Warning: Permanently added '10.128.1.35' (ED25519) to the list of known hosts. 2026/07/23 23:30:06 parsed 1 programs 2026/07/23 23:30:06 serving rpc on tcp://35673 [ 66.368358][ T4198] cgroup: Unknown subsys name 'net' [ 66.506468][ T4198] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.046121][ T4198] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 70.260762][ T4224] chnl_net:caif_netlink_parms(): no params data found [ 70.308212][ T4224] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.316283][ T4224] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.324331][ T4224] device bridge_slave_0 entered promiscuous mode [ 70.335128][ T4224] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.342551][ T4224] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.351635][ T4224] device bridge_slave_1 entered promiscuous mode [ 70.380031][ T4224] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.393005][ T4224] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.423692][ T4224] team0: Port device team_slave_0 added [ 70.432013][ T4224] team0: Port device team_slave_1 added [ 70.455714][ T4224] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.462754][ T4224] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.491179][ T4224] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.504960][ T4224] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.513860][ T4224] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.541695][ T4224] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.584665][ T4224] device hsr_slave_0 entered promiscuous mode [ 70.593635][ T4224] device hsr_slave_1 entered promiscuous mode [ 70.735763][ T4224] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.748391][ T4224] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.759054][ T4224] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.769652][ T4224] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.804881][ T4224] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.812290][ T4224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.820336][ T4224] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.827596][ T4224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.893979][ T4224] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.908857][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.923181][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.933676][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.942415][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 70.959749][ T4224] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.973047][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.982375][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.989547][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.011960][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.022159][ T1217] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.029424][ T1217] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.043241][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.058033][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.071552][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.089805][ T4224] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.102089][ T4224] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.115975][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.126889][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.136402][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.286186][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.294490][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.310297][ T4224] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.334637][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.346313][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.382885][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.393216][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.403610][ T4224] device veth0_vlan entered promiscuous mode [ 71.413079][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.421942][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.438826][ T4224] device veth1_vlan entered promiscuous mode [ 71.464380][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.475676][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.484923][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 71.495202][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.506704][ T4224] device veth0_macvtap entered promiscuous mode [ 71.519787][ T4224] device veth1_macvtap entered promiscuous mode [ 71.530438][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.537157][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.540939][ T4224] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.554461][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 71.563830][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 71.573952][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.582718][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.594984][ T4224] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.605169][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.614573][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.632933][ T4224] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.642301][ T4224] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.651555][ T4224] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.660417][ T4224] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.789253][ T4224] syz-executor (4224) used greatest stack depth: 21136 bytes left [ 71.875115][ T154] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.765586][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.777508][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.788634][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.808525][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.817319][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.825778][ T1217] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2026/07/23 23:30:15 executed programs: 0 [ 73.206191][ T4286] chnl_net:caif_netlink_parms(): no params data found [ 73.244729][ T4286] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.252271][ T4286] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.259988][ T4286] device bridge_slave_0 entered promiscuous mode [ 73.269514][ T4286] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.276849][ T4286] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.284959][ T4286] device bridge_slave_1 entered promiscuous mode [ 73.304590][ T4286] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.315617][ T4286] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.335699][ T4286] team0: Port device team_slave_0 added [ 73.344143][ T4286] team0: Port device team_slave_1 added [ 73.359863][ T4286] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.367464][ T4286] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.393709][ T4286] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.405812][ T4286] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.413058][ T4286] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.439845][ T4286] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.473736][ T4286] device hsr_slave_0 entered promiscuous mode [ 73.481306][ T4286] device hsr_slave_1 entered promiscuous mode [ 73.488058][ T4286] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.496015][ T4286] Cannot create hsr debugfs directory [ 74.697547][ T154] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.201415][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 77.236073][ T154] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.291504][ T13] Bluetooth: hci0: command 0x041b tx timeout [ 77.306610][ T154] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.130825][ T4286] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.144878][ T4286] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.155139][ T4286] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.166615][ T4286] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.298696][ T4286] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.314034][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 78.325957][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 78.339635][ T4286] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.359067][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.367703][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.376578][ T3066] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.383737][ T3066] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.394671][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 78.403283][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.412132][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.420951][ T3066] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.428109][ T3066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.448904][ T154] device hsr_slave_0 left promiscuous mode [ 78.455846][ T154] device hsr_slave_1 left promiscuous mode [ 78.464270][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 78.472602][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 78.482247][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 78.489846][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 78.498500][ T154] device bridge_slave_1 left promiscuous mode [ 78.505027][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.518202][ T154] device bridge_slave_0 left promiscuous mode [ 78.525027][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.542187][ T154] device veth1_macvtap left promiscuous mode [ 78.548742][ T154] device veth0_macvtap left promiscuous mode [ 78.554974][ T154] device veth1_vlan left promiscuous mode [ 78.561963][ T154] device veth0_vlan left promiscuous mode [ 78.709092][ T154] team0 (unregistering): Port device team_slave_1 removed [ 78.728898][ T154] team0 (unregistering): Port device team_slave_0 removed [ 78.743723][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 78.759073][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 78.815728][ T154] bond0 (unregistering): Released all slaves [ 78.860926][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 78.869889][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.881911][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 78.892645][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 78.903554][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 78.918089][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 78.927768][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.940141][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 78.956960][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 78.969122][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 78.978134][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 78.989501][ T4286] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 79.093661][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 79.101889][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 79.111565][ T4286] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.127632][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 79.137231][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 79.158057][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 79.166594][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 79.175725][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 79.183801][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 79.193834][ T4286] device veth0_vlan entered promiscuous mode [ 79.214027][ T4286] device veth1_vlan entered promiscuous mode [ 79.237071][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 79.251524][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 79.259734][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 79.270218][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 79.283302][ T4286] device veth0_macvtap entered promiscuous mode [ 79.295741][ T4286] device veth1_macvtap entered promiscuous mode [ 79.313522][ T4286] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.322456][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 79.332319][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 79.342080][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 79.353130][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 79.365540][ T4286] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.373263][ T4308] Bluetooth: hci0: command 0x040f tx timeout [ 79.379784][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 79.390066][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 79.404069][ T4286] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.413969][ T4286] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.423586][ T4286] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.434684][ T4286] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.503204][ T3066] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.514861][ T3066] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.535775][ T4346] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 79.551934][ T4346] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.559997][ T4346] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.569735][ T3066] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 79.765211][ T4351] [ 79.767593][ T4351] ====================================================== [ 79.774801][ T4351] WARNING: possible circular locking dependency detected [ 79.781919][ T4351] syzkaller #0 Not tainted [ 79.786455][ T4351] ------------------------------------------------------ [ 79.793677][ T4351] syz.0.17/4351 is trying to acquire lock: [ 79.799502][ T4351] ffff88805b3ad028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 [ 79.810584][ T4351] [ 79.810584][ T4351] but task is already holding lock: [ 79.818057][ T4351] ffffffff8d6d3c28 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 79.827751][ T4351] [ 79.827751][ T4351] which lock already depends on the new lock. [ 79.827751][ T4351] [ 79.838174][ T4351] [ 79.838174][ T4351] the existing dependency chain (in reverse order) is: [ 79.847212][ T4351] [ 79.847212][ T4351] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 79.855325][ T4351] __mutex_lock_common+0x1e5/0x2400 [ 79.861197][ T4351] mutex_lock_nested+0x17/0x20 [ 79.866517][ T4351] rfkill_register+0x2f/0x970 [ 79.871744][ T4351] hci_register_dev+0x459/0x980 [ 79.877135][ T4351] vhci_create_device+0x32e/0x5c0 [ 79.882713][ T4351] vhci_write+0x389/0x440 [ 79.887679][ T4351] vfs_write+0x748/0xd70 [ 79.892597][ T4351] ksys_write+0x153/0x260 [ 79.897481][ T4351] do_syscall_64+0x4c/0xa0 [ 79.902449][ T4351] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.909001][ T4351] [ 79.909001][ T4351] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 79.916852][ T4351] __mutex_lock_common+0x1e5/0x2400 [ 79.922699][ T4351] mutex_lock_nested+0x17/0x20 [ 79.928016][ T4351] vhci_send_frame+0x88/0x100 [ 79.933253][ T4351] hci_send_frame+0x1a9/0x2e0 [ 79.938489][ T4351] hci_tx_work+0x9b5/0x16d0 [ 79.943638][ T4351] process_one_work+0x867/0xff0 [ 79.949040][ T4351] worker_thread+0xad7/0x12a0 [ 79.954279][ T4351] kthread+0x42e/0x520 [ 79.958901][ T4351] ret_from_fork+0x1f/0x30 [ 79.963875][ T4351] [ 79.963875][ T4351] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 79.973114][ T4351] __flush_work+0x116/0x210 [ 79.978169][ T4351] hci_dev_do_close+0x201/0x1020 [ 79.983751][ T4351] hci_unregister_dev+0x2eb/0x590 [ 79.989321][ T4351] vhci_release+0x73/0xc0 [ 79.994203][ T4351] __fput+0x212/0x8c0 [ 79.998733][ T4351] task_work_run+0x125/0x1a0 [ 80.003876][ T4351] do_exit+0x635/0x2110 [ 80.008573][ T4351] do_group_exit+0x12c/0x2f0 [ 80.013706][ T4351] get_signal+0x7eb/0x12e0 [ 80.018665][ T4351] arch_do_signal_or_restart+0xe6/0x12a0 [ 80.024962][ T4351] exit_to_user_mode_loop+0x9e/0x130 [ 80.030795][ T4351] exit_to_user_mode_prepare+0xee/0x180 [ 80.036895][ T4351] syscall_exit_to_user_mode+0x16/0x40 [ 80.042996][ T4351] do_syscall_64+0x58/0xa0 [ 80.047970][ T4351] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.054460][ T4351] [ 80.054460][ T4351] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 80.062220][ T4351] __mutex_lock_common+0x1e5/0x2400 [ 80.067966][ T4351] mutex_lock_nested+0x17/0x20 [ 80.073375][ T4351] bg_scan_update+0x44/0x3b0 [ 80.078509][ T4351] process_one_work+0x867/0xff0 [ 80.084252][ T4351] worker_thread+0xad7/0x12a0 [ 80.089481][ T4351] kthread+0x42e/0x520 [ 80.094290][ T4351] ret_from_fork+0x1f/0x30 [ 80.099261][ T4351] [ 80.099261][ T4351] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 80.109338][ T4351] __lock_acquire+0x2c66/0x7b50 [ 80.114744][ T4351] lock_acquire+0x19e/0x400 [ 80.119801][ T4351] __flush_work+0x116/0x210 [ 80.124859][ T4351] __cancel_work_timer+0x3f4/0x560 [ 80.130525][ T4351] hci_request_cancel_all+0xcc/0x300 [ 80.136361][ T4351] hci_dev_do_close+0x4e/0x1020 [ 80.142037][ T4351] hci_rfkill_set_block+0x101/0x180 [ 80.147789][ T4351] rfkill_set_block+0x1c1/0x3c0 [ 80.153201][ T4351] rfkill_fop_write+0x453/0x560 [ 80.158599][ T4351] vfs_write+0x304/0xd70 [ 80.163387][ T4351] ksys_write+0x153/0x260 [ 80.168265][ T4351] do_syscall_64+0x4c/0xa0 [ 80.173314][ T4351] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.179755][ T4351] [ 80.179755][ T4351] other info that might help us debug this: [ 80.179755][ T4351] [ 80.190004][ T4351] Chain exists of: [ 80.190004][ T4351] (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex [ 80.190004][ T4351] [ 80.205809][ T4351] Possible unsafe locking scenario: [ 80.205809][ T4351] [ 80.213283][ T4351] CPU0 CPU1 [ 80.218833][ T4351] ---- ---- [ 80.224235][ T4351] lock(rfkill_global_mutex); [ 80.229036][ T4351] lock(&data->open_mutex); [ 80.236436][ T4351] lock(rfkill_global_mutex); [ 80.243748][ T4351] lock((work_completion)(&hdev->bg_scan_update)); [ 80.250477][ T4351] [ 80.250477][ T4351] *** DEADLOCK *** [ 80.250477][ T4351] [ 80.258728][ T4351] 1 lock held by syz.0.17/4351: [ 80.263608][ T4351] #0: ffffffff8d6d3c28 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 80.273825][ T4351] [ 80.273825][ T4351] stack backtrace: [ 80.280007][ T4351] CPU: 0 PID: 4351 Comm: syz.0.17 Not tainted syzkaller #0 [ 80.287323][ T4351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 80.297613][ T4351] Call Trace: [ 80.301049][ T4351] [ 80.303999][ T4351] dump_stack_lvl+0x188/0x250 [ 80.308708][ T4351] ? load_image+0x410/0x410 [ 80.313244][ T4351] ? show_regs_print_info+0x20/0x20 [ 80.318474][ T4351] ? print_circular_bug+0x12b/0x1a0 [ 80.323745][ T4351] check_noncircular+0x296/0x330 [ 80.328918][ T4351] ? look_up_lock_class+0x71/0x110 [ 80.334171][ T4351] ? add_chain_block+0x9b0/0x9b0 [ 80.339220][ T4351] ? lockdep_lock+0xf1/0x1f0 [ 80.343953][ T4351] ? __lock_acquire+0x1305/0x7b50 [ 80.349016][ T4351] ? mark_lock+0x94/0x320 [ 80.353394][ T4351] ? _find_first_zero_bit+0xd1/0xf0 [ 80.358626][ T4351] __lock_acquire+0x2c66/0x7b50 [ 80.363603][ T4351] ? verify_lock_unused+0x140/0x140 [ 80.368906][ T4351] ? verify_lock_unused+0x140/0x140 [ 80.374142][ T4351] lock_acquire+0x19e/0x400 [ 80.378674][ T4351] ? __flush_work+0xfa/0x210 [ 80.383291][ T4351] ? __lock_acquire+0x7b50/0x7b50 [ 80.388363][ T4351] ? read_lock_is_recursive+0x10/0x10 [ 80.393852][ T4351] ? start_flush_work+0x784/0x830 [ 80.398904][ T4351] __flush_work+0x116/0x210 [ 80.403436][ T4351] ? __flush_work+0xfa/0x210 [ 80.408060][ T4351] ? flush_work+0x20/0x20 [ 80.412430][ T4351] ? try_to_grab_pending+0xfb/0x820 [ 80.417659][ T4351] ? mark_lock+0x94/0x320 [ 80.422015][ T4351] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 80.428021][ T4351] ? lock_chain_count+0x20/0x20 [ 80.432901][ T4351] ? mark_lock+0x94/0x320 [ 80.437254][ T4351] ? __cancel_work_timer+0x36a/0x560 [ 80.442570][ T4351] __cancel_work_timer+0x3f4/0x560 [ 80.447720][ T4351] ? cancel_work_sync+0x20/0x20 [ 80.452600][ T4351] ? __cancel_work+0x1f9/0x2e0 [ 80.457472][ T4351] ? lockdep_hardirqs_on+0x94/0x140 [ 80.462702][ T4351] ? __cancel_work+0x27b/0x2e0 [ 80.467492][ T4351] ? cancel_work+0x20/0x20 [ 80.472029][ T4351] hci_request_cancel_all+0xcc/0x300 [ 80.477420][ T4351] hci_dev_do_close+0x4e/0x1020 [ 80.482295][ T4351] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 80.488322][ T4351] ? _raw_spin_unlock+0x40/0x40 [ 80.493213][ T4351] hci_rfkill_set_block+0x101/0x180 [ 80.498540][ T4351] ? rcu_lock_release+0x20/0x20 [ 80.503418][ T4351] rfkill_set_block+0x1c1/0x3c0 [ 80.508304][ T4351] rfkill_fop_write+0x453/0x560 [ 80.513188][ T4351] ? rfkill_fop_read+0x560/0x560 [ 80.518237][ T4351] ? common_file_perm+0xf0/0x1c0 [ 80.523202][ T4351] ? fsnotify_perm+0x5d/0x560 [ 80.527954][ T4351] ? security_file_permission+0x75/0xa0 [ 80.533626][ T4351] ? rfkill_fop_read+0x560/0x560 [ 80.538601][ T4351] vfs_write+0x304/0xd70 [ 80.542870][ T4351] ? file_end_write+0x250/0x250 [ 80.547761][ T4351] ? __context_tracking_exit+0x4c/0x80 [ 80.553257][ T4351] ? __fdget_pos+0x1e2/0x370 [ 80.557871][ T4351] ksys_write+0x153/0x260 [ 80.562238][ T4351] ? __ia32_sys_read+0x80/0x80 [ 80.567127][ T4351] ? lockdep_hardirqs_on+0x94/0x140 [ 80.572375][ T4351] do_syscall_64+0x4c/0xa0 [ 80.576814][ T4351] ? clear_bhb_loop+0x30/0x80 [ 80.581515][ T4351] ? clear_bhb_loop+0x30/0x80 [ 80.586328][ T4351] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.592260][ T4351] RIP: 0033:0x7f09c599de99 [ 80.596699][ T4351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.616502][ T4351] RSP: 002b:00007ffc828cb4d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 80.625031][ T4351] RAX: ffffffffffffffda RBX: 00007f09c5c25fa0 RCX: 00007f09c599de99 [ 80.633036][ T4351] RDX: 0000000000000008 RSI: 0000200000000040 RDI: 0000000000000003 [ 80.641046][ T4351] RBP: 00007f09c5a33eaf R08: 0000000000000000 R09: 0000000000000000 [ 80.649044][ T4351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.657155][ T4351] R13: 00007f09c5c25fac R14: 00007f09c5c25fa0 R15: 00007f09c5c25fa0 [ 80.665163][ T4351]