Warning: Permanently added '10.128.0.182' (ED25519) to the list of known hosts. [ 30.778433][ T6102] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.780859][ T6102] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.782957][ T6102] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.785183][ T6102] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.787298][ T6102] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 30.790280][ T6102] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 30.941095][ T6099] [ 30.941715][ T6099] ====================================================== [ 30.943323][ T6099] WARNING: possible circular locking dependency detected [ 30.944820][ T6099] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 30.946418][ T6099] ------------------------------------------------------ [ 30.948038][ T6099] syz-executor344/6099 is trying to acquire lock: [ 30.949512][ T6099] ffff0000d1af4e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 30.952064][ T6099] [ 30.952064][ T6099] but task is already holding lock: [ 30.953959][ T6099] ffff0000d1af5108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 30.956367][ T6099] [ 30.956367][ T6099] which lock already depends on the new lock. [ 30.956367][ T6099] [ 30.958723][ T6099] [ 30.958723][ T6099] the existing dependency chain (in reverse order) is: [ 30.961001][ T6099] [ 30.961001][ T6099] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 30.962805][ T6099] __mutex_lock_common+0x190/0x21a0 [ 30.964219][ T6099] mutex_lock_nested+0x2c/0x38 [ 30.965455][ T6099] hci_rfkill_set_block+0xe8/0x20c [ 30.966744][ T6099] rfkill_set_block+0x18c/0x37c [ 30.968124][ T6099] rfkill_fop_write+0x578/0x734 [ 30.969430][ T6099] vfs_write+0x2a0/0x910 [ 30.970520][ T6099] ksys_write+0x15c/0x26c [ 30.971579][ T6099] __arm64_sys_write+0x7c/0x90 [ 30.972729][ T6099] invoke_syscall+0x98/0x2b8 [ 30.973932][ T6099] el0_svc_common+0x130/0x23c [ 30.975141][ T6099] do_el0_svc+0x48/0x58 [ 30.976268][ T6099] el0_svc+0x54/0x158 [ 30.977390][ T6099] el0t_64_sync_handler+0x84/0xfc [ 30.978756][ T6099] el0t_64_sync+0x190/0x194 [ 30.980045][ T6099] [ 30.980045][ T6099] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 30.981947][ T6099] __mutex_lock_common+0x190/0x21a0 [ 30.983353][ T6099] mutex_lock_nested+0x2c/0x38 [ 30.984573][ T6099] rfkill_register+0x44/0x7d4 [ 30.985853][ T6099] hci_register_dev+0x3e0/0x954 [ 30.987173][ T6099] vhci_create_device+0x358/0x6c4 [ 30.988521][ T6099] vhci_write+0x318/0x3b8 [ 30.989705][ T6099] vfs_write+0x610/0x910 [ 30.990867][ T6099] ksys_write+0x15c/0x26c [ 30.992063][ T6099] __arm64_sys_write+0x7c/0x90 [ 30.993324][ T6099] invoke_syscall+0x98/0x2b8 [ 30.994569][ T6099] el0_svc_common+0x130/0x23c [ 30.995911][ T6099] do_el0_svc+0x48/0x58 [ 30.996959][ T6099] el0_svc+0x54/0x158 [ 30.998045][ T6099] el0t_64_sync_handler+0x84/0xfc [ 30.999414][ T6099] el0t_64_sync+0x190/0x194 [ 31.000640][ T6099] [ 31.000640][ T6099] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 31.002545][ T6099] __mutex_lock_common+0x190/0x21a0 [ 31.003901][ T6099] mutex_lock_nested+0x2c/0x38 [ 31.005094][ T6099] vhci_send_frame+0x8c/0x10c [ 31.006377][ T6099] hci_send_frame+0x1c4/0x35c [ 31.007628][ T6099] hci_tx_work+0xba0/0x18e4 [ 31.008754][ T6099] process_one_work+0x694/0x1204 [ 31.010063][ T6099] worker_thread+0x938/0xef4 [ 31.011337][ T6099] kthread+0x288/0x310 [ 31.012449][ T6099] ret_from_fork+0x10/0x20 [ 31.013601][ T6099] [ 31.013601][ T6099] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 31.015769][ T6099] __lock_acquire+0x3384/0x763c [ 31.017033][ T6099] lock_acquire+0x23c/0x71c [ 31.018187][ T6099] __flush_work+0xf8/0x1c0 [ 31.019427][ T6099] flush_work+0x24/0x38 [ 31.020539][ T6099] hci_dev_close_sync+0x1c8/0xf30 [ 31.021832][ T6099] hci_rfkill_set_block+0xf0/0x20c [ 31.023135][ T6099] rfkill_set_block+0x18c/0x37c [ 31.024409][ T6099] rfkill_fop_write+0x578/0x734 [ 31.025680][ T6099] vfs_write+0x2a0/0x910 [ 31.026810][ T6099] ksys_write+0x15c/0x26c [ 31.027940][ T6099] __arm64_sys_write+0x7c/0x90 [ 31.029166][ T6099] invoke_syscall+0x98/0x2b8 [ 31.030431][ T6099] el0_svc_common+0x130/0x23c [ 31.031691][ T6099] do_el0_svc+0x48/0x58 [ 31.032824][ T6099] el0_svc+0x54/0x158 [ 31.033917][ T6099] el0t_64_sync_handler+0x84/0xfc [ 31.035223][ T6099] el0t_64_sync+0x190/0x194 [ 31.036293][ T6099] [ 31.036293][ T6099] other info that might help us debug this: [ 31.036293][ T6099] [ 31.038646][ T6099] Chain exists of: [ 31.038646][ T6099] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 31.038646][ T6099] [ 31.042161][ T6099] Possible unsafe locking scenario: [ 31.042161][ T6099] [ 31.043890][ T6099] CPU0 CPU1 [ 31.045141][ T6099] ---- ---- [ 31.046443][ T6099] lock(&hdev->req_lock); [ 31.047500][ T6099] lock(rfkill_global_mutex); [ 31.049324][ T6099] lock(&hdev->req_lock); [ 31.051022][ T6099] lock((work_completion)(&hdev->tx_work)); [ 31.052403][ T6099] [ 31.052403][ T6099] *** DEADLOCK *** [ 31.052403][ T6099] [ 31.054338][ T6099] 2 locks held by syz-executor344/6099: [ 31.055685][ T6099] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 31.058159][ T6099] #1: ffff0000d1af5108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 31.060525][ T6099] [ 31.060525][ T6099] stack backtrace: [ 31.061929][ T6099] CPU: 1 PID: 6099 Comm: syz-executor344 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 31.064313][ T6099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 31.066603][ T6099] Call trace: [ 31.067410][ T6099] dump_backtrace+0x1b8/0x1e4 [ 31.068465][ T6099] show_stack+0x2c/0x3c [ 31.069382][ T6099] dump_stack_lvl+0xd0/0x124 [ 31.070444][ T6099] dump_stack+0x1c/0x28 [ 31.071442][ T6099] print_circular_bug+0x150/0x1b8 [ 31.072721][ T6099] check_noncircular+0x310/0x404 [ 31.073896][ T6099] __lock_acquire+0x3384/0x763c [ 31.075081][ T6099] lock_acquire+0x23c/0x71c [ 31.076155][ T6099] __flush_work+0xf8/0x1c0 [ 31.077164][ T6099] flush_work+0x24/0x38 [ 31.078186][ T6099] hci_dev_close_sync+0x1c8/0xf30 [ 31.079465][ T6099] hci_rfkill_set_block+0xf0/0x20c [ 31.080676][ T6099] rfkill_set_block+0x18c/0x37c [ 31.081769][ T6099] rfkill_fop_write+0x578/0x734 [ 31.082961][ T6099] vfs_write+0x2a0/0x910 [ 31.084013][ T6099] ksys_write+0x15c/0x26c [ 31.085060][ T6099] __arm64_sys_write+0x7c/0x90 [ 31.086149][ T6099] invoke_syscall+0x98/0x2b8 [ 31.087241][ T6099] el0_svc_common+0x130/0x23c [ 31.088269][ T6099] do_el0_svc+0x48/0x58 [ 31.089283][ T6099] el0_svc+0x54/0x158 [ 31.090236][ T6099] el0t_64_sync_handler+0x84/0xfc [ 31.091410][ T6099] el0t_64_sync+0x190/0x194