Warning: Permanently added '10.128.10.2' (ED25519) to the list of known hosts. 1970/01/01 00:00:44 ignoring optional flag "sandboxArg"="0" 1970/01/01 00:00:46 parsed 1 programs [ 48.437986][ T4034] cgroup: Unknown subsys name 'net' [ 48.696703][ T4034] cgroup: Unknown subsys name 'rlimit' [ 49.051157][ T4034] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 57.733858][ T1624] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.736005][ T1624] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.738803][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 57.761917][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.764161][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.766843][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 58.670093][ T4092] chnl_net:caif_netlink_parms(): no params data found [ 58.709033][ T4092] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.711147][ T4092] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.713696][ T4092] device bridge_slave_0 entered promiscuous mode [ 58.718219][ T4092] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.720118][ T4092] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.722774][ T4092] device bridge_slave_1 entered promiscuous mode [ 58.740334][ T4092] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.745796][ T4092] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.763324][ T4092] team0: Port device team_slave_0 added [ 58.766747][ T4092] team0: Port device team_slave_1 added [ 58.782475][ T4092] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 58.784347][ T4092] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.791336][ T4092] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 58.795819][ T4092] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 58.797536][ T4092] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.804908][ T4092] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 58.862816][ T4092] device hsr_slave_0 entered promiscuous mode [ 58.901736][ T4092] device hsr_slave_1 entered promiscuous mode [ 59.023628][ T4092] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 59.073780][ T4092] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 59.113019][ T4092] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 59.163565][ T4092] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 59.267913][ T4092] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.283542][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 59.286429][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.291407][ T4092] 8021q: adding VLAN 0 to HW filter on device team0 [ 59.301552][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 59.304179][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 59.306850][ T136] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.308857][ T136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.312144][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.315346][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.318069][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.319878][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.333715][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.336213][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 59.338911][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 59.353572][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 59.359522][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 59.363209][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 59.367835][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.370929][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.373442][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 59.384506][ T4092] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 59.472152][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 59.474598][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 59.485214][ T4092] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.497884][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 59.513494][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 59.517689][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 59.520005][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 59.523460][ T4092] device veth0_vlan entered promiscuous mode [ 59.529786][ T4092] device veth1_vlan entered promiscuous mode [ 59.546415][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 59.548965][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 59.560912][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 59.570337][ T4092] device veth0_macvtap entered promiscuous mode [ 59.575944][ T4092] device veth1_macvtap entered promiscuous mode [ 59.587030][ T4092] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 59.589205][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 59.595970][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 59.604344][ T4092] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 59.606574][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 59.611590][ T4092] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.613917][ T4092] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.615993][ T4092] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.618402][ T4092] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:01:00 executed programs: 0 [ 60.258432][ T4131] chnl_net:caif_netlink_parms(): no params data found [ 60.295547][ T4131] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.297247][ T4131] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.299524][ T4131] device bridge_slave_0 entered promiscuous mode [ 60.303464][ T4131] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.305188][ T4131] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.307688][ T4131] device bridge_slave_1 entered promiscuous mode [ 60.324836][ T4131] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.329053][ T4131] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.346283][ T4131] team0: Port device team_slave_0 added [ 60.349395][ T4131] team0: Port device team_slave_1 added [ 60.363504][ T4131] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.365334][ T4131] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.372528][ T4131] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.376479][ T4131] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.378301][ T4131] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.385172][ T4131] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.442514][ T4131] device hsr_slave_0 entered promiscuous mode [ 60.481783][ T4131] device hsr_slave_1 entered promiscuous mode [ 60.520736][ T4131] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.522949][ T4131] Cannot create hsr debugfs directory [ 60.585598][ T4131] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.250961][ T4120] Bluetooth: hci0: command 0x0409 tx timeout [ 62.778074][ T4131] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.340878][ T4120] Bluetooth: hci0: command 0x041b tx timeout [ 65.200142][ T4131] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.249938][ T4131] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.452919][ T4131] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 65.513149][ T4131] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 65.553971][ T4131] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 65.644700][ T4131] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 65.739929][ T4131] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.747572][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.749998][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.759462][ T4131] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.766215][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 65.768908][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 65.774869][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.776752][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.787201][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 65.789905][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 65.798316][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 65.802288][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.804177][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.806433][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 65.822501][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 65.825386][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 65.828723][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 65.846055][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 65.848581][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 65.854727][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.857303][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.859822][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.865453][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 65.868050][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.875423][ T4131] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.951173][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 65.953401][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 65.959023][ T4131] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.976212][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 65.979021][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 65.995754][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 65.998476][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.005432][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 66.008204][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 66.015562][ T4131] device veth0_vlan entered promiscuous mode [ 66.024527][ T4131] device veth1_vlan entered promiscuous mode [ 66.039665][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 66.042560][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 66.045029][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 66.047607][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.052254][ T4131] device veth0_macvtap entered promiscuous mode [ 66.058365][ T4131] device veth1_macvtap entered promiscuous mode [ 66.069093][ T4131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.075853][ T4131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.079594][ T4131] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.082464][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.085358][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 66.088076][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 66.092433][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.096872][ T4131] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.099598][ T4131] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.103733][ T4131] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.106145][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.109785][ T1624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.116854][ T4131] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.119052][ T4131] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.122029][ T4131] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.124321][ T4131] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.165388][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.167505][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.174320][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.195765][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.198103][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.204919][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.312860][ T4143] [ 66.313476][ T4143] ====================================================== [ 66.315362][ T4143] WARNING: possible circular locking dependency detected [ 66.317197][ T4143] 5.15.178-syzkaller #0 Not tainted [ 66.318622][ T4143] ------------------------------------------------------ [ 66.320504][ T4143] syz.0.16/4143 is trying to acquire lock: [ 66.322094][ T4143] ffff0000d5470c28 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 66.325038][ T4143] [ 66.325038][ T4143] but task is already holding lock: [ 66.327030][ T4143] ffff800016f39608 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x250/0x750 [ 66.329602][ T4143] [ 66.329602][ T4143] which lock already depends on the new lock. [ 66.329602][ T4143] [ 66.332316][ T4143] [ 66.332316][ T4143] the existing dependency chain (in reverse order) is: [ 66.334692][ T4143] [ 66.334692][ T4143] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 66.336758][ T4143] __mutex_lock_common+0x194/0x2154 [ 66.338278][ T4143] mutex_lock_nested+0xa4/0xf8 [ 66.339668][ T4143] rfkill_register+0x44/0x7a4 [ 66.341051][ T4143] hci_register_dev+0x3e0/0x880 [ 66.342400][ T4143] vhci_create_device+0x2c4/0x568 [ 66.343936][ T4143] vhci_write+0x318/0x3b8 [ 66.345225][ T4143] vfs_write+0x884/0xb44 [ 66.346464][ T4143] ksys_write+0x15c/0x26c [ 66.347711][ T4143] __arm64_sys_write+0x7c/0x90 [ 66.349126][ T4143] invoke_syscall+0x98/0x2b8 [ 66.350495][ T4143] el0_svc_common+0x138/0x258 [ 66.351853][ T4143] do_el0_svc+0x58/0x14c [ 66.353163][ T4143] el0_svc+0x7c/0x1f0 [ 66.354434][ T4143] el0t_64_sync_handler+0x84/0xe4 [ 66.355972][ T4143] el0t_64_sync+0x1a0/0x1a4 [ 66.357219][ T4143] [ 66.357219][ T4143] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 66.359310][ T4143] __mutex_lock_common+0x194/0x2154 [ 66.360851][ T4143] mutex_lock_nested+0xa4/0xf8 [ 66.362219][ T4143] vhci_send_frame+0x8c/0x10c [ 66.363590][ T4143] hci_send_frame+0x194/0x2f0 [ 66.364935][ T4143] hci_tx_work+0x9ac/0x16cc [ 66.366318][ T4143] process_one_work+0x790/0x11b8 [ 66.367733][ T4143] worker_thread+0x910/0x1034 [ 66.369111][ T4143] kthread+0x37c/0x45c [ 66.370264][ T4143] ret_from_fork+0x10/0x20 [ 66.371579][ T4143] [ 66.371579][ T4143] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 66.374082][ T4143] __flush_work+0xf8/0x1c0 [ 66.375377][ T4143] flush_work+0x24/0x38 [ 66.376639][ T4143] hci_dev_do_close+0x16c/0x1060 [ 66.378100][ T4143] hci_unregister_dev+0x248/0x4d4 [ 66.379590][ T4143] vhci_release+0x74/0xc4 [ 66.380989][ T4143] __fput+0x1c4/0x800 [ 66.382126][ T4143] ____fput+0x20/0x30 [ 66.383226][ T4143] task_work_run+0x130/0x1e4 [ 66.384638][ T4143] do_exit+0x670/0x20bc [ 66.385881][ T4143] do_group_exit+0x110/0x268 [ 66.387211][ T4143] get_signal+0x634/0x1550 [ 66.388500][ T4143] do_notify_resume+0x3d0/0x32b8 [ 66.390028][ T4143] el0_svc+0xfc/0x1f0 [ 66.391245][ T4143] el0t_64_sync_handler+0x84/0xe4 [ 66.392719][ T4143] el0t_64_sync+0x1a0/0x1a4 [ 66.394085][ T4143] [ 66.394085][ T4143] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 66.396088][ T4143] __mutex_lock_common+0x194/0x2154 [ 66.397645][ T4143] mutex_lock_nested+0xa4/0xf8 [ 66.399099][ T4143] bg_scan_update+0x9c/0x470 [ 66.400453][ T4143] process_one_work+0x790/0x11b8 [ 66.401884][ T4143] worker_thread+0x910/0x1034 [ 66.403233][ T4143] kthread+0x37c/0x45c [ 66.404533][ T4143] ret_from_fork+0x10/0x20 [ 66.405861][ T4143] [ 66.405861][ T4143] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 66.408428][ T4143] __lock_acquire+0x32d4/0x7638 [ 66.409853][ T4143] lock_acquire+0x240/0x77c [ 66.411168][ T4143] __flush_work+0xf8/0x1c0 [ 66.412410][ T4143] __cancel_work_timer+0x3ec/0x548 [ 66.413877][ T4143] cancel_work_sync+0x24/0x38 [ 66.415263][ T4143] hci_request_cancel_all+0xcc/0x2d0 [ 66.416836][ T4143] hci_dev_do_close+0x54/0x1060 [ 66.418286][ T4143] hci_rfkill_set_block+0xdc/0x1d0 [ 66.419767][ T4143] rfkill_set_block+0x18c/0x37c [ 66.421194][ T4143] rfkill_fop_write+0x594/0x750 [ 66.422690][ T4143] vfs_write+0x280/0xb44 [ 66.423922][ T4143] ksys_write+0x15c/0x26c [ 66.425276][ T4143] __arm64_sys_write+0x7c/0x90 [ 66.426733][ T4143] invoke_syscall+0x98/0x2b8 [ 66.428112][ T4143] el0_svc_common+0x138/0x258 [ 66.429481][ T4143] do_el0_svc+0x58/0x14c [ 66.430765][ T4143] el0_svc+0x7c/0x1f0 [ 66.431962][ T4143] el0t_64_sync_handler+0x84/0xe4 [ 66.433490][ T4143] el0t_64_sync+0x1a0/0x1a4 [ 66.434807][ T4143] [ 66.434807][ T4143] other info that might help us debug this: [ 66.434807][ T4143] [ 66.437605][ T4143] Chain exists of: [ 66.437605][ T4143] (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex [ 66.437605][ T4143] [ 66.441848][ T4143] Possible unsafe locking scenario: [ 66.441848][ T4143] [ 66.443863][ T4143] CPU0 CPU1 [ 66.445249][ T4143] ---- ---- [ 66.446691][ T4143] lock(rfkill_global_mutex); [ 66.447904][ T4143] lock(&data->open_mutex); [ 66.449818][ T4143] lock(rfkill_global_mutex); [ 66.451769][ T4143] lock((work_completion)(&hdev->bg_scan_update)); [ 66.453429][ T4143] [ 66.453429][ T4143] *** DEADLOCK *** [ 66.453429][ T4143] [ 66.455523][ T4143] 1 lock held by syz.0.16/4143: [ 66.456787][ T4143] #0: ffff800016f39608 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x250/0x750 [ 66.459419][ T4143] [ 66.459419][ T4143] stack backtrace: [ 66.460923][ T4143] CPU: 1 PID: 4143 Comm: syz.0.16 Not tainted 5.15.178-syzkaller #0 [ 66.463011][ T4143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 66.465646][ T4143] Call trace: [ 66.466477][ T4143] dump_backtrace+0x0/0x530 [ 66.467611][ T4143] show_stack+0x2c/0x3c [ 66.468763][ T4143] dump_stack_lvl+0x108/0x170 [ 66.469992][ T4143] dump_stack+0x1c/0x58 [ 66.471113][ T4143] print_circular_bug+0x150/0x1b8 [ 66.472415][ T4143] check_noncircular+0x2cc/0x378 [ 66.473701][ T4143] __lock_acquire+0x32d4/0x7638 [ 66.474924][ T4143] lock_acquire+0x240/0x77c [ 66.476099][ T4143] __flush_work+0xf8/0x1c0 [ 66.477229][ T4143] __cancel_work_timer+0x3ec/0x548 [ 66.478578][ T4143] cancel_work_sync+0x24/0x38 [ 66.479719][ T4143] hci_request_cancel_all+0xcc/0x2d0 [ 66.481100][ T4143] hci_dev_do_close+0x54/0x1060 [ 66.482429][ T4143] hci_rfkill_set_block+0xdc/0x1d0 [ 66.483855][ T4143] rfkill_set_block+0x18c/0x37c [ 66.485177][ T4143] rfkill_fop_write+0x594/0x750 [ 66.486356][ T4143] vfs_write+0x280/0xb44 [ 66.487562][ T4143] ksys_write+0x15c/0x26c [ 66.488727][ T4143] __arm64_sys_write+0x7c/0x90 [ 66.489978][ T4143] invoke_syscall+0x98/0x2b8 [ 66.491146][ T4143] el0_svc_common+0x138/0x258 [ 66.492380][ T4143] do_el0_svc+0x58/0x14c [ 66.493506][ T4143] el0_svc+0x7c/0x1f0 [ 66.494546][ T4143] el0t_64_sync_handler+0x84/0xe4 [ 66.495872][ T4143] el0t_64_sync+0x1a0/0x1a4 [ 66.514705][ T21] Bluetooth: hci0: command 0x040f tx timeout