Warning: Permanently added '10.128.0.38' (ED25519) to the list of known hosts.
2026/09/27 17:36:59 parsed 1 programs
2026/09/27 17:36:59 serving rpc on tcp://37103
[ 63.936406][ T4198] cgroup: Unknown subsys name 'net'
[ 64.047954][ T4198] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 65.328887][ T4198] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 66.809774][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 66.817735][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 66.828735][ T3047] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 66.850361][ T3047] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 66.858844][ T3047] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 66.867108][ T3047] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 68.486016][ T154] ODEBUG: Out of memory. ODEBUG disabled
[ 68.510655][ T4258] chnl_net:caif_netlink_parms(): no params data found
[ 68.585110][ T4258] bridge0: port 1(bridge_slave_0) entered blocking state
[ 68.606481][ T4258] bridge0: port 1(bridge_slave_0) entered disabled state
[ 68.616150][ T4258] device bridge_slave_0 entered promiscuous mode
[ 68.646177][ T4258] bridge0: port 2(bridge_slave_1) entered blocking state
[ 68.654678][ T4258] bridge0: port 2(bridge_slave_1) entered disabled state
[ 68.663575][ T4258] device bridge_slave_1 entered promiscuous mode
[ 68.692622][ T4258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 68.704489][ T4258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 68.737868][ T4258] team0: Port device team_slave_0 added
[ 68.750480][ T4258] team0: Port device team_slave_1 added
[ 68.764953][ T4258] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 68.773423][ T4258] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 68.799877][ T4258] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 68.812875][ T4258] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 68.820083][ T4258] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 68.847413][ T4258] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 68.880171][ T4258] device hsr_slave_0 entered promiscuous mode
[ 68.887304][ T4258] device hsr_slave_1 entered promiscuous mode
[ 68.967690][ T4258] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 68.979796][ T4258] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 68.988728][ T4258] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 68.997655][ T4258] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 69.047273][ T4258] 8021q: adding VLAN 0 to HW filter on device bond0
[ 69.063928][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 69.072427][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 69.083685][ T4258] 8021q: adding VLAN 0 to HW filter on device team0
[ 69.094458][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 69.104078][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 69.114959][ T9] bridge0: port 1(bridge_slave_0) entered blocking state
[ 69.123369][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 69.133660][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 69.161758][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 69.173004][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 69.182239][ T9] bridge0: port 2(bridge_slave_1) entered blocking state
[ 69.189520][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 69.201125][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 69.229462][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 69.241137][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 69.250427][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 69.282512][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 69.291850][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 69.301713][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 69.312773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 69.339745][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 69.351441][ T4258] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 69.445580][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 69.453481][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 69.469570][ T4258] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 69.501869][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 69.518920][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 69.528233][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 69.540883][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 69.554437][ T4258] device veth0_vlan entered promiscuous mode
[ 69.577175][ T4258] device veth1_vlan entered promiscuous mode
[ 69.594646][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 69.602976][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 69.612557][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 69.622771][ T4258] device veth0_macvtap entered promiscuous mode
[ 69.634284][ T4258] device veth1_macvtap entered promiscuous mode
[ 69.660589][ T4258] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 69.668361][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 69.676779][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 69.685610][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 69.696374][ T4258] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 69.705639][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 69.715181][ T622] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 69.725874][ T4258] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 69.735877][ T4258] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 69.745170][ T4258] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 69.754264][ T4258] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2026/09/27 17:37:07 executed programs: 0
[ 70.558005][ T4300] chnl_net:caif_netlink_parms(): no params data found
[ 70.610479][ T4300] bridge0: port 1(bridge_slave_0) entered blocking state
[ 70.617683][ T4300] bridge0: port 1(bridge_slave_0) entered disabled state
[ 70.626068][ T4300] device bridge_slave_0 entered promiscuous mode
[ 70.634408][ T4300] bridge0: port 2(bridge_slave_1) entered blocking state
[ 70.641660][ T4300] bridge0: port 2(bridge_slave_1) entered disabled state
[ 70.657456][ T4300] device bridge_slave_1 entered promiscuous mode
[ 70.680968][ T4300] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 70.692675][ T4300] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 70.717958][ T4300] team0: Port device team_slave_0 added
[ 70.725704][ T4300] team0: Port device team_slave_1 added
[ 70.745268][ T4300] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 70.752741][ T4300] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 70.778985][ T4300] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 70.791634][ T4300] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 70.798907][ T4300] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 70.825978][ T4300] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 70.863475][ T4300] device hsr_slave_0 entered promiscuous mode
[ 70.870354][ T4300] device hsr_slave_1 entered promiscuous mode
[ 70.879700][ T4300] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 70.887812][ T4300] Cannot create hsr debugfs directory
[ 70.984209][ T4300] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 71.540869][ T1420] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.547341][ T1420] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.489318][ T1108] Bluetooth: hci0: command 0x0409 tx timeout
[ 73.804989][ T4300] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 74.568652][ T4308] Bluetooth: hci0: command 0x041b tx timeout
[ 74.743370][ T4300] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 74.813416][ T4300] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 74.993408][ T4300] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 75.012540][ T4300] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 75.021462][ T4300] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 75.030308][ T4300] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 75.084685][ T4300] 8021q: adding VLAN 0 to HW filter on device bond0
[ 75.107580][ T3047] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 75.117629][ T3047] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 75.130122][ T4300] 8021q: adding VLAN 0 to HW filter on device team0
[ 75.143645][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 75.153408][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 75.164113][ T4288] bridge0: port 1(bridge_slave_0) entered blocking state
[ 75.171826][ T4288] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 75.184842][ T154] device hsr_slave_0 left promiscuous mode
[ 75.191945][ T154] device hsr_slave_1 left promiscuous mode
[ 75.201470][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 75.209819][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 75.220848][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 75.228906][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 75.237285][ T154] device bridge_slave_1 left promiscuous mode
[ 75.244063][ T154] bridge0: port 2(bridge_slave_1) entered disabled state
[ 75.256522][ T154] device bridge_slave_0 left promiscuous mode
[ 75.264429][ T154] bridge0: port 1(bridge_slave_0) entered disabled state
[ 75.283333][ T154] device veth1_macvtap left promiscuous mode
[ 75.291189][ T154] device veth0_macvtap left promiscuous mode
[ 75.297583][ T154] device veth1_vlan left promiscuous mode
[ 75.303867][ T154] device veth0_vlan left promiscuous mode
[ 75.422377][ T154] team0 (unregistering): Port device team_slave_1 removed
[ 75.435160][ T154] team0 (unregistering): Port device team_slave_0 removed
[ 75.449046][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 75.462528][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 75.507935][ T154] bond0 (unregistering): Released all slaves
[ 75.559532][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 75.567578][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 75.576816][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 75.585365][ T4288] bridge0: port 2(bridge_slave_1) entered blocking state
[ 75.592986][ T4288] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 75.601644][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 75.612480][ T3047] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 75.624964][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 75.634094][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 75.644941][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 75.663205][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 75.674703][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 75.683661][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 75.693082][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 75.702164][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 75.711089][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 75.720600][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 75.807747][ T3047] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 75.816108][ T3047] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 75.827618][ T4300] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 75.848566][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 75.857338][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 75.872611][ T4300] device veth0_vlan entered promiscuous mode
[ 75.880917][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 75.889698][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 75.897951][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 75.906121][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 75.917166][ T4300] device veth1_vlan entered promiscuous mode
[ 75.936630][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 75.944960][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 75.955122][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 75.964110][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 75.977275][ T4300] device veth0_macvtap entered promiscuous mode
[ 75.988381][ T4300] device veth1_macvtap entered promiscuous mode
[ 76.006513][ T4300] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 76.017571][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 76.027360][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 76.036803][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 76.045843][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 76.058343][ T4300] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 76.067594][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 76.077739][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 76.090636][ T4300] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.102504][ T4300] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.112771][ T4300] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.123329][ T4300] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.180785][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 76.192596][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 76.211289][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 76.225659][ T3047] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 76.235229][ T3047] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 76.246075][ T4288] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 76.318410][ T146] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:200'
[ 76.328189][ T146] CPU: 1 PID: 146 Comm: kworker/u5:0 Not tainted syzkaller #0
[ 76.335686][ T146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 76.345764][ T146] Workqueue: hci0 hci_rx_work
[ 76.350616][ T146] Call Trace:
[ 76.353918][ T146]
[ 76.356919][ T146] dump_stack_lvl+0x188/0x250
[ 76.361708][ T146] ? show_regs_print_info+0x20/0x20
[ 76.367000][ T146] ? load_image+0x410/0x410
[ 76.371553][ T146] sysfs_create_dir_ns+0x26a/0x290
[ 76.376673][ T146] ? sysfs_warn_dup+0xa0/0xa0
[ 76.381356][ T146] ? ret_from_fork+0x1f/0x30
[ 76.385964][ T146] ? do_raw_spin_unlock+0x11d/0x230
[ 76.391350][ T146] kobject_add_internal+0x5ba/0xcd0
[ 76.396581][ T146] kobject_add+0x160/0x230
[ 76.401012][ T146] ? kobject_init+0x1c0/0x1c0
[ 76.405733][ T146] ? __raw_spin_lock_init+0x41/0x100
[ 76.411064][ T146] ? get_device_parent+0x121/0x3e0
[ 76.416188][ T146] device_add+0x470/0x1050
[ 76.420644][ T146] hci_conn_add_sysfs+0xd1/0x1e0
[ 76.425599][ T146] hci_sync_conn_complete_evt+0x647/0x9d0
[ 76.431331][ T146] ? __rwlock_init+0x140/0x140
[ 76.436250][ T146] hci_event_packet+0x8cf/0x1310
[ 76.441211][ T146] ? _raw_spin_unlock+0x40/0x40
[ 76.446444][ T146] ? rcu_lock_release+0x20/0x20
[ 76.451432][ T146] ? hci_send_to_monitor+0x9c/0x4a0
[ 76.456926][ T146] ? hci_rx_work+0x63e/0xa10
[ 76.461537][ T146] hci_rx_work+0x255/0xa10
[ 76.465980][ T146] process_one_work+0x867/0xff0
[ 76.470884][ T146] ? worker_detach_from_pool+0x240/0x240
[ 76.476716][ T146] ? lockdep_hardirqs_off+0x70/0x100
[ 76.482023][ T146] ? _raw_spin_lock_irq+0xb7/0xf0
[ 76.487068][ T146] ? _raw_spin_lock_irqsave+0x100/0x100
[ 76.493080][ T146] ? wq_worker_running+0x97/0x170
[ 76.498176][ T146] worker_thread+0xad7/0x12a0
[ 76.503017][ T146] kthread+0x42e/0x520
[ 76.507175][ T146] ? rcu_lock_release+0x20/0x20
[ 76.512048][ T146] ? kthread_blkcg+0xd0/0xd0
[ 76.516994][ T146] ret_from_fork+0x1f/0x30
[ 76.521436][ T146]
[ 76.525112][ T146] kobject_add_internal failed for hci0:200 with -EEXIST, don't try to register things with the same name in the same directory.
[ 76.538417][ T146] Bluetooth: hci0: failed to register connection device
[ 76.545891][ T146]
[ 76.548272][ T146] ======================================================
[ 76.555476][ T146] WARNING: possible circular locking dependency detected
[ 76.562679][ T146] syzkaller #0 Not tainted
[ 76.567090][ T146] ------------------------------------------------------
[ 76.574110][ T146] kworker/u5:0/146 is trying to acquire lock:
[ 76.580175][ T146] ffff88807d7e8120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x70a/0xd00
[ 76.590883][ T146]
[ 76.590883][ T146] but task is already holding lock:
[ 76.598418][ T146] ffffffff8d593e48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0x45e/0x9d0
[ 76.608723][ T146]
[ 76.608723][ T146] which lock already depends on the new lock.
[ 76.608723][ T146]
[ 76.619592][ T146]
[ 76.619592][ T146] the existing dependency chain (in reverse order) is:
[ 76.628603][ T146]
[ 76.628603][ T146] -> #2 (hci_cb_list_lock){+.+.}-{3:3}:
[ 76.636336][ T146] __mutex_lock_common+0x1e5/0x2400
[ 76.642048][ T146] mutex_lock_nested+0x17/0x20
[ 76.647457][ T146] hci_remote_features_evt+0x5d9/0xa10
[ 76.653528][ T146] hci_event_packet+0x600/0x1310
[ 76.659255][ T146] hci_rx_work+0x255/0xa10
[ 76.664277][ T146] process_one_work+0x867/0xff0
[ 76.669719][ T146] worker_thread+0xad7/0x12a0
[ 76.674902][ T146] kthread+0x42e/0x520
[ 76.679478][ T146] ret_from_fork+0x1f/0x30
[ 76.684403][ T146]
[ 76.684403][ T146] -> #1 (&hdev->lock){+.+.}-{3:3}:
[ 76.691778][ T146] __mutex_lock_common+0x1e5/0x2400
[ 76.697486][ T146] mutex_lock_nested+0x17/0x20
[ 76.702856][ T146] sco_sock_connect+0x189/0x940
[ 76.708417][ T146] __sys_connect+0x3cb/0x450
[ 76.713781][ T146] __x64_sys_connect+0x76/0x80
[ 76.719096][ T146] do_syscall_64+0x4c/0xa0
[ 76.724176][ T146] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 76.730608][ T146]
[ 76.730608][ T146] -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
[ 76.739904][ T146] __lock_acquire+0x2c66/0x7b50
[ 76.745466][ T146] lock_acquire+0x19e/0x400
[ 76.750486][ T146] lock_sock_nested+0x44/0x100
[ 76.755964][ T146] sco_connect_cfm+0x70a/0xd00
[ 76.761245][ T146] hci_sync_conn_complete_evt+0x4be/0x9d0
[ 76.767472][ T146] hci_event_packet+0x8cf/0x1310
[ 76.772929][ T146] hci_rx_work+0x255/0xa10
[ 76.778022][ T146] process_one_work+0x867/0xff0
[ 76.783396][ T146] worker_thread+0xad7/0x12a0
[ 76.788580][ T146] kthread+0x42e/0x520
[ 76.793180][ T146] ret_from_fork+0x1f/0x30
[ 76.798119][ T146]
[ 76.798119][ T146] other info that might help us debug this:
[ 76.798119][ T146]
[ 76.808343][ T146] Chain exists of:
[ 76.808343][ T146] sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
[ 76.808343][ T146]
[ 76.822589][ T146] Possible unsafe locking scenario:
[ 76.822589][ T146]
[ 76.830034][ T146] CPU0 CPU1
[ 76.835787][ T146] ---- ----
[ 76.841406][ T146] lock(hci_cb_list_lock);
[ 76.846131][ T146] lock(&hdev->lock);
[ 76.852701][ T146] lock(hci_cb_list_lock);
[ 76.859723][ T146] lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
[ 76.869013][ T146]
[ 76.869013][ T146] *** DEADLOCK ***
[ 76.869013][ T146]
[ 76.877324][ T146] 4 locks held by kworker/u5:0/146:
[ 76.882502][ T146] #0: ffff88802af60938 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0
[ 76.892777][ T146] #1: ffffc900016afd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0
[ 76.904153][ T146] #2: ffff8880239a8478 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0xb8/0x9d0
[ 76.914411][ T146] #3: ffffffff8d593e48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0x45e/0x9d0
[ 76.925102][ T146]
[ 76.925102][ T146] stack backtrace:
[ 76.931079][ T146] CPU: 1 PID: 146 Comm: kworker/u5:0 Not tainted syzkaller #0
[ 76.938626][ T146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 76.948944][ T146] Workqueue: hci0 hci_rx_work
[ 76.954147][ T146] Call Trace:
[ 76.957415][ T146]
[ 76.960333][ T146] dump_stack_lvl+0x188/0x250
[ 76.965018][ T146] ? load_image+0x410/0x410
[ 76.969505][ T146] ? show_regs_print_info+0x20/0x20
[ 76.977181][ T146] ? print_circular_bug+0x12b/0x1a0
[ 76.982385][ T146] check_noncircular+0x296/0x330
[ 76.987311][ T146] ? stack_trace_snprint+0xe0/0xe0
[ 76.992501][ T146] ? add_chain_block+0x9b0/0x9b0
[ 76.997430][ T146] ? lockdep_lock+0xf1/0x1f0
[ 77.002102][ T146] ? mark_lock+0x94/0x320
[ 77.006423][ T146] ? _find_first_zero_bit+0xd1/0xf0
[ 77.011950][ T146] __lock_acquire+0x2c66/0x7b50
[ 77.016841][ T146] ? verify_lock_unused+0x140/0x140
[ 77.022056][ T146] ? verify_lock_unused+0x140/0x140
[ 77.027250][ T146] ? hci_rx_work+0x255/0xa10
[ 77.031852][ T146] ? process_one_work+0x867/0xff0
[ 77.036896][ T146] ? worker_thread+0xad7/0x12a0
[ 77.041874][ T146] ? kthread+0x42e/0x520
[ 77.046151][ T146] ? ret_from_fork+0x1f/0x30
[ 77.050758][ T146] lock_acquire+0x19e/0x400
[ 77.055268][ T146] ? sco_connect_cfm+0x70a/0xd00
[ 77.060196][ T146] ? sco_connect_cfm+0x6fa/0xd00
[ 77.065224][ T146] ? read_lock_is_recursive+0x10/0x10
[ 77.070603][ T146] ? __lock_acquire+0x7b50/0x7b50
[ 77.075618][ T146] ? do_raw_spin_lock+0x128/0x2f0
[ 77.080635][ T146] ? __rwlock_init+0x140/0x140
[ 77.085394][ T146] lock_sock_nested+0x44/0x100
[ 77.090162][ T146] ? sco_connect_cfm+0x70a/0xd00
[ 77.095249][ T146] sco_connect_cfm+0x70a/0xd00
[ 77.100036][ T146] ? sco_skb_put_cmsg+0xa0/0xa0
[ 77.104898][ T146] ? sco_skb_put_cmsg+0xa0/0xa0
[ 77.109852][ T146] hci_sync_conn_complete_evt+0x4be/0x9d0
[ 77.115699][ T146] ? __rwlock_init+0x140/0x140
[ 77.120501][ T146] hci_event_packet+0x8cf/0x1310
[ 77.125446][ T146] ? _raw_spin_unlock+0x40/0x40
[ 77.130298][ T146] ? rcu_lock_release+0x20/0x20
[ 77.135140][ T146] ? hci_send_to_monitor+0x9c/0x4a0
[ 77.140327][ T146] ? hci_rx_work+0x63e/0xa10
[ 77.144911][ T146] hci_rx_work+0x255/0xa10
[ 77.149404][ T146] process_one_work+0x867/0xff0
[ 77.154248][ T146] ? worker_detach_from_pool+0x240/0x240
[ 77.159873][ T146] ? lockdep_hardirqs_off+0x70/0x100
[ 77.165260][ T146] ? _raw_spin_lock_irq+0xb7/0xf0
[ 77.170584][ T146] ? _raw_spin_lock_irqsave+0x100/0x100
[ 77.176131][ T146] ? wq_worker_running+0x97/0x170
[ 77.181148][ T146] worker_thread+0xad7/0x12a0
[ 77.185836][ T146] kthread+0x42e/0x520
[ 77.189888][ T146] ? rcu_lock_release+0x20/0x20
[ 77.194746][ T146] ? kthread_blkcg+0xd0/0xd0
[ 77.199321][ T146] ret_from_fork+0x1f/0x30
[ 77.203733][ T146]
[ 77.207565][ T4263] Bluetooth: hci0: command 0x040f tx timeout
[ 79.288804][ T1108] Bluetooth: hci0: command 0x0419 tx timeout