Warning: Permanently added '10.128.10.5' (ED25519) to the list of known hosts. [ 31.381175][ T4225] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 31.383806][ T4225] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 31.386230][ T4225] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 31.388814][ T4225] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 31.391784][ T4225] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 31.393911][ T4225] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 31.543355][ T4222] [ 31.544002][ T4222] ====================================================== [ 31.545846][ T4222] WARNING: possible circular locking dependency detected [ 31.547685][ T4222] 6.1.64-syzkaller #0 Not tainted [ 31.549024][ T4222] ------------------------------------------------------ [ 31.550815][ T4222] syz-executor405/4222 is trying to acquire lock: [ 31.552575][ T4222] ffff0000d0964dc0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 31.555290][ T4222] [ 31.555290][ T4222] but task is already holding lock: [ 31.557235][ T4222] ffff0000d09650b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 31.559791][ T4222] [ 31.559791][ T4222] which lock already depends on the new lock. [ 31.559791][ T4222] [ 31.562453][ T4222] [ 31.562453][ T4222] the existing dependency chain (in reverse order) is: [ 31.564787][ T4222] [ 31.564787][ T4222] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 31.566904][ T4222] __mutex_lock_common+0x190/0x21a0 [ 31.568442][ T4222] mutex_lock_nested+0x38/0x44 [ 31.569878][ T4222] hci_rfkill_set_block+0xe8/0x20c [ 31.571373][ T4222] rfkill_set_block+0x18c/0x37c [ 31.572863][ T4222] rfkill_fop_write+0x578/0x734 [ 31.574322][ T4222] vfs_write+0x2a4/0x914 [ 31.575585][ T4222] ksys_write+0x15c/0x26c [ 31.576842][ T4222] __arm64_sys_write+0x7c/0x90 [ 31.578176][ T4222] invoke_syscall+0x98/0x2c0 [ 31.579531][ T4222] el0_svc_common+0x138/0x258 [ 31.580857][ T4222] do_el0_svc+0x64/0x218 [ 31.582209][ T4222] el0_svc+0x58/0x168 [ 31.583416][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 31.584906][ T4222] el0t_64_sync+0x18c/0x190 [ 31.586204][ T4222] [ 31.586204][ T4222] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 31.588254][ T4222] __mutex_lock_common+0x190/0x21a0 [ 31.589764][ T4222] mutex_lock_nested+0x38/0x44 [ 31.591158][ T4222] rfkill_register+0x44/0x7a4 [ 31.592508][ T4222] hci_register_dev+0x3e0/0x954 [ 31.594009][ T4222] vhci_create_device+0x358/0x694 [ 31.595491][ T4222] vhci_write+0x318/0x3b8 [ 31.596848][ T4222] vfs_write+0x610/0x914 [ 31.598142][ T4222] ksys_write+0x15c/0x26c [ 31.599378][ T4222] __arm64_sys_write+0x7c/0x90 [ 31.600799][ T4222] invoke_syscall+0x98/0x2c0 [ 31.602206][ T4222] el0_svc_common+0x138/0x258 [ 31.603590][ T4222] do_el0_svc+0x64/0x218 [ 31.604836][ T4222] el0_svc+0x58/0x168 [ 31.605955][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 31.607396][ T4222] el0t_64_sync+0x18c/0x190 [ 31.608778][ T4222] [ 31.608778][ T4222] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 31.610894][ T4222] __mutex_lock_common+0x190/0x21a0 [ 31.612408][ T4222] mutex_lock_nested+0x38/0x44 [ 31.613845][ T4222] vhci_send_frame+0x8c/0x10c [ 31.615202][ T4222] hci_send_frame+0x1c4/0x35c [ 31.616535][ T4222] hci_tx_work+0xba0/0x18e4 [ 31.617889][ T4222] process_one_work+0x7ac/0x1404 [ 31.619387][ T4222] worker_thread+0x8e4/0xfec [ 31.620706][ T4222] kthread+0x250/0x2d8 [ 31.621995][ T4222] ret_from_fork+0x10/0x20 [ 31.623279][ T4222] [ 31.623279][ T4222] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 31.625670][ T4222] __lock_acquire+0x3338/0x764c [ 31.627128][ T4222] lock_acquire+0x26c/0x7cc [ 31.628423][ T4222] __flush_work+0xf8/0x1c0 [ 31.629717][ T4222] flush_work+0x24/0x38 [ 31.630934][ T4222] hci_dev_close_sync+0x1c8/0xf1c [ 31.632399][ T4222] hci_rfkill_set_block+0xf0/0x20c [ 31.633941][ T4222] rfkill_set_block+0x18c/0x37c [ 31.635327][ T4222] rfkill_fop_write+0x578/0x734 [ 31.636765][ T4222] vfs_write+0x2a4/0x914 [ 31.638040][ T4222] ksys_write+0x15c/0x26c [ 31.639281][ T4222] __arm64_sys_write+0x7c/0x90 [ 31.640658][ T4222] invoke_syscall+0x98/0x2c0 [ 31.641987][ T4222] el0_svc_common+0x138/0x258 [ 31.643419][ T4222] do_el0_svc+0x64/0x218 [ 31.644662][ T4222] el0_svc+0x58/0x168 [ 31.645847][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 31.647331][ T4222] el0t_64_sync+0x18c/0x190 [ 31.648636][ T4222] [ 31.648636][ T4222] other info that might help us debug this: [ 31.648636][ T4222] [ 31.651333][ T4222] Chain exists of: [ 31.651333][ T4222] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 31.651333][ T4222] [ 31.655372][ T4222] Possible unsafe locking scenario: [ 31.655372][ T4222] [ 31.657295][ T4222] CPU0 CPU1 [ 31.658755][ T4222] ---- ---- [ 31.660185][ T4222] lock(&hdev->req_lock); [ 31.661309][ T4222] lock(rfkill_global_mutex); [ 31.663235][ T4222] lock(&hdev->req_lock); [ 31.665034][ T4222] lock((work_completion)(&hdev->tx_work)); [ 31.666588][ T4222] [ 31.666588][ T4222] *** DEADLOCK *** [ 31.666588][ T4222] [ 31.668756][ T4222] 2 locks held by syz-executor405/4222: [ 31.670259][ T4222] #0: ffff80001808a588 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 31.672973][ T4222] #1: ffff0000d09650b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 31.675594][ T4222] [ 31.675594][ T4222] stack backtrace: [ 31.677142][ T4222] CPU: 0 PID: 4222 Comm: syz-executor405 Not tainted 6.1.64-syzkaller #0 [ 31.679310][ T4222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 31.682009][ T4222] Call trace: [ 31.682846][ T4222] dump_backtrace+0x1c8/0x1f4 [ 31.684021][ T4222] show_stack+0x2c/0x3c [ 31.685095][ T4222] dump_stack_lvl+0x108/0x170 [ 31.686359][ T4222] dump_stack+0x1c/0x58 [ 31.687440][ T4222] print_circular_bug+0x150/0x1b8 [ 31.688811][ T4222] check_noncircular+0x2cc/0x378 [ 31.690118][ T4222] __lock_acquire+0x3338/0x764c [ 31.691419][ T4222] lock_acquire+0x26c/0x7cc [ 31.692601][ T4222] __flush_work+0xf8/0x1c0 [ 31.693750][ T4222] flush_work+0x24/0x38 [ 31.694887][ T4222] hci_dev_close_sync+0x1c8/0xf1c [ 31.696267][ T4222] hci_rfkill_set_block+0xf0/0x20c [ 31.697594][ T4222] rfkill_set_block+0x18c/0x37c [ 31.698834][ T4222] rfkill_fop_write+0x578/0x734 [ 31.700102][ T4222] vfs_write+0x2a4/0x914 [ 31.701231][ T4222] ksys_write+0x15c/0x26c [ 31.702349][ T4222] __arm64_sys_write+0x7c/0x90 [ 31.703619][ T4222] invoke_syscall+0x98/0x2c0 [ 31.704844][ T4222] el0_svc_common+0x138/0x258 [ 31.706040][ T4222] do_el0_svc+0x64/0x218 [ 31.707179][ T4222] el0_svc+0x58/0x168 [ 31.708247][ T4222] el0t_64_sync_handler+0x84/0xf0 [ 31.709508][ T4222] el0t_64_sync+0x18c/0x190