Warning: Permanently added '10.128.1.134' (ED25519) to the list of known hosts. 2026/06/22 06:58:56 parsed 1 programs 2026/06/22 06:58:56 serving rpc on tcp://35245 [ 68.406885][ T4199] cgroup: Unknown subsys name 'net' [ 68.559849][ T4199] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 70.061452][ T4199] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 71.299837][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.306429][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.707609][ T1227] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.719569][ T1227] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.731632][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.751125][ T660] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.759398][ T660] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.770302][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.307400][ T4247] chnl_net:caif_netlink_parms(): no params data found [ 73.370047][ T4247] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.377998][ T4247] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.386387][ T4247] device bridge_slave_0 entered promiscuous mode [ 73.396555][ T4247] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.403770][ T4247] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.411611][ T4247] device bridge_slave_1 entered promiscuous mode [ 73.435978][ T4247] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.447822][ T4247] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.473783][ T4247] team0: Port device team_slave_0 added [ 73.482242][ T4247] team0: Port device team_slave_1 added [ 73.503518][ T4247] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.510512][ T4247] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.536606][ T4247] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.549790][ T4247] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.556828][ T4247] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.583149][ T4247] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.621805][ T4247] device hsr_slave_0 entered promiscuous mode [ 73.628850][ T4247] device hsr_slave_1 entered promiscuous mode [ 73.797859][ T4247] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.838030][ T4247] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.855751][ T4247] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.895660][ T4247] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 73.917423][ T4247] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.924686][ T4247] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.932575][ T4247] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.939733][ T4247] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.986529][ T4247] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.999104][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 74.009559][ T660] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.018381][ T660] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.027198][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 74.041847][ T4247] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.053016][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 74.061623][ T660] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.068762][ T660] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.087073][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 74.095819][ T660] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.102965][ T660] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.116543][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 74.125677][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 74.139409][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 74.151807][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.164332][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 74.176733][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 74.294867][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 74.302428][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 74.319644][ T4247] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.360502][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 74.369580][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 74.406808][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 74.421383][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 74.430399][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 74.439513][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 74.451104][ T4247] device veth0_vlan entered promiscuous mode [ 74.477446][ T4247] device veth1_vlan entered promiscuous mode [ 74.497608][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 74.506584][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 74.515262][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 74.524269][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 74.535910][ T4247] device veth0_macvtap entered promiscuous mode [ 74.546146][ T4247] device veth1_macvtap entered promiscuous mode [ 74.579901][ T4247] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.588867][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 74.598826][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 74.607538][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 74.616591][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 74.629592][ T4247] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.637337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.646373][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.675052][ T4247] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.684545][ T4247] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.694761][ T4247] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.703676][ T4247] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/06/22 06:59:06 executed programs: 0 [ 76.456059][ T4303] chnl_net:caif_netlink_parms(): no params data found [ 76.510051][ T4303] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.519086][ T4303] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.527704][ T4303] device bridge_slave_0 entered promiscuous mode [ 76.537246][ T4303] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.544684][ T4303] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.552914][ T4303] device bridge_slave_1 entered promiscuous mode [ 76.583935][ T4303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.599054][ T4303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.629854][ T4303] team0: Port device team_slave_0 added [ 76.638272][ T4303] team0: Port device team_slave_1 added [ 76.664055][ T4303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.671070][ T4303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 76.697912][ T4303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.710870][ T4303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.718018][ T4303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 76.744302][ T4303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.779728][ T4303] device hsr_slave_0 entered promiscuous mode [ 76.789915][ T4303] device hsr_slave_1 entered promiscuous mode [ 76.796760][ T4303] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 76.805325][ T4303] Cannot create hsr debugfs directory [ 76.905143][ T4303] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.334010][ T4265] Bluetooth: hci0: command 0x0409 tx timeout [ 79.700508][ T4303] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.809167][ T4303] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.881701][ T4303] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.074278][ T4303] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.086545][ T4303] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.096284][ T4303] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.107042][ T4303] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.174474][ T144] device hsr_slave_0 left promiscuous mode [ 80.181441][ T144] device hsr_slave_1 left promiscuous mode [ 80.189501][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 80.197345][ T144] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 80.207273][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 80.215427][ T144] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 80.223253][ T144] device bridge_slave_1 left promiscuous mode [ 80.230328][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.244187][ T144] device bridge_slave_0 left promiscuous mode [ 80.250458][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.272087][ T144] device veth1_macvtap left promiscuous mode [ 80.278725][ T144] device veth0_macvtap left promiscuous mode [ 80.285402][ T144] device veth1_vlan left promiscuous mode [ 80.291360][ T144] device veth0_vlan left promiscuous mode [ 80.413161][ T4264] Bluetooth: hci0: command 0x041b tx timeout [ 80.472911][ T144] team0 (unregistering): Port device team_slave_1 removed [ 80.487760][ T144] team0 (unregistering): Port device team_slave_0 removed [ 80.501030][ T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 80.519254][ T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 80.579024][ T144] bond0 (unregistering): Released all slaves [ 80.634792][ T4303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.647786][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 80.655672][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 80.673253][ T4303] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.683475][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 80.692317][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 80.701110][ T1227] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.708243][ T1227] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.717998][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 80.728648][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 80.738422][ T1227] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.747204][ T1227] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.754322][ T1227] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.774849][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 80.785220][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 80.795522][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 80.810959][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 80.820565][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 80.831149][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 80.840227][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 80.851947][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 80.861816][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 80.875480][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 80.885393][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 80.905271][ T4303] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 81.008185][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 81.016217][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 81.029809][ T4303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.048821][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 81.057651][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 81.076865][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 81.086153][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 81.094748][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 81.102523][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 81.114015][ T4303] device veth0_vlan entered promiscuous mode [ 81.131319][ T4303] device veth1_vlan entered promiscuous mode [ 81.155747][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 81.164970][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 81.175345][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 81.184139][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 81.194859][ T4303] device veth0_macvtap entered promiscuous mode [ 81.215371][ T4303] device veth1_macvtap entered promiscuous mode [ 81.234459][ T4303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.241882][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 81.250424][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 81.260039][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 81.269223][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 81.282695][ T4303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.291162][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 81.301653][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 81.314274][ T4303] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.323018][ T4303] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.332668][ T4303] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.341689][ T4303] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.414338][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.422218][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.442716][ T660] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 81.468991][ T660] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.476970][ T660] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.486131][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 81.633512][ T4324] [ 81.635909][ T4324] ====================================================== [ 81.642950][ T4324] WARNING: possible circular locking dependency detected [ 81.650004][ T4324] syzkaller #0 Not tainted [ 81.654435][ T4324] ------------------------------------------------------ [ 81.661465][ T4324] syz.0.17/4324 is trying to acquire lock: [ 81.667290][ T4324] ffff88801f679028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 [ 81.678392][ T4324] [ 81.678392][ T4324] but task is already holding lock: [ 81.685768][ T4324] ffffffff8d6c48a8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 81.695455][ T4324] [ 81.695455][ T4324] which lock already depends on the new lock. [ 81.695455][ T4324] [ 81.705882][ T4324] [ 81.705882][ T4324] the existing dependency chain (in reverse order) is: [ 81.714924][ T4324] [ 81.714924][ T4324] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 81.722979][ T4324] __mutex_lock_common+0x1e5/0x2400 [ 81.728742][ T4324] mutex_lock_nested+0x17/0x20 [ 81.734052][ T4324] rfkill_register+0x2f/0x970 [ 81.739280][ T4324] hci_register_dev+0x459/0x980 [ 81.744688][ T4324] vhci_create_device+0x32e/0x5c0 [ 81.750270][ T4324] vhci_write+0x389/0x440 [ 81.755148][ T4324] vfs_write+0x748/0xd70 [ 81.759941][ T4324] ksys_write+0x153/0x260 [ 81.764818][ T4324] do_syscall_64+0x4c/0xa0 [ 81.769779][ T4324] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.776221][ T4324] [ 81.776221][ T4324] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 81.784099][ T4324] __mutex_lock_common+0x1e5/0x2400 [ 81.789840][ T4324] mutex_lock_nested+0x17/0x20 [ 81.795186][ T4324] vhci_send_frame+0x88/0x100 [ 81.800422][ T4324] hci_send_frame+0x1a9/0x2e0 [ 81.805645][ T4324] hci_tx_work+0x9b5/0x16d0 [ 81.810705][ T4324] process_one_work+0x867/0xff0 [ 81.816099][ T4324] worker_thread+0xad7/0x12a0 [ 81.821317][ T4324] kthread+0x42e/0x520 [ 81.825925][ T4324] ret_from_fork+0x1f/0x30 [ 81.830879][ T4324] [ 81.830879][ T4324] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 81.840115][ T4324] __flush_work+0x116/0x210 [ 81.845191][ T4324] hci_dev_do_close+0x201/0x1020 [ 81.850686][ T4324] hci_unregister_dev+0x2eb/0x590 [ 81.856252][ T4324] vhci_release+0x73/0xc0 [ 81.861123][ T4324] __fput+0x212/0x8c0 [ 81.865645][ T4324] task_work_run+0x125/0x1a0 [ 81.870782][ T4324] do_exit+0x635/0x2110 [ 81.875477][ T4324] do_group_exit+0x12c/0x2f0 [ 81.880603][ T4324] get_signal+0x7eb/0x12e0 [ 81.885557][ T4324] arch_do_signal_or_restart+0xe6/0x12a0 [ 81.891738][ T4324] exit_to_user_mode_loop+0x9e/0x130 [ 81.897567][ T4324] exit_to_user_mode_prepare+0xee/0x180 [ 81.903662][ T4324] syscall_exit_to_user_mode+0x16/0x40 [ 81.909666][ T4324] do_syscall_64+0x58/0xa0 [ 81.914627][ T4324] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.921077][ T4324] [ 81.921077][ T4324] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 81.928752][ T4324] __mutex_lock_common+0x1e5/0x2400 [ 81.934500][ T4324] mutex_lock_nested+0x17/0x20 [ 81.939817][ T4324] bg_scan_update+0x44/0x3b0 [ 81.944960][ T4324] process_one_work+0x867/0xff0 [ 81.950362][ T4324] worker_thread+0xad7/0x12a0 [ 81.955604][ T4324] kthread+0x42e/0x520 [ 81.960226][ T4324] ret_from_fork+0x1f/0x30 [ 81.965196][ T4324] [ 81.965196][ T4324] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 81.975051][ T4324] __lock_acquire+0x2c66/0x7b50 [ 81.980459][ T4324] lock_acquire+0x19e/0x400 [ 81.985506][ T4324] __flush_work+0x116/0x210 [ 81.990555][ T4324] __cancel_work_timer+0x3f4/0x560 [ 81.996212][ T4324] hci_request_cancel_all+0xcc/0x300 [ 82.002051][ T4324] hci_dev_do_close+0x4e/0x1020 [ 82.007536][ T4324] hci_rfkill_set_block+0x101/0x180 [ 82.013278][ T4324] rfkill_set_block+0x1c1/0x3c0 [ 82.018701][ T4324] rfkill_fop_write+0x453/0x560 [ 82.024089][ T4324] vfs_write+0x304/0xd70 [ 82.028878][ T4324] ksys_write+0x153/0x260 [ 82.033747][ T4324] do_syscall_64+0x4c/0xa0 [ 82.038709][ T4324] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.045151][ T4324] [ 82.045151][ T4324] other info that might help us debug this: [ 82.045151][ T4324] [ 82.055449][ T4324] Chain exists of: [ 82.055449][ T4324] (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex [ 82.055449][ T4324] [ 82.071220][ T4324] Possible unsafe locking scenario: [ 82.071220][ T4324] [ 82.078692][ T4324] CPU0 CPU1 [ 82.084079][ T4324] ---- ---- [ 82.089459][ T4324] lock(rfkill_global_mutex); [ 82.094246][ T4324] lock(&data->open_mutex); [ 82.101381][ T4324] lock(rfkill_global_mutex); [ 82.108691][ T4324] lock((work_completion)(&hdev->bg_scan_update)); [ 82.115309][ T4324] [ 82.115309][ T4324] *** DEADLOCK *** [ 82.115309][ T4324] [ 82.123471][ T4324] 1 lock held by syz.0.17/4324: [ 82.128340][ T4324] #0: ffffffff8d6c48a8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 82.138467][ T4324] [ 82.138467][ T4324] stack backtrace: [ 82.144383][ T4324] CPU: 1 PID: 4324 Comm: syz.0.17 Not tainted syzkaller #0 [ 82.151603][ T4324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 82.161698][ T4324] Call Trace: [ 82.165002][ T4324] [ 82.167949][ T4324] dump_stack_lvl+0x188/0x250 [ 82.172656][ T4324] ? load_image+0x410/0x410 [ 82.177181][ T4324] ? show_regs_print_info+0x20/0x20 [ 82.182409][ T4324] ? print_circular_bug+0x12b/0x1a0 [ 82.187633][ T4324] check_noncircular+0x296/0x330 [ 82.192611][ T4324] ? look_up_lock_class+0x71/0x110 [ 82.197757][ T4324] ? add_chain_block+0x9b0/0x9b0 [ 82.202724][ T4324] ? lockdep_lock+0xf1/0x1f0 [ 82.207346][ T4324] ? __lock_acquire+0x1305/0x7b50 [ 82.212753][ T4324] ? mark_lock+0x94/0x320 [ 82.217109][ T4324] ? _find_first_zero_bit+0xd1/0xf0 [ 82.222347][ T4324] __lock_acquire+0x2c66/0x7b50 [ 82.227229][ T4324] ? verify_lock_unused+0x140/0x140 [ 82.232463][ T4324] ? verify_lock_unused+0x140/0x140 [ 82.237711][ T4324] lock_acquire+0x19e/0x400 [ 82.242248][ T4324] ? __flush_work+0xfa/0x210 [ 82.246862][ T4324] ? __lock_acquire+0x7b50/0x7b50 [ 82.251929][ T4324] ? read_lock_is_recursive+0x10/0x10 [ 82.257337][ T4324] ? start_flush_work+0x784/0x830 [ 82.262392][ T4324] __flush_work+0x116/0x210 [ 82.266920][ T4324] ? __flush_work+0xfa/0x210 [ 82.271539][ T4324] ? flush_work+0x20/0x20 [ 82.275921][ T4324] ? try_to_grab_pending+0xfb/0x820 [ 82.281146][ T4324] ? mark_lock+0x94/0x320 [ 82.285516][ T4324] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 82.291532][ T4324] ? lock_chain_count+0x20/0x20 [ 82.296419][ T4324] ? mark_lock+0x94/0x320 [ 82.300775][ T4324] ? __cancel_work_timer+0x36a/0x560 [ 82.306091][ T4324] __cancel_work_timer+0x3f4/0x560 [ 82.311239][ T4324] ? cancel_work_sync+0x20/0x20 [ 82.316211][ T4324] ? __cancel_work+0x1f9/0x2e0 [ 82.321002][ T4324] ? lockdep_hardirqs_on+0x94/0x140 [ 82.326267][ T4324] ? __cancel_work+0x27b/0x2e0 [ 82.331063][ T4324] ? cancel_work+0x20/0x20 [ 82.335512][ T4324] hci_request_cancel_all+0xcc/0x300 [ 82.340834][ T4324] hci_dev_do_close+0x4e/0x1020 [ 82.345728][ T4324] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 82.351656][ T4324] ? _raw_spin_unlock+0x40/0x40 [ 82.356540][ T4324] hci_rfkill_set_block+0x101/0x180 [ 82.361766][ T4324] ? rcu_lock_release+0x20/0x20 [ 82.366641][ T4324] rfkill_set_block+0x1c1/0x3c0 [ 82.371530][ T4324] rfkill_fop_write+0x453/0x560 [ 82.376417][ T4324] ? rfkill_fop_read+0x560/0x560 [ 82.381390][ T4324] ? common_file_perm+0x120/0x1c0 [ 82.386439][ T4324] ? fsnotify_perm+0x5d/0x560 [ 82.391142][ T4324] ? security_file_permission+0x75/0xa0 [ 82.396710][ T4324] ? rfkill_fop_read+0x560/0x560 [ 82.401658][ T4324] vfs_write+0x304/0xd70 [ 82.405918][ T4324] ? file_end_write+0x250/0x250 [ 82.410779][ T4324] ? __context_tracking_exit+0x4c/0x80 [ 82.416253][ T4324] ? __fdget_pos+0x1e2/0x370 [ 82.420855][ T4324] ksys_write+0x153/0x260 [ 82.425198][ T4324] ? __ia32_sys_read+0x80/0x80 [ 82.429979][ T4324] ? lockdep_hardirqs_on+0x94/0x140 [ 82.435193][ T4324] do_syscall_64+0x4c/0xa0 [ 82.439625][ T4324] ? clear_bhb_loop+0x30/0x80 [ 82.444313][ T4324] ? clear_bhb_loop+0x30/0x80 [ 82.449025][ T4324] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.455036][ T4324] RIP: 0033:0x7fb59de2be59 [ 82.459819][ T4324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.479436][ T4324] RSP: 002b:00007fff3862eb18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 82.487906][ T4324] RAX: ffffffffffffffda RBX: 00007fb59e0a4fa0 RCX: 00007fb59de2be59 [ 82.495895][ T4324] RDX: 0000000000000008 RSI: 0000200000000040 RDI: 0000000000000003 [ 82.503888][ T4324] RBP: 00007fb59dec1e6f R08: 0000000000000000 R09: 0000000000000000 [ 82.511874][ T4324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.519856][ T4324] R13: 00007fb59e0a4fac R14: 00007fb59e0a4fa0 R15: 00007fb59e0a4fa0 [ 82.528377][ T4324] [ 82.545258][ T4265] Bluetooth: hci0: command 0x040f tx timeout