Warning: Permanently added '10.128.0.119' (ED25519) to the list of known hosts. executing program [ 38.687762][ T4018] [ 38.688431][ T4018] ====================================================== [ 38.690182][ T4018] WARNING: possible circular locking dependency detected [ 38.691950][ T4018] 5.15.165-syzkaller #0 Not tainted [ 38.693222][ T4018] ------------------------------------------------------ [ 38.694946][ T4018] syz-executor247/4018 is trying to acquire lock: [ 38.696543][ T4018] ffff0000caf9cb98 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 38.699189][ T4018] [ 38.699189][ T4018] but task is already holding lock: [ 38.701004][ T4018] ffff0000caf9cff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 38.703346][ T4018] [ 38.703346][ T4018] which lock already depends on the new lock. [ 38.703346][ T4018] [ 38.705967][ T4018] [ 38.705967][ T4018] the existing dependency chain (in reverse order) is: [ 38.708185][ T4018] [ 38.708185][ T4018] -> #3 (&hdev->req_lock){+.+.}-{3:3}: [ 38.710105][ T4018] __mutex_lock_common+0x194/0x2154 [ 38.711524][ T4018] mutex_lock_nested+0xa4/0xf8 [ 38.712821][ T4018] hci_dev_do_close+0x64/0x1060 [ 38.714173][ T4018] hci_rfkill_set_block+0xdc/0x1d0 [ 38.715581][ T4018] rfkill_set_block+0x18c/0x37c [ 38.716925][ T4018] rfkill_fop_write+0x594/0x750 [ 38.718272][ T4018] vfs_write+0x280/0xb44 [ 38.719461][ T4018] ksys_write+0x15c/0x26c [ 38.720664][ T4018] __arm64_sys_write+0x7c/0x90 [ 38.721992][ T4018] invoke_syscall+0x98/0x2b8 [ 38.723265][ T4018] el0_svc_common+0x138/0x258 [ 38.724627][ T4018] do_el0_svc+0x58/0x14c [ 38.725813][ T4018] el0_svc+0x7c/0x1f0 [ 38.726969][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 38.728327][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 38.729575][ T4018] [ 38.729575][ T4018] -> #2 (rfkill_global_mutex){+.+.}-{3:3}: [ 38.731556][ T4018] __mutex_lock_common+0x194/0x2154 [ 38.732969][ T4018] mutex_lock_nested+0xa4/0xf8 [ 38.734270][ T4018] rfkill_register+0x44/0x7a4 [ 38.735575][ T4018] hci_register_dev+0x3e0/0x880 [ 38.736971][ T4018] vhci_create_device+0x2c4/0x568 [ 38.738340][ T4018] vhci_write+0x318/0x3b8 [ 38.739550][ T4018] vfs_write+0x884/0xb44 [ 38.740749][ T4018] ksys_write+0x15c/0x26c [ 38.741926][ T4018] __arm64_sys_write+0x7c/0x90 [ 38.743266][ T4018] invoke_syscall+0x98/0x2b8 [ 38.744535][ T4018] el0_svc_common+0x138/0x258 [ 38.745868][ T4018] do_el0_svc+0x58/0x14c [ 38.747061][ T4018] el0_svc+0x7c/0x1f0 [ 38.748170][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 38.749571][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 38.750840][ T4018] [ 38.750840][ T4018] -> #1 (&data->open_mutex){+.+.}-{3:3}: [ 38.752909][ T4018] __mutex_lock_common+0x194/0x2154 [ 38.754413][ T4018] mutex_lock_nested+0xa4/0xf8 [ 38.755719][ T4018] vhci_send_frame+0x8c/0x10c [ 38.757018][ T4018] hci_send_frame+0x194/0x2f0 [ 38.758311][ T4018] hci_tx_work+0x8d8/0x157c [ 38.759545][ T4018] process_one_work+0x790/0x11b8 [ 38.760916][ T4018] worker_thread+0x910/0x1034 [ 38.762195][ T4018] kthread+0x37c/0x45c [ 38.763387][ T4018] ret_from_fork+0x10/0x20 [ 38.764598][ T4018] [ 38.764598][ T4018] -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 38.766889][ T4018] __lock_acquire+0x32d4/0x7638 [ 38.768226][ T4018] lock_acquire+0x240/0x77c [ 38.769609][ T4018] __flush_work+0xf8/0x1c0 [ 38.770855][ T4018] flush_work+0x24/0x38 [ 38.772060][ T4018] hci_dev_do_close+0x16c/0x1060 [ 38.773408][ T4018] hci_rfkill_set_block+0xdc/0x1d0 [ 38.774803][ T4018] rfkill_set_block+0x18c/0x37c [ 38.776163][ T4018] rfkill_fop_write+0x594/0x750 [ 38.777508][ T4018] vfs_write+0x280/0xb44 [ 38.778689][ T4018] ksys_write+0x15c/0x26c [ 38.779885][ T4018] __arm64_sys_write+0x7c/0x90 [ 38.781328][ T4018] invoke_syscall+0x98/0x2b8 [ 38.782618][ T4018] el0_svc_common+0x138/0x258 [ 38.783924][ T4018] do_el0_svc+0x58/0x14c [ 38.785107][ T4018] el0_svc+0x7c/0x1f0 [ 38.786234][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 38.787711][ T4018] el0t_64_sync+0x1a0/0x1a4 [ 38.789047][ T4018] [ 38.789047][ T4018] other info that might help us debug this: [ 38.789047][ T4018] [ 38.791618][ T4018] Chain exists of: [ 38.791618][ T4018] (work_completion)(&hdev->tx_work) --> rfkill_global_mutex --> &hdev->req_lock [ 38.791618][ T4018] [ 38.795384][ T4018] Possible unsafe locking scenario: [ 38.795384][ T4018] [ 38.797188][ T4018] CPU0 CPU1 [ 38.798566][ T4018] ---- ---- [ 38.799908][ T4018] lock(&hdev->req_lock); [ 38.800996][ T4018] lock(rfkill_global_mutex); [ 38.802794][ T4018] lock(&hdev->req_lock); [ 38.804519][ T4018] lock((work_completion)(&hdev->tx_work)); [ 38.806100][ T4018] [ 38.806100][ T4018] *** DEADLOCK *** [ 38.806100][ T4018] [ 38.808198][ T4018] 2 locks held by syz-executor247/4018: [ 38.809579][ T4018] #0: ffff800016e77d28 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x250/0x750 [ 38.812094][ T4018] #1: ffff0000caf9cff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x64/0x1060 [ 38.814564][ T4018] [ 38.814564][ T4018] stack backtrace: [ 38.816033][ T4018] CPU: 1 PID: 4018 Comm: syz-executor247 Not tainted 5.15.165-syzkaller #0 [ 38.818211][ T4018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 38.820650][ T4018] Call trace: [ 38.821461][ T4018] dump_backtrace+0x0/0x530 [ 38.822551][ T4018] show_stack+0x2c/0x3c [ 38.823577][ T4018] dump_stack_lvl+0x108/0x170 [ 38.824726][ T4018] dump_stack+0x1c/0x58 [ 38.825811][ T4018] print_circular_bug+0x150/0x1b8 [ 38.827098][ T4018] check_noncircular+0x2cc/0x378 [ 38.828312][ T4018] __lock_acquire+0x32d4/0x7638 [ 38.829582][ T4018] lock_acquire+0x240/0x77c [ 38.830703][ T4018] __flush_work+0xf8/0x1c0 [ 38.831780][ T4018] flush_work+0x24/0x38 [ 38.832838][ T4018] hci_dev_do_close+0x16c/0x1060 [ 38.834168][ T4018] hci_rfkill_set_block+0xdc/0x1d0 [ 38.835452][ T4018] rfkill_set_block+0x18c/0x37c [ 38.836661][ T4018] rfkill_fop_write+0x594/0x750 [ 38.837855][ T4018] vfs_write+0x280/0xb44 [ 38.838938][ T4018] ksys_write+0x15c/0x26c [ 38.840019][ T4018] __arm64_sys_write+0x7c/0x90 [ 38.841271][ T4018] invoke_syscall+0x98/0x2b8 [ 38.842442][ T4018] el0_svc_common+0x138/0x258 [ 38.843644][ T4018] do_el0_svc+0x58/0x14c [ 38.844686][ T4018] el0_svc+0x7c/0x1f0 [ 38.845688][ T4018] el0t_64_sync_handler+0x84/0xe4 [ 38.846952][ T4018] el0t_64_sync+0x1a0/0x1a4