Warning: Permanently added '10.128.0.240' (ED25519) to the list of known hosts. 2026/07/25 01:58:41 parsed 1 programs 2026/07/25 01:58:41 serving rpc on tcp://42385 [ 83.223212][ T5608] cgroup: Unknown subsys name 'net' [ 83.462253][ T5608] cgroup: Unknown subsys name 'cpuset' [ 83.518603][ T5608] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.159860][ T5608] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.705454][ T822] cfg80211: failed to load regulatory.db [ 89.581140][ T5634] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.582480][ T5634] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.582644][ T5634] bridge_slave_0: entered allmulticast mode [ 89.584571][ T5634] bridge_slave_0: entered promiscuous mode [ 89.617366][ T5634] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.617553][ T5634] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.617718][ T5634] bridge_slave_1: entered allmulticast mode [ 89.624700][ T5634] bridge_slave_1: entered promiscuous mode [ 89.673627][ T5634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.677211][ T5634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.724348][ T5634] team0: Port device team_slave_0 added [ 89.727668][ T5634] team0: Port device team_slave_1 added [ 89.810691][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.810710][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.810725][ T5634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.813630][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.813640][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.813653][ T5634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.922594][ T5634] hsr_slave_0: entered promiscuous mode [ 89.923944][ T5634] hsr_slave_1: entered promiscuous mode [ 90.335607][ T5634] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.361297][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 90.365097][ T5634] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.393894][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 90.395402][ T5634] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.415436][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 90.416920][ T5634] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.453210][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 90.593194][ T5634] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.658307][ T5634] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.676571][ T1192] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.676763][ T1192] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.704734][ T1192] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.704888][ T1192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.136623][ T5634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.221660][ T5634] veth0_vlan: entered promiscuous mode [ 91.245400][ T5634] veth1_vlan: entered promiscuous mode [ 91.322155][ T5634] veth0_macvtap: entered promiscuous mode [ 91.327875][ T5634] veth1_macvtap: entered promiscuous mode [ 91.371634][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.387877][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.407474][ T4095] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.423461][ T4095] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.426822][ T4095] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.427032][ T4095] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.314723][ T1192] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.093863][ T1192] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.307717][ T4912] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.323266][ T4912] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.327890][ T4912] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.330353][ T4912] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.332722][ T4912] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 93.860910][ T1192] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.237607][ T1192] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.893847][ T1192] bridge_slave_1: left allmulticast mode [ 94.893953][ T1192] bridge_slave_1: left promiscuous mode [ 94.911892][ T1192] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.109779][ T1192] bridge_slave_0: left allmulticast mode [ 95.109814][ T1192] bridge_slave_0: left promiscuous mode [ 95.110081][ T1192] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.838743][ T1192] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 95.919980][ T1192] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 95.940921][ T1192] bond0 (unregistering): Released all slaves [ 95.997578][ T5258] 8021q: adding VLAN 0 to HW filter on device eth1 [ 96.408524][ T1192] hsr_slave_0: left promiscuous mode [ 96.448352][ T1192] hsr_slave_1: left promiscuous mode [ 96.449510][ T1192] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 96.449568][ T1192] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 96.491571][ T1192] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 96.491589][ T1192] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 96.669827][ T1192] veth1_macvtap: left promiscuous mode [ 96.670097][ T1192] veth0_macvtap: left promiscuous mode [ 96.670406][ T1192] veth1_vlan: left promiscuous mode [ 96.670720][ T1192] veth0_vlan: left promiscuous mode [ 97.368580][ T1192] team0 (unregistering): Port device team_slave_1 removed [ 97.408546][ T1192] team0 (unregistering): Port device team_slave_0 removed [ 97.587807][ T5258] 8021q: adding VLAN 0 to HW filter on device eth2 [ 98.348763][ T5258] 8021q: adding VLAN 0 to HW filter on device eth3 [ 98.607296][ T105] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.607323][ T105] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.814190][ T105] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.814210][ T105] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.077274][ T5258] 8021q: adding VLAN 0 to HW filter on device eth4 2026/07/25 01:59:02 executed programs: 0 [ 101.006876][ T4912] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 101.030283][ T4912] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 101.043348][ T4912] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 101.044880][ T4912] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 101.054778][ T4912] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 101.637700][ T5796] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.637928][ T5796] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.638488][ T5796] bridge_slave_0: entered allmulticast mode [ 101.641592][ T5796] bridge_slave_0: entered promiscuous mode [ 101.645542][ T5796] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.645985][ T5796] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.646528][ T5796] bridge_slave_1: entered allmulticast mode [ 101.650516][ T5796] bridge_slave_1: entered promiscuous mode [ 101.710032][ T5796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.713781][ T5796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.751847][ T5796] team0: Port device team_slave_0 added [ 101.756744][ T5796] team0: Port device team_slave_1 added [ 101.805156][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.805167][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.805180][ T5796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.807175][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.807184][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.807196][ T5796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.918771][ T5796] hsr_slave_0: entered promiscuous mode [ 101.920024][ T5796] hsr_slave_1: entered promiscuous mode [ 103.070044][ T4912] Bluetooth: hci0: command tx timeout [ 104.503213][ T5796] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.535910][ T5796] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.537248][ T5796] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.582630][ T5796] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.583959][ T5796] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.620692][ T5796] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.635200][ T5796] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.691570][ T5796] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.877152][ T5796] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.941710][ T5796] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.971919][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.974789][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.016906][ T4095] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.017105][ T4095] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.153176][ T4912] Bluetooth: hci0: command tx timeout [ 105.803577][ T5796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.191651][ T5796] veth0_vlan: entered promiscuous mode [ 106.250909][ T5796] veth1_vlan: entered promiscuous mode [ 106.402910][ T5796] veth0_macvtap: entered promiscuous mode [ 106.414953][ T5796] veth1_macvtap: entered promiscuous mode [ 106.457163][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.494026][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.523756][ T4095] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.525721][ T4095] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.525762][ T4095] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.525796][ T4095] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.093554][ T4370] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.093581][ T4370] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.145803][ T4370] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.145823][ T4370] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/07/25 01:59:08 executed programs: 2 [ 107.228264][ T4912] Bluetooth: hci0: command tx timeout [ 107.376023][ T5951] [ 107.376034][ T5951] ====================================================== [ 107.376041][ T5951] WARNING: possible circular locking dependency detected [ 107.376057][ T5951] syzkaller #0 Not tainted [ 107.376065][ T5951] ------------------------------------------------------ [ 107.376076][ T5951] syz.0.18/5951 is trying to acquire lock: [ 107.376085][ T5951] ffff88802304c7c0 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: configfs_depend_item_unlocked+0x153/0x420 [ 107.376152][ T5951] [ 107.376152][ T5951] but task is already holding lock: [ 107.376158][ T5951] ffff8880296eb910 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x147/0x590 [ 107.376202][ T5951] [ 107.376202][ T5951] which lock already depends on the new lock. [ 107.376202][ T5951] [ 107.376209][ T5951] [ 107.376209][ T5951] the existing dependency chain (in reverse order) is: [ 107.376215][ T5951] [ 107.376215][ T5951] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 107.376238][ T5951] mutex_lock_nested+0x5a/0x1d0 [ 107.376260][ T5951] tcm_set_name+0x2b/0xd0 [ 107.376275][ T5951] function_make+0x1a8/0x360 [ 107.376291][ T5951] configfs_mkdir+0x4f6/0x9e0 [ 107.376310][ T5951] vfs_mkdir+0x408/0x620 [ 107.376332][ T5951] filename_mkdirat+0x289/0x520 [ 107.376353][ T5951] __se_sys_mkdir+0x34/0x150 [ 107.376375][ T5951] do_syscall_64+0x17b/0x530 [ 107.376390][ T5951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.376407][ T5951] [ 107.376407][ T5951] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 107.376429][ T5951] mutex_lock_nested+0x5a/0x1d0 [ 107.376449][ T5951] uvcg_streaming_header_allow_link+0x75/0x4d0 [ 107.376472][ T5951] configfs_symlink+0x59a/0x1030 [ 107.376495][ T5951] vfs_symlink+0x18b/0x330 [ 107.376518][ T5951] filename_symlinkat+0x1cd/0x420 [ 107.376542][ T5951] __se_sys_symlink+0x4d/0x2b0 [ 107.376565][ T5951] do_syscall_64+0x17b/0x530 [ 107.376581][ T5951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.376597][ T5951] [ 107.376597][ T5951] -> #0 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}: [ 107.376620][ T5951] __lock_acquire+0x15ff/0x2e40 [ 107.376635][ T5951] lock_acquire+0x115/0x350 [ 107.376659][ T5951] down_write+0x3a/0x50 [ 107.376675][ T5951] configfs_depend_item_unlocked+0x153/0x420 [ 107.376696][ T5951] usbg_make_tpg+0x1f6/0x590 [ 107.376718][ T5951] target_fabric_make_tpg+0xa8/0x6d0 [ 107.376735][ T5951] configfs_mkdir+0x4f6/0x9e0 [ 107.376753][ T5951] vfs_mkdir+0x408/0x620 [ 107.376774][ T5951] filename_mkdirat+0x289/0x520 [ 107.376795][ T5951] __se_sys_mkdir+0x34/0x150 [ 107.376815][ T5951] do_syscall_64+0x17b/0x530 [ 107.376830][ T5951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.376846][ T5951] [ 107.376846][ T5951] other info that might help us debug this: [ 107.376846][ T5951] [ 107.376853][ T5951] Chain exists of: [ 107.376853][ T5951] &sb->s_type->i_mutex_key#23 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 107.376853][ T5951] [ 107.376885][ T5951] Possible unsafe locking scenario: [ 107.376885][ T5951] [ 107.376891][ T5951] CPU0 CPU1 [ 107.376896][ T5951] ---- ---- [ 107.376902][ T5951] lock(&opts->dep_lock); [ 107.376914][ T5951] lock(gadget_subsys.su_mutex); [ 107.376927][ T5951] lock(&opts->dep_lock); [ 107.376939][ T5951] lock(&sb->s_type->i_mutex_key#23); [ 107.376956][ T5951] [ 107.376956][ T5951] *** DEADLOCK *** [ 107.376956][ T5951] [ 107.376961][ T5951] locks held by syz.0.18/5951: 5, last CPU#0: [ 107.376974][ T5951] #0: ffff88801e354510 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 107.377022][ T5951] #1: ffff88803e99e2c8 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 107.377075][ T5951] #2: ffffffff8eea86e0 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b0/0x9e0 [ 107.377129][ T5951] #3: ffffffff8f1defd8 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf7/0x590 [ 107.377178][ T5951] #4: ffff8880296eb910 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x147/0x590 [ 107.377226][ T5951] [ 107.377226][ T5951] stack backtrace: [ 107.377248][ T5951] CPU: 0 UID: 0 PID: 5951 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 107.377268][ T5951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 107.377286][ T5951] Call Trace: [ 107.377293][ T5951] [ 107.377301][ T5951] dump_stack_lvl+0xe8/0x150 [ 107.377324][ T5951] print_circular_bug+0x2e2/0x300 [ 107.377347][ T5951] check_noncircular+0x12f/0x150 [ 107.377370][ T5951] __lock_acquire+0x15ff/0x2e40 [ 107.377396][ T5951] lock_acquire+0x115/0x350 [ 107.377423][ T5951] ? configfs_depend_item_unlocked+0x153/0x420 [ 107.377452][ T5951] down_write+0x3a/0x50 [ 107.377469][ T5951] ? configfs_depend_item_unlocked+0x153/0x420 [ 107.377492][ T5951] configfs_depend_item_unlocked+0x153/0x420 [ 107.377517][ T5951] usbg_make_tpg+0x1f6/0x590 [ 107.377544][ T5951] ? __pfx_usbg_make_tpg+0x10/0x10 [ 107.377571][ T5951] ? lockdep_hardirqs_on+0x7a/0x110 [ 107.377590][ T5951] target_fabric_make_tpg+0xa8/0x6d0 [ 107.377607][ T5951] configfs_mkdir+0x4f6/0x9e0 [ 107.377629][ T5951] ? __pfx_current_check_access_path+0x10/0x10 [ 107.377652][ T5951] ? __pfx_configfs_mkdir+0x10/0x10 [ 107.377670][ T5951] ? generic_permission+0x2bf/0x670 [ 107.377689][ T5951] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 107.377712][ T5951] vfs_mkdir+0x408/0x620 [ 107.377743][ T5951] filename_mkdirat+0x289/0x520 [ 107.377769][ T5951] ? __pfx_filename_mkdirat+0x10/0x10 [ 107.377791][ T5951] ? strncpy_from_user+0x150/0x2c0 [ 107.377813][ T5951] ? do_getname+0x151/0x250 [ 107.377848][ T5951] __se_sys_mkdir+0x34/0x150 [ 107.377873][ T5951] do_syscall_64+0x17b/0x530 [ 107.377890][ T5951] ? irqentry_exit+0x10f/0x8f0 [ 107.377907][ T5951] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.377922][ T5951] ? clear_bhb_loop+0x40/0x90 [ 107.377941][ T5951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.377959][ T5951] RIP: 0033:0x7fb88062de99 [ 107.377979][ T5951] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.377993][ T5951] RSP: 002b:00007ffd3b2c9538 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 107.378009][ T5951] RAX: ffffffffffffffda RBX: 00007fb8808b5fa0 RCX: 00007fb88062de99 [ 107.378022][ T5951] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000200000000600 [ 107.378033][ T5951] RBP: 00007fb8806c3eaf R08: 0000000000000000 R09: 0000000000000000 [ 107.378044][ T5951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.378054][ T5951] R13: 00007fb8808b5fac R14: 00007fb8808b5fa0 R15: 00007fb8808b5fa0 [ 107.378073][ T5951] [ 109.308101][ T4912] Bluetooth: hci0: command tx timeout 2026/07/25 01:59:13 executed programs: 105 2026/07/25 01:59:18 executed programs: 223