Warning: Permanently added '10.128.0.200' (ED25519) to the list of known hosts. 2026/08/08 22:16:43 parsed 1 programs 2026/08/08 22:16:43 serving rpc on tcp://32867 syzkaller login: [ 72.722338][ T4286] cgroup: Unknown subsys name 'net' [ 72.862245][ T4286] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.144390][ T4286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 76.277704][ T47] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.285740][ T47] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.301314][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 76.335048][ T47] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.343859][ T47] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.352216][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 77.309549][ T4348] chnl_net:caif_netlink_parms(): no params data found [ 77.355960][ T4348] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.364598][ T4348] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.376999][ T4348] device bridge_slave_0 entered promiscuous mode [ 77.390018][ T4348] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.397284][ T4348] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.405071][ T4348] device bridge_slave_1 entered promiscuous mode [ 77.438528][ T4348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.452879][ T4348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.476656][ T4348] team0: Port device team_slave_0 added [ 77.484341][ T4348] team0: Port device team_slave_1 added [ 77.500717][ T4348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.508254][ T4348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.534501][ T4348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.547104][ T4348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.554149][ T4348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.580206][ T4348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.606533][ T4348] device hsr_slave_0 entered promiscuous mode [ 77.613453][ T4348] device hsr_slave_1 entered promiscuous mode [ 77.718439][ T4348] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 77.728825][ T4348] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 77.738700][ T4348] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 77.758539][ T4348] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 77.780641][ T4348] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.787968][ T4348] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.795948][ T4348] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.803237][ T4348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.865323][ T4348] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.878374][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.889415][ T33] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.898736][ T33] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.907499][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 77.930063][ T4348] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.941889][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.950659][ T1174] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.957822][ T1174] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.975715][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.984746][ T1174] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.991873][ T1174] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.012073][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 78.020686][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.029856][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 78.046668][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 78.058979][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 78.069514][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 78.253634][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 78.263474][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 78.292418][ T4348] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.309007][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 78.319175][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 78.349919][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 78.359143][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 78.367678][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 78.375469][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 78.385032][ T4348] device veth0_vlan entered promiscuous mode [ 78.398882][ T4348] device veth1_vlan entered promiscuous mode [ 78.425159][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 78.437877][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 78.453076][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.461947][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.472649][ T4348] device veth0_macvtap entered promiscuous mode [ 78.483593][ T4348] device veth1_macvtap entered promiscuous mode [ 78.498744][ T4348] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.506252][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.514815][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.523922][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 78.534129][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 78.547001][ T4348] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.554393][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 78.563090][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 78.575315][ T4348] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.584958][ T4348] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.594094][ T4348] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.602879][ T4348] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.722816][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 78.839087][ T4373] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.848911][ T4373] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.857700][ T4373] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.865511][ T4373] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.874104][ T4373] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 78.882683][ T4373] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2026/08/08 22:16:51 executed programs: 0 [ 79.319642][ T4373] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.328465][ T4373] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.336273][ T4373] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.344581][ T4373] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.353112][ T4373] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 79.360675][ T4373] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.462920][ T4385] chnl_net:caif_netlink_parms(): no params data found [ 79.501617][ T4385] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.508906][ T4385] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.517589][ T4385] device bridge_slave_0 entered promiscuous mode [ 79.525513][ T4385] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.532856][ T4385] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.541439][ T4385] device bridge_slave_1 entered promiscuous mode [ 79.565377][ T4385] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.576397][ T4385] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.597919][ T4385] team0: Port device team_slave_0 added [ 79.605113][ T4385] team0: Port device team_slave_1 added [ 79.623787][ T4385] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.630858][ T4385] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.658411][ T4385] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.670215][ T4385] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.677523][ T4385] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.703957][ T4385] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.735950][ T4385] device hsr_slave_0 entered promiscuous mode [ 79.742770][ T4385] device hsr_slave_1 entered promiscuous mode [ 79.749469][ T4385] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.757523][ T4385] Cannot create hsr debugfs directory [ 81.338336][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 81.377190][ T4373] Bluetooth: hci0: command 0x0409 tx timeout [ 83.467654][ T49] Bluetooth: hci0: command 0x041b tx timeout [ 83.886159][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.927906][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.789723][ T9] device hsr_slave_0 left promiscuous mode [ 84.796577][ T9] device hsr_slave_1 left promiscuous mode [ 84.804853][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 84.813647][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 84.822731][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 84.830545][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 84.838507][ T9] device bridge_slave_1 left promiscuous mode [ 84.845630][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.859024][ T9] device bridge_slave_0 left promiscuous mode [ 84.865292][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.887257][ T9] device veth1_macvtap left promiscuous mode [ 84.893501][ T9] device veth0_macvtap left promiscuous mode [ 84.900177][ T9] device veth1_vlan left promiscuous mode [ 84.906120][ T9] device veth0_vlan left promiscuous mode [ 85.214374][ T9] team0 (unregistering): Port device team_slave_1 removed [ 85.241813][ T9] team0 (unregistering): Port device team_slave_0 removed [ 85.269029][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 85.296113][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 85.474459][ T9] bond0 (unregistering): Released all slaves [ 85.537013][ T49] Bluetooth: hci0: command 0x040f tx timeout [ 85.581005][ T4385] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.592989][ T4385] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.603049][ T4385] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.617405][ T4385] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.670214][ T4385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.689828][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 85.705065][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 85.715256][ T4385] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.724556][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 85.733473][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 85.743442][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.750674][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.759413][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 85.782232][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 85.791314][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 85.800113][ T1174] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.807331][ T1174] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.815253][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 85.827133][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 85.839559][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 85.850376][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 85.860059][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 85.870729][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 85.880157][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 85.898312][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 85.907317][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 85.919622][ T4385] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 85.933240][ T4385] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 85.942098][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 85.950941][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 86.128050][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 86.135775][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 86.159997][ T4385] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.178763][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 86.188855][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 86.206372][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 86.215030][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 86.225383][ T4385] device veth0_vlan entered promiscuous mode [ 86.233735][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 86.241655][ T1174] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 86.252925][ T4385] device veth1_vlan entered promiscuous mode [ 86.279313][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 86.288282][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 86.296304][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 86.305795][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 86.318520][ T4385] device veth0_macvtap entered promiscuous mode [ 86.333538][ T4385] device veth1_macvtap entered promiscuous mode [ 86.349986][ T4385] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.357566][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 86.365673][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 86.374647][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 86.383549][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 86.402442][ T4385] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.410723][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 86.420081][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 86.431436][ T4385] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.440278][ T4385] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.449176][ T4385] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.458431][ T4385] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.516041][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.528899][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.545498][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.562867][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.571206][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.580547][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.634147][ T4428] [ 86.636522][ T4428] ====================================================== [ 86.643545][ T4428] WARNING: possible circular locking dependency detected [ 86.650560][ T4428] syzkaller #0 Not tainted [ 86.654987][ T4428] ------------------------------------------------------ [ 86.662116][ T4428] syz.0.17/4428 is trying to acquire lock: [ 86.668015][ T4428] ffffffff8d8089e8 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x1d/0x1e0 [ 86.676893][ T4428] [ 86.676893][ T4428] but task is already holding lock: [ 86.684281][ T4428] ffff888078486310 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x55/0x250 [ 86.693240][ T4428] [ 86.693240][ T4428] which lock already depends on the new lock. [ 86.693240][ T4428] [ 86.703649][ T4428] [ 86.703649][ T4428] the existing dependency chain (in reverse order) is: [ 86.712669][ T4428] [ 86.712669][ T4428] -> #3 (&gi->lock){+.+.}-{3:3}: [ 86.719785][ T4428] __mutex_lock+0x12d/0xae0 [ 86.724854][ T4428] config_usb_cfg_link+0x55/0x250 [ 86.730793][ T4428] configfs_symlink+0x5a4/0x13c0 [ 86.736267][ T4428] vfs_symlink+0x245/0x3d0 [ 86.741210][ T4428] do_symlinkat+0x1b6/0x400 [ 86.746265][ T4428] __x64_sys_symlinkat+0x95/0xa0 [ 86.751741][ T4428] do_syscall_64+0x4c/0xa0 [ 86.756695][ T4428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.763134][ T4428] [ 86.763134][ T4428] -> #2 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}: [ 86.771837][ T4428] down_write+0x36/0x60 [ 86.776508][ T4428] configfs_depend_item_unlocked+0x14f/0x430 [ 86.783006][ T4428] usbg_make_tpg+0x1f3/0x580 [ 86.788112][ T4428] target_fabric_make_tpg+0xa0/0x6d0 [ 86.793970][ T4428] configfs_mkdir+0x511/0x9e0 [ 86.799161][ T4428] vfs_mkdir+0x386/0x570 [ 86.803915][ T4428] do_mkdirat+0x1d8/0x440 [ 86.808755][ T4428] __x64_sys_mkdirat+0x85/0x90 [ 86.814027][ T4428] do_syscall_64+0x4c/0xa0 [ 86.818969][ T4428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.825385][ T4428] [ 86.825385][ T4428] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 86.833020][ T4428] __mutex_lock+0x12d/0xae0 [ 86.838043][ T4428] usbg_make_tpg+0x144/0x580 [ 86.843148][ T4428] target_fabric_make_tpg+0xa0/0x6d0 [ 86.848945][ T4428] configfs_mkdir+0x511/0x9e0 [ 86.854145][ T4428] vfs_mkdir+0x386/0x570 [ 86.858898][ T4428] do_mkdirat+0x1d8/0x440 [ 86.863735][ T4428] __x64_sys_mkdirat+0x85/0x90 [ 86.869009][ T4428] do_syscall_64+0x4c/0xa0 [ 86.873939][ T4428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.880350][ T4428] [ 86.880350][ T4428] -> #0 (tpg_instances_lock){+.+.}-{3:3}: [ 86.888261][ T4428] __lock_acquire+0x2d18/0x7c40 [ 86.893626][ T4428] lock_acquire+0x1bb/0x4a0 [ 86.898644][ T4428] __mutex_lock+0x12d/0xae0 [ 86.903681][ T4428] tcm_alloc+0x1d/0x1e0 [ 86.908353][ T4428] usb_get_function+0x59/0xa0 [ 86.913541][ T4428] config_usb_cfg_link+0x144/0x250 [ 86.919165][ T4428] configfs_symlink+0x5a4/0x13c0 [ 86.924615][ T4428] vfs_symlink+0x245/0x3d0 [ 86.929558][ T4428] do_symlinkat+0x1b6/0x400 [ 86.934677][ T4428] __x64_sys_symlinkat+0x95/0xa0 [ 86.940143][ T4428] do_syscall_64+0x4c/0xa0 [ 86.945072][ T4428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.951484][ T4428] [ 86.951484][ T4428] other info that might help us debug this: [ 86.951484][ T4428] [ 86.961708][ T4428] Chain exists of: [ 86.961708][ T4428] tpg_instances_lock --> &sb->s_type->i_mutex_key#21 --> &gi->lock [ 86.961708][ T4428] [ 86.975521][ T4428] Possible unsafe locking scenario: [ 86.975521][ T4428] [ 86.982956][ T4428] CPU0 CPU1 [ 86.988319][ T4428] ---- ---- [ 86.993691][ T4428] lock(&gi->lock); [ 86.997574][ T4428] lock(&sb->s_type->i_mutex_key#21); [ 87.005576][ T4428] lock(&gi->lock); [ 87.012007][ T4428] lock(tpg_instances_lock); [ 87.016683][ T4428] [ 87.016683][ T4428] *** DEADLOCK *** [ 87.016683][ T4428] [ 87.024815][ T4428] 3 locks held by syz.0.17/4428: [ 87.029737][ T4428] #0: ffff888019f70460 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 87.038978][ T4428] #1: ffff88805b52daa0 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: configfs_symlink+0x47b/0x13c0 [ 87.049861][ T4428] #2: ffff888078486310 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x55/0x250 [ 87.059250][ T4428] [ 87.059250][ T4428] stack backtrace: [ 87.065146][ T4428] CPU: 1 PID: 4428 Comm: syz.0.17 Not tainted syzkaller #0 [ 87.072332][ T4428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.082394][ T4428] Call Trace: [ 87.085668][ T4428] [ 87.088590][ T4428] dump_stack_lvl+0x188/0x24e [ 87.093286][ T4428] ? load_image+0x410/0x410 [ 87.097803][ T4428] ? show_regs_print_info+0x12/0x12 [ 87.103008][ T4428] ? print_circular_bug+0x12b/0x1a0 [ 87.108203][ T4428] check_noncircular+0x296/0x330 [ 87.113140][ T4428] ? add_chain_block+0x9b0/0x9b0 [ 87.118070][ T4428] ? lockdep_lock+0xf1/0x1f0 [ 87.122659][ T4428] ? _find_first_zero_bit+0xd2/0x100 [ 87.127941][ T4428] __lock_acquire+0x2d18/0x7c40 [ 87.132898][ T4428] ? module_check_misalignment+0x100/0x5c0 [ 87.138698][ T4428] ? verify_lock_unused+0x140/0x140 [ 87.143898][ T4428] ? verify_lock_unused+0x140/0x140 [ 87.149183][ T4428] lock_acquire+0x1bb/0x4a0 [ 87.153681][ T4428] ? tcm_alloc+0x1d/0x1e0 [ 87.158008][ T4428] ? __might_sleep+0xd0/0xd0 [ 87.162588][ T4428] ? read_lock_is_recursive+0x10/0x10 [ 87.167964][ T4428] ? __mutex_trylock_common+0x15c/0x260 [ 87.173511][ T4428] __mutex_lock+0x12d/0xae0 [ 87.178013][ T4428] ? tcm_alloc+0x1d/0x1e0 [ 87.182337][ T4428] ? rcu_is_watching+0x11/0xa0 [ 87.187098][ T4428] ? trace_contention_end+0x5f/0x170 [ 87.192378][ T4428] ? __mutex_lock+0x1ab/0xae0 [ 87.197053][ T4428] ? tcm_alloc+0x1d/0x1e0 [ 87.201377][ T4428] ? mutex_lock_nested+0x10/0x10 [ 87.206333][ T4428] ? config_usb_cfg_link+0x55/0x250 [ 87.211529][ T4428] ? mutex_lock_nested+0x10/0x10 [ 87.216481][ T4428] tcm_alloc+0x1d/0x1e0 [ 87.220638][ T4428] usb_get_function+0x59/0xa0 [ 87.225505][ T4428] config_usb_cfg_link+0x144/0x250 [ 87.230632][ T4428] configfs_symlink+0x5a4/0x13c0 [ 87.235658][ T4428] ? end_current_label_crit_section+0x14b/0x170 [ 87.241903][ T4428] ? common_perm+0x15d/0x1b0 [ 87.246493][ T4428] ? from_kgid+0x14f/0x6a0 [ 87.250907][ T4428] ? make_kgid+0x650/0x650 [ 87.255332][ T4428] ? apparmor_path_symlink+0x1ac/0x230 [ 87.260792][ T4428] ? lookup_one_qstr_excl+0x11c/0x240 [ 87.266172][ T4428] ? detach_groups+0x370/0x370 [ 87.270927][ T4428] ? inode_permission+0xef/0x480 [ 87.275874][ T4428] ? bpf_lsm_inode_symlink+0x5/0x10 [ 87.281432][ T4428] ? security_inode_symlink+0xb2/0x100 [ 87.286899][ T4428] vfs_symlink+0x245/0x3d0 [ 87.291331][ T4428] do_symlinkat+0x1b6/0x400 [ 87.295883][ T4428] ? vfs_symlink+0x3d0/0x3d0 [ 87.300473][ T4428] __x64_sys_symlinkat+0x95/0xa0 [ 87.305413][ T4428] do_syscall_64+0x4c/0xa0 [ 87.309828][ T4428] ? clear_bhb_loop+0x60/0xb0 [ 87.314509][ T4428] ? clear_bhb_loop+0x60/0xb0 [ 87.319180][ T4428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.325067][ T4428] RIP: 0033:0x7fec4179e0d9 [ 87.329482][ T4428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.349090][ T4428] RSP: 002b:00007ffdbf816328 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 87.357506][ T4428] RAX: ffffffffffffffda RBX: 00007fec41a25fa0 RCX: 00007fec4179e0d9 [ 87.365471][ T4428] RDX: 0000200000000a40 RSI: ffffffffffffff9c RDI: 0000200000000a00 [ 87.373473][ T4428] RBP: 00007fec41835024 R08: 0000000000000000 R09: 0000000000000000 [ 87.381434][ T4428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.389398][ T4428] R13: 00007fec41a25fac R14: 00007fec41a25fa0 R15: 00007fec41a25fa0 [ 87.397373][ T4428] [ 87.402038][ T126] cfg80211: failed to load regulatory.db