Warning: Permanently added '10.128.0.228' (ED25519) to the list of known hosts. 2026/07/19 23:12:58 parsed 1 programs 2026/07/19 23:12:58 serving rpc on tcp://34301 [ 73.009671][ T4199] cgroup: Unknown subsys name 'net' [ 73.119561][ T4199] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.672154][ T4199] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 77.136856][ T4242] chnl_net:caif_netlink_parms(): no params data found [ 77.205339][ T4242] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.214742][ T4242] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.223343][ T4242] device bridge_slave_0 entered promiscuous mode [ 77.233417][ T4242] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.240612][ T4242] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.250207][ T4242] device bridge_slave_1 entered promiscuous mode [ 77.277203][ T4242] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.298331][ T4242] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.326884][ T4242] team0: Port device team_slave_0 added [ 77.335420][ T4242] team0: Port device team_slave_1 added [ 77.358421][ T4242] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.365834][ T4242] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.392485][ T4242] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.405830][ T4242] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.412879][ T4242] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.439146][ T4242] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.479385][ T4242] device hsr_slave_0 entered promiscuous mode [ 77.487327][ T4242] device hsr_slave_1 entered promiscuous mode [ 77.638259][ T4242] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 77.651013][ T4242] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 77.664223][ T4242] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 77.676220][ T4242] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 77.768415][ T4242] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.784130][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 77.796505][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.809033][ T4242] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.821573][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.830873][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.843097][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.850447][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.863877][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 77.878784][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.888617][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.898897][ T1278] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.906152][ T1278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.923771][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.944106][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.955896][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.966134][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.978277][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.988002][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.008526][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 78.017322][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 78.028267][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 78.037999][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 78.048473][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 78.059811][ T4242] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 78.188709][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 78.198015][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 78.219917][ T4242] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.245184][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 78.256593][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 78.280632][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 78.291039][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 78.300565][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 78.311300][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 78.323771][ T4242] device veth0_vlan entered promiscuous mode [ 78.337612][ T4242] device veth1_vlan entered promiscuous mode [ 78.361479][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 78.370390][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 78.380487][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.390148][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.402177][ T4242] device veth0_macvtap entered promiscuous mode [ 78.415009][ T4242] device veth1_macvtap entered promiscuous mode [ 78.431280][ T4242] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.439331][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.449110][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.459322][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 78.469468][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 78.482138][ T4242] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.494743][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 78.504577][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 78.515634][ T4242] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.525145][ T4242] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.534416][ T4242] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.543443][ T4242] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.738908][ T1278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.754208][ T1278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.777533][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 79.794269][ T4255] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.802150][ T4255] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.812261][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2026/07/19 23:13:09 executed programs: 0 [ 81.055544][ T4298] chnl_net:caif_netlink_parms(): no params data found [ 81.111821][ T4298] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.119204][ T4298] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.128112][ T4298] device bridge_slave_0 entered promiscuous mode [ 81.137178][ T4298] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.144666][ T4298] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.153406][ T4298] device bridge_slave_1 entered promiscuous mode [ 81.180033][ T4298] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.193868][ T4298] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.222560][ T4298] team0: Port device team_slave_0 added [ 81.230714][ T4298] team0: Port device team_slave_1 added [ 81.252450][ T4298] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.259916][ T4298] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.287690][ T4298] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.300893][ T4298] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.308036][ T4298] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.335075][ T4298] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.375831][ T4298] device hsr_slave_0 entered promiscuous mode [ 81.383583][ T4298] device hsr_slave_1 entered promiscuous mode [ 81.391250][ T4298] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.399493][ T4298] Cannot create hsr debugfs directory [ 81.434483][ T144] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.003900][ T1336] Bluetooth: hci0: command 0x0409 tx timeout [ 84.341278][ T144] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.400283][ T144] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.464580][ T144] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.083235][ T3519] Bluetooth: hci0: command 0x041b tx timeout [ 85.387168][ T4298] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.396917][ T4298] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.432780][ T4298] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.442012][ T4298] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.528129][ T4298] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.548992][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 85.557732][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 85.570185][ T4298] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.599700][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 85.608714][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 85.617986][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.625201][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.635119][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 85.647631][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 85.657663][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 85.666454][ T390] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.674960][ T390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.707951][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 85.721530][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 85.734761][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 85.747081][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 85.756415][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 85.768140][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 85.777629][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 85.814797][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 85.823595][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 85.835591][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 85.844277][ T390] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 85.856409][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 85.980945][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 85.988936][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 86.025601][ T4298] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.044291][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 86.053302][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 86.076547][ T4298] device veth0_vlan entered promiscuous mode [ 86.085144][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 86.094933][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 86.104912][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 86.113497][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 86.135557][ T4298] device veth1_vlan entered promiscuous mode [ 86.167831][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 86.176721][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 86.187467][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 86.196886][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 86.210825][ T4298] device veth0_macvtap entered promiscuous mode [ 86.227568][ T4298] device veth1_macvtap entered promiscuous mode [ 86.245005][ T144] device hsr_slave_0 left promiscuous mode [ 86.251791][ T144] device hsr_slave_1 left promiscuous mode [ 86.259280][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.266972][ T144] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.276690][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.284593][ T144] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.292376][ T144] device bridge_slave_1 left promiscuous mode [ 86.300241][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.315658][ T144] device bridge_slave_0 left promiscuous mode [ 86.322234][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.341868][ T144] device veth1_macvtap left promiscuous mode [ 86.349097][ T144] device veth0_macvtap left promiscuous mode [ 86.355607][ T144] device veth1_vlan left promiscuous mode [ 86.361682][ T144] device veth0_vlan left promiscuous mode [ 86.547505][ T144] team0 (unregistering): Port device team_slave_1 removed [ 86.561269][ T144] team0 (unregistering): Port device team_slave_0 removed [ 86.579181][ T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 86.598321][ T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 86.665336][ T144] bond0 (unregistering): Released all slaves [ 86.749071][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 86.759257][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 86.778787][ T4298] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.791151][ T4298] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.799713][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 86.812352][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 86.821759][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 86.835122][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 86.856422][ T4298] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.865249][ T4298] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.874431][ T4298] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.884453][ T4298] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.053804][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.087938][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.133439][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 87.173973][ T3519] Bluetooth: hci0: command 0x040f tx timeout [ 87.181608][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.193580][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.213105][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 87.434537][ T4358] [ 87.437025][ T4358] ====================================================== [ 87.444084][ T4358] WARNING: possible circular locking dependency detected [ 87.451797][ T4358] syzkaller #0 Not tainted [ 87.456281][ T4358] ------------------------------------------------------ [ 87.463847][ T4358] syz.0.17/4358 is trying to acquire lock: [ 87.470199][ T4358] ffff888079c25028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 [ 87.482126][ T4358] [ 87.482126][ T4358] but task is already holding lock: [ 87.489525][ T4358] ffffffff8d6d3c28 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 87.499748][ T4358] [ 87.499748][ T4358] which lock already depends on the new lock. [ 87.499748][ T4358] [ 87.510820][ T4358] [ 87.510820][ T4358] the existing dependency chain (in reverse order) is: [ 87.519996][ T4358] [ 87.519996][ T4358] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 87.528339][ T4358] __mutex_lock_common+0x1e5/0x2400 [ 87.534188][ T4358] mutex_lock_nested+0x17/0x20 [ 87.539615][ T4358] rfkill_register+0x2f/0x970 [ 87.544847][ T4358] hci_register_dev+0x459/0x980 [ 87.550235][ T4358] vhci_create_device+0x32e/0x5c0 [ 87.556058][ T4358] vhci_write+0x389/0x440 [ 87.560950][ T4358] vfs_write+0x748/0xd70 [ 87.566441][ T4358] ksys_write+0x153/0x260 [ 87.571564][ T4358] do_syscall_64+0x4c/0xa0 [ 87.576720][ T4358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.583338][ T4358] [ 87.583338][ T4358] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 87.591193][ T4358] __mutex_lock_common+0x1e5/0x2400 [ 87.597110][ T4358] mutex_lock_nested+0x17/0x20 [ 87.602653][ T4358] vhci_send_frame+0x88/0x100 [ 87.608014][ T4358] hci_send_frame+0x1a9/0x2e0 [ 87.613268][ T4358] hci_tx_work+0x9b5/0x16d0 [ 87.618552][ T4358] process_one_work+0x867/0xff0 [ 87.624094][ T4358] worker_thread+0xad7/0x12a0 [ 87.629565][ T4358] kthread+0x42e/0x520 [ 87.634511][ T4358] ret_from_fork+0x1f/0x30 [ 87.639491][ T4358] [ 87.639491][ T4358] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 87.650053][ T4358] __flush_work+0x116/0x210 [ 87.656349][ T4358] hci_dev_do_close+0x201/0x1020 [ 87.662644][ T4358] hci_unregister_dev+0x2eb/0x590 [ 87.668928][ T4358] vhci_release+0x73/0xc0 [ 87.674080][ T4358] __fput+0x212/0x8c0 [ 87.678752][ T4358] task_work_run+0x125/0x1a0 [ 87.683907][ T4358] do_exit+0x635/0x2110 [ 87.688869][ T4358] do_group_exit+0x12c/0x2f0 [ 87.693993][ T4358] get_signal+0x7eb/0x12e0 [ 87.699035][ T4358] arch_do_signal_or_restart+0xe6/0x12a0 [ 87.705221][ T4358] exit_to_user_mode_loop+0x9e/0x130 [ 87.711261][ T4358] exit_to_user_mode_prepare+0xee/0x180 [ 87.717522][ T4358] syscall_exit_to_user_mode+0x16/0x40 [ 87.723613][ T4358] do_syscall_64+0x58/0xa0 [ 87.728616][ T4358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.735072][ T4358] [ 87.735072][ T4358] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 87.742871][ T4358] __mutex_lock_common+0x1e5/0x2400 [ 87.748713][ T4358] mutex_lock_nested+0x17/0x20 [ 87.754106][ T4358] bg_scan_update+0x44/0x3b0 [ 87.759239][ T4358] process_one_work+0x867/0xff0 [ 87.764782][ T4358] worker_thread+0xad7/0x12a0 [ 87.770289][ T4358] kthread+0x42e/0x520 [ 87.774964][ T4358] ret_from_fork+0x1f/0x30 [ 87.779926][ T4358] [ 87.779926][ T4358] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 87.790457][ T4358] __lock_acquire+0x2c66/0x7b50 [ 87.795864][ T4358] lock_acquire+0x19e/0x400 [ 87.800905][ T4358] __flush_work+0x116/0x210 [ 87.805971][ T4358] __cancel_work_timer+0x3f4/0x560 [ 87.811646][ T4358] hci_request_cancel_all+0xcc/0x300 [ 87.817618][ T4358] hci_dev_do_close+0x4e/0x1020 [ 87.823577][ T4358] hci_rfkill_set_block+0x101/0x180 [ 87.829430][ T4358] rfkill_set_block+0x1c1/0x3c0 [ 87.835003][ T4358] rfkill_fop_write+0x453/0x560 [ 87.840838][ T4358] vfs_write+0x304/0xd70 [ 87.845640][ T4358] ksys_write+0x153/0x260 [ 87.851155][ T4358] do_syscall_64+0x4c/0xa0 [ 87.856212][ T4358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.863375][ T4358] [ 87.863375][ T4358] other info that might help us debug this: [ 87.863375][ T4358] [ 87.874850][ T4358] Chain exists of: [ 87.874850][ T4358] (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex [ 87.874850][ T4358] [ 87.891205][ T4358] Possible unsafe locking scenario: [ 87.891205][ T4358] [ 87.898871][ T4358] CPU0 CPU1 [ 87.904348][ T4358] ---- ---- [ 87.909730][ T4358] lock(rfkill_global_mutex); [ 87.914620][ T4358] lock(&data->open_mutex); [ 87.921840][ T4358] lock(rfkill_global_mutex); [ 87.929157][ T4358] lock((work_completion)(&hdev->bg_scan_update)); [ 87.936051][ T4358] [ 87.936051][ T4358] *** DEADLOCK *** [ 87.936051][ T4358] [ 87.945046][ T4358] 1 lock held by syz.0.17/4358: [ 87.950304][ T4358] #0: ffffffff8d6d3c28 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 87.960887][ T4358] [ 87.960887][ T4358] stack backtrace: [ 87.966940][ T4358] CPU: 1 PID: 4358 Comm: syz.0.17 Not tainted syzkaller #0 [ 87.974782][ T4358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 87.985396][ T4358] Call Trace: [ 87.988798][ T4358] [ 87.991858][ T4358] dump_stack_lvl+0x188/0x250 [ 87.996681][ T4358] ? load_image+0x410/0x410 [ 88.001360][ T4358] ? show_regs_print_info+0x20/0x20 [ 88.006610][ T4358] ? print_circular_bug+0x12b/0x1a0 [ 88.011858][ T4358] check_noncircular+0x296/0x330 [ 88.016950][ T4358] ? look_up_lock_class+0x71/0x110 [ 88.022079][ T4358] ? add_chain_block+0x9b0/0x9b0 [ 88.027116][ T4358] ? lockdep_lock+0xf1/0x1f0 [ 88.031731][ T4358] ? __lock_acquire+0x1305/0x7b50 [ 88.036962][ T4358] ? mark_lock+0x94/0x320 [ 88.041371][ T4358] ? _find_first_zero_bit+0xd1/0xf0 [ 88.046600][ T4358] __lock_acquire+0x2c66/0x7b50 [ 88.051485][ T4358] ? verify_lock_unused+0x140/0x140 [ 88.056711][ T4358] ? verify_lock_unused+0x140/0x140 [ 88.062216][ T4358] lock_acquire+0x19e/0x400 [ 88.066753][ T4358] ? __flush_work+0xfa/0x210 [ 88.071421][ T4358] ? __lock_acquire+0x7b50/0x7b50 [ 88.076488][ T4358] ? read_lock_is_recursive+0x10/0x10 [ 88.081882][ T4358] ? start_flush_work+0x784/0x830 [ 88.086922][ T4358] __flush_work+0x116/0x210 [ 88.091459][ T4358] ? __flush_work+0xfa/0x210 [ 88.096136][ T4358] ? flush_work+0x20/0x20 [ 88.100532][ T4358] ? try_to_grab_pending+0xfb/0x820 [ 88.106029][ T4358] ? mark_lock+0x94/0x320 [ 88.110384][ T4358] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 88.116393][ T4358] ? lock_chain_count+0x20/0x20 [ 88.121268][ T4358] ? mark_lock+0x94/0x320 [ 88.125617][ T4358] ? __cancel_work_timer+0x36a/0x560 [ 88.131104][ T4358] __cancel_work_timer+0x3f4/0x560 [ 88.136245][ T4358] ? cancel_work_sync+0x20/0x20 [ 88.141304][ T4358] ? __cancel_work+0x1f9/0x2e0 [ 88.146333][ T4358] ? lockdep_hardirqs_on+0x94/0x140 [ 88.152309][ T4358] ? __cancel_work+0x27b/0x2e0 [ 88.157273][ T4358] ? cancel_work+0x20/0x20 [ 88.161731][ T4358] hci_request_cancel_all+0xcc/0x300 [ 88.167065][ T4358] hci_dev_do_close+0x4e/0x1020 [ 88.172130][ T4358] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 88.178052][ T4358] ? _raw_spin_unlock+0x40/0x40 [ 88.182926][ T4358] hci_rfkill_set_block+0x101/0x180 [ 88.188143][ T4358] ? rcu_lock_release+0x20/0x20 [ 88.193111][ T4358] rfkill_set_block+0x1c1/0x3c0 [ 88.198010][ T4358] rfkill_fop_write+0x453/0x560 [ 88.202894][ T4358] ? rfkill_fop_read+0x560/0x560 [ 88.207881][ T4358] ? common_file_perm+0xf0/0x1c0 [ 88.213148][ T4358] ? fsnotify_perm+0x5d/0x560 [ 88.217950][ T4358] ? security_file_permission+0x75/0xa0 [ 88.223633][ T4358] ? rfkill_fop_read+0x560/0x560 [ 88.229001][ T4358] vfs_write+0x304/0xd70 [ 88.234507][ T4358] ? file_end_write+0x250/0x250 [ 88.239397][ T4358] ? __context_tracking_exit+0x4c/0x80 [ 88.244885][ T4358] ? __fdget_pos+0x1e2/0x370 [ 88.249608][ T4358] ksys_write+0x153/0x260 [ 88.254054][ T4358] ? __ia32_sys_read+0x80/0x80 [ 88.258925][ T4358] ? lockdep_hardirqs_on+0x94/0x140 [ 88.264227][ T4358] do_syscall_64+0x4c/0xa0 [ 88.269102][ T4358] ? clear_bhb_loop+0x30/0x80 [ 88.273794][ T4358] ? clear_bhb_loop+0x30/0x80 [ 88.278579][ T4358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 88.284520][ T4358] RIP: 0033:0x7fccf33e5e99 [ 88.289334][ T4358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.310083][ T4358] RSP: 002b:00007ffd69691678 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 88.319033][ T4358] RAX: ffffffffffffffda RBX: 00007fccf366dfa0 RCX: 00007fccf33e5e99 [ 88.327518][ T4358] RDX: 0000000000000008 RSI: 00002000000002c0 RDI: 0000000000000003 [ 88.337945][ T4358] RBP: 00007fccf347beaf R08: 0000000000000000 R09: 0000000000000000 [ 88.346321][ T4358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.354948][ T4358] R13: 00007fccf366dfac R14: 00007fccf366dfa0 R15: 00007fccf366dfa0 [ 88.364127][ T4358]