Warning: Permanently added '10.128.0.251' (ED25519) to the list of known hosts. 2025/08/25 04:56:00 parsed 1 programs syzkaller login: [ 65.938824][ T4189] cgroup: Unknown subsys name 'net' [ 66.066725][ T4189] cgroup: Unknown subsys name 'rlimit' [ 67.559245][ T4189] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 70.132768][ T4224] chnl_net:caif_netlink_parms(): no params data found [ 70.198903][ T4224] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.206846][ T4224] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.215434][ T4224] device bridge_slave_0 entered promiscuous mode [ 70.225688][ T4224] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.233293][ T4224] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.241738][ T4224] device bridge_slave_1 entered promiscuous mode [ 70.272154][ T4224] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.285293][ T4224] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.324854][ T4224] team0: Port device team_slave_0 added [ 70.333184][ T4224] team0: Port device team_slave_1 added [ 70.362444][ T4224] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.369444][ T4224] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.397193][ T4224] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.412151][ T4224] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.419143][ T4224] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.446788][ T4224] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.491221][ T4224] device hsr_slave_0 entered promiscuous mode [ 70.498284][ T4224] device hsr_slave_1 entered promiscuous mode [ 70.647008][ T4224] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.662033][ T4224] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.673637][ T4224] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.685355][ T4224] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.725942][ T4224] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.733271][ T4224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.741681][ T4224] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.748822][ T4224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.811631][ T4224] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.826277][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.839953][ T384] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.848754][ T384] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.858355][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 70.874726][ T4224] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.887864][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.897522][ T384] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.904695][ T384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.927038][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.936124][ T1461] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.943258][ T1461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.961486][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.971502][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 70.980908][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.996936][ T4224] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.008086][ T4224] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.022407][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.034241][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.047317][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.143281][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.151661][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.166485][ T4224] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.198758][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.208749][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.230842][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.239065][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.248633][ T4224] device veth0_vlan entered promiscuous mode [ 71.258633][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.265503][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.268605][ T4224] device veth1_vlan entered promiscuous mode [ 71.282232][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.291547][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.299411][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.341984][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.350762][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 71.359415][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.368584][ T4224] device veth0_macvtap entered promiscuous mode [ 71.378600][ T4224] device veth1_macvtap entered promiscuous mode [ 71.394342][ T4224] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.402522][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 71.411337][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 71.419423][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.429010][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.442688][ T4224] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.450299][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.458950][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.471733][ T4224] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.481797][ T4224] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.491304][ T4224] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.500410][ T4224] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.610593][ T4224] syz-executor (4224) used greatest stack depth: 20840 bytes left [ 72.520142][ T384] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.528161][ T384] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.553482][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.563780][ T384] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.579690][ T384] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.588256][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.669469][ T144] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/08/25 04:56:10 executed programs: 0 [ 73.871198][ T4291] chnl_net:caif_netlink_parms(): no params data found [ 73.915954][ T4291] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.923151][ T4291] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.931691][ T4291] device bridge_slave_0 entered promiscuous mode [ 73.940766][ T4291] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.947918][ T4291] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.955889][ T4291] device bridge_slave_1 entered promiscuous mode [ 73.978847][ T4291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.990171][ T4291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.014618][ T4291] team0: Port device team_slave_0 added [ 74.022453][ T4291] team0: Port device team_slave_1 added [ 74.044492][ T4291] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.051644][ T4291] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.078736][ T4291] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.091709][ T4291] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.098704][ T4291] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.125271][ T4291] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.157248][ T4291] device hsr_slave_0 entered promiscuous mode [ 74.164446][ T4291] device hsr_slave_1 entered promiscuous mode [ 74.171364][ T4291] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 74.179267][ T4291] Cannot create hsr debugfs directory [ 75.810281][ T4246] Bluetooth: hci0: command 0x0409 tx timeout [ 76.567340][ T144] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.614736][ T144] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.668710][ T144] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.478781][ T4291] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 77.487829][ T4291] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 77.497606][ T4291] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 77.506901][ T4291] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 77.607664][ T4291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.620785][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 77.628717][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.640591][ T4291] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.654722][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.663810][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.673207][ T384] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.680441][ T384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.688374][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 77.705284][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.714156][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.723159][ T384] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.730344][ T384] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.743230][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.770982][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.781916][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.792423][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.801739][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.836977][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.846120][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.858126][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.866833][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.892485][ T4310] Bluetooth: hci0: command 0x041b tx timeout [ 77.904546][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.913615][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.924935][ T4291] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 78.046160][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 78.054507][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 78.066473][ T4291] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.105310][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 78.114613][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 78.145250][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 78.154231][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 78.163742][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 78.172794][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 78.191882][ T4291] device veth0_vlan entered promiscuous mode [ 78.203253][ T4291] device veth1_vlan entered promiscuous mode [ 78.225632][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 78.234234][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 78.243440][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.253149][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.267952][ T4291] device veth0_macvtap entered promiscuous mode [ 78.282203][ T144] device hsr_slave_0 left promiscuous mode [ 78.288718][ T144] device hsr_slave_1 left promiscuous mode [ 78.297033][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 78.305210][ T144] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 78.313710][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 78.321297][ T144] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 78.329090][ T144] device bridge_slave_1 left promiscuous mode [ 78.336832][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.353076][ T144] device bridge_slave_0 left promiscuous mode [ 78.359336][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.378344][ T144] device veth1_macvtap left promiscuous mode [ 78.385470][ T144] device veth0_macvtap left promiscuous mode [ 78.392307][ T144] device veth1_vlan left promiscuous mode [ 78.398316][ T144] device veth0_vlan left promiscuous mode [ 78.572515][ T144] team0 (unregistering): Port device team_slave_1 removed [ 78.585044][ T144] team0 (unregistering): Port device team_slave_0 removed [ 78.600083][ T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 78.613875][ T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 78.676852][ T144] bond0 (unregistering): Released all slaves [ 78.757329][ T4291] device veth1_macvtap entered promiscuous mode [ 78.765962][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.774213][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.796950][ T4291] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.804965][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 78.816365][ T384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 78.835334][ T4291] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.845877][ T4291] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.855235][ T4291] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.865108][ T4291] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.874170][ T4291] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.884767][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 78.895007][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 78.965925][ T384] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.982216][ T384] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.992954][ T1461] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.994851][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 79.008575][ T1461] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.020078][ T1461] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 79.141792][ T4345] [ 79.144179][ T4345] ====================================================== [ 79.151211][ T4345] WARNING: possible circular locking dependency detected [ 79.158284][ T4345] 5.15.189-syzkaller #0 Not tainted [ 79.163496][ T4345] ------------------------------------------------------ [ 79.170531][ T4345] syz.0.17/4345 is trying to acquire lock: [ 79.176356][ T4345] ffff888075a04c28 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xc1/0x1b0 [ 79.187465][ T4345] [ 79.187465][ T4345] but task is already holding lock: [ 79.194849][ T4345] ffffffff8d4be228 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x19e/0x560 [ 79.204556][ T4345] [ 79.204556][ T4345] which lock already depends on the new lock. [ 79.204556][ T4345] [ 79.214983][ T4345] [ 79.214983][ T4345] the existing dependency chain (in reverse order) is: [ 79.224020][ T4345] [ 79.224020][ T4345] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 79.232042][ T4345] __mutex_lock_common+0x1eb/0x2390 [ 79.237797][ T4345] mutex_lock_nested+0x17/0x20 [ 79.243108][ T4345] rfkill_register+0x33/0x8a0 [ 79.248315][ T4345] hci_register_dev+0x452/0x970 [ 79.253691][ T4345] vhci_create_device+0x32c/0x5c0 [ 79.259273][ T4345] vhci_write+0x391/0x450 [ 79.264155][ T4345] vfs_write+0x712/0xd00 [ 79.268954][ T4345] ksys_write+0x14d/0x250 [ 79.273832][ T4345] do_syscall_64+0x4c/0xa0 [ 79.278802][ T4345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.285256][ T4345] [ 79.285256][ T4345] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 79.293111][ T4345] __mutex_lock_common+0x1eb/0x2390 [ 79.298866][ T4345] mutex_lock_nested+0x17/0x20 [ 79.304190][ T4345] vhci_send_frame+0x88/0x100 [ 79.309426][ T4345] hci_send_frame+0x1a9/0x2e0 [ 79.314742][ T4345] hci_tx_work+0x9f9/0x1710 [ 79.319800][ T4345] process_one_work+0x863/0x1000 [ 79.325285][ T4345] worker_thread+0xaa8/0x12a0 [ 79.330510][ T4345] kthread+0x436/0x520 [ 79.335122][ T4345] ret_from_fork+0x1f/0x30 [ 79.340072][ T4345] [ 79.340072][ T4345] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 79.349309][ T4345] __flush_work+0xdd/0x1b0 [ 79.354284][ T4345] hci_dev_do_close+0x1e7/0x1030 [ 79.359774][ T4345] hci_unregister_dev+0x2d7/0x580 [ 79.365356][ T4345] vhci_release+0x73/0xc0 [ 79.370255][ T4345] __fput+0x234/0x930 [ 79.374821][ T4345] task_work_run+0x125/0x1a0 [ 79.380057][ T4345] do_exit+0x61e/0x20a0 [ 79.384788][ T4345] do_group_exit+0x12e/0x300 [ 79.389924][ T4345] get_signal+0x6ca/0x12c0 [ 79.394886][ T4345] arch_do_signal_or_restart+0xc1/0x1300 [ 79.401069][ T4345] exit_to_user_mode_loop+0x9e/0x130 [ 79.406913][ T4345] exit_to_user_mode_prepare+0xb1/0x140 [ 79.413013][ T4345] syscall_exit_to_user_mode+0x16/0x40 [ 79.419197][ T4345] do_syscall_64+0x58/0xa0 [ 79.424394][ T4345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.430824][ T4345] [ 79.430824][ T4345] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 79.438495][ T4345] __mutex_lock_common+0x1eb/0x2390 [ 79.444246][ T4345] mutex_lock_nested+0x17/0x20 [ 79.449557][ T4345] bg_scan_update+0x44/0x3b0 [ 79.454689][ T4345] process_one_work+0x863/0x1000 [ 79.460178][ T4345] worker_thread+0xaa8/0x12a0 [ 79.465434][ T4345] kthread+0x436/0x520 [ 79.470044][ T4345] ret_from_fork+0x1f/0x30 [ 79.475021][ T4345] [ 79.475021][ T4345] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 79.485257][ T4345] __lock_acquire+0x2c33/0x7c60 [ 79.490659][ T4345] lock_acquire+0x197/0x3f0 [ 79.495753][ T4345] __flush_work+0xdd/0x1b0 [ 79.500714][ T4345] __cancel_work_timer+0x3ac/0x520 [ 79.506371][ T4345] hci_request_cancel_all+0xcc/0x300 [ 79.512207][ T4345] hci_dev_do_close+0x4e/0x1030 [ 79.517604][ T4345] hci_rfkill_set_block+0x10a/0x190 [ 79.523355][ T4345] rfkill_set_block+0x1c6/0x420 [ 79.528852][ T4345] rfkill_fop_write+0x458/0x560 [ 79.534249][ T4345] vfs_write+0x300/0xd00 [ 79.539036][ T4345] ksys_write+0x14d/0x250 [ 79.543920][ T4345] do_syscall_64+0x4c/0xa0 [ 79.548892][ T4345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.555358][ T4345] [ 79.555358][ T4345] other info that might help us debug this: [ 79.555358][ T4345] [ 79.565603][ T4345] Chain exists of: [ 79.565603][ T4345] (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex [ 79.565603][ T4345] [ 79.581358][ T4345] Possible unsafe locking scenario: [ 79.581358][ T4345] [ 79.588828][ T4345] CPU0 CPU1 [ 79.594560][ T4345] ---- ---- [ 79.599941][ T4345] lock(rfkill_global_mutex); [ 79.604744][ T4345] lock(&data->open_mutex); [ 79.611878][ T4345] lock(rfkill_global_mutex); [ 79.619194][ T4345] lock((work_completion)(&hdev->bg_scan_update)); [ 79.625818][ T4345] [ 79.625818][ T4345] *** DEADLOCK *** [ 79.625818][ T4345] [ 79.633981][ T4345] 1 lock held by syz.0.17/4345: [ 79.638941][ T4345] #0: ffffffff8d4be228 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x19e/0x560 [ 79.649084][ T4345] [ 79.649084][ T4345] stack backtrace: [ 79.654999][ T4345] CPU: 1 PID: 4345 Comm: syz.0.17 Not tainted 5.15.189-syzkaller #0 [ 79.663005][ T4345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 79.673141][ T4345] Call Trace: [ 79.676442][ T4345] [ 79.679391][ T4345] dump_stack_lvl+0x168/0x230 [ 79.684099][ T4345] ? load_image+0x3b0/0x3b0 [ 79.688627][ T4345] ? show_regs_print_info+0x20/0x20 [ 79.693952][ T4345] ? print_circular_bug+0x12b/0x1a0 [ 79.699182][ T4345] check_noncircular+0x274/0x310 [ 79.704150][ T4345] ? add_chain_block+0x940/0x940 [ 79.709115][ T4345] ? lockdep_lock+0xdc/0x1e0 [ 79.713839][ T4345] ? __lock_acquire+0x12d9/0x7c60 [ 79.718899][ T4345] ? lockdep_lock+0x1e0/0x1e0 [ 79.723697][ T4345] ? mark_lock+0x94/0x320 [ 79.728069][ T4345] ? _find_first_zero_bit+0xce/0xf0 [ 79.733311][ T4345] __lock_acquire+0x2c33/0x7c60 [ 79.738241][ T4345] ? verify_lock_unused+0x140/0x140 [ 79.743474][ T4345] ? verify_lock_unused+0x140/0x140 [ 79.748716][ T4345] lock_acquire+0x197/0x3f0 [ 79.753509][ T4345] ? __flush_work+0xc1/0x1b0 [ 79.758131][ T4345] ? __lock_acquire+0x7c60/0x7c60 [ 79.763186][ T4345] ? read_lock_is_recursive+0x10/0x10 [ 79.768590][ T4345] ? start_flush_work+0x776/0x820 [ 79.773642][ T4345] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 79.779568][ T4345] ? _raw_spin_unlock+0x40/0x40 [ 79.784551][ T4345] __flush_work+0xdd/0x1b0 [ 79.789007][ T4345] ? __flush_work+0xc1/0x1b0 [ 79.793629][ T4345] ? flush_work+0x20/0x20 [ 79.797991][ T4345] ? try_to_grab_pending+0xf3/0x7e0 [ 79.803227][ T4345] ? lockdep_hardirqs_off+0x70/0x100 [ 79.808548][ T4345] ? mark_lock+0x94/0x320 [ 79.813054][ T4345] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 79.819082][ T4345] ? lock_chain_count+0x20/0x20 [ 79.823989][ T4345] ? mark_lock+0x94/0x320 [ 79.828368][ T4345] ? __cancel_work_timer+0x331/0x520 [ 79.833693][ T4345] __cancel_work_timer+0x3ac/0x520 [ 79.838838][ T4345] ? cancel_work_sync+0x20/0x20 [ 79.843719][ T4345] ? __cancel_work+0x1f4/0x2d0 [ 79.848514][ T4345] ? lockdep_hardirqs_on+0x94/0x140 [ 79.853747][ T4345] ? __cancel_work+0x26f/0x2d0 [ 79.858543][ T4345] ? cancel_work+0x20/0x20 [ 79.863026][ T4345] ? lock_chain_count+0x20/0x20 [ 79.867917][ T4345] hci_request_cancel_all+0xcc/0x300 [ 79.873235][ T4345] hci_dev_do_close+0x4e/0x1030 [ 79.878129][ T4345] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 79.884054][ T4345] ? _raw_spin_unlock+0x40/0x40 [ 79.888947][ T4345] hci_rfkill_set_block+0x10a/0x190 [ 79.894181][ T4345] ? rcu_lock_release+0x20/0x20 [ 79.899068][ T4345] rfkill_set_block+0x1c6/0x420 [ 79.903956][ T4345] rfkill_fop_write+0x458/0x560 [ 79.908848][ T4345] ? verify_lock_unused+0x140/0x140 [ 79.914089][ T4345] ? rfkill_fop_read+0x4b0/0x4b0 [ 79.919059][ T4345] ? common_file_perm+0x150/0x1c0 [ 79.924250][ T4345] ? fsnotify_perm+0x5d/0x560 [ 79.928984][ T4345] ? security_file_permission+0x75/0xa0 [ 79.934568][ T4345] ? rfkill_fop_read+0x4b0/0x4b0 [ 79.939628][ T4345] vfs_write+0x300/0xd00 [ 79.943902][ T4345] ? file_end_write+0x250/0x250 [ 79.948787][ T4345] ? __context_tracking_exit+0x4c/0x80 [ 79.954279][ T4345] ? __lock_acquire+0x7c60/0x7c60 [ 79.959339][ T4345] ? __fdget_pos+0x1e2/0x370 [ 79.964643][ T4345] ksys_write+0x14d/0x250 [ 79.969008][ T4345] ? __ia32_sys_read+0x80/0x80 [ 79.973892][ T4345] ? lockdep_hardirqs_on+0x94/0x140 [ 79.979125][ T4345] do_syscall_64+0x4c/0xa0 [ 79.983586][ T4345] ? clear_bhb_loop+0x30/0x80 [ 79.988309][ T4345] ? clear_bhb_loop+0x30/0x80 [ 79.993020][ T4345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.998963][ T4345] RIP: 0033:0x7fa650786be9 [ 80.003413][ T4345] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 80.023045][ T4345] RSP: 002b:00007ffd8aa62dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 80.031754][ T4345] RAX: ffffffffffffffda RBX: 00007fa6509adfa0 RCX: 00007fa650786be9 [ 80.039756][ T4345] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000003 [ 80.047752][ T4345] RBP: 00007fa650809e19 R08: 0000000000000000 R09: 0000000000000000 [ 80.055752][ T4345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.064369][ T4345] R13: 00007fa6509adfa0 R14: 00007fa6509adfa0 R15: 0000000000000003 [ 80.072370][ T4345] [ 80.086454][ T1334] Bluetooth: hci0: command 0x040f tx timeout