Warning: Permanently added '10.128.10.37' (ED25519) to the list of known hosts. [ 35.606080][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.608457][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.611034][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.614241][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.616282][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 35.618114][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 35.785251][ T6096] [ 35.785879][ T6096] ====================================================== [ 35.787427][ T6096] WARNING: possible circular locking dependency detected [ 35.789056][ T6096] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 35.790766][ T6096] ------------------------------------------------------ [ 35.792436][ T6096] syz-executor327/6096 is trying to acquire lock: [ 35.794044][ T6096] ffff0000d17f0e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 35.796745][ T6096] [ 35.796745][ T6096] but task is already holding lock: [ 35.798506][ T6096] ffff0000d17f1108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.800748][ T6096] [ 35.800748][ T6096] which lock already depends on the new lock. [ 35.800748][ T6096] [ 35.803365][ T6096] [ 35.803365][ T6096] the existing dependency chain (in reverse order) is: [ 35.805678][ T6096] [ 35.805678][ T6096] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 35.807586][ T6096] __mutex_lock_common+0x190/0x21a0 [ 35.808967][ T6096] mutex_lock_nested+0x2c/0x38 [ 35.810169][ T6096] hci_rfkill_set_block+0xe8/0x20c [ 35.811572][ T6096] rfkill_set_block+0x18c/0x37c [ 35.812848][ T6096] rfkill_fop_write+0x578/0x734 [ 35.814232][ T6096] vfs_write+0x2a0/0x910 [ 35.815436][ T6096] ksys_write+0x15c/0x26c [ 35.816678][ T6096] __arm64_sys_write+0x7c/0x90 [ 35.818001][ T6096] invoke_syscall+0x98/0x2b8 [ 35.819277][ T6096] el0_svc_common+0x130/0x23c [ 35.820549][ T6096] do_el0_svc+0x48/0x58 [ 35.821728][ T6096] el0_svc+0x54/0x158 [ 35.822783][ T6096] el0t_64_sync_handler+0x84/0xfc [ 35.824154][ T6096] el0t_64_sync+0x190/0x194 [ 35.825389][ T6096] [ 35.825389][ T6096] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 35.827501][ T6096] __mutex_lock_common+0x190/0x21a0 [ 35.828972][ T6096] mutex_lock_nested+0x2c/0x38 [ 35.830272][ T6096] rfkill_register+0x44/0x7d4 [ 35.831496][ T6096] hci_register_dev+0x3e0/0x954 [ 35.832839][ T6096] vhci_create_device+0x358/0x6c4 [ 35.834153][ T6096] vhci_write+0x318/0x3b8 [ 35.835375][ T6096] vfs_write+0x610/0x910 [ 35.836488][ T6096] ksys_write+0x15c/0x26c [ 35.837634][ T6096] __arm64_sys_write+0x7c/0x90 [ 35.839013][ T6096] invoke_syscall+0x98/0x2b8 [ 35.840218][ T6096] el0_svc_common+0x130/0x23c [ 35.841590][ T6096] do_el0_svc+0x48/0x58 [ 35.842785][ T6096] el0_svc+0x54/0x158 [ 35.844084][ T6096] el0t_64_sync_handler+0x84/0xfc [ 35.845380][ T6096] el0t_64_sync+0x190/0x194 [ 35.846581][ T6096] [ 35.846581][ T6096] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 35.848628][ T6096] __mutex_lock_common+0x190/0x21a0 [ 35.850153][ T6096] mutex_lock_nested+0x2c/0x38 [ 35.851421][ T6096] vhci_send_frame+0x8c/0x10c [ 35.852711][ T6096] hci_send_frame+0x1c4/0x35c [ 35.854025][ T6096] hci_tx_work+0xba0/0x18e4 [ 35.855284][ T6096] process_one_work+0x694/0x1204 [ 35.856894][ T6096] worker_thread+0x938/0xef4 [ 35.858151][ T6096] kthread+0x288/0x310 [ 35.859374][ T6096] ret_from_fork+0x10/0x20 [ 35.860740][ T6096] [ 35.860740][ T6096] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 35.863230][ T6096] __lock_acquire+0x3384/0x763c [ 35.864576][ T6096] lock_acquire+0x23c/0x71c [ 35.865832][ T6096] __flush_work+0xf8/0x1c0 [ 35.867044][ T6096] flush_work+0x24/0x38 [ 35.868344][ T6096] hci_dev_close_sync+0x1c8/0xf30 [ 35.869662][ T6096] hci_rfkill_set_block+0xf0/0x20c [ 35.871036][ T6096] rfkill_set_block+0x18c/0x37c [ 35.872346][ T6096] rfkill_fop_write+0x578/0x734 [ 35.873815][ T6096] vfs_write+0x2a0/0x910 [ 35.874989][ T6096] ksys_write+0x15c/0x26c [ 35.876220][ T6096] __arm64_sys_write+0x7c/0x90 [ 35.877460][ T6096] invoke_syscall+0x98/0x2b8 [ 35.878845][ T6096] el0_svc_common+0x130/0x23c [ 35.880132][ T6096] do_el0_svc+0x48/0x58 [ 35.881470][ T6096] el0_svc+0x54/0x158 [ 35.882549][ T6096] el0t_64_sync_handler+0x84/0xfc [ 35.883952][ T6096] el0t_64_sync+0x190/0x194 [ 35.885208][ T6096] [ 35.885208][ T6096] other info that might help us debug this: [ 35.885208][ T6096] [ 35.888031][ T6096] Chain exists of: [ 35.888031][ T6096] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 35.888031][ T6096] [ 35.891702][ T6096] Possible unsafe locking scenario: [ 35.891702][ T6096] [ 35.893738][ T6096] CPU0 CPU1 [ 35.895139][ T6096] ---- ---- [ 35.896544][ T6096] lock(&hdev->req_lock); [ 35.897635][ T6096] lock(rfkill_global_mutex); [ 35.899614][ T6096] lock(&hdev->req_lock); [ 35.901329][ T6096] lock((work_completion)(&hdev->tx_work)); [ 35.902798][ T6096] [ 35.902798][ T6096] *** DEADLOCK *** [ 35.902798][ T6096] [ 35.904833][ T6096] 2 locks held by syz-executor327/6096: [ 35.906189][ T6096] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 35.908853][ T6096] #1: ffff0000d17f1108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.911458][ T6096] [ 35.911458][ T6096] stack backtrace: [ 35.912953][ T6096] CPU: 1 PID: 6096 Comm: syz-executor327 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 35.915404][ T6096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 35.917936][ T6096] Call trace: [ 35.918748][ T6096] dump_backtrace+0x1b8/0x1e4 [ 35.919910][ T6096] show_stack+0x2c/0x3c [ 35.920892][ T6096] dump_stack_lvl+0xd0/0x124 [ 35.922057][ T6096] dump_stack+0x1c/0x28 [ 35.923233][ T6096] print_circular_bug+0x150/0x1b8 [ 35.924509][ T6096] check_noncircular+0x310/0x404 [ 35.925700][ T6096] __lock_acquire+0x3384/0x763c [ 35.926955][ T6096] lock_acquire+0x23c/0x71c [ 35.928071][ T6096] __flush_work+0xf8/0x1c0 [ 35.929383][ T6096] flush_work+0x24/0x38 [ 35.930513][ T6096] hci_dev_close_sync+0x1c8/0xf30 [ 35.931733][ T6096] hci_rfkill_set_block+0xf0/0x20c [ 35.933013][ T6096] rfkill_set_block+0x18c/0x37c [ 35.934215][ T6096] rfkill_fop_write+0x578/0x734 [ 35.935601][ T6096] vfs_write+0x2a0/0x910 [ 35.936641][ T6096] ksys_write+0x15c/0x26c [ 35.937738][ T6096] __arm64_sys_write+0x7c/0x90 [ 35.938967][ T6096] invoke_syscall+0x98/0x2b8 [ 35.940166][ T6096] el0_svc_common+0x130/0x23c [ 35.941340][ T6096] do_el0_svc+0x48/0x58 [ 35.942436][ T6096] el0_svc+0x54/0x158 [ 35.943501][ T6096] el0t_64_sync_handler+0x84/0xfc [ 35.944715][ T6096] el0t_64_sync+0x190/0x194