Warning: Permanently added '10.128.1.21' (ED25519) to the list of known hosts. [ 35.239305][ T6099] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.241593][ T6099] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.243504][ T6099] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.245892][ T6099] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.247827][ T6099] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 35.249617][ T6099] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 35.391362][ T6098] [ 35.391995][ T6098] ====================================================== [ 35.393581][ T6098] WARNING: possible circular locking dependency detected [ 35.395205][ T6098] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 35.396598][ T6098] ------------------------------------------------------ [ 35.398231][ T6098] syz-executor236/6098 is trying to acquire lock: [ 35.399714][ T6098] ffff0000d066ce10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 35.402187][ T6098] [ 35.402187][ T6098] but task is already holding lock: [ 35.403945][ T6098] ffff0000d066d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.406250][ T6098] [ 35.406250][ T6098] which lock already depends on the new lock. [ 35.406250][ T6098] [ 35.408537][ T6098] [ 35.408537][ T6098] the existing dependency chain (in reverse order) is: [ 35.410585][ T6098] [ 35.410585][ T6098] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 35.412261][ T6098] __mutex_lock_common+0x190/0x21a0 [ 35.413622][ T6098] mutex_lock_nested+0x2c/0x38 [ 35.414855][ T6098] hci_rfkill_set_block+0xe8/0x20c [ 35.416146][ T6098] rfkill_set_block+0x18c/0x37c [ 35.417368][ T6098] rfkill_fop_write+0x578/0x734 [ 35.418595][ T6098] vfs_write+0x2a0/0x910 [ 35.419626][ T6098] ksys_write+0x15c/0x26c [ 35.420727][ T6098] __arm64_sys_write+0x7c/0x90 [ 35.421965][ T6098] invoke_syscall+0x98/0x2b8 [ 35.423158][ T6098] el0_svc_common+0x130/0x23c [ 35.424316][ T6098] do_el0_svc+0x48/0x58 [ 35.425374][ T6098] el0_svc+0x54/0x158 [ 35.426372][ T6098] el0t_64_sync_handler+0x84/0xfc [ 35.427691][ T6098] el0t_64_sync+0x190/0x194 [ 35.428826][ T6098] [ 35.428826][ T6098] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 35.430615][ T6098] __mutex_lock_common+0x190/0x21a0 [ 35.431966][ T6098] mutex_lock_nested+0x2c/0x38 [ 35.433139][ T6098] rfkill_register+0x44/0x7d4 [ 35.434374][ T6098] hci_register_dev+0x3e0/0x954 [ 35.435688][ T6098] vhci_create_device+0x358/0x6c4 [ 35.437025][ T6098] vhci_write+0x318/0x3b8 [ 35.438174][ T6098] vfs_write+0x610/0x910 [ 35.439205][ T6098] ksys_write+0x15c/0x26c [ 35.440357][ T6098] __arm64_sys_write+0x7c/0x90 [ 35.441577][ T6098] invoke_syscall+0x98/0x2b8 [ 35.442794][ T6098] el0_svc_common+0x130/0x23c [ 35.444104][ T6098] do_el0_svc+0x48/0x58 [ 35.445118][ T6098] el0_svc+0x54/0x158 [ 35.446218][ T6098] el0t_64_sync_handler+0x84/0xfc [ 35.447487][ T6098] el0t_64_sync+0x190/0x194 [ 35.448653][ T6098] [ 35.448653][ T6098] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 35.450471][ T6098] __mutex_lock_common+0x190/0x21a0 [ 35.451750][ T6098] mutex_lock_nested+0x2c/0x38 [ 35.453059][ T6098] vhci_send_frame+0x8c/0x10c [ 35.454162][ T6098] hci_send_frame+0x1c4/0x35c [ 35.455391][ T6098] hci_tx_work+0xba0/0x18e4 [ 35.456417][ T6098] process_one_work+0x694/0x1204 [ 35.457595][ T6098] worker_thread+0x938/0xef4 [ 35.458749][ T6098] kthread+0x288/0x310 [ 35.459813][ T6098] ret_from_fork+0x10/0x20 [ 35.460970][ T6098] [ 35.460970][ T6098] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 35.463089][ T6098] __lock_acquire+0x3384/0x763c [ 35.464269][ T6098] lock_acquire+0x23c/0x71c [ 35.465457][ T6098] __flush_work+0xf8/0x1c0 [ 35.466636][ T6098] flush_work+0x24/0x38 [ 35.467666][ T6098] hci_dev_close_sync+0x1c8/0xf30 [ 35.468882][ T6098] hci_rfkill_set_block+0xf0/0x20c [ 35.470202][ T6098] rfkill_set_block+0x18c/0x37c [ 35.471474][ T6098] rfkill_fop_write+0x578/0x734 [ 35.472706][ T6098] vfs_write+0x2a0/0x910 [ 35.473803][ T6098] ksys_write+0x15c/0x26c [ 35.474899][ T6098] __arm64_sys_write+0x7c/0x90 [ 35.476238][ T6098] invoke_syscall+0x98/0x2b8 [ 35.477427][ T6098] el0_svc_common+0x130/0x23c [ 35.478632][ T6098] do_el0_svc+0x48/0x58 [ 35.479671][ T6098] el0_svc+0x54/0x158 [ 35.480638][ T6098] el0t_64_sync_handler+0x84/0xfc [ 35.481954][ T6098] el0t_64_sync+0x190/0x194 [ 35.483029][ T6098] [ 35.483029][ T6098] other info that might help us debug this: [ 35.483029][ T6098] [ 35.485306][ T6098] Chain exists of: [ 35.485306][ T6098] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 35.485306][ T6098] [ 35.488670][ T6098] Possible unsafe locking scenario: [ 35.488670][ T6098] [ 35.490284][ T6098] CPU0 CPU1 [ 35.491415][ T6098] ---- ---- [ 35.492612][ T6098] lock(&hdev->req_lock); [ 35.493581][ T6098] lock(rfkill_global_mutex); [ 35.495273][ T6098] lock(&hdev->req_lock); [ 35.496858][ T6098] lock((work_completion)(&hdev->tx_work)); [ 35.498229][ T6098] [ 35.498229][ T6098] *** DEADLOCK *** [ 35.498229][ T6098] [ 35.500110][ T6098] 2 locks held by syz-executor236/6098: [ 35.501246][ T6098] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 35.503562][ T6098] #1: ffff0000d066d108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 35.505837][ T6098] [ 35.505837][ T6098] stack backtrace: [ 35.507199][ T6098] CPU: 1 PID: 6098 Comm: syz-executor236 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 35.509562][ T6098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 35.511916][ T6098] Call trace: [ 35.512678][ T6098] dump_backtrace+0x1b8/0x1e4 [ 35.513817][ T6098] show_stack+0x2c/0x3c [ 35.514772][ T6098] dump_stack_lvl+0xd0/0x124 [ 35.515896][ T6098] dump_stack+0x1c/0x28 [ 35.516843][ T6098] print_circular_bug+0x150/0x1b8 [ 35.518125][ T6098] check_noncircular+0x310/0x404 [ 35.519222][ T6098] __lock_acquire+0x3384/0x763c [ 35.520405][ T6098] lock_acquire+0x23c/0x71c [ 35.521423][ T6098] __flush_work+0xf8/0x1c0 [ 35.522494][ T6098] flush_work+0x24/0x38 [ 35.523417][ T6098] hci_dev_close_sync+0x1c8/0xf30 [ 35.524573][ T6098] hci_rfkill_set_block+0xf0/0x20c [ 35.525847][ T6098] rfkill_set_block+0x18c/0x37c [ 35.526856][ T6098] rfkill_fop_write+0x578/0x734 [ 35.527972][ T6098] vfs_write+0x2a0/0x910 [ 35.528918][ T6098] ksys_write+0x15c/0x26c [ 35.529909][ T6098] __arm64_sys_write+0x7c/0x90 [ 35.531025][ T6098] invoke_syscall+0x98/0x2b8 [ 35.532069][ T6098] el0_svc_common+0x130/0x23c [ 35.533107][ T6098] do_el0_svc+0x48/0x58 [ 35.534108][ T6098] el0_svc+0x54/0x158 [ 35.534924][ T6098] el0t_64_sync_handler+0x84/0xfc [ 35.536053][ T6098] el0t_64_sync+0x190/0x194