Bluetooth: hci4: Opcode 0x0c1a failed: -110 Bluetooth: hci4: Error when powering off device on rfkill (-110) ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ kworker/0:6/5916 is trying to acquire lock: ffff888069a45840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] ffff888069a45840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] ffff888069a45840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4233 [inline] ffff888069a45840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: __flush_work+0x100/0xc50 kernel/workqueue.c:4291 but task is already holding lock: ffff888069a45af8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 net/bluetooth/l2cap_core.c:1755 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&conn->lock#2){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x19f/0x1300 kernel/locking/mutex.c:776 l2cap_info_timeout+0x60/0xa0 net/bluetooth/l2cap_core.c:1661 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #0 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 touch_work_lockdep_map kernel/workqueue.c:4005 [inline] start_flush_work kernel/workqueue.c:4259 [inline] __flush_work+0x700/0xc50 kernel/workqueue.c:4291 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4447 l2cap_conn_del+0x40f/0x5c0 net/bluetooth/l2cap_core.c:1791 hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline] hci_conn_hash_flush+0x10d/0x260 net/bluetooth/hci_conn.c:2644 hci_dev_close_sync+0x821/0x10e0 net/bluetooth/hci_sync.c:5358 hci_dev_do_close+0x30/0xc0 net/bluetooth/hci_core.c:502 hci_rfkill_set_block+0x1f4/0x290 net/bluetooth/hci_core.c:930 rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346 rfkill_sync net/rfkill/core.c:379 [inline] rfkill_sync_work+0x114/0x200 net/rfkill/core.c:1056 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&conn->lock#2); lock((work_completion)(&(&conn->info_timer)->work)); lock(&conn->lock#2); lock((work_completion)(&(&conn->info_timer)->work)); *** DEADLOCK *** 8 locks held by kworker/0:6/5916: #0: ffff88813fe0f548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline] #0: ffff88813fe0f548 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358 #1: ffffc90004467c40 ((work_completion)(&rfkill->sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline] #1: ffffc90004467c40 ((work_completion)(&rfkill->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358 #2: ffffffff8fee63e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_sync_work+0x2e/0x200 net/rfkill/core.c:1055 #3: ffff8880833fcec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x28/0xc0 net/bluetooth/hci_core.c:500 #4: ffff8880833fc0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5346 #5: ffffffff8fd59f28 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline] #5: ffffffff8fd59f28 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2644 #6: ffff888069a45af8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 net/bluetooth/l2cap_core.c:1755 #7: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #7: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #7: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: start_flush_work kernel/workqueue.c:4233 [inline] #7: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x100/0xc50 kernel/workqueue.c:4291 stack backtrace: CPU: 0 UID: 0 PID: 5916 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: events rfkill_sync_work Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043 check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 touch_work_lockdep_map kernel/workqueue.c:4005 [inline] start_flush_work kernel/workqueue.c:4259 [inline] __flush_work+0x700/0xc50 kernel/workqueue.c:4291 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4447 l2cap_conn_del+0x40f/0x5c0 net/bluetooth/l2cap_core.c:1791 hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline] hci_conn_hash_flush+0x10d/0x260 net/bluetooth/hci_conn.c:2644 hci_dev_close_sync+0x821/0x10e0 net/bluetooth/hci_sync.c:5358 hci_dev_do_close+0x30/0xc0 net/bluetooth/hci_core.c:502 hci_rfkill_set_block+0x1f4/0x290 net/bluetooth/hci_core.c:930 rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346 rfkill_sync net/rfkill/core.c:379 [inline] rfkill_sync_work+0x114/0x200 net/rfkill/core.c:1056 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245