====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ kworker/1:9/4232 is trying to acquire lock: ffff88801e6d5028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 kernel/workqueue.c:3090 but task is already holding lock: ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_epo+0x43/0x170 net/rfkill/core.c:465 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (rfkill_global_mutex){+.+.}-{3:3} : __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_register+0x2f/0x970 net/rfkill/core.c:1060 hci_register_dev+0x459/0x980 net/bluetooth/hci_core.c:3987 __vhci_create_device drivers/bluetooth/hci_vhci.c:129 [inline] vhci_create_device+0x32e/0x5c0 drivers/bluetooth/hci_vhci.c:153 vhci_get_user drivers/bluetooth/hci_vhci.c:210 [inline] vhci_write+0x389/0x440 drivers/bluetooth/hci_vhci.c:290 call_write_iter include/linux/fs.h:2179 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x748/0xd70 fs/read_write.c:594 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #3 (&data->open_mutex){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 vhci_send_frame+0x88/0x100 drivers/bluetooth/hci_vhci.c:71 hci_send_frame+0x1a9/0x2e0 net/bluetooth/hci_core.c:4286 hci_sched_acl_pkt net/bluetooth/hci_core.c:4811 [inline] hci_sched_acl net/bluetooth/hci_core.c:4896 [inline] hci_tx_work+0x9b5/0x16d0 net/bluetooth/hci_core.c:4962 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: __flush_work+0x116/0x210 kernel/workqueue.c:3090 hci_dev_do_close+0x201/0x1020 net/bluetooth/hci_core.c:1774 hci_unregister_dev+0x2eb/0x590 net/bluetooth/hci_core.c:4070 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x635/0x2110 kernel/exit.c:890 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004 __do_sys_exit_group kernel/exit.c:1015 [inline] __se_sys_exit_group kernel/exit.c:1013 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1013 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #1 ( &hdev->req_lock){+.+.}-{3:3} : __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 hci_req_sync net/bluetooth/hci_request.c:278 [inline] bg_scan_update+0x44/0x3b0 net/bluetooth/hci_request.c:2952 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #0 ((work_completion)(&hdev->bg_scan_update) ){+.+.}-{0:0} : check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 __flush_work+0x116/0x210 kernel/workqueue.c:3090 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 hci_request_cancel_all+0xcc/0x300 net/bluetooth/hci_request.c:3522 hci_dev_do_close+0x4e/0x1020 net/bluetooth/hci_core.c:1754 hci_rfkill_set_block+0x101/0x180 net/bluetooth/hci_core.c:2253 rfkill_set_block+0x1c1/0x3c0 net/rfkill/core.c:360 rfkill_epo+0x75/0x170 net/rfkill/core.c:469 __rfkill_handle_global_op net/rfkill/input.c:60 [inline] rfkill_op_handler+0x76/0x220 net/rfkill/input.c:108 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 other info that might help us debug this: Chain exists of: (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rfkill_global_mutex); lock( &data->open_mutex); lock(rfkill_global_mutex); lock( (work_completion)(&hdev->bg_scan_update)); *** DEADLOCK *** 3 locks held by kworker/1:9/4232: #0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0} , at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc900031dfd00 ((rfkill_op_work).work ){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e4d7308 (rfkill_global_mutex ){+.+.}-{3:3}, at: rfkill_epo+0x43/0x170 net/rfkill/core.c:465 stack backtrace: CPU: 1 PID: 4232 Comm: kworker/1:9 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Workqueue: events rfkill_op_handler Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 __flush_work+0x116/0x210 kernel/workqueue.c:3090 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 hci_request_cancel_all+0xcc/0x300 net/bluetooth/hci_request.c:3522 hci_dev_do_close+0x4e/0x1020 net/bluetooth/hci_core.c:1754 hci_rfkill_set_block+0x101/0x180 net/bluetooth/hci_core.c:2253 rfkill_set_block+0x1c1/0x3c0 net/rfkill/core.c:360 rfkill_epo+0x75/0x170 net/rfkill/core.c:469 __rfkill_handle_global_op net/rfkill/input.c:60 [inline] rfkill_op_handler+0x76/0x220 net/rfkill/input.c:108 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 hci1: cancelling interleave scan hci1 state 0 -> 0 All LE pending actions cleared hdev hci1 hcon ffff888079098000 reason 22 hcon ffff888079098000 conn ffff888074442800, err 103 hci1 hcon ffff888079098000 chan ffff88802c75cd00 hci1 hcon ffff888079098000 handle 201 hcon ffff888079098000 hci1: conn ffff888079098000 device: 'hci1:201': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci1:201: removing kernfs uevent: removing PM: Removing info for No Bus:hci1:201 kobject: 'hci1:201' (ffff888079098420): kobject_uevent_env kobject: 'hci1:201' (ffff888079098420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/hci1:201' kernfs hci1:201: removing kobject: 'hci1:201' (ffff888079098420): kobject_cleanup, parent 0000000000000000 kobject: 'hci1:201' (ffff888079098420): calling ktype release kobject: 'hci1:201': free name hci1 orig refcnt 10 hcon ffff88807a272000 reason 22 hcon ffff88807a272000 conn ffff888074441800, err 103 hci1 hcon ffff88807a272000 chan ffff88802c75cc00 hci1 hcon ffff88807a272000 handle 200 hcon ffff88807a272000 hci1: conn ffff88807a272000 device: 'hci1:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci1:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci1:200 kobject: 'hci1:200' (ffff88807a272420): kobject_uevent_env kobject: 'hci1:200' (ffff88807a272420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/hci1:200' kernfs hci1:200: removing kobject: 'hci1:200' (ffff88807a272420): kobject_cleanup, parent 0000000000000000 kobject: 'hci1:200' (ffff88807a272420): calling ktype release kobject: 'hci1:200': free name hci1 orig refcnt 7 hdev hci1 event 4 hdev 0000000000000000 len 8 hdev hci1 event 8 hci1 orig refcnt 6 kobject: 'rfkill6' (ffff888148b5d108): kobject_uevent_env kobject: 'rfkill6' (ffff888148b5d108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/rfkill6' ffff88801ff08000 name hci2 blocked 1 hci2 ffff88801ff08000 hci2: err 0x13 hci2: cancelling interleave scan hci2 state 0 -> 0 All LE pending actions cleared hdev hci2 hcon ffff88807cb98000 reason 22 hcon ffff88807cb98000 conn ffff8880795ad800, err 103 hci2 hcon ffff88807cb98000 chan ffff888021b79200 hci2 hcon ffff88807cb98000 handle 201 hcon ffff88807cb98000 hci2: conn ffff88807cb98000 device: 'hci2:201': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci2:201: removing kernfs uevent: removing PM: Removing info for No Bus:hci2:201 kobject: 'hci2:201' (ffff88807cb98420): kobject_uevent_env kobject: 'hci2:201' (ffff88807cb98420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/hci2:201' kernfs hci2:201: removing kobject: 'hci2:201' (ffff88807cb98420): kobject_cleanup, parent 0000000000000000 kobject: 'hci2:201' (ffff88807cb98420): calling ktype release kobject: 'hci2:201': free name hci2 orig refcnt 10 hcon ffff88801afba000 reason 22 hcon ffff88801afba000 conn ffff8880795ad000, err 103 hci2 hcon ffff88801afba000 chan ffff88801f255600 hci2 hcon ffff88801afba000 handle 200 hcon ffff88801afba000 hci2: conn ffff88801afba000 device: 'hci2:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci2:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci2:200 kobject: 'hci2:200' (ffff88801afba420): kobject_uevent_env kobject: 'hci2:200' (ffff88801afba420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/hci2:200' kernfs hci2:200: removing kobject: 'hci2:200' (ffff88801afba420): kobject_cleanup, parent 0000000000000000 kobject: 'hci2:200' (ffff88801afba420): calling ktype release kobject: 'hci2:200': free name hci2 orig refcnt 7 hdev hci2 event 4 hdev 0000000000000000 len 8 hdev hci2 event 8 hci2 orig refcnt 6 kobject: 'rfkill7' (ffff888148c29108): kobject_uevent_env kobject: 'rfkill7' (ffff888148c29108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/rfkill7' ffff88801f3e8000 name hci3 blocked 1 hci3 ffff88801f3e8000 hci3: err 0x13 hci3: cancelling interleave scan hci3 state 0 -> 0 All LE pending actions cleared hdev hci3 hcon ffff88807d11e000 reason 22 hcon ffff88807d11e000 conn ffff888079f87000, err 103 hci3 hcon ffff88807d11e000 chan ffff88802c96d600 hci3 hcon ffff88807d11e000 handle 201 hcon ffff88807d11e000 hci3: conn ffff88807d11e000 device: 'hci3:201': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci3:201: removing kernfs uevent: removing PM: Removing info for No Bus:hci3:201 kobject: 'hci3:201' (ffff88807d11e420): kobject_uevent_env kobject: 'hci3:201' (ffff88807d11e420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci3/hci3:201' kernfs hci3:201: removing kobject: 'hci3:201' (ffff88807d11e420): kobject_cleanup, parent 0000000000000000 kobject: 'hci3:201' (ffff88807d11e420): calling ktype release kobject: 'hci3:201': free name hci3 orig refcnt 10 hcon ffff888074b9e000 reason 22 hcon ffff888074b9e000 conn ffff888079f86800, err 103 hci3 hcon ffff888074b9e000 chan ffff88802c96d900 hci3 hcon ffff888074b9e000 handle 200 hcon ffff888074b9e000 hci3: conn ffff888074b9e000 device: 'hci3:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci3:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci3:200 kobject: 'hci3:200' (ffff888074b9e420): kobject_uevent_env kobject: 'hci3:200' (ffff888074b9e420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci3/hci3:200' kernfs hci3:200: removing kobject: 'hci3:200' (ffff888074b9e420): kobject_cleanup, parent 0000000000000000 kobject: 'hci3:200' (ffff888074b9e420): calling ktype release kobject: 'hci3:200': free name hci3 orig refcnt 7 hdev hci3 event 4 hdev 0000000000000000 len 8 hdev hci3 event 8 hci3 orig refcnt 6 kobject: 'rfkill8' (ffff88814cbbf108): kobject_uevent_env kobject: 'rfkill8' (ffff88814cbbf108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci3/rfkill8' ffff88801f518000 name hci4 blocked 1 hci4 ffff88801f518000 hci4: err 0x13 hci4: cancelling interleave scan hci4 state 0 -> 0 All LE pending actions cleared hdev hci4 hcon ffff888074432000 reason 22 hcon ffff888074432000 conn ffff888079678000, err 103 hci4 hcon ffff888074432000 chan ffff88802c75cf00 hci4 hcon ffff888074432000 handle 201 hcon ffff888074432000 hci4: conn ffff888074432000 device: 'hci4:201': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci4:201: removing kernfs uevent: removing PM: Removing info for No Bus:hci4:201 kobject: 'hci4:201' (ffff888074432420): kobject_uevent_env kobject: 'hci4:201' (ffff888074432420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci4/hci4:201' kernfs hci4:201: removing kobject: 'hci4:201' (ffff888074432420): kobject_cleanup, parent 0000000000000000 kobject: 'hci4:201' (ffff888074432420): calling ktype release kobject: 'hci4:201': free name hci4 orig refcnt 10 hcon ffff888079a4e000 reason 22 hcon ffff888079a4e000 conn ffff888074447800, err 103 hci4 hcon ffff888079a4e000 chan ffff88802c75ce00 hci4 hcon ffff888079a4e000 handle 200 hcon ffff888079a4e000 hci4: conn ffff888079a4e000 device: 'hci4:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci4:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci4:200 kobject: 'hci4:200' (ffff888079a4e420): kobject_uevent_env kobject: 'hci4:200' (ffff888079a4e420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci4/hci4:200' kernfs hci4:200: removing kobject: 'hci4:200' (ffff888079a4e420): kobject_cleanup, parent 0000000000000000 kobject: 'hci4:200' (ffff888079a4e420): calling ktype release kobject: 'hci4:200': free name hci4 orig refcnt 7 hdev hci4 event 4 hdev 0000000000000000 len 8 hdev hci4 event 8 hci4 orig refcnt 6 kobject: 'rfkill9' (ffff88814cbbb108): kobject_uevent_env kobject: 'rfkill9' (ffff88814cbbb108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci4/rfkill9' ieee80211 phy3: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=08:02:11:00:00:00) ieee80211 phy3: BCN EN: 0 (BI=100) ieee80211 phy3: beaconing vifs remaining: 0 ieee80211 phy3: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=08:02:11:00:00:00) ieee80211 phy3: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy3: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) mac80211_hwsim hwsim2 wlan0: bond_netdev_event received NETDEV_GOING_DOWN net wlan0: siw: event 10 ieee80211 phy3: mac80211_hwsim_remove_interface (type=1 mac_addr=08:02:11:00:00:00) ieee80211 phy3: mac80211_hwsim_stop mac80211_hwsim hwsim2 wlan0: bond_netdev_event received NETDEV_DOWN net wlan0: siw: event 2 sctp: sctp_addr_wq_mgmt: add new entry for cmd:2, addr:fe80::a02:11ff:fe00:0 in wq:ffff888074b8a718 kobject: 'rfkill10' (ffff8880786e4108): kobject_uevent_env kobject: 'rfkill10' (ffff8880786e4108): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim2/ieee80211/phy3/rfkill10' ieee80211 phy4: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=08:02:11:00:00:01) ieee80211 phy4: BCN EN: 0 (BI=100) ieee80211 phy4: beaconing vifs remaining: 0 ieee80211 phy4: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=08:02:11:00:00:01) ieee80211 phy4: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy4: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) mac80211_hwsim hwsim3 wlan1: bond_netdev_event received NETDEV_GOING_DOWN net wlan1: siw: event 10 ieee80211 phy4: mac80211_hwsim_remove_interface (type=1 mac_addr=08:02:11:00:00:01) ieee80211 phy4: mac80211_hwsim_stop mac80211_hwsim hwsim3 wlan1: bond_netdev_event received NETDEV_DOWN net wlan1: siw: event 2 sctp: sctp_addr_wq_mgmt: add new entry for cmd:2, addr:fe80::a02:11ff:fe00:1 in wq:ffff888074b8a718 kobject: 'rfkill11' (ffff88802601c108): kobject_uevent_env kobject: 'rfkill11' (ffff88802601c108): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim3/ieee80211/phy4/rfkill11'