[   97.008511][   T24] cfg80211: failed to load regulatory.db
Warning: Permanently added '10.128.0.34' (ED25519) to the list of known hosts.
[  100.993057][ T5840] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  101.018874][ T5843] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  101.027401][ T5843] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  101.037207][ T5847] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  101.037456][ T5843] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  101.044807][ T5847] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  101.052753][ T5843] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  101.059659][ T5847] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  101.066566][ T5843] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  101.073979][ T5847] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  101.081616][ T5843] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  101.087247][ T5847] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  101.095248][ T5843] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  101.102180][ T5847] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  101.115743][ T5847] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  101.124410][ T5847] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  101.132328][ T5847] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  101.139989][ T5847] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  101.140888][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  101.148142][ T5847] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
executing program
executing program
executing program
executing program
[  101.676282][ T5856] 
[  101.678666][ T5856] ======================================================
[  101.685713][ T5856] WARNING: possible circular locking dependency detected
[  101.692780][ T5856] 6.15.0-syzkaller-01958-g785cdec46e92 #0 Not tainted
[  101.699582][ T5856] ------------------------------------------------------
[  101.706629][ T5856] syz-executor131/5856 is trying to acquire lock:
[  101.713056][ T5856] ffff888142fc85e0 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x103/0x400
[  101.722537][ T5856] 
[  101.722537][ T5856] but task is already holding lock:
[  101.729909][ T5856] ffff888142fc80a8 (&q->q_usage_counter(io)#55){++++}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20
[  101.741979][ T5856] 
[  101.741979][ T5856] which lock already depends on the new lock.
[  101.741979][ T5856] 
[  101.752390][ T5856] 
[  101.752390][ T5856] the existing dependency chain (in reverse order) is:
[  101.761417][ T5856] 
[  101.761417][ T5856] -> #3 (&q->q_usage_counter(io)#55){++++}-{0:0}:
[  101.770059][ T5856]        blk_alloc_queue+0x619/0x760
[  101.775395][ T5856]        blk_mq_alloc_queue+0x175/0x290
[  101.780961][ T5856]        __blk_mq_alloc_disk+0x29/0x120
[  101.786523][ T5856]        nbd_dev_add+0x4a0/0xbc0
[  101.791495][ T5856]        nbd_init+0x181/0x320
[  101.796201][ T5856]        do_one_initcall+0x120/0x6e0
[  101.801505][ T5856]        kernel_init_freeable+0x5c2/0x900
[  101.807303][ T5856]        kernel_init+0x1c/0x2b0
[  101.812177][ T5856]        ret_from_fork+0x48/0x80
[  101.817137][ T5856]        ret_from_fork_asm+0x1a/0x30
[  101.822628][ T5856] 
[  101.822628][ T5856] -> #2 (fs_reclaim){+.+.}-{0:0}:
[  101.829865][ T5856]        fs_reclaim_acquire+0x102/0x150
[  101.835446][ T5856]        prepare_alloc_pages+0x162/0x610
[  101.841118][ T5856]        __alloc_frozen_pages_noprof+0x18b/0x23f0
[  101.847558][ T5856]        __alloc_pages_noprof+0xb/0x1b0
[  101.853127][ T5856]        pcpu_populate_chunk+0x110/0xb00
[  101.858776][ T5856]        pcpu_alloc_noprof+0x86a/0x1470
[  101.864341][ T5856]        xt_percpu_counter_alloc+0x13e/0x1b0
[  101.870362][ T5856]        find_check_entry.constprop.0+0xbf/0xa20
[  101.876718][ T5856]        translate_table+0xd0b/0x17b0
[  101.882117][ T5856]        ip6t_register_table+0x102/0x430
[  101.887776][ T5856]        ip6table_filter_table_init+0x75/0xa0
[  101.893875][ T5856]        xt_find_table_lock+0x2e1/0x520
[  101.899484][ T5856]        xt_request_find_table_lock+0x28/0xf0
[  101.905583][ T5856]        get_info+0x190/0x620
[  101.910289][ T5856]        do_ip6t_get_ctl+0x169/0xa50
[  101.915604][ T5856]        nf_getsockopt+0x7c/0xe0
[  101.920562][ T5856]        ipv6_getsockopt+0x1f7/0x280
[  101.925869][ T5856]        tcp_getsockopt+0x9e/0x100
[  101.931048][ T5856]        do_sock_getsockopt+0x3ff/0x800
[  101.936636][ T5856]        __sys_getsockopt+0x123/0x1b0
[  101.942028][ T5856]        __x64_sys_getsockopt+0xbd/0x160
[  101.947682][ T5856]        do_syscall_64+0xcd/0x230
[  101.952738][ T5856]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  101.959169][ T5856] 
[  101.959169][ T5856] -> #1 (pcpu_alloc_mutex){+.+.}-{4:4}:
[  101.966946][ T5856]        __mutex_lock+0x199/0xb90
[  101.972004][ T5856]        pcpu_alloc_noprof+0xb4a/0x1470
[  101.977570][ T5856]        sbitmap_init_node+0x2fd/0x770
[  101.983064][ T5856]        sbitmap_queue_init_node+0x41/0x560
[  101.988987][ T5856]        blk_mq_init_tags+0x12d/0x2b0
[  101.994469][ T5856]        blk_mq_alloc_map_and_rqs+0x237/0xf60
[  102.000571][ T5856]        blk_mq_init_sched+0x30c/0x610
[  102.006058][ T5856]        elevator_switch+0x1e1/0x7f0
[  102.011370][ T5856]        elevator_change+0x2ac/0x400
[  102.016682][ T5856]        elevator_set_default+0x292/0x320
[  102.022461][ T5856]        blk_register_queue+0x393/0x4f0
[  102.028029][ T5856]        __add_disk+0x74a/0xf00
[  102.032905][ T5856]        add_disk_fwnode+0x13f/0x5d0
[  102.038219][ T5856]        nbd_dev_add+0x791/0xbc0
[  102.043189][ T5856]        nbd_init+0x181/0x320
[  102.047972][ T5856]        do_one_initcall+0x120/0x6e0
[  102.053277][ T5856]        kernel_init_freeable+0x5c2/0x900
[  102.059020][ T5856]        kernel_init+0x1c/0x2b0
[  102.063889][ T5856]        ret_from_fork+0x48/0x80
[  102.068856][ T5856]        ret_from_fork_asm+0x1a/0x30
[  102.074157][ T5856] 
[  102.074157][ T5856] -> #0 (&q->elevator_lock){+.+.}-{4:4}:
[  102.082008][ T5856]        __lock_acquire+0x126f/0x1c90
[  102.087490][ T5856]        lock_acquire+0x179/0x350
[  102.092537][ T5856]        __mutex_lock+0x199/0xb90
[  102.097603][ T5856]        elevator_change+0x103/0x400
[  102.102939][ T5856]        elv_iosched_store+0x2eb/0x3a0
[  102.108433][ T5856]        queue_attr_store+0x276/0x320
[  102.113999][ T5856]        sysfs_kf_write+0xf2/0x150
[  102.119233][ T5856]        kernfs_fop_write_iter+0x354/0x510
[  102.125066][ T5856]        iter_file_splice_write+0x91c/0x1150
[  102.131084][ T5856]        direct_splice_actor+0x18f/0x6c0
[  102.136763][ T5856]        splice_direct_to_actor+0x342/0xa30
[  102.142687][ T5856]        do_splice_direct+0x174/0x240
[  102.148094][ T5856]        do_sendfile+0xb06/0xe50
[  102.153047][ T5856]        __x64_sys_sendfile64+0x1d8/0x220
[  102.158965][ T5856]        do_syscall_64+0xcd/0x230
[  102.164020][ T5856]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  102.170452][ T5856] 
[  102.170452][ T5856] other info that might help us debug this:
[  102.170452][ T5856] 
[  102.180689][ T5856] Chain exists of:
[  102.180689][ T5856]   &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#55
[  102.180689][ T5856] 
[  102.194468][ T5856]  Possible unsafe locking scenario:
[  102.194468][ T5856] 
[  102.201929][ T5856]        CPU0                    CPU1
[  102.207310][ T5856]        ----                    ----
[  102.212687][ T5856]   lock(&q->q_usage_counter(io)#55);
[  102.218178][ T5856]                                lock(fs_reclaim);
[  102.224705][ T5856]                                lock(&q->q_usage_counter(io)#55);
[  102.232629][ T5856]   lock(&q->elevator_lock);
[  102.237237][ T5856] 
[  102.237237][ T5856]  *** DEADLOCK ***
[  102.237237][ T5856] 
[  102.245388][ T5856] 6 locks held by syz-executor131/5856:
[  102.250941][ T5856]  #0: ffff888031e38428 (sb_writers#7){.+.+}-{0:0}, at: splice_direct_to_actor+0x342/0xa30
[  102.261034][ T5856]  #1: ffff888029df2c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x510
[  102.270843][ T5856]  #2: ffff888141b351e8 (kn->active#50){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2b2/0x510
[  102.280932][ T5856]  #3: ffff88802683a188 (&set->update_nr_hwq_lock){.+.+}-{4:4}, at: elv_iosched_store+0x337/0x3a0
[  102.291612][ T5856]  #4: ffff888142fc80a8 (&q->q_usage_counter(io)#55){++++}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20
[  102.303350][ T5856]  #5: ffff888142fc80e0 (&q->q_usage_counter(queue)#7){+.+.}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20
[  102.315430][ T5856] 
[  102.315430][ T5856] stack backtrace:
[  102.321343][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor131 Not tainted 6.15.0-syzkaller-01958-g785cdec46e92 #0 PREEMPT(full) 
[  102.321377][ T5856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[  102.321396][ T5856] Call Trace:
[  102.321405][ T5856]  <TASK>
[  102.321415][ T5856]  dump_stack_lvl+0x116/0x1f0
[  102.321459][ T5856]  print_circular_bug+0x275/0x350
[  102.321489][ T5856]  check_noncircular+0x14c/0x170
[  102.321521][ T5856]  __lock_acquire+0x126f/0x1c90
[  102.321555][ T5856]  lock_acquire+0x179/0x350
[  102.321582][ T5856]  ? elevator_change+0x103/0x400
[  102.321620][ T5856]  ? __pfx___might_resched+0x10/0x10
[  102.321647][ T5856]  __mutex_lock+0x199/0xb90
[  102.321685][ T5856]  ? elevator_change+0x103/0x400
[  102.321721][ T5856]  ? elevator_change+0x103/0x400
[  102.321758][ T5856]  ? __pfx___mutex_lock+0x10/0x10
[  102.321801][ T5856]  ? blk_mq_cancel_work_sync+0xd8/0x110
[  102.321827][ T5856]  ? __pfx_blk_mq_cancel_work_sync+0x10/0x10
[  102.321857][ T5856]  ? elevator_change+0x103/0x400
[  102.321897][ T5856]  elevator_change+0x103/0x400
[  102.321935][ T5856]  elv_iosched_store+0x2eb/0x3a0
[  102.321975][ T5856]  ? __pfx_elv_iosched_store+0x10/0x10
[  102.322014][ T5856]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  102.322050][ T5856]  ? __mutex_trylock_common+0xe9/0x250
[  102.322081][ T5856]  ? __pfx_elv_iosched_store+0x10/0x10
[  102.322120][ T5856]  queue_attr_store+0x276/0x320
[  102.322150][ T5856]  ? __pfx_queue_attr_store+0x10/0x10
[  102.322177][ T5856]  ? __lock_acquire+0x622/0x1c90
[  102.322212][ T5856]  ? find_held_lock+0x2b/0x80
[  102.322250][ T5856]  ? sysfs_file_kobj+0xe4/0x290
[  102.322290][ T5856]  ? __pfx_queue_attr_store+0x10/0x10
[  102.322318][ T5856]  sysfs_kf_write+0xf2/0x150
[  102.322357][ T5856]  kernfs_fop_write_iter+0x354/0x510
[  102.322392][ T5856]  ? __pfx_sysfs_kf_write+0x10/0x10
[  102.322433][ T5856]  iter_file_splice_write+0x91c/0x1150
[  102.322484][ T5856]  ? __pfx_iter_file_splice_write+0x10/0x10
[  102.322536][ T5856]  ? __pfx_copy_splice_read+0x10/0x10
[  102.322583][ T5856]  ? __pfx_iter_file_splice_write+0x10/0x10
[  102.322632][ T5856]  direct_splice_actor+0x18f/0x6c0
[  102.322674][ T5856]  splice_direct_to_actor+0x342/0xa30
[  102.322715][ T5856]  ? __pfx_direct_splice_actor+0x10/0x10
[  102.322759][ T5856]  ? __pfx_splice_direct_to_actor+0x10/0x10
[  102.322798][ T5856]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  102.322837][ T5856]  do_splice_direct+0x174/0x240
[  102.322883][ T5856]  ? __pfx_do_splice_direct+0x10/0x10
[  102.322924][ T5856]  ? __pfx_direct_file_splice_eof+0x10/0x10
[  102.322965][ T5856]  ? rw_verify_area+0xcf/0x680
[  102.323006][ T5856]  do_sendfile+0xb06/0xe50
[  102.323031][ T5856]  ? __pfx_do_sendfile+0x10/0x10
[  102.323056][ T5856]  ? find_held_lock+0x2b/0x80
[  102.323095][ T5856]  __x64_sys_sendfile64+0x1d8/0x220
[  102.323128][ T5856]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[  102.323165][ T5856]  do_syscall_64+0xcd/0x230
[  102.323204][ T5856]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  102.323230][ T5856] RIP: 0033:0x7f65b3761d19
[  102.323255][ T5856] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
executing program
[  102.323279][ T5856] RSP: 002b:00007ffd1e113fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  102.323303][ T5856] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f65b3761d19
[  102.323319][ T5856] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003
[  102.323334][ T5856] RBP: 0000000000000000 R08: 00007ffd1e114010 R09: 00007ffd1e114010
[  102.323351][ T5856] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f65b37eb488
[  102.323366][ T5856] R13: 00007ffd1e113ffc R14: 0000000000000000 R15: 431bde82d7b634db
[  102.323391][ T5856]  </TASK>
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[  103.166052][ T5148] Bluetooth: hci0: command tx timeout
[  103.166062][ T5847] Bluetooth: hci2: command tx timeout
executing program
[  103.246046][ T5148] Bluetooth: hci3: command tx timeout
[  103.246059][ T5847] Bluetooth: hci1: command tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[  105.247139][ T5847] Bluetooth: hci0: command tx timeout
[  105.250730][ T5148] Bluetooth: hci2: command tx timeout
executing program
executing program
executing program
[  105.326400][ T5148] Bluetooth: hci1: command tx timeout
[  105.333106][ T5148] Bluetooth: hci3: command tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[  107.332535][ T5148] Bluetooth: hci0: command tx timeout
[  107.332546][ T5847] Bluetooth: hci2: command tx timeout
executing program
executing program
[  107.406554][ T5148] Bluetooth: hci3: command tx timeout
[  107.408705][ T5847] Bluetooth: hci1: command tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[  109.407421][ T5148] Bluetooth: hci2: command tx timeout
[  109.418254][ T5847] Bluetooth: hci0: command tx timeout
executing program
executing program
executing program
[  109.486100][ T5148] Bluetooth: hci3: command tx timeout
[  109.491577][ T5847] Bluetooth: hci1: command tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program