Warning: Permanently added '10.128.1.102' (ED25519) to the list of known hosts. [ 32.429302][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 32.432711][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 32.435016][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 32.437293][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 32.439363][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 32.441249][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 32.585312][ T6109] [ 32.585894][ T6109] ====================================================== [ 32.587546][ T6109] WARNING: possible circular locking dependency detected [ 32.589241][ T6109] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 32.590743][ T6109] ------------------------------------------------------ [ 32.592426][ T6109] syz-executor242/6109 is trying to acquire lock: [ 32.594051][ T6109] ffff0000d41e0e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 32.596669][ T6109] [ 32.596669][ T6109] but task is already holding lock: [ 32.598538][ T6109] ffff0000d41e1108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.600953][ T6109] [ 32.600953][ T6109] which lock already depends on the new lock. [ 32.600953][ T6109] [ 32.603601][ T6109] [ 32.603601][ T6109] the existing dependency chain (in reverse order) is: [ 32.605828][ T6109] [ 32.605828][ T6109] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 32.607837][ T6109] __mutex_lock_common+0x190/0x21a0 [ 32.609320][ T6109] mutex_lock_nested+0x2c/0x38 [ 32.610650][ T6109] hci_rfkill_set_block+0xe8/0x20c [ 32.612096][ T6109] rfkill_set_block+0x18c/0x37c [ 32.613466][ T6109] rfkill_fop_write+0x578/0x734 [ 32.614854][ T6109] vfs_write+0x2a0/0x910 [ 32.616019][ T6109] ksys_write+0x15c/0x26c [ 32.617244][ T6109] __arm64_sys_write+0x7c/0x90 [ 32.618546][ T6109] invoke_syscall+0x98/0x2b8 [ 32.619830][ T6109] el0_svc_common+0x130/0x23c [ 32.621156][ T6109] do_el0_svc+0x48/0x58 [ 32.622351][ T6109] el0_svc+0x54/0x158 [ 32.623438][ T6109] el0t_64_sync_handler+0x84/0xfc [ 32.624807][ T6109] el0t_64_sync+0x190/0x194 [ 32.626066][ T6109] [ 32.626066][ T6109] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 32.628083][ T6109] __mutex_lock_common+0x190/0x21a0 [ 32.629564][ T6109] mutex_lock_nested+0x2c/0x38 [ 32.630864][ T6109] rfkill_register+0x44/0x7d4 [ 32.632165][ T6109] hci_register_dev+0x3e0/0x954 [ 32.633539][ T6109] vhci_create_device+0x358/0x6c4 [ 32.634867][ T6109] vhci_write+0x318/0x3b8 [ 32.636118][ T6109] vfs_write+0x610/0x910 [ 32.637353][ T6109] ksys_write+0x15c/0x26c [ 32.638565][ T6109] __arm64_sys_write+0x7c/0x90 [ 32.639969][ T6109] invoke_syscall+0x98/0x2b8 [ 32.641118][ T6109] el0_svc_common+0x130/0x23c [ 32.642413][ T6109] do_el0_svc+0x48/0x58 [ 32.643564][ T6109] el0_svc+0x54/0x158 [ 32.644626][ T6109] el0t_64_sync_handler+0x84/0xfc [ 32.646042][ T6109] el0t_64_sync+0x190/0x194 [ 32.647354][ T6109] [ 32.647354][ T6109] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 32.649340][ T6109] __mutex_lock_common+0x190/0x21a0 [ 32.650789][ T6109] mutex_lock_nested+0x2c/0x38 [ 32.652066][ T6109] vhci_send_frame+0x8c/0x10c [ 32.653281][ T6109] hci_send_frame+0x1c4/0x35c [ 32.654524][ T6109] hci_tx_work+0xba0/0x18e4 [ 32.655737][ T6109] process_one_work+0x694/0x1204 [ 32.657187][ T6109] worker_thread+0x938/0xef4 [ 32.658534][ T6109] kthread+0x288/0x310 [ 32.659711][ T6109] ret_from_fork+0x10/0x20 [ 32.660970][ T6109] [ 32.660970][ T6109] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 32.663292][ T6109] __lock_acquire+0x3384/0x763c [ 32.664781][ T6109] lock_acquire+0x23c/0x71c [ 32.666051][ T6109] __flush_work+0xf8/0x1c0 [ 32.667226][ T6109] flush_work+0x24/0x38 [ 32.668368][ T6109] hci_dev_close_sync+0x1c8/0xf30 [ 32.669717][ T6109] hci_rfkill_set_block+0xf0/0x20c [ 32.671144][ T6109] rfkill_set_block+0x18c/0x37c [ 32.672502][ T6109] rfkill_fop_write+0x578/0x734 [ 32.673813][ T6109] vfs_write+0x2a0/0x910 [ 32.675013][ T6109] ksys_write+0x15c/0x26c [ 32.676237][ T6109] __arm64_sys_write+0x7c/0x90 [ 32.677610][ T6109] invoke_syscall+0x98/0x2b8 [ 32.678885][ T6109] el0_svc_common+0x130/0x23c [ 32.680080][ T6109] do_el0_svc+0x48/0x58 [ 32.681267][ T6109] el0_svc+0x54/0x158 [ 32.682452][ T6109] el0t_64_sync_handler+0x84/0xfc [ 32.683876][ T6109] el0t_64_sync+0x190/0x194 [ 32.685120][ T6109] [ 32.685120][ T6109] other info that might help us debug this: [ 32.685120][ T6109] [ 32.687645][ T6109] Chain exists of: [ 32.687645][ T6109] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 32.687645][ T6109] [ 32.691293][ T6109] Possible unsafe locking scenario: [ 32.691293][ T6109] [ 32.693091][ T6109] CPU0 CPU1 [ 32.694425][ T6109] ---- ---- [ 32.695625][ T6109] lock(&hdev->req_lock); [ 32.696734][ T6109] lock(rfkill_global_mutex); [ 32.698588][ T6109] lock(&hdev->req_lock); [ 32.700294][ T6109] lock((work_completion)(&hdev->tx_work)); [ 32.701768][ T6109] [ 32.701768][ T6109] *** DEADLOCK *** [ 32.701768][ T6109] [ 32.703838][ T6109] 2 locks held by syz-executor242/6109: [ 32.705284][ T6109] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 32.707749][ T6109] #1: ffff0000d41e1108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 32.710183][ T6109] [ 32.710183][ T6109] stack backtrace: [ 32.711567][ T6109] CPU: 1 PID: 6109 Comm: syz-executor242 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 32.714139][ T6109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 32.716582][ T6109] Call trace: [ 32.717388][ T6109] dump_backtrace+0x1b8/0x1e4 [ 32.718519][ T6109] show_stack+0x2c/0x3c [ 32.719607][ T6109] dump_stack_lvl+0xd0/0x124 [ 32.720765][ T6109] dump_stack+0x1c/0x28 [ 32.721763][ T6109] print_circular_bug+0x150/0x1b8 [ 32.722993][ T6109] check_noncircular+0x310/0x404 [ 32.724319][ T6109] __lock_acquire+0x3384/0x763c [ 32.725482][ T6109] lock_acquire+0x23c/0x71c [ 32.726628][ T6109] __flush_work+0xf8/0x1c0 [ 32.727787][ T6109] flush_work+0x24/0x38 [ 32.728815][ T6109] hci_dev_close_sync+0x1c8/0xf30 [ 32.730092][ T6109] hci_rfkill_set_block+0xf0/0x20c [ 32.731389][ T6109] rfkill_set_block+0x18c/0x37c [ 32.732677][ T6109] rfkill_fop_write+0x578/0x734 [ 32.733906][ T6109] vfs_write+0x2a0/0x910 [ 32.734983][ T6109] ksys_write+0x15c/0x26c [ 32.736052][ T6109] __arm64_sys_write+0x7c/0x90 [ 32.737211][ T6109] invoke_syscall+0x98/0x2b8 [ 32.738388][ T6109] el0_svc_common+0x130/0x23c [ 32.739506][ T6109] do_el0_svc+0x48/0x58 [ 32.740654][ T6109] el0_svc+0x54/0x158 [ 32.741682][ T6109] el0t_64_sync_handler+0x84/0xfc [ 32.743014][ T6109] el0t_64_sync+0x190/0x194