Warning: Permanently added '10.128.0.20' (ED25519) to the list of known hosts. [ 32.840466][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 32.842885][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 32.844944][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 32.847320][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 32.849437][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 32.851714][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 32.885310][ T6099] [ 32.885931][ T6099] ====================================================== [ 32.887461][ T6099] WARNING: possible circular locking dependency detected [ 32.889039][ T6099] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 32.890500][ T6099] ------------------------------------------------------ [ 32.892252][ T6099] syz-executor238/6099 is trying to acquire lock: [ 32.893572][ T6099] ffff0000d3944e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 32.895872][ T6099] [ 32.895872][ T6099] but task is already holding lock: [ 32.897692][ T6099] ffff0000d3945108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.899861][ T6099] [ 32.899861][ T6099] which lock already depends on the new lock. [ 32.899861][ T6099] [ 32.902206][ T6099] [ 32.902206][ T6099] the existing dependency chain (in reverse order) is: [ 32.904211][ T6099] [ 32.904211][ T6099] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 32.905845][ T6099] __mutex_lock_common+0x190/0x21a0 [ 32.907282][ T6099] mutex_lock_nested+0x2c/0x38 [ 32.908337][ T6099] hci_rfkill_set_block+0xe8/0x20c [ 32.909724][ T6099] rfkill_set_block+0x18c/0x37c [ 32.910948][ T6099] rfkill_fop_write+0x578/0x734 [ 32.912247][ T6099] vfs_write+0x2a0/0x910 [ 32.913419][ T6099] ksys_write+0x15c/0x26c [ 32.914583][ T6099] __arm64_sys_write+0x7c/0x90 [ 32.915756][ T6099] invoke_syscall+0x98/0x2b8 [ 32.916946][ T6099] el0_svc_common+0x130/0x23c [ 32.918198][ T6099] do_el0_svc+0x48/0x58 [ 32.919320][ T6099] el0_svc+0x54/0x158 [ 32.920342][ T6099] el0t_64_sync_handler+0x84/0xfc [ 32.921641][ T6099] el0t_64_sync+0x190/0x194 [ 32.922880][ T6099] [ 32.922880][ T6099] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 32.924751][ T6099] __mutex_lock_common+0x190/0x21a0 [ 32.926039][ T6099] mutex_lock_nested+0x2c/0x38 [ 32.927268][ T6099] rfkill_register+0x44/0x7d4 [ 32.928466][ T6099] hci_register_dev+0x3e0/0x954 [ 32.929775][ T6099] vhci_create_device+0x358/0x6c4 [ 32.931089][ T6099] vhci_write+0x318/0x3b8 [ 32.932187][ T6099] vfs_write+0x610/0x910 [ 32.933393][ T6099] ksys_write+0x15c/0x26c [ 32.934469][ T6099] __arm64_sys_write+0x7c/0x90 [ 32.935580][ T6099] invoke_syscall+0x98/0x2b8 [ 32.936714][ T6099] el0_svc_common+0x130/0x23c [ 32.937882][ T6099] do_el0_svc+0x48/0x58 [ 32.939123][ T6099] el0_svc+0x54/0x158 [ 32.940200][ T6099] el0t_64_sync_handler+0x84/0xfc [ 32.941371][ T6099] el0t_64_sync+0x190/0x194 [ 32.942578][ T6099] [ 32.942578][ T6099] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 32.944351][ T6099] __mutex_lock_common+0x190/0x21a0 [ 32.945748][ T6099] mutex_lock_nested+0x2c/0x38 [ 32.946964][ T6099] vhci_send_frame+0x8c/0x10c [ 32.948259][ T6099] hci_send_frame+0x1c4/0x35c [ 32.949512][ T6099] hci_tx_work+0xba0/0x18e4 [ 32.950643][ T6099] process_one_work+0x694/0x1204 [ 32.952040][ T6099] worker_thread+0x938/0xef4 [ 32.953225][ T6099] kthread+0x288/0x310 [ 32.954281][ T6099] ret_from_fork+0x10/0x20 [ 32.955387][ T6099] [ 32.955387][ T6099] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 32.957456][ T6099] __lock_acquire+0x3384/0x763c [ 32.958604][ T6099] lock_acquire+0x23c/0x71c [ 32.959691][ T6099] __flush_work+0xf8/0x1c0 [ 32.961051][ T6099] flush_work+0x24/0x38 [ 32.962044][ T6099] hci_dev_close_sync+0x1c8/0xf30 [ 32.963228][ T6099] hci_rfkill_set_block+0xf0/0x20c [ 32.964548][ T6099] rfkill_set_block+0x18c/0x37c [ 32.965783][ T6099] rfkill_fop_write+0x578/0x734 [ 32.966972][ T6099] vfs_write+0x2a0/0x910 [ 32.967934][ T6099] ksys_write+0x15c/0x26c [ 32.969002][ T6099] __arm64_sys_write+0x7c/0x90 [ 32.970348][ T6099] invoke_syscall+0x98/0x2b8 [ 32.971586][ T6099] el0_svc_common+0x130/0x23c [ 32.972763][ T6099] do_el0_svc+0x48/0x58 [ 32.973875][ T6099] el0_svc+0x54/0x158 [ 32.974877][ T6099] el0t_64_sync_handler+0x84/0xfc [ 32.976078][ T6099] el0t_64_sync+0x190/0x194 [ 32.977192][ T6099] [ 32.977192][ T6099] other info that might help us debug this: [ 32.977192][ T6099] [ 32.979387][ T6099] Chain exists of: [ 32.979387][ T6099] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 32.979387][ T6099] [ 32.982817][ T6099] Possible unsafe locking scenario: [ 32.982817][ T6099] [ 32.984472][ T6099] CPU0 CPU1 [ 32.985642][ T6099] ---- ---- [ 32.986999][ T6099] lock(&hdev->req_lock); [ 32.988092][ T6099] lock(rfkill_global_mutex); [ 32.990001][ T6099] lock(&hdev->req_lock); [ 32.991566][ T6099] lock((work_completion)(&hdev->tx_work)); [ 32.993010][ T6099] [ 32.993010][ T6099] *** DEADLOCK *** [ 32.993010][ T6099] [ 32.994823][ T6099] 2 locks held by syz-executor238/6099: [ 32.996118][ T6099] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 32.998589][ T6099] #1: ffff0000d3945108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 33.000965][ T6099] [ 33.000965][ T6099] stack backtrace: [ 33.002323][ T6099] CPU: 1 PID: 6099 Comm: syz-executor238 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 33.004552][ T6099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 33.006958][ T6099] Call trace: [ 33.007626][ T6099] dump_backtrace+0x1b8/0x1e4 [ 33.008730][ T6099] show_stack+0x2c/0x3c [ 33.009692][ T6099] dump_stack_lvl+0xd0/0x124 [ 33.010782][ T6099] dump_stack+0x1c/0x28 [ 33.011737][ T6099] print_circular_bug+0x150/0x1b8 [ 33.012766][ T6099] check_noncircular+0x310/0x404 [ 33.013868][ T6099] __lock_acquire+0x3384/0x763c [ 33.014941][ T6099] lock_acquire+0x23c/0x71c [ 33.016049][ T6099] __flush_work+0xf8/0x1c0 [ 33.017038][ T6099] flush_work+0x24/0x38 [ 33.018074][ T6099] hci_dev_close_sync+0x1c8/0xf30 [ 33.019235][ T6099] hci_rfkill_set_block+0xf0/0x20c [ 33.020440][ T6099] rfkill_set_block+0x18c/0x37c [ 33.021528][ T6099] rfkill_fop_write+0x578/0x734 [ 33.022622][ T6099] vfs_write+0x2a0/0x910 [ 33.023726][ T6099] ksys_write+0x15c/0x26c [ 33.024699][ T6099] __arm64_sys_write+0x7c/0x90 [ 33.025851][ T6099] invoke_syscall+0x98/0x2b8 [ 33.026903][ T6099] el0_svc_common+0x130/0x23c [ 33.027912][ T6099] do_el0_svc+0x48/0x58 [ 33.028966][ T6099] el0_svc+0x54/0x158 [ 33.029821][ T6099] el0t_64_sync_handler+0x84/0xfc [ 33.030978][ T6099] el0t_64_sync+0x190/0x194