Warning: Permanently added '10.128.0.134' (ED25519) to the list of known hosts. 2026/08/01 20:39:56 parsed 1 programs 2026/08/01 20:39:56 serving rpc on tcp://35915 [ 69.062464][ T4198] cgroup: Unknown subsys name 'net' [ 69.186054][ T4198] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 70.736942][ T4198] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 71.293182][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.299790][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.409443][ T4211] chnl_net:caif_netlink_parms(): no params data found [ 72.470428][ T4211] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.478084][ T4211] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.486216][ T4211] device bridge_slave_0 entered promiscuous mode [ 72.495941][ T4211] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.503190][ T4211] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.511450][ T4211] device bridge_slave_1 entered promiscuous mode [ 72.535852][ T4211] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.546983][ T4211] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.568992][ T4211] team0: Port device team_slave_0 added [ 72.576938][ T4211] team0: Port device team_slave_1 added [ 72.597864][ T4211] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.604865][ T4211] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.630914][ T4211] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.643429][ T4211] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.650592][ T4211] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.676511][ T4211] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.711543][ T4211] device hsr_slave_0 entered promiscuous mode [ 72.718373][ T4211] device hsr_slave_1 entered promiscuous mode [ 72.834465][ T4211] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.845716][ T4211] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.855201][ T4211] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.865281][ T4211] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.891863][ T4211] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.899058][ T4211] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.907091][ T4211] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.914344][ T4211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.961715][ T4211] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.981211][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.992294][ T3092] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.001480][ T3092] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.010105][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 73.024711][ T4211] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.037985][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.047080][ T3092] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.054433][ T3092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.068159][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.076997][ T3092] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.084141][ T3092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.108291][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.125180][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 73.137236][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.156070][ T4211] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 73.168427][ T4211] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 73.183407][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 73.194218][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 73.211714][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 73.342771][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 73.352050][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 73.363578][ T4211] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.385433][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 73.396270][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 73.417720][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 73.428430][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 73.438744][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 73.450456][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 73.459749][ T4211] device veth0_vlan entered promiscuous mode [ 73.474546][ T4211] device veth1_vlan entered promiscuous mode [ 73.498296][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.507926][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.518784][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.527882][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.541392][ T4211] device veth0_macvtap entered promiscuous mode [ 73.556915][ T4211] device veth1_macvtap entered promiscuous mode [ 73.574878][ T4211] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.584337][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.593988][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.602532][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.612861][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.625473][ T4211] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.633558][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.644068][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.658543][ T4211] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.668110][ T4211] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.677142][ T4211] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.689450][ T4211] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.482411][ T3092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.498081][ T3092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.516690][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.532571][ T3092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.541102][ T3092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.549861][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.761934][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.095860][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.535688][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.587704][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.987074][ T9] device hsr_slave_0 left promiscuous mode [ 80.011403][ T9] device hsr_slave_1 left promiscuous mode [ 80.030175][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 80.037694][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 80.061896][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 80.069360][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 80.101820][ T9] device bridge_slave_1 left promiscuous mode [ 80.109061][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.128121][ T9] device bridge_slave_0 left promiscuous mode [ 80.134622][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.158956][ T9] device veth1_macvtap left promiscuous mode [ 80.165643][ T9] device veth0_macvtap left promiscuous mode [ 80.173017][ T9] device veth1_vlan left promiscuous mode [ 80.179036][ T9] device veth0_vlan left promiscuous mode [ 80.362332][ T9] team0 (unregistering): Port device team_slave_1 removed [ 80.375805][ T9] team0 (unregistering): Port device team_slave_0 removed [ 80.389040][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 80.406928][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 80.467661][ T9] bond0 (unregistering): Released all slaves 2026/08/01 20:40:11 executed programs: 0 [ 81.712569][ T4365] chnl_net:caif_netlink_parms(): no params data found [ 81.848006][ T4365] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.859641][ T4365] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.878708][ T4365] device bridge_slave_0 entered promiscuous mode [ 81.887643][ T4365] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.895333][ T4365] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.903598][ T4365] device bridge_slave_1 entered promiscuous mode [ 81.934053][ T4365] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.952161][ T4365] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.999217][ T4365] team0: Port device team_slave_0 added [ 82.012989][ T4365] team0: Port device team_slave_1 added [ 82.057787][ T4365] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.079611][ T4365] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.129553][ T4365] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.151502][ T4365] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.158514][ T4365] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.219553][ T4365] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.294468][ T4365] device hsr_slave_0 entered promiscuous mode [ 82.301624][ T4365] device hsr_slave_1 entered promiscuous mode [ 83.009720][ T4365] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.083240][ T4365] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.103958][ T4365] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.119267][ T4365] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.235710][ T4365] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.251292][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 83.259249][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 83.270655][ T4365] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.282215][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 83.292822][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 83.301836][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.308931][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.319254][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 83.341788][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 83.350792][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 83.359407][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.367083][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.378613][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 83.389052][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 83.412970][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 83.423904][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 83.434407][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 83.445734][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 83.458514][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 83.467639][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.477960][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 83.486841][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.499336][ T4365] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 83.509545][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 83.520333][ T4419] Bluetooth: hci0: command 0x0409 tx timeout [ 83.706778][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 83.716206][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 83.729421][ T4365] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.785954][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 83.796243][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.818188][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.827687][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.875767][ T4365] device veth0_vlan entered promiscuous mode [ 83.883324][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.892260][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.906766][ T4365] device veth1_vlan entered promiscuous mode [ 83.962743][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 83.971882][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 83.980757][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.991801][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 84.003183][ T4365] device veth0_macvtap entered promiscuous mode [ 84.053682][ T4365] device veth1_macvtap entered promiscuous mode [ 84.072882][ T4365] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.082195][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 84.092947][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 84.102648][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 84.111852][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.127901][ T4365] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.138883][ T4365] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.149281][ T4365] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.159366][ T4365] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.169972][ T4365] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.212470][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 84.224598][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 84.393838][ T3092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.427809][ T3092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.459300][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 84.532186][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.549523][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.557151][ T3092] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 84.785405][ T4474] [ 84.787800][ T4474] ====================================================== [ 84.794839][ T4474] WARNING: possible circular locking dependency detected [ 84.801909][ T4474] syzkaller #0 Not tainted [ 84.806362][ T4474] ------------------------------------------------------ [ 84.813705][ T4474] syz.0.17/4474 is trying to acquire lock: [ 84.819528][ T4474] ffff88802abd9028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 [ 84.830621][ T4474] [ 84.830621][ T4474] but task is already holding lock: [ 84.838005][ T4474] ffffffff8d6d5ea8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 84.847707][ T4474] [ 84.847707][ T4474] which lock already depends on the new lock. [ 84.847707][ T4474] [ 84.858138][ T4474] [ 84.858138][ T4474] the existing dependency chain (in reverse order) is: [ 84.867179][ T4474] [ 84.867179][ T4474] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 84.875209][ T4474] __mutex_lock_common+0x1e5/0x2400 [ 84.880966][ T4474] mutex_lock_nested+0x17/0x20 [ 84.886307][ T4474] rfkill_register+0x2f/0x970 [ 84.891536][ T4474] hci_register_dev+0x459/0x980 [ 84.896953][ T4474] vhci_create_device+0x32e/0x5c0 [ 84.902530][ T4474] vhci_write+0x389/0x440 [ 84.907403][ T4474] vfs_write+0x748/0xd70 [ 84.912195][ T4474] ksys_write+0x153/0x260 [ 84.917071][ T4474] do_syscall_64+0x4c/0xa0 [ 84.922043][ T4474] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 84.928505][ T4474] [ 84.928505][ T4474] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 84.936365][ T4474] __mutex_lock_common+0x1e5/0x2400 [ 84.942132][ T4474] mutex_lock_nested+0x17/0x20 [ 84.947457][ T4474] vhci_send_frame+0x88/0x100 [ 84.952690][ T4474] hci_send_frame+0x1a9/0x2e0 [ 84.957917][ T4474] hci_tx_work+0x9b5/0x16d0 [ 84.962980][ T4474] process_one_work+0x867/0xff0 [ 84.968390][ T4474] worker_thread+0xad7/0x12a0 [ 84.973615][ T4474] kthread+0x42e/0x520 [ 84.978271][ T4474] ret_from_fork+0x1f/0x30 [ 84.983251][ T4474] [ 84.983251][ T4474] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 84.992511][ T4474] __flush_work+0x116/0x210 [ 84.997656][ T4474] hci_dev_do_close+0x201/0x1020 [ 85.003196][ T4474] hci_unregister_dev+0x2eb/0x590 [ 85.008770][ T4474] vhci_release+0x73/0xc0 [ 85.013651][ T4474] __fput+0x212/0x8c0 [ 85.018184][ T4474] task_work_run+0x125/0x1a0 [ 85.023339][ T4474] do_exit+0x635/0x2110 [ 85.028040][ T4474] do_group_exit+0x12c/0x2f0 [ 85.033172][ T4474] get_signal+0x7eb/0x12e0 [ 85.038132][ T4474] arch_do_signal_or_restart+0xe6/0x12a0 [ 85.044335][ T4474] exit_to_user_mode_loop+0x9e/0x130 [ 85.050179][ T4474] exit_to_user_mode_prepare+0xee/0x180 [ 85.056279][ T4474] syscall_exit_to_user_mode+0x16/0x40 [ 85.062289][ T4474] do_syscall_64+0x58/0xa0 [ 85.067258][ T4474] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 85.073706][ T4474] [ 85.073706][ T4474] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 85.081483][ T4474] __mutex_lock_common+0x1e5/0x2400 [ 85.087267][ T4474] mutex_lock_nested+0x17/0x20 [ 85.092582][ T4474] bg_scan_update+0x44/0x3b0 [ 85.097739][ T4474] process_one_work+0x867/0xff0 [ 85.103154][ T4474] worker_thread+0xad7/0x12a0 [ 85.108388][ T4474] kthread+0x42e/0x520 [ 85.113002][ T4474] ret_from_fork+0x1f/0x30 [ 85.117969][ T4474] [ 85.117969][ T4474] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 85.127815][ T4474] __lock_acquire+0x2c66/0x7b50 [ 85.133392][ T4474] lock_acquire+0x19e/0x400 [ 85.138457][ T4474] __flush_work+0x116/0x210 [ 85.143518][ T4474] __cancel_work_timer+0x3f4/0x560 [ 85.149182][ T4474] hci_request_cancel_all+0xcc/0x300 [ 85.155020][ T4474] hci_dev_do_close+0x4e/0x1020 [ 85.160420][ T4474] hci_rfkill_set_block+0x101/0x180 [ 85.166175][ T4474] rfkill_set_block+0x1c1/0x3c0 [ 85.171596][ T4474] rfkill_fop_write+0x453/0x560 [ 85.177016][ T4474] vfs_write+0x304/0xd70 [ 85.181802][ T4474] ksys_write+0x153/0x260 [ 85.186675][ T4474] do_syscall_64+0x4c/0xa0 [ 85.191636][ T4474] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 85.198087][ T4474] [ 85.198087][ T4474] other info that might help us debug this: [ 85.198087][ T4474] [ 85.208344][ T4474] Chain exists of: [ 85.208344][ T4474] (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex [ 85.208344][ T4474] [ 85.224107][ T4474] Possible unsafe locking scenario: [ 85.224107][ T4474] [ 85.231574][ T4474] CPU0 CPU1 [ 85.236956][ T4474] ---- ---- [ 85.242336][ T4474] lock(rfkill_global_mutex); [ 85.247137][ T4474] lock(&data->open_mutex); [ 85.254279][ T4474] lock(rfkill_global_mutex); [ 85.261591][ T4474] lock((work_completion)(&hdev->bg_scan_update)); [ 85.268202][ T4474] [ 85.268202][ T4474] *** DEADLOCK *** [ 85.268202][ T4474] [ 85.276388][ T4474] 1 lock held by syz.0.17/4474: [ 85.281255][ T4474] #0: ffffffff8d6d5ea8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 85.291396][ T4474] [ 85.291396][ T4474] stack backtrace: [ 85.297494][ T4474] CPU: 0 PID: 4474 Comm: syz.0.17 Not tainted syzkaller #0 [ 85.304733][ T4474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 85.314829][ T4474] Call Trace: [ 85.318145][ T4474] [ 85.321125][ T4474] dump_stack_lvl+0x188/0x250 [ 85.325837][ T4474] ? load_image+0x410/0x410 [ 85.330368][ T4474] ? show_regs_print_info+0x20/0x20 [ 85.335629][ T4474] ? print_circular_bug+0x12b/0x1a0 [ 85.340884][ T4474] check_noncircular+0x296/0x330 [ 85.345853][ T4474] ? look_up_lock_class+0x71/0x110 [ 85.351028][ T4474] ? add_chain_block+0x9b0/0x9b0 [ 85.355997][ T4474] ? lockdep_lock+0xf1/0x1f0 [ 85.360621][ T4474] ? __lock_acquire+0x1305/0x7b50 [ 85.365678][ T4474] ? mark_lock+0x94/0x320 [ 85.370032][ T4474] ? _find_first_zero_bit+0xd1/0xf0 [ 85.375258][ T4474] __lock_acquire+0x2c66/0x7b50 [ 85.380148][ T4474] ? verify_lock_unused+0x140/0x140 [ 85.385401][ T4474] ? verify_lock_unused+0x140/0x140 [ 85.390662][ T4474] lock_acquire+0x19e/0x400 [ 85.395209][ T4474] ? __flush_work+0xfa/0x210 [ 85.399845][ T4474] ? __lock_acquire+0x7b50/0x7b50 [ 85.404912][ T4474] ? read_lock_is_recursive+0x10/0x10 [ 85.410348][ T4474] ? start_flush_work+0x784/0x830 [ 85.415420][ T4474] __flush_work+0x116/0x210 [ 85.420101][ T4474] ? __flush_work+0xfa/0x210 [ 85.424839][ T4474] ? flush_work+0x20/0x20 [ 85.429214][ T4474] ? try_to_grab_pending+0xfb/0x820 [ 85.434524][ T4474] ? mark_lock+0x94/0x320 [ 85.438969][ T4474] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 85.444986][ T4474] ? lock_chain_count+0x20/0x20 [ 85.449907][ T4474] ? mark_lock+0x94/0x320 [ 85.454303][ T4474] ? __cancel_work_timer+0x36a/0x560 [ 85.459651][ T4474] __cancel_work_timer+0x3f4/0x560 [ 85.464798][ T4474] ? cancel_work_sync+0x20/0x20 [ 85.469679][ T4474] ? __cancel_work+0x1f9/0x2e0 [ 85.474467][ T4474] ? lockdep_hardirqs_on+0x94/0x140 [ 85.479696][ T4474] ? __cancel_work+0x27b/0x2e0 [ 85.484493][ T4474] ? cancel_work+0x20/0x20 [ 85.488938][ T4474] hci_request_cancel_all+0xcc/0x300 [ 85.494257][ T4474] hci_dev_do_close+0x4e/0x1020 [ 85.499137][ T4474] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 85.505059][ T4474] ? _raw_spin_unlock+0x40/0x40 [ 85.509943][ T4474] hci_rfkill_set_block+0x101/0x180 [ 85.515195][ T4474] ? rcu_lock_release+0x20/0x20 [ 85.520068][ T4474] rfkill_set_block+0x1c1/0x3c0 [ 85.525039][ T4474] rfkill_fop_write+0x453/0x560 [ 85.529918][ T4474] ? rfkill_fop_read+0x560/0x560 [ 85.534886][ T4474] ? common_file_perm+0x100/0x1c0 [ 85.539955][ T4474] ? fsnotify_perm+0x5d/0x560 [ 85.544662][ T4474] ? security_file_permission+0x75/0xa0 [ 85.550244][ T4474] ? rfkill_fop_read+0x560/0x560 [ 85.555225][ T4474] vfs_write+0x304/0xd70 [ 85.559498][ T4474] ? file_end_write+0x250/0x250 [ 85.564377][ T4474] ? __context_tracking_exit+0x4c/0x80 [ 85.569869][ T4474] ? __fdget_pos+0x1e2/0x370 [ 85.574521][ T4474] ksys_write+0x153/0x260 [ 85.578937][ T4474] ? __ia32_sys_read+0x80/0x80 [ 85.583727][ T4474] ? lockdep_hardirqs_on+0x94/0x140 [ 85.588952][ T4474] do_syscall_64+0x4c/0xa0 [ 85.593402][ T4474] ? clear_bhb_loop+0x30/0x80 [ 85.598114][ T4474] ? clear_bhb_loop+0x30/0x80 [ 85.602817][ T4474] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 85.608748][ T4474] RIP: 0033:0x7f5a5c551019 [ 85.613191][ T4474] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.632820][ T4474] RSP: 002b:00007ffd6f5a4998 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.641264][ T4474] RAX: ffffffffffffffda RBX: 00007f5a5c7d8fa0 RCX: 00007f5a5c551019 [ 85.649262][ T4474] RDX: 0000000000000008 RSI: 0000200000000040 RDI: 0000000000000003 [ 85.657271][ T4474] RBP: 00007f5a5c5e800c R08: 0000000000000000 R09: 0000000000000000 [ 85.665272][ T4474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.673268][ T4474] R13: 00007f5a5c7d8fac R14: 00007f5a5c7d8fa0 R15: 00007f5a5c7d8fa0 [ 85.681271][ T4474] [ 85.694243][ T4280] Bluetooth: hci0: command 0x041b tx timeout