last executing test programs: 731.825596ms ago: executing program 2 (id=3): r0 = socket$packet(0x11, 0x3, 0x300) bind$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x14) 606.241322ms ago: executing program 2 (id=5): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000940)=@newtfilter={0x48, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x1c, 0x2, [@TCA_FW_INDEV={0x14}, @TCA_FW_ACT={0x4}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x10040815}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)=@deltfilter={0x48, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x1c, 0x2, [@TCA_FW_INDEV={0x14}, @TCA_FW_ACT={0x4}]}}]}, 0x48}}, 0x0) 377.656752ms ago: executing program 2 (id=6): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./debug\x00', 0x1ff) mount(&(0x7f0000000440)=@filename='none\x00', &(0x7f0000000400)='./debug\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/netdev:wlan0/mesh_config/dot11MeshHWMPmaxPREQretries\x00', 0x0, 0x0) read(r3, &(0x7f0000000600)=""/100, 0x64) 313.825666ms ago: executing program 3 (id=4): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='auxv\x00') read(r0, &(0x7f0000000100)=""/512, 0x200) 174.423742ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 +4\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='2\n', 0x2) 146.194713ms ago: executing program 3 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x0, 0x5f5e100}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r6 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) 0s ago: executing program 2 (id=8): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0xc4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x84, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x1, 0x1], [0x0, 0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x20, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xf4240}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0xf}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0xb}]}}, @qdisc_kind_options]}, 0xc4}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newqdisc={0x34, 0x24, 0x501, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0x1, 0x1}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.15' (ED25519) to the list of known hosts. [ 76.427582][ T5765] cgroup: Unknown subsys name 'net' [ 76.559736][ T5765] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 78.276965][ T5765] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.729077][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.737928][ T5780] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.745675][ T5780] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.755143][ T5786] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.763919][ T5786] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 80.771491][ T5786] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 80.780410][ T5786] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.789283][ T5786] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.796802][ T5786] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.804733][ T5786] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.813396][ T5786] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.816714][ T5790] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.828785][ T5790] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 80.833321][ T5786] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 80.836776][ T5790] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.851843][ T5790] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.853321][ T5786] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.866736][ T5790] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.885753][ T5792] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.893315][ T5790] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 80.911057][ T5790] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.920464][ T5790] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 80.935018][ T5790] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 80.942435][ T5790] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.352809][ T5788] chnl_net:caif_netlink_parms(): no params data found [ 81.447889][ T5782] chnl_net:caif_netlink_parms(): no params data found [ 81.518470][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 81.580184][ T5788] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.588175][ T5788] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.597441][ T5788] bridge_slave_0: entered allmulticast mode [ 81.604796][ T5788] bridge_slave_0: entered promiscuous mode [ 81.634513][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 81.645339][ T5788] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.652515][ T5788] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.659846][ T5788] bridge_slave_1: entered allmulticast mode [ 81.667386][ T5788] bridge_slave_1: entered promiscuous mode [ 81.706731][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.714062][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.721245][ T5782] bridge_slave_0: entered allmulticast mode [ 81.728350][ T5782] bridge_slave_0: entered promiscuous mode [ 81.738057][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.745479][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.752758][ T5782] bridge_slave_1: entered allmulticast mode [ 81.759815][ T5782] bridge_slave_1: entered promiscuous mode [ 81.868768][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.880835][ T5788] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.894143][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.901314][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.908762][ T5777] bridge_slave_0: entered allmulticast mode [ 81.915705][ T5777] bridge_slave_0: entered promiscuous mode [ 81.931374][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.943193][ T5788] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.952713][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.960199][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.967860][ T5777] bridge_slave_1: entered allmulticast mode [ 81.974760][ T5777] bridge_slave_1: entered promiscuous mode [ 82.048781][ T5782] team0: Port device team_slave_0 added [ 82.060922][ T5788] team0: Port device team_slave_0 added [ 82.078665][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.085925][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.093355][ T5781] bridge_slave_0: entered allmulticast mode [ 82.101106][ T5781] bridge_slave_0: entered promiscuous mode [ 82.109631][ T5782] team0: Port device team_slave_1 added [ 82.127182][ T5788] team0: Port device team_slave_1 added [ 82.145011][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.158458][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.167741][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.175195][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.182409][ T5781] bridge_slave_1: entered allmulticast mode [ 82.189431][ T5781] bridge_slave_1: entered promiscuous mode [ 82.218840][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.226093][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.252381][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.294996][ T5788] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.301990][ T5788] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.330990][ T5788] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.343630][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.350613][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.376801][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.406833][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.418850][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.428740][ T5788] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.436262][ T5788] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.462845][ T5788] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.500910][ T5777] team0: Port device team_slave_0 added [ 82.510126][ T5777] team0: Port device team_slave_1 added [ 82.549884][ T5788] hsr_slave_0: entered promiscuous mode [ 82.556261][ T5788] hsr_slave_1: entered promiscuous mode [ 82.586890][ T5781] team0: Port device team_slave_0 added [ 82.595780][ T5781] team0: Port device team_slave_1 added [ 82.645671][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.652668][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.678938][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.722301][ T5782] hsr_slave_0: entered promiscuous mode [ 82.729434][ T5782] hsr_slave_1: entered promiscuous mode [ 82.736437][ T5782] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.744314][ T5782] Cannot create hsr debugfs directory [ 82.750412][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.757809][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.784239][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.816714][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.824183][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.850220][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.864150][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.871127][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.897230][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.930012][ T51] Bluetooth: hci3: command tx timeout [ 82.990449][ T5777] hsr_slave_0: entered promiscuous mode [ 82.997641][ T5777] hsr_slave_1: entered promiscuous mode [ 83.003112][ T5790] Bluetooth: hci0: command tx timeout [ 83.003497][ T5780] Bluetooth: hci1: command tx timeout [ 83.008862][ T51] Bluetooth: hci2: command tx timeout [ 83.020039][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.027836][ T5777] Cannot create hsr debugfs directory [ 83.127695][ T5781] hsr_slave_0: entered promiscuous mode [ 83.134923][ T5781] hsr_slave_1: entered promiscuous mode [ 83.141115][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.148891][ T5781] Cannot create hsr debugfs directory [ 83.428488][ T5788] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.451930][ T5788] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 83.462142][ T5788] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 83.488278][ T5788] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 83.528168][ T5782] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.549962][ T5782] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.560829][ T5782] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.591950][ T5782] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.657364][ T5777] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.667027][ T5777] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.678458][ T5777] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.688318][ T5777] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.788981][ T5781] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.814012][ T5781] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.833357][ T5781] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 83.842780][ T5781] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 83.882045][ T5788] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.942444][ T5788] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.989320][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.996722][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.026766][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.034000][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.072549][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.107746][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.144327][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.159145][ T5782] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.171103][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.178258][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.202021][ T2991] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.209220][ T2991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.249558][ T2991] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.256758][ T2991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.308847][ T2991] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.316038][ T2991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.348850][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.432339][ T5782] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 84.446758][ T5782] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 84.461601][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.506708][ T3511] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.513954][ T3511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.579266][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.586542][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.849709][ T5788] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.946897][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.991624][ T5788] veth0_vlan: entered promiscuous mode [ 85.005068][ T51] Bluetooth: hci3: command tx timeout [ 85.024523][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.041279][ T5788] veth1_vlan: entered promiscuous mode [ 85.084186][ T51] Bluetooth: hci2: command tx timeout [ 85.085864][ T5780] Bluetooth: hci0: command tx timeout [ 85.089621][ T5790] Bluetooth: hci1: command tx timeout [ 85.180855][ T5777] veth0_vlan: entered promiscuous mode [ 85.214815][ T5788] veth0_macvtap: entered promiscuous mode [ 85.227908][ T5782] veth0_vlan: entered promiscuous mode [ 85.238103][ T5777] veth1_vlan: entered promiscuous mode [ 85.250786][ T5788] veth1_macvtap: entered promiscuous mode [ 85.271398][ T5782] veth1_vlan: entered promiscuous mode [ 85.292214][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.308166][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.342152][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.381081][ T5788] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.391227][ T5788] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.400001][ T5788] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.409720][ T5788] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.426272][ T5782] veth0_macvtap: entered promiscuous mode [ 85.442842][ T5782] veth1_macvtap: entered promiscuous mode [ 85.469463][ T5777] veth0_macvtap: entered promiscuous mode [ 85.481323][ T5777] veth1_macvtap: entered promiscuous mode [ 85.522704][ T5781] veth0_vlan: entered promiscuous mode [ 85.532592][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.545032][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.560197][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.588071][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.599853][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.611190][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.630027][ T5781] veth1_vlan: entered promiscuous mode [ 85.642322][ T5777] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.658444][ T5777] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.668553][ T5777] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.677370][ T5777] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.695526][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.707461][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.717616][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.728285][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.740407][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.751651][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.762569][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.780396][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.791244][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.803678][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.851688][ T2991] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.862229][ T5782] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.871148][ T2991] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.879109][ T5782] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.888285][ T5782] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.897223][ T5782] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.989640][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.994346][ T5781] veth0_macvtap: entered promiscuous mode [ 86.010622][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.054326][ T5781] veth1_macvtap: entered promiscuous mode [ 86.110901][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.124308][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.135586][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.147404][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.157300][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.168082][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.179614][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.195542][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.207728][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.235605][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.248809][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.261899][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.278520][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.290767][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.312755][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.324739][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.374882][ T2991] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.382771][ T2991] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.403923][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.412009][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.446135][ T5781] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.464607][ T5781] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.474519][ T5781] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.483328][ T5781] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.572319][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.610320][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.844974][ T3000] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.852838][ T3000] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.024489][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.068715][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.083605][ T5790] Bluetooth: hci3: command tx timeout [ 87.114987][ T5860] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 87.164066][ T5790] Bluetooth: hci0: command tx timeout [ 87.165762][ T5780] Bluetooth: hci2: command tx timeout [ 87.169511][ T5790] Bluetooth: hci1: command tx timeout [ 87.190188][ T5863] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8'. [ 87.249169][ T5860] [ 87.251605][ T5860] ====================================================== [ 87.258646][ T5860] WARNING: possible circular locking dependency detected [ 87.265683][ T5860] syzkaller #0 Not tainted [ 87.270119][ T5860] ------------------------------------------------------ [ 87.277150][ T5860] syz.3.7/5860 is trying to acquire lock: [ 87.282882][ T5860] ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x21/0x2d0 [ 87.291796][ T5860] [ 87.291796][ T5860] but task is already holding lock: [ 87.299177][ T5860] ffff88805d2aa398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 87.308179][ T5860] [ 87.308179][ T5860] which lock already depends on the new lock. [ 87.308179][ T5860] [ 87.318595][ T5860] [ 87.318595][ T5860] the existing dependency chain (in reverse order) is: [ 87.327621][ T5860] [ 87.327621][ T5860] -> #2 (&gi->lock){+.+.}-{3:3}: [ 87.334780][ T5860] __mutex_lock+0x135/0xc80 [ 87.339828][ T5860] config_usb_cfg_link+0x59/0x250 [ 87.345400][ T5860] configfs_symlink+0x5a5/0xfe0 [ 87.350799][ T5860] vfs_symlink+0x138/0x2b0 [ 87.355761][ T5860] do_symlinkat+0x1ba/0x400 [ 87.360837][ T5860] __x64_sys_symlinkat+0x99/0xb0 [ 87.366315][ T5860] do_syscall_64+0x55/0xb0 [ 87.371267][ T5860] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.377713][ T5860] [ 87.377713][ T5860] -> #1 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 87.386417][ T5860] down_write+0x97/0x200 [ 87.391180][ T5860] configfs_depend_item_unlocked+0x157/0x430 [ 87.397708][ T5860] usbg_make_tpg+0x1e1/0x550 [ 87.402821][ T5860] target_fabric_make_tpg+0xa4/0x6d0 [ 87.408650][ T5860] configfs_mkdir+0x515/0x9e0 [ 87.413870][ T5860] vfs_mkdir+0x2a5/0x470 [ 87.418636][ T5860] do_mkdirat+0x1dc/0x450 [ 87.423482][ T5860] __x64_sys_mkdirat+0x89/0xa0 [ 87.428758][ T5860] do_syscall_64+0x55/0xb0 [ 87.433706][ T5860] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.440145][ T5860] [ 87.440145][ T5860] -> #0 (tpg_instances_lock){+.+.}-{3:3}: [ 87.448048][ T5860] __lock_acquire+0x37ef/0x7d80 [ 87.453420][ T5860] lock_acquire+0x19e/0x420 [ 87.458448][ T5860] __mutex_lock+0x135/0xc80 [ 87.463488][ T5860] tcm_alloc+0x21/0x2d0 [ 87.468178][ T5860] usb_get_function+0x5d/0xb0 [ 87.473397][ T5860] config_usb_cfg_link+0x148/0x250 [ 87.479040][ T5860] configfs_symlink+0x5a5/0xfe0 [ 87.484408][ T5860] vfs_symlink+0x138/0x2b0 [ 87.489363][ T5860] do_symlinkat+0x1ba/0x400 [ 87.494383][ T5860] __x64_sys_symlinkat+0x99/0xb0 [ 87.499836][ T5860] do_syscall_64+0x55/0xb0 [ 87.504780][ T5860] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.511234][ T5860] [ 87.511234][ T5860] other info that might help us debug this: [ 87.511234][ T5860] [ 87.521494][ T5860] Chain exists of: [ 87.521494][ T5860] tpg_instances_lock --> &sb->s_type->i_mutex_key#21 --> &gi->lock [ 87.521494][ T5860] [ 87.535314][ T5860] Possible unsafe locking scenario: [ 87.535314][ T5860] [ 87.542768][ T5860] CPU0 CPU1 [ 87.548128][ T5860] ---- ---- [ 87.553498][ T5860] lock(&gi->lock); [ 87.557410][ T5860] lock(&sb->s_type->i_mutex_key#21); [ 87.565392][ T5860] lock(&gi->lock); [ 87.571811][ T5860] lock(tpg_instances_lock); [ 87.576514][ T5860] [ 87.576514][ T5860] *** DEADLOCK *** [ 87.576514][ T5860] [ 87.584656][ T5860] 3 locks held by syz.3.7/5860: [ 87.589498][ T5860] #0: ffff888017db2418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 87.598727][ T5860] #1: ffff88805e2da9e0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 87.609514][ T5860] #2: ffff88805d2aa398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 87.618906][ T5860] [ 87.618906][ T5860] stack backtrace: [ 87.624804][ T5860] CPU: 1 PID: 5860 Comm: syz.3.7 Not tainted syzkaller #0 [ 87.631908][ T5860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.641961][ T5860] Call Trace: [ 87.645248][ T5860] [ 87.648181][ T5860] dump_stack_lvl+0x18c/0x250 [ 87.652883][ T5860] ? load_image+0x420/0x420 [ 87.657410][ T5860] ? show_regs_print_info+0x20/0x20 [ 87.662617][ T5860] ? print_circular_bug+0x12b/0x1a0 [ 87.667825][ T5860] check_noncircular+0x2fc/0x400 [ 87.672788][ T5860] ? print_deadlock_bug+0x5d0/0x5d0 [ 87.677983][ T5860] ? lockdep_lock+0xf5/0x230 [ 87.682571][ T5860] ? _find_first_zero_bit+0xd6/0x100 [ 87.687872][ T5860] __lock_acquire+0x37ef/0x7d80 [ 87.692735][ T5860] ? verify_lock_unused+0x140/0x140 [ 87.697929][ T5860] ? __lock_acquire+0x1336/0x7d80 [ 87.702959][ T5860] ? verify_lock_unused+0x140/0x140 [ 87.708226][ T5860] lock_acquire+0x19e/0x420 [ 87.712743][ T5860] ? tcm_alloc+0x21/0x2d0 [ 87.717069][ T5860] ? __might_sleep+0xe0/0xe0 [ 87.721673][ T5860] ? read_lock_is_recursive+0x20/0x20 [ 87.727042][ T5860] ? __mutex_trylock_common+0x160/0x270 [ 87.732595][ T5860] __mutex_lock+0x135/0xc80 [ 87.737114][ T5860] ? tcm_alloc+0x21/0x2d0 [ 87.741437][ T5860] ? trace_contention_end+0x39/0xe0 [ 87.746632][ T5860] ? __mutex_lock+0x30d/0xc80 [ 87.751303][ T5860] ? tcm_alloc+0x21/0x2d0 [ 87.755636][ T5860] ? mutex_lock_nested+0x20/0x20 [ 87.760601][ T5860] ? read_lock_is_recursive+0x20/0x20 [ 87.766004][ T5860] ? config_usb_cfg_link+0x59/0x250 [ 87.771246][ T5860] ? mutex_lock_nested+0x20/0x20 [ 87.776221][ T5860] ? configfs_symlink+0x469/0xfe0 [ 87.781287][ T5860] tcm_alloc+0x21/0x2d0 [ 87.785475][ T5860] usb_get_function+0x5d/0xb0 [ 87.790177][ T5860] config_usb_cfg_link+0x148/0x250 [ 87.795302][ T5860] configfs_symlink+0x5a5/0xfe0 [ 87.800153][ T5860] ? from_kgid+0x153/0x6a0 [ 87.804572][ T5860] ? generic_permission+0x1ed/0x590 [ 87.809781][ T5860] ? detach_groups+0x370/0x370 [ 87.814555][ T5860] ? inode_permission+0xf3/0x480 [ 87.819487][ T5860] ? bpf_lsm_inode_symlink+0x9/0x10 [ 87.824678][ T5860] ? security_inode_symlink+0xb6/0x100 [ 87.830137][ T5860] vfs_symlink+0x138/0x2b0 [ 87.834552][ T5860] do_symlinkat+0x1ba/0x400 [ 87.839071][ T5860] ? vfs_symlink+0x2b0/0x2b0 [ 87.843660][ T5860] __x64_sys_symlinkat+0x99/0xb0 [ 87.848596][ T5860] do_syscall_64+0x55/0xb0 [ 87.853043][ T5860] ? clear_bhb_loop+0x40/0x90 [ 87.857759][ T5860] ? clear_bhb_loop+0x40/0x90 [ 87.862437][ T5860] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.868338][ T5860] RIP: 0033:0x7fbb2c79e159 [ 87.872764][ T5860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.892386][ T5860] RSP: 002b:00007fbb2d648028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 87.900811][ T5860] RAX: ffffffffffffffda RBX: 00007fbb2ca25fa0 RCX: 00007fbb2c79e159 [ 87.908782][ T5860] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 87.916759][ T5860] RBP: 00007fbb2c83506b R08: 0000000000000000 R09: 0000000000000000 [ 87.924742][ T5860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.932706][ T5860] R13: 00007fbb2ca26038 R14: 00007fbb2ca25fa0 R15: 00007ffc6ad9f268 [ 87.940675][ T5860] [ 88.252961][ T27] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 88.433946][ T27] usb 1-1: Dual-Role OTG device on HNP port [ 88.440128][ T27] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 88.449525][ T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.460749][ T23] Using the BOT protocol [ 88.467730][ T23] Using the UAS protocol [ 88.475740][ T27] scsi host1: uas [ 88.487431][ T11] scsi 1:0:0:0: Direct-Access LIO-ORG RAMDISK-MCP 4.0 PQ: 0 ANSI: 6 [ 88.504825][ T11] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 88.509409][ T12] sd 1:0:0:0: [sdb] 512 512-byte logical blocks: (262 kB/256 KiB) [ 88.528114][ T12] sd 1:0:0:0: [sdb] Write Protect is off [ 88.534291][ T12] sd 1:0:0:0: [sdb] Mode Sense: 43 00 00 08 [ 88.542139][ T12] sd 1:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA [ 88.574478][ T12] sd 1:0:0:0: [sdb] Attached SCSI disk [ 88.641883][ T27] target: Unknown data direction for SCSI Opcode 0xa1 [ 88.933294][ T5859] NFSD: attempt to initialize umh client tracking in a container ignored. [ 88.941963][ T5859] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 88.950783][ T5859] NFSD: Unable to initialize client recovery tracking! (-22) [ 88.958303][ T5859] NFSD: starting 90-second grace period (net f00003d4) [ 89.163269][ T5780] Bluetooth: hci3: command tx timeout [ 89.243213][ T51] Bluetooth: hci1: command tx timeout [ 89.243223][ T5790] Bluetooth: hci0: command tx timeout [ 89.243311][ T5780] Bluetooth: hci2: command tx timeout [ 92.205177][ T969] cfg80211: failed to load regulatory.db