[ 71.492749][ T63] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:16657' (ED25519) to the list of known hosts. [ 78.403510][ T43] audit: type=1400 audit(1790243276.725:138): avc: denied { execute } for pid=5738 comm="sh" name="syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 78.403940][ T43] audit: type=1400 audit(1790243276.725:139): avc: denied { execute_no_trans } for pid=5738 comm="sh" path="/syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 2026/09/24 09:47:57 parsed 1 programs 2026/09/24 09:47:58 serving rpc on tcp://38341 [ 79.669727][ T43] audit: type=1400 audit(1790243277.985:140): avc: denied { node_bind } for pid=5738 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 79.670130][ T43] audit: type=1400 audit(1790243277.985:141): avc: denied { node_bind } for pid=5738 comm="syz-execprog" saddr=::ffff:127.0.0.1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 82.412316][ T43] audit: type=1400 audit(1790243280.735:142): avc: denied { mounton } for pid=5747 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 82.414719][ T43] audit: type=1400 audit(1790243280.735:143): avc: denied { mount } for pid=5747 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 82.417975][ T5747] cgroup: Unknown subsys name 'net' [ 82.419870][ T43] audit: type=1400 audit(1790243280.735:144): avc: denied { unmount } for pid=5747 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 82.564081][ T5747] cgroup: Unknown subsys name 'cpuset' [ 82.567147][ T5747] cgroup: Unknown subsys name 'rlimit' [ 82.715754][ T43] audit: type=1400 audit(1790243281.035:145): avc: denied { setattr } for pid=5747 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 82.716411][ T43] audit: type=1400 audit(1790243281.035:146): avc: denied { create } for pid=5747 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 82.716689][ T43] audit: type=1400 audit(1790243281.035:147): avc: denied { write } for pid=5747 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 82.777536][ T5756] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 83.493212][ T5747] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.215581][ T43] kauditd_printk_skb: 11 callbacks suppressed [ 85.215595][ T43] audit: type=1400 audit(1790243283.535:159): avc: denied { execmem } for pid=5759 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 85.222410][ T43] audit: type=1400 audit(1790243283.545:160): avc: denied { read } for pid=5760 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 85.222441][ T43] audit: type=1400 audit(1790243283.545:161): avc: denied { open } for pid=5760 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 85.222460][ T43] audit: type=1400 audit(1790243283.545:162): avc: denied { mounton } for pid=5760 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 85.269704][ T43] audit: type=1400 audit(1790243283.585:163): avc: denied { mount } for pid=5760 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 85.270678][ T43] audit: type=1400 audit(1790243283.595:164): avc: denied { mounton } for pid=5760 comm="syz-executor" path="/syzkaller.isMUCk/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 85.271858][ T43] audit: type=1400 audit(1790243283.595:165): avc: denied { mount } for pid=5760 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 85.273834][ T43] audit: type=1400 audit(1790243283.595:166): avc: denied { mounton } for pid=5760 comm="syz-executor" path="/syzkaller.isMUCk/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 85.274563][ T43] audit: type=1400 audit(1790243283.595:167): avc: denied { mounton } for pid=5760 comm="syz-executor" path="/syzkaller.isMUCk/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7193 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 85.277990][ T43] audit: type=1400 audit(1790243283.595:168): avc: denied { unmount } for pid=5760 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 85.315396][ T5760] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 85.619763][ T682] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.619777][ T682] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.705284][ T682] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.705299][ T682] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.221747][ T66] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.222238][ T66] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.223169][ T66] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.224295][ T66] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.225016][ T66] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.249923][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.250611][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.250679][ T5812] bridge_slave_0: entered allmulticast mode [ 87.251491][ T5812] bridge_slave_0: entered promiscuous mode [ 87.255128][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.255171][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.255226][ T5812] bridge_slave_1: entered allmulticast mode [ 87.256004][ T5812] bridge_slave_1: entered promiscuous mode [ 87.268936][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.270426][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.283400][ T5812] team0: Port device team_slave_0 added [ 87.285390][ T5812] team0: Port device team_slave_1 added [ 87.300988][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.300998][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.301011][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.302702][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.302710][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.302722][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.329112][ T5812] hsr_slave_0: entered promiscuous mode [ 87.329653][ T5812] hsr_slave_1: entered promiscuous mode [ 87.464552][ T5812] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.468160][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.468816][ T5812] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.471384][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.471766][ T5812] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.474732][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.475757][ T5812] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.478910][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.503399][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.503584][ T5812] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.503958][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.504037][ T5812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.545152][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.554839][ T682] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.555672][ T682] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.559937][ T5812] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.565975][ T682] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.566097][ T682] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.569540][ T682] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.569588][ T682] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.816952][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.853215][ T5812] veth0_vlan: entered promiscuous mode [ 87.857288][ T5812] veth1_vlan: entered promiscuous mode [ 87.872780][ T5812] veth0_macvtap: entered promiscuous mode [ 87.876130][ T5812] veth1_macvtap: entered promiscuous mode [ 87.888745][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.897454][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.950475][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.981247][ T5773] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.981501][ T5773] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.982007][ T5773] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.018988][ T5773] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.110093][ T5773] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.162277][ T5773] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.237211][ T5773] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/09/24 09:48:07 executed programs: 0 [ 88.902254][ T66] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.903370][ T66] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.903731][ T66] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.905565][ T66] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.906304][ T66] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 89.274654][ T5873] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.274736][ T5873] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.275664][ T5873] bridge_slave_0: entered allmulticast mode [ 89.276400][ T5873] bridge_slave_0: entered promiscuous mode [ 89.278273][ T5873] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.278346][ T5873] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.278431][ T5873] bridge_slave_1: entered allmulticast mode [ 89.280475][ T5873] bridge_slave_1: entered promiscuous mode [ 89.303317][ T5873] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.304778][ T5873] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.320210][ T5873] team0: Port device team_slave_0 added [ 89.321581][ T5873] team0: Port device team_slave_1 added [ 89.341862][ T5873] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.341878][ T5873] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.341898][ T5873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.343680][ T5873] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.343689][ T5873] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.343701][ T5873] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.368215][ T5873] hsr_slave_0: entered promiscuous mode [ 89.368841][ T5873] hsr_slave_1: entered promiscuous mode [ 89.369182][ T5873] debugfs: 'hsr0' already exists in 'hsr' [ 89.369263][ T5873] Cannot create hsr debugfs directory [ 90.932737][ T5773] bridge_slave_1: left allmulticast mode [ 90.932764][ T5773] bridge_slave_1: left promiscuous mode [ 90.933891][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.936809][ T5773] bridge_slave_0: left allmulticast mode [ 90.936822][ T5773] bridge_slave_0: left promiscuous mode [ 90.936945][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.942644][ T5089] Bluetooth: hci0: command tx timeout [ 91.033106][ T5773] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 91.035481][ T5773] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 91.036841][ T5773] bond0 (unregistering): Released all slaves [ 91.076838][ T5773] hsr_slave_0: left promiscuous mode [ 91.077289][ T5773] hsr_slave_1: left promiscuous mode [ 91.077742][ T5773] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 91.077765][ T5773] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 91.078567][ T5773] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 91.078577][ T5773] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 91.088955][ T5773] veth1_macvtap: left promiscuous mode [ 91.089001][ T5773] veth0_macvtap: left promiscuous mode [ 91.089089][ T5773] veth1_vlan: left promiscuous mode [ 91.089157][ T5773] veth0_vlan: left promiscuous mode [ 91.237439][ T5773] team0 (unregistering): Port device team_slave_1 removed [ 91.243739][ T5773] team0 (unregistering): Port device team_slave_0 removed [ 91.389622][ T43] kauditd_printk_skb: 20 callbacks suppressed [ 91.389634][ T43] audit: type=1400 audit(1790243289.705:189): avc: denied { write } for pid=5893 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.389762][ T43] audit: type=1400 audit(1790243289.705:190): avc: denied { create } for pid=5893 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 91.391260][ T43] audit: type=1400 audit(1790243289.715:191): avc: denied { write } for pid=5893 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth2.link" dev="tmpfs" ino=2035 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 91.391286][ T43] audit: type=1400 audit(1790243289.715:192): avc: denied { append } for pid=5893 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" dev="tmpfs" ino=2035 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 91.439320][ T43] audit: type=1400 audit(1790243289.755:193): avc: denied { write } for pid=5896 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.439375][ T43] audit: type=1400 audit(1790243289.755:194): avc: denied { unlink } for pid=5896 comm="rm" name="resolv.conf.eth2.link" dev="tmpfs" ino=2035 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 91.524812][ T43] audit: type=1400 audit(1790243289.845:195): avc: denied { write } for pid=5898 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.527152][ T5873] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 91.529057][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 91.529573][ T5873] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.538607][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 91.539059][ T5873] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.544441][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 91.545772][ T5873] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.548890][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 91.570040][ T43] audit: type=1400 audit(1790243289.885:196): avc: denied { write } for pid=5901 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.595138][ T5873] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.604544][ T5873] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.608810][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.608856][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.614023][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.614067][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.991460][ T5873] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.012239][ T5873] veth0_vlan: entered promiscuous mode [ 92.017135][ T5873] veth1_vlan: entered promiscuous mode [ 92.038093][ T5873] veth0_macvtap: entered promiscuous mode [ 92.040802][ T5873] veth1_macvtap: entered promiscuous mode [ 92.048300][ T5873] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.052439][ T5873] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.072410][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.072689][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.073445][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.096721][ T682] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.096741][ T682] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.116469][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.116490][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.131890][ T5773] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.142253][ T43] audit: type=1400 audit(1790243290.465:197): avc: denied { mount } for pid=5919 comm="syz.0.17" name="/" dev="configfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 92.142459][ T43] audit: type=1400 audit(1790243290.465:198): avc: denied { search } for pid=5919 comm="syz.0.17" name="/" dev="configfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 92.168731][ T5920] [ 92.169758][ T5920] ====================================================== [ 92.172524][ T5920] WARNING: possible circular locking dependency detected [ 92.175296][ T5920] syzkaller #0 Not tainted [ 92.177107][ T5920] ------------------------------------------------------ [ 92.179901][ T5920] syz.0.18/5920 is trying to acquire lock: [ 92.182971][ T5920] ffff888020489900 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: configfs_depend_item_unlocked+0xf3/0x6a0 [ 92.187075][ T5920] [ 92.187075][ T5920] but task is already holding lock: [ 92.190006][ T5920] ffffffff90480000 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 92.193705][ T5920] [ 92.193705][ T5920] which lock already depends on the new lock. [ 92.193705][ T5920] [ 92.197810][ T5920] [ 92.197810][ T5920] the existing dependency chain (in reverse order) is: [ 92.201341][ T5920] [ 92.201341][ T5920] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 92.204579][ T5920] lock_acquire+0x1d1/0x380 [ 92.206751][ T5920] __mutex_lock+0x1a4/0x1bd0 [ 92.208852][ T5920] tcm_alloc+0x20/0x440 [ 92.210653][ T5920] usb_get_function+0x5e/0xd0 [ 92.212468][ T5920] config_usb_cfg_link+0x1ed/0x3a0 [ 92.214906][ T5920] configfs_symlink+0x695/0x1340 [ 92.217118][ T5920] vfs_symlink+0x178/0x4d0 [ 92.219129][ T5920] filename_symlinkat+0x2a6/0x560 [ 92.221356][ T5920] __x64_sys_symlinkat+0x9c/0xe0 [ 92.223574][ T5920] do_syscall_64+0x123/0x790 [ 92.225664][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.228234][ T5920] [ 92.228234][ T5920] -> #1 (&gi->lock){+.+.}-{4:4}: [ 92.230847][ T5920] lock_acquire+0x1d1/0x380 [ 92.232685][ T5920] __mutex_lock+0x1a4/0x1bd0 [ 92.234772][ T5920] config_usb_cfg_link+0x57/0x3a0 [ 92.237003][ T5920] configfs_symlink+0x695/0x1340 [ 92.239212][ T5920] vfs_symlink+0x178/0x4d0 [ 92.241217][ T5920] filename_symlinkat+0x2a6/0x560 [ 92.243471][ T5920] __x64_sys_symlinkat+0x9c/0xe0 [ 92.245696][ T5920] do_syscall_64+0x123/0x790 [ 92.247764][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.250289][ T5920] [ 92.250289][ T5920] -> #0 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 92.253771][ T5920] check_prev_add+0xeb/0xe60 [ 92.255831][ T5920] __lock_acquire+0x1528/0x1f40 [ 92.258002][ T5920] lock_acquire+0x1d1/0x380 [ 92.259813][ T5920] down_write+0x8b/0x1f0 [ 92.261565][ T5920] configfs_depend_item_unlocked+0xf3/0x6a0 [ 92.264121][ T5920] usbg_make_tpg+0x251/0x610 [ 92.266183][ T5920] target_fabric_make_tpg+0xab/0x8c0 [ 92.268525][ T5920] configfs_mkdir+0x525/0xd40 [ 92.270623][ T5920] vfs_mkdir+0x364/0x850 [ 92.272546][ T5920] filename_mkdirat+0x48b/0x5e0 [ 92.274746][ T5920] __x64_sys_mkdirat+0x89/0xc0 [ 92.276885][ T5920] do_syscall_64+0x123/0x790 [ 92.278962][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.281516][ T5920] [ 92.281516][ T5920] other info that might help us debug this: [ 92.281516][ T5920] [ 92.285561][ T5920] Chain exists of: [ 92.285561][ T5920] &sb->s_type->i_mutex_key#24 --> &gi->lock --> tpg_instances_lock [ 92.285561][ T5920] [ 92.290997][ T5920] Possible unsafe locking scenario: [ 92.290997][ T5920] [ 92.293964][ T5920] CPU0 CPU1 [ 92.296105][ T5920] ---- ---- [ 92.298278][ T5920] lock(tpg_instances_lock); [ 92.300184][ T5920] lock(&gi->lock); [ 92.302723][ T5920] lock(tpg_instances_lock); [ 92.305605][ T5920] lock(&sb->s_type->i_mutex_key#24); [ 92.307812][ T5920] [ 92.307812][ T5920] *** DEADLOCK *** [ 92.307812][ T5920] [ 92.311034][ T5920] locks held by syz.0.18/5920: 4, last CPU#2: [ 92.313487][ T5920] #0: ffff8880238da460 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 92.317248][ T5920] #1: ffff88804586b580 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 [ 92.321519][ T5920] #2: ffffffff8ffb2e68 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4c0/0xd40 [ 92.325537][ T5920] #3: ffffffff90480000 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 92.329439][ T5920] [ 92.329439][ T5920] stack backtrace: [ 92.331831][ T5920] CPU: 2 UID: 0 PID: 5920 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) [ 92.335428][ T5920] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.339440][ T5920] Call Trace: [ 92.340800][ T5920] [ 92.342026][ T5920] dump_stack_lvl+0x100/0x190 [ 92.343938][ T5920] print_circular_bug.cold+0x178/0x1be [ 92.346159][ T5920] check_noncircular+0x146/0x160 [ 92.348177][ T5920] check_prev_add+0xeb/0xe60 [ 92.349942][ T5920] __lock_acquire+0x1528/0x1f40 [ 92.351478][ T5920] ? rcu_is_watching+0x13/0xc0 [ 92.353005][ T5920] lock_acquire+0x1d1/0x380 [ 92.354449][ T5920] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 92.356349][ T5920] ? __pfx___might_resched+0x10/0x10 [ 92.358029][ T5920] down_write+0x8b/0x1f0 [ 92.359360][ T5920] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 92.361256][ T5920] ? __pfx_down_write+0x10/0x10 [ 92.362791][ T5920] ? kstrtou16+0xde/0x130 [ 92.364147][ T5920] configfs_depend_item_unlocked+0xf3/0x6a0 [ 92.365993][ T5920] usbg_make_tpg+0x251/0x610 [ 92.367488][ T5920] ? __pfx_usbg_make_tpg+0x10/0x10 [ 92.369093][ T5920] ? find_held_lock+0x2b/0x80 [ 92.370584][ T5920] ? __pfx_usbg_make_tpg+0x10/0x10 [ 92.372180][ T5920] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 92.374029][ T5920] target_fabric_make_tpg+0xab/0x8c0 [ 92.375676][ T5920] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 92.377562][ T5920] configfs_mkdir+0x525/0xd40 [ 92.379042][ T5920] ? may_create+0x285/0x440 [ 92.380476][ T5920] ? __pfx_configfs_mkdir+0x10/0x10 [ 92.382112][ T5920] vfs_mkdir+0x364/0x850 [ 92.383448][ T5920] filename_mkdirat+0x48b/0x5e0 [ 92.384974][ T5920] ? __pfx_filename_mkdirat+0x10/0x10 [ 92.386684][ T5920] ? strncpy_from_user+0x19d/0x2d0 [ 92.388283][ T5920] ? do_getname+0x191/0x390 [ 92.389736][ T5920] __x64_sys_mkdirat+0x89/0xc0 [ 92.391246][ T5920] do_syscall_64+0x123/0x790 [ 92.392709][ T5920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.395310][ T5920] RIP: 0033:0x7fcd2a39e159 [ 92.396750][ T5920] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.402691][ T5920] RSP: 002b:00007ffd7911d658 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 92.405265][ T5920] RAX: ffffffffffffffda RBX: 00007fcd2a625fa0 RCX: 00007fcd2a39e159 [ 92.407750][ T5920] RDX: 00000000000001ff RSI: 0000200000001300 RDI: ffffffffffffff9c [ 92.410228][ T5920] RBP: 00007fcd2a43506b R08: 0000000000000000 R09: 0000000000000000 [ 92.412671][ T5920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.415266][ T5920] R13: 00007fcd2a625fac R14: 00007fcd2a625fa0 R15: 00007fcd2a625fa0 [ 92.417775][ T5920] [ 93.010556][ T5089] Bluetooth: hci0: command tx timeout 2026/09/24 09:48:12 executed programs: 88 [ 95.090388][ T5089] Bluetooth: hci0: command tx timeout [ 97.180489][ T5089] Bluetooth: hci0: command tx timeout 2026/09/24 09:48:17 executed programs: 376