/0x37c [ 30.861191][ T6098] rfkill_fop_write+0x578/0x734 [ 30.862622][ T6098] vfs_write+0x2a0/0x910 [ 30.863841][ T6098] ksys_write+0x15c/0x26c [ 30.864962][ T6098] __arm64_sys_write+0x7c/0x90 [ 30.866361][ T6098] invoke_syscall+0x98/0x2b8 [ 30.867669][ T6098] el0_svc_common+0x130/0x23c [ 30.868971][ T6098] do_el0_svc+0x48/0x58 [ 30.870207][ T6098] el0_svc+0x54/0x158 [ 30.871259][ T6098] el0t_64_sync_handler+0x84/0xfc [ 30.872728][ T6098] el0t_64_sync+0x190/0x194 [ 30.874067][ T6098] [ 30.874067][ T6098] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 30.876173][ T6098] __mutex_lock_common+0x190/0x21a0 [ 30.877619][ T6098] mutex_lock_nested+0x2c/0x38 [ 30.878977][ T6098] rfkill_register+0x44/0x7d4 [ 30.880345][ T6098] hci_register_dev+0x3e0/0x954 [ 30.881679][ T6098] vhci_create_device+0x358/0x6c4 [ 30.883098][ T6098] vhci_write+0x318/0x3b8 [ 30.884293][ T6098] vfs_write+0x610/0x910 [ 30.885463][ T6098] ksys_write+0x15c/0x26c [ 30.886666][ T6098] __arm64_sys_write+0x7c/0x90 [ 30.887996][ T6098] invoke_syscall+0x98/0x2b8 [ 30.889232][ T6098] el0_svc_common+0x130/0x23c [ 30.890541][ T6098] do_el0_svc+0x48/0x58 [ 30.891735][ T6098] el0_svc+0x54/0x158 [ 30.892797][ T6098] el0t_64_sync_handler+0x84/0xfc [ 30.894140][ T6098] el0t_64_sync+0x190/0x194 [ 30.895490][ T6098] [ 30.895490][ T6098] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 30.897510][ T6098] __mutex_lock_common+0x190/0x21a0 [ 30.898955][ T6098] mutex_lock_nested+0x2c/0x38 [ 30.900337][ T6098] vhci_send_frame+0x8c/0x10c [ 30.901637][ T6098] hci_send_frame+0x1c4/0x35c [ 30.902910][ T6098] hci_tx_work+0xba0/0x18e4 [ 30.904188][ T6098] process_one_work+0x694/0x1204 [ 30.905549][ T6098] worker_thread+0x938/0xef4 [ 30.906942][ T6098] kthread+0x288/0x310 [ 30.908174][ T6098] ret_from_fork+0x10/0x20 [ 30.909469][ T6098] [ 30.909469][ T6098] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 30.911827][ T6098] __lock_acquire+0x3384/0x763c [ 30.913207][ T6098] lock_acquire+0x23c/0x71c [ 30.914474][ T6098] __flush_work+0xf8/0x1c0 [ 30.915713][ T6098] flush_work+0x24/0x38 [ 30.916781][ T6098] hci_dev_close_sync+0x1c8/0xf30 [ 30.918117][ T6098] hci_rfkill_set_block+0xf0/0x20c [ 30.919541][ T6098] rfkill_set_block+0x18c/0x37c [ 30.920910][ T6098] rfkill_fop_write+0x578/0x734 [ 30.922248][ T6098] vfs_write+0x2a0/0x910 [ 30.923466][ T6098] ksys_write+0x15c/0x26c [ 30.924648][ T6098] __arm64_sys_write+0x7c/0x90 [ 30.925922][ T6098] invoke_syscall+0x98/0x2b8 [ 30.927189][ T6098] el0_svc_common+0x130/0x23c [ 30.928488][ T6098] do_el0_svc+0x48/0x58 [ 30.929765][ T6098] el0_svc+0x54/0x158 [ 30.930960][ T6098] el0t_64_sync_handler+0x84/0xfc [ 30.932258][ T6098] el0t_64_sync+0x190/0x194 [ 30.933535][ T6098] [ 30.933535][ T6098] other info that might help us debug this: [ 30.933535][ T6098] [ 30.936108][ T6098] Chain exists of: [ 30.936108][ T6098] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 30.936108][ T6098] [ 30.939850][ T6098] Possible unsafe locking scenario: [ 30.939850][ T6098] [ 30.941707][ T6098] CPU0 CPU1 [ 30.943105][ T6098] ---- ---- [ 30.944429][ T6098] lock(&hdev->req_lock); [ 30.945597][ T6098] lock(rfkill_global_mutex); [ 30.947262][ T6098] lock(&hdev->req_lock); [ 30.948972][ T6098] lock((work_completion)(&hdev->tx_work)); [ 30.950380][ T6098] [ 30.950380][ T6098] *** DEADLOCK *** [ 30.950380][ T6098] [ 30.952399][ T6098] 2 locks held by syz-executor240/6098: [ 30.953815][ T6098] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 30.956351][ T6098] #1: ffff0000da669108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.958745][ T6098] [ 30.958745][ T6098] stack backtrace: [ 30.960160][ T6098] CPU: 0 PID: 6098 Comm: syz-executor240 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 30.962597][ T6098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 30.965136][ T6098] Call trace: [ 30.965912][ T6098] dump_backtrace+0x1b8/0x1e4 [ 30.967055][ T6098] show_stack+0x2c/0x3c [ 30.968193][ T6098] dump_stack_lvl+0xd0/0x124 [ 30.969356][ T6098] dump_stack+0x1c/0x28 [ 30.970425][ T6098] print_circular_bug+0x150/0x1b8 [ 30.971816][ T6098] check_noncircular+0x310/0x404 [ 30.973084][ T6098] __lock_acquire+0x3384/0x763c [ 30.974365][ T6098] lock_acquire+0x23c/0x71c [ 30.975463][ T6098] __flush_work+0xf8/0x1c0 [ 30.976585][ T6098] flush_work+0x24/0x38 [ 30.977654][ T6098] hci_dev_close_sync+0x1c8/0xf30 [ 30.979001][ T6098] hci_rfkill_set_block+0xf0/0x20c [ 30.980370][ T6098] rfkill_set_block+0x18c/0x37c [ 30.981611][ T6098] rfkill_fop_write+0x578/0x734 [ 30.982844][ T6098] vfs_write+0x2a0/0x910 [ 30.983842][ T6098] ksys_write+0x15c/0x26c [ 30.984876][ T6098] __arm64_sys_write+0x7c/0x90 [ 30.986053][ T6098] invoke_syscall+0x98/0x2b8 [ 30.987295][ T6098] el0_svc_common+0x130/0x23c [ 30.988440][ T6098] do_el0_svc+0x48/0x58 [ 30.989470][ T6098] el0_svc+0x54/0x158 [ 30.990436][ T6098] el0t_64_sync_handler+0x84/0xfc [ 30.991665][ T6098] el0t_64_sync+0x190/0x194