Warning: Permanently added '10.128.0.18' (ED25519) to the list of known hosts. [ 31.312339][ T6096] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 31.314598][ T6096] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 31.316623][ T6096] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 31.319210][ T6096] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 31.321414][ T6096] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 31.323251][ T6096] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 31.476188][ T6094] [ 31.476658][ T6094] ====================================================== [ 31.478283][ T6094] WARNING: possible circular locking dependency detected [ 31.479747][ T6094] 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 Not tainted [ 31.481219][ T6094] ------------------------------------------------------ [ 31.482764][ T6094] syz-executor406/6094 is trying to acquire lock: [ 31.484196][ T6094] ffff0000d0088e10 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 31.486650][ T6094] [ 31.486650][ T6094] but task is already holding lock: [ 31.488465][ T6094] ffff0000d0089108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 31.490736][ T6094] [ 31.490736][ T6094] which lock already depends on the new lock. [ 31.490736][ T6094] [ 31.493142][ T6094] [ 31.493142][ T6094] the existing dependency chain (in reverse order) is: [ 31.495183][ T6094] [ 31.495183][ T6094] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 31.496988][ T6094] __mutex_lock_common+0x190/0x21a0 [ 31.498362][ T6094] mutex_lock_nested+0x2c/0x38 [ 31.499688][ T6094] hci_rfkill_set_block+0xe8/0x20c [ 31.501073][ T6094] rfkill_set_block+0x18c/0x37c [ 31.502382][ T6094] rfkill_fop_write+0x578/0x734 [ 31.503697][ T6094] vfs_write+0x2a0/0x910 [ 31.504841][ T6094] ksys_write+0x15c/0x26c [ 31.505974][ T6094] __arm64_sys_write+0x7c/0x90 [ 31.507246][ T6094] invoke_syscall+0x98/0x2b8 [ 31.508443][ T6094] el0_svc_common+0x130/0x23c [ 31.509571][ T6094] do_el0_svc+0x48/0x58 [ 31.510718][ T6094] el0_svc+0x54/0x158 [ 31.511848][ T6094] el0t_64_sync_handler+0x84/0xfc [ 31.513168][ T6094] el0t_64_sync+0x190/0x194 [ 31.514309][ T6094] [ 31.514309][ T6094] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 31.516183][ T6094] __mutex_lock_common+0x190/0x21a0 [ 31.517513][ T6094] mutex_lock_nested+0x2c/0x38 [ 31.518788][ T6094] rfkill_register+0x44/0x7d4 [ 31.519914][ T6094] hci_register_dev+0x3e0/0x954 [ 31.521289][ T6094] vhci_create_device+0x358/0x6c4 [ 31.522628][ T6094] vhci_write+0x318/0x3b8 [ 31.523765][ T6094] vfs_write+0x610/0x910 [ 31.524941][ T6094] ksys_write+0x15c/0x26c [ 31.526050][ T6094] __arm64_sys_write+0x7c/0x90 [ 31.527299][ T6094] invoke_syscall+0x98/0x2b8 [ 31.528486][ T6094] el0_svc_common+0x130/0x23c [ 31.529712][ T6094] do_el0_svc+0x48/0x58 [ 31.530808][ T6094] el0_svc+0x54/0x158 [ 31.531822][ T6094] el0t_64_sync_handler+0x84/0xfc [ 31.533075][ T6094] el0t_64_sync+0x190/0x194 [ 31.534233][ T6094] [ 31.534233][ T6094] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 31.536135][ T6094] __mutex_lock_common+0x190/0x21a0 [ 31.537493][ T6094] mutex_lock_nested+0x2c/0x38 [ 31.538725][ T6094] vhci_send_frame+0x8c/0x10c [ 31.540065][ T6094] hci_send_frame+0x1c4/0x35c [ 31.541216][ T6094] hci_tx_work+0xba0/0x18e4 [ 31.542435][ T6094] process_one_work+0x694/0x1204 [ 31.543768][ T6094] worker_thread+0x938/0xef4 [ 31.545031][ T6094] kthread+0x288/0x310 [ 31.546082][ T6094] ret_from_fork+0x10/0x20 [ 31.547329][ T6094] [ 31.547329][ T6094] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 31.549493][ T6094] __lock_acquire+0x3384/0x763c [ 31.550688][ T6094] lock_acquire+0x23c/0x71c [ 31.551831][ T6094] __flush_work+0xf8/0x1c0 [ 31.553005][ T6094] flush_work+0x24/0x38 [ 31.554141][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 31.555386][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 31.556769][ T6094] rfkill_set_block+0x18c/0x37c [ 31.558075][ T6094] rfkill_fop_write+0x578/0x734 [ 31.559293][ T6094] vfs_write+0x2a0/0x910 [ 31.560429][ T6094] ksys_write+0x15c/0x26c [ 31.561521][ T6094] __arm64_sys_write+0x7c/0x90 [ 31.562831][ T6094] invoke_syscall+0x98/0x2b8 [ 31.563985][ T6094] el0_svc_common+0x130/0x23c [ 31.565196][ T6094] do_el0_svc+0x48/0x58 [ 31.566309][ T6094] el0_svc+0x54/0x158 [ 31.567305][ T6094] el0t_64_sync_handler+0x84/0xfc [ 31.568647][ T6094] el0t_64_sync+0x190/0x194 [ 31.569801][ T6094] [ 31.569801][ T6094] other info that might help us debug this: [ 31.569801][ T6094] [ 31.572154][ T6094] Chain exists of: [ 31.572154][ T6094] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 31.572154][ T6094] [ 31.575727][ T6094] Possible unsafe locking scenario: [ 31.575727][ T6094] [ 31.577500][ T6094] CPU0 CPU1 [ 31.578803][ T6094] ---- ---- [ 31.580039][ T6094] lock(&hdev->req_lock); [ 31.581146][ T6094] lock(rfkill_global_mutex); [ 31.582894][ T6094] lock(&hdev->req_lock); [ 31.584496][ T6094] lock((work_completion)(&hdev->tx_work)); [ 31.585933][ T6094] [ 31.585933][ T6094] *** DEADLOCK *** [ 31.585933][ T6094] [ 31.587908][ T6094] 2 locks held by syz-executor406/6094: [ 31.589197][ T6094] #0: ffff80009122cca8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x234/0x734 [ 31.591677][ T6094] #1: ffff0000d0089108 (&hdev->req_lock){+.+.}-{3:3}, at: hci_rfkill_set_block+0xe8/0x20c [ 31.594036][ T6094] [ 31.594036][ T6094] stack backtrace: [ 31.595498][ T6094] CPU: 0 PID: 6094 Comm: syz-executor406 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 31.597960][ T6094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 31.600360][ T6094] Call trace: [ 31.601137][ T6094] dump_backtrace+0x1b8/0x1e4 [ 31.602189][ T6094] show_stack+0x2c/0x3c [ 31.603127][ T6094] dump_stack_lvl+0xd0/0x124 [ 31.604240][ T6094] dump_stack+0x1c/0x28 [ 31.605204][ T6094] print_circular_bug+0x150/0x1b8 [ 31.606380][ T6094] check_noncircular+0x310/0x404 [ 31.607663][ T6094] __lock_acquire+0x3384/0x763c [ 31.608823][ T6094] lock_acquire+0x23c/0x71c [ 31.609907][ T6094] __flush_work+0xf8/0x1c0 [ 31.610929][ T6094] flush_work+0x24/0x38 [ 31.611966][ T6094] hci_dev_close_sync+0x1c8/0xf30 [ 31.613184][ T6094] hci_rfkill_set_block+0xf0/0x20c [ 31.614496][ T6094] rfkill_set_block+0x18c/0x37c [ 31.615517][ T6094] rfkill_fop_write+0x578/0x734 [ 31.616382][ T6094] vfs_write+0x2a0/0x910 [ 31.617765][ T6094] ksys_write+0x15c/0x26c [ 31.618786][ T6094] __arm64_sys_write+0x7c/0x90 [ 31.619938][ T6094] invoke_syscall+0x98/0x2b8 [ 31.621022][ T6094] el0_svc_common+0x130/0x23c [ 31.622114][ T6094] do_el0_svc+0x48/0x58 [ 31.623131][ T6094] el0_svc+0x54/0x158 [ 31.624061][ T6094] el0t_64_sync_handler+0x84/0xfc [ 31.625168][ T6094] el0t_64_sync+0x190/0x194