====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ kworker/1:5/4257 is trying to acquire lock: ffff888077ca5028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 kernel/workqueue.c:3090 but task is already holding lock: ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_epo+0x43/0x170 net/rfkill/core.c:465 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (rfkill_global_mutex){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_register+0x2f/0x970 net/rfkill/core.c:1060 hci_register_dev+0x459/0x980 net/bluetooth/hci_core.c:3987 __vhci_create_device drivers/bluetooth/hci_vhci.c:129 [inline] vhci_create_device+0x32e/0x5c0 drivers/bluetooth/hci_vhci.c:153 vhci_get_user drivers/bluetooth/hci_vhci.c:210 [inline] vhci_write+0x389/0x440 drivers/bluetooth/hci_vhci.c:290 call_write_iter include/linux/fs.h:2179 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x748/0xd70 fs/read_write.c:594 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #3 (&data->open_mutex){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 vhci_send_frame+0x88/0x100 drivers/bluetooth/hci_vhci.c:71 hci_send_frame+0x1a9/0x2e0 net/bluetooth/hci_core.c:4286 hci_sched_acl_pkt net/bluetooth/hci_core.c:4811 [inline] hci_sched_acl net/bluetooth/hci_core.c:4896 [inline] hci_tx_work+0x9b5/0x16d0 net/bluetooth/hci_core.c:4962 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: __flush_work+0x116/0x210 kernel/workqueue.c:3090 hci_dev_do_open+0xc77/0x12a0 net/bluetooth/hci_core.c:1637 hci_power_on+0x1a7/0x5f0 net/bluetooth/hci_core.c:2283 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #1 (&hdev->req_lock){+.+.}-{3:3}: __mutex_lock_common+0x1e5/0x2400 kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 hci_req_sync net/bluetooth/hci_request.c:278 [inline] bg_scan_update+0x44/0x3b0 net/bluetooth/hci_request.c:2952 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 __flush_work+0x116/0x210 kernel/workqueue.c:3090 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 hci_request_cancel_all+0xcc/0x300 net/bluetooth/hci_request.c:3522 hci_dev_do_close+0x4e/0x1020 net/bluetooth/hci_core.c:1754 hci_rfkill_set_block+0x101/0x180 net/bluetooth/hci_core.c:2253 rfkill_set_block+0x1c1/0x3c0 net/rfkill/core.c:360 rfkill_epo+0x75/0x170 net/rfkill/core.c:469 __rfkill_handle_global_op net/rfkill/input.c:60 [inline] rfkill_op_handler+0x76/0x220 net/rfkill/input.c:108 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 other info that might help us debug this: Chain exists of: (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rfkill_global_mutex); lock(&data->open_mutex); lock(rfkill_global_mutex); lock( (work_completion)(&hdev->bg_scan_update)); *** DEADLOCK *** 3 locks held by kworker/1:5/4257: #0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000317fd00 ((rfkill_op_work).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_epo+0x43/0x170 net/rfkill/core.c:465 stack backtrace: CPU: 1 PID: 4257 Comm: kworker/1:5 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: events rfkill_op_handler Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3120 [inline] check_prevs_add kernel/locking/lockdep.c:3239 [inline] validate_chain kernel/locking/lockdep.c:3855 [inline] __lock_acquire+0x38f7/0x7d40 kernel/locking/lockdep.c:5120 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737 __flush_work+0x116/0x210 kernel/workqueue.c:3090 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 hci_request_cancel_all+0xcc/0x300 net/bluetooth/hci_request.c:3522 hci_dev_do_close+0x4e/0x1020 net/bluetooth/hci_core.c:1754 hci_rfkill_set_block+0x101/0x180 net/bluetooth/hci_core.c:2253 rfkill_set_block+0x1c1/0x3c0 net/rfkill/core.c:360 rfkill_epo+0x75/0x170 net/rfkill/core.c:469 __rfkill_handle_global_op net/rfkill/input.c:60 [inline] rfkill_op_handler+0x76/0x220 net/rfkill/input.c:108 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 hci0: cancelling interleave scan hci0 state 0 -> 0 sock ffff8880615de000, index 0, cmd 15, status 15 channel 2 len 15 channel 3 len 10 All LE pending actions cleared hdev hci0 hcon ffff8880797b2000 reason 22 hcon ffff8880797b2000 conn ffff88807d2f7800, err 103 hci0 hcon ffff8880797b2000 chan ffff888023e9ae00 hci0 hcon ffff8880797b2000 handle 201 hcon ffff8880797b2000 hci0: conn ffff8880797b2000 device: 'hci0:201': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci0:201: removing kernfs uevent: removing PM: Removing info for No Bus:hci0:201 kobject: 'hci0:201' (ffff8880797b2420): kobject_uevent_env kobject: 'hci0:201' (ffff8880797b2420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/hci0:201' kernfs hci0:201: removing kobject: 'hci0:201' (ffff8880797b2420): kobject_cleanup, parent 0000000000000000 kobject: 'hci0:201' (ffff8880797b2420): calling ktype release kobject: 'hci0:201': free name hci0 orig refcnt 10 hcon ffff8880793e8000 reason 22 hcon ffff8880793e8000 conn ffff88807d2f7000, err 103 hci0 hcon ffff8880793e8000 chan ffff888023e9af00 hci0 hcon ffff8880793e8000 handle 200 hcon ffff8880793e8000 hci0: conn ffff8880793e8000 device: 'hci0:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci0:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci0:200 kobject: 'hci0:200' (ffff8880793e8420): kobject_uevent_env kobject: 'hci0:200' (ffff8880793e8420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/hci0:200' kernfs hci0:200: removing kobject: 'hci0:200' (ffff8880793e8420): kobject_cleanup, parent 0000000000000000 kobject: 'hci0:200' (ffff8880793e8420): calling ktype release kobject: 'hci0:200': free name hci0 orig refcnt 7 hdev hci0 event 4 hdev 0000000000000000 len 8 hdev hci0 event 8 hci0 orig refcnt 6 kobject: 'rfkill5' (ffff8881485fb108): kobject_uevent_env kobject: 'rfkill5' (ffff8881485fb108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci0/rfkill5' ffff888026abc000 name hci1 blocked 1 hci1 ffff888026abc000 hci1: err 0x13 hci1: cancelling interleave scan hci1 state 0 -> 0 sock ffff88807af3d000, index 1, cmd 14, status 15 channel 2 len 15 channel 3 len 10 All LE pending actions cleared hdev hci1 hcon ffff88801a9b8000 reason 22 hcon ffff88801a9b8000 conn ffff88807d4dc800, err 103 hci1 hcon ffff88801a9b8000 chan ffff888023e9ad00 hci1 hcon ffff88801a9b8000 handle 200 hcon ffff88801a9b8000 hci1: conn ffff88801a9b8000 device: 'hci1:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci1:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci1:200 kobject: 'hci1:200' (ffff88801a9b8420): kobject_uevent_env kobject: 'hci1:200' (ffff88801a9b8420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/hci1:200' kernfs hci1:200: removing kobject: 'hci1:200' (ffff88801a9b8420): kobject_cleanup, parent 0000000000000000 kobject: 'hci1:200' (ffff88801a9b8420): calling ktype release kobject: 'hci1:200': free name hci1 orig refcnt 7 hdev hci1 event 4 hdev 0000000000000000 len 8 hdev hci1 event 8 hci1 orig refcnt 6 kobject: 'rfkill6' (ffff8881485e4108): kobject_uevent_env kobject: 'rfkill6' (ffff8881485e4108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/rfkill6' ffff888077c90000 name hci2 blocked 1 hci2 ffff888077c90000 hci2: err 0x13 hci2: cancelling interleave scan hci2 state 0 -> 0 All LE pending actions cleared hdev hci2 hcon ffff888078d6e000 reason 22 hcon ffff888078d6e000 conn ffff88801fd2a000, err 103 hci2 hcon ffff888078d6e000 chan ffff88802b4ea100 hci2 hcon ffff888078d6e000 handle 201 hcon ffff888078d6e000 hci2: conn ffff888078d6e000 device: 'hci2:201': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci2:201: removing kernfs uevent: removing PM: Removing info for No Bus:hci2:201 kobject: 'hci2:201' (ffff888078d6e420): kobject_uevent_env kobject: 'hci2:201' (ffff888078d6e420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/hci2:201' kernfs hci2:201: removing kobject: 'hci2:201' (ffff888078d6e420): kobject_cleanup, parent 0000000000000000 kobject: 'hci2:201' (ffff888078d6e420): calling ktype release kobject: 'hci2:201': free name hci2 orig refcnt 10 hcon ffff8880797f2000 reason 22 hcon ffff8880797f2000 conn ffff88801fd29800, err 103 hci2 hcon ffff8880797f2000 chan ffff88802b4ea000 hci2 hcon ffff8880797f2000 handle 200 hcon ffff8880797f2000 hci2: conn ffff8880797f2000 device: 'hci2:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci2:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci2:200 kobject: 'hci2:200' (ffff8880797f2420): kobject_uevent_env kobject: 'hci2:200' (ffff8880797f2420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/hci2:200' kernfs hci2:200: removing kobject: 'hci2:200' (ffff8880797f2420): kobject_cleanup, parent 0000000000000000 kobject: 'hci2:200' (ffff8880797f2420): calling ktype release kobject: 'hci2:200': free name hci2 orig refcnt 7 hdev hci2 event 4 hdev 0000000000000000 len 8 hdev hci2 event 8 hci2 orig refcnt 6 kobject: 'rfkill7' (ffff88814c989108): kobject_uevent_env kobject: 'rfkill7' (ffff88814c989108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci2/rfkill7' ffff88802607c000 name hci3 blocked 1 hci3 ffff88802607c000 hci3: err 0x13 hci3: cancelling interleave scan hci3 state 0 -> 0 channel 3 len 10 All LE pending actions cleared hdev hci3 hcon ffff88801abce000 reason 22 hcon ffff88801abce000 conn ffff88802d113800, err 103 hci3 hcon ffff88801abce000 chan ffff88801fc6e400 hci3 hcon ffff88801abce000 handle 200 hcon ffff88801abce000 hci3: conn ffff88801abce000 device: 'hci3:200': device_unregister kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs hci3:200: removing kernfs uevent: removing PM: Removing info for No Bus:hci3:200 kobject: 'hci3:200' (ffff88801abce420): kobject_uevent_env kobject: 'hci3:200' (ffff88801abce420): fill_kobj_path: path = '/devices/virtual/bluetooth/hci3/hci3:200' kernfs hci3:200: removing kobject: 'hci3:200' (ffff88801abce420): kobject_cleanup, parent 0000000000000000 kobject: 'hci3:200' (ffff88801abce420): calling ktype release kobject: 'hci3:200': free name hci3 orig refcnt 7 hdev hci3 event 4 hdev 0000000000000000 len 8 hdev hci3 event 8 hci3 orig refcnt 6 kobject: 'rfkill8' (ffff88801fc11108): kobject_uevent_env kobject: 'rfkill8' (ffff88801fc11108): fill_kobj_path: path = '/devices/virtual/bluetooth/hci3/rfkill8' ffff8880786fc000 name hci4 blocked 1 hci4 ffff8880786fc000 hci4: err 0x13 hci4: cancelling interleave scan hci4 state 0 -> 0