Warning: Permanently added '[localhost]:44148' (ED25519) to the list of known hosts. [ 43.813758][ T44] kauditd_printk_skb: 15 callbacks suppressed [ 43.813792][ T44] audit: type=1400 audit(1791275838.953:138): avc: denied { execute } for pid=5729 comm="sh" name="syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 43.814038][ T44] audit: type=1400 audit(1791275838.953:139): avc: denied { execute_no_trans } for pid=5729 comm="sh" path="/syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 2026/10/06 08:37:20 parsed 1 programs 2026/10/06 08:37:20 serving rpc on tcp://33221 [ 44.998792][ T44] audit: type=1400 audit(1791275840.143:140): avc: denied { node_bind } for pid=5729 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 47.275616][ T44] audit: type=1400 audit(1791275842.413:141): avc: denied { mounton } for pid=5739 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 47.284044][ T44] audit: type=1400 audit(1791275842.423:142): avc: denied { mount } for pid=5739 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 47.287649][ T5739] cgroup: Unknown subsys name 'net' [ 47.296759][ T44] audit: type=1400 audit(1791275842.443:143): avc: denied { unmount } for pid=5739 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 47.418767][ T5739] cgroup: Unknown subsys name 'cpuset' [ 47.421678][ T5739] cgroup: Unknown subsys name 'rlimit' [ 47.603053][ T44] audit: type=1400 audit(1791275842.743:144): avc: denied { setattr } for pid=5739 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 47.603427][ T44] audit: type=1400 audit(1791275842.743:145): avc: denied { create } for pid=5739 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 47.603624][ T44] audit: type=1400 audit(1791275842.743:146): avc: denied { write } for pid=5739 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 47.603832][ T44] audit: type=1400 audit(1791275842.743:147): avc: denied { read } for pid=5739 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 47.676818][ T5741] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 48.339331][ T5739] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 50.388891][ T44] kauditd_printk_skb: 10 callbacks suppressed [ 50.388905][ T44] audit: type=1400 audit(1791275845.533:158): avc: denied { execmem } for pid=5746 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 50.472484][ T44] audit: type=1400 audit(1791275845.613:159): avc: denied { read } for pid=5747 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 50.472745][ T44] audit: type=1400 audit(1791275845.613:160): avc: denied { open } for pid=5747 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 50.473490][ T44] audit: type=1400 audit(1791275845.613:161): avc: denied { mounton } for pid=5747 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 50.520208][ T44] audit: type=1400 audit(1791275845.663:162): avc: denied { mount } for pid=5747 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 50.522406][ T44] audit: type=1400 audit(1791275845.663:163): avc: denied { mounton } for pid=5747 comm="syz-executor" path="/syzkaller.m1I1bd/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 50.522437][ T44] audit: type=1400 audit(1791275845.663:164): avc: denied { mount } for pid=5747 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 50.524219][ T44] audit: type=1400 audit(1791275845.663:165): avc: denied { mounton } for pid=5747 comm="syz-executor" path="/syzkaller.m1I1bd/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 50.525209][ T44] audit: type=1400 audit(1791275845.663:166): avc: denied { mounton } for pid=5747 comm="syz-executor" path="/syzkaller.m1I1bd/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3981 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 50.528639][ T44] audit: type=1400 audit(1791275845.673:167): avc: denied { unmount } for pid=5747 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 50.574204][ T5747] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 50.922604][ T5761] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 50.923664][ T5092] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 50.924168][ T5092] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 50.924526][ T5092] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 50.925012][ T5092] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 51.136312][ T110] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.136328][ T110] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.154120][ T110] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.154143][ T110] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.084693][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.085456][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.085583][ T5820] bridge_slave_0: entered allmulticast mode [ 53.086977][ T5820] bridge_slave_0: entered promiscuous mode [ 53.090498][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.090566][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.090658][ T5820] bridge_slave_1: entered allmulticast mode [ 53.092652][ T5820] bridge_slave_1: entered promiscuous mode [ 53.115731][ T5820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.118903][ T5820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.139496][ T5820] team0: Port device team_slave_0 added [ 53.141484][ T5820] team0: Port device team_slave_1 added [ 53.163246][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.163263][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 53.163282][ T5820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.165274][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.165285][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 53.165303][ T5820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.195455][ T5820] hsr_slave_0: entered promiscuous mode [ 53.196252][ T5820] hsr_slave_1: entered promiscuous mode [ 53.348187][ T5820] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 53.354113][ T5820] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 53.354859][ T5820] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 53.358346][ T5820] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 53.359331][ T5820] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 53.364382][ T5820] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 53.365179][ T5820] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 53.370355][ T5820] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 53.440284][ T5820] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.453993][ T5820] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.459608][ T110] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.459681][ T110] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.464859][ T110] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.464920][ T110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.740092][ T5820] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.772417][ T5820] veth0_vlan: entered promiscuous mode [ 53.775790][ T5820] veth1_vlan: entered promiscuous mode [ 53.793684][ T5820] veth0_macvtap: entered promiscuous mode [ 53.797605][ T5820] veth1_macvtap: entered promiscuous mode [ 53.807041][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.813022][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.825210][ T5754] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.850828][ T5754] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.850869][ T5754] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.856735][ T5785] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.921249][ T5754] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.998194][ T5754] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 54.078903][ T5754] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 54.173094][ T5754] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/10/06 08:37:29 executed programs: 0 [ 54.307957][ T5092] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 54.308380][ T5092] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 54.309531][ T5092] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 54.310428][ T5092] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 54.311154][ T5092] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 54.686627][ T5863] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.686672][ T5863] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.686818][ T5863] bridge_slave_0: entered allmulticast mode [ 54.687533][ T5863] bridge_slave_0: entered promiscuous mode [ 54.690286][ T5863] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.690393][ T5863] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.690451][ T5863] bridge_slave_1: entered allmulticast mode [ 54.691221][ T5863] bridge_slave_1: entered promiscuous mode [ 54.706603][ T5863] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.708142][ T5863] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.720400][ T5863] team0: Port device team_slave_0 added [ 54.721640][ T5863] team0: Port device team_slave_1 added [ 54.733219][ T5863] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.733229][ T5863] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.733242][ T5863] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.734212][ T5863] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.734220][ T5863] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.734233][ T5863] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.759018][ T5863] hsr_slave_0: entered promiscuous mode [ 54.759439][ T5863] hsr_slave_1: entered promiscuous mode [ 54.759739][ T5863] debugfs: 'hsr0' already exists in 'hsr' [ 54.759804][ T5863] Cannot create hsr debugfs directory [ 56.346874][ T5092] Bluetooth: hci0: command tx timeout [ 56.644732][ T5754] bridge_slave_1: left allmulticast mode [ 56.644766][ T5754] bridge_slave_1: left promiscuous mode [ 56.645857][ T5754] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.652482][ T5754] bridge_slave_0: left allmulticast mode [ 56.652501][ T5754] bridge_slave_0: left promiscuous mode [ 56.652771][ T5754] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.792687][ T5754] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 56.795213][ T5754] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 56.797149][ T5754] bond0 (unregistering): Released all slaves [ 56.852064][ T5754] hsr_slave_0: left promiscuous mode [ 56.852712][ T5754] hsr_slave_1: left promiscuous mode [ 56.853368][ T5754] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 56.853390][ T5754] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 56.854338][ T5754] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 56.854353][ T5754] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 56.866525][ T5754] veth1_macvtap: left promiscuous mode [ 56.866570][ T5754] veth0_macvtap: left promiscuous mode [ 56.866656][ T5754] veth1_vlan: left promiscuous mode [ 56.866746][ T5754] veth0_vlan: left promiscuous mode [ 56.899088][ T44] kauditd_printk_skb: 20 callbacks suppressed [ 56.899100][ T44] audit: type=1400 audit(1791275852.043:188): avc: denied { write } for pid=5882 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.900798][ T44] audit: type=1400 audit(1791275852.043:189): avc: denied { create } for pid=5882 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 56.900824][ T44] audit: type=1400 audit(1791275852.043:190): avc: denied { write } for pid=5882 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth2.link" dev="tmpfs" ino=1946 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 56.900845][ T44] audit: type=1400 audit(1791275852.043:191): avc: denied { append } for pid=5882 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" dev="tmpfs" ino=1946 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 56.964225][ T44] audit: type=1400 audit(1791275852.103:192): avc: denied { write } for pid=5885 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.965082][ T44] audit: type=1400 audit(1791275852.103:193): avc: denied { unlink } for pid=5885 comm="rm" name="resolv.conf.eth2.link" dev="tmpfs" ino=1946 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 57.047138][ T5754] team0 (unregistering): Port device team_slave_1 removed [ 57.061258][ T5754] team0 (unregistering): Port device team_slave_0 removed [ 57.171594][ T5445] 8021q: adding VLAN 0 to HW filter on device eth2 [ 57.252455][ T44] audit: type=1400 audit(1791275852.393:194): avc: denied { write } for pid=5888 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.320070][ T44] audit: type=1400 audit(1791275852.463:195): avc: denied { write } for pid=5891 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.427550][ T5863] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 57.429999][ T5863] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 57.430330][ T44] audit: type=1400 audit(1791275852.573:196): avc: denied { write } for pid=5894 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.430579][ T5863] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 57.432611][ T5863] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 57.433059][ T5863] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 57.435380][ T5863] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 57.436412][ T5863] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 57.439688][ T5863] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 57.497456][ T44] audit: type=1400 audit(1791275852.643:197): avc: denied { write } for pid=5903 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.497611][ T5863] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.508220][ T5863] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.512542][ T110] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.512627][ T110] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.520371][ T110] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.520448][ T110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.809997][ T5863] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.841193][ T5863] veth0_vlan: entered promiscuous mode [ 57.847584][ T5863] veth1_vlan: entered promiscuous mode [ 57.865943][ T5863] veth0_macvtap: entered promiscuous mode [ 57.868927][ T5863] veth1_macvtap: entered promiscuous mode [ 57.875793][ T5863] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.879272][ T5863] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.906314][ T5754] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.906542][ T5754] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.926240][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.931233][ T228] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.931245][ T228] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.947073][ T110] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.947084][ T110] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.983544][ T5921] [ 57.984375][ T5921] ====================================================== [ 57.986548][ T5921] WARNING: possible circular locking dependency detected [ 57.988671][ T5921] syzkaller #0 Not tainted [ 57.990046][ T5921] ------------------------------------------------------ [ 57.992268][ T5921] syz.0.17/5921 is trying to acquire lock: [ 57.994055][ T5921] ffff88802d8700b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_chan_connect+0xac/0x2110 [ 57.996808][ T5921] [ 57.996808][ T5921] but task is already holding lock: [ 57.999077][ T5921] ffffffff90f83f60 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x92/0xac0 [ 58.001824][ T5921] [ 58.001824][ T5921] which lock already depends on the new lock. [ 58.001824][ T5921] [ 58.004927][ T5921] [ 58.004927][ T5921] the existing dependency chain (in reverse order) is: [ 58.006037][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.010327][ T5921] [ 58.010327][ T5921] -> #2 (rfcomm_mutex){+.+.}-{4:4}: [ 58.012971][ T5921] lock_acquire+0x1d1/0x380 [ 58.014989][ T5921] __mutex_lock+0x1a4/0x1bd0 [ 58.016748][ T5921] rfcomm_security_cfm+0x3f/0x4b0 [ 58.018520][ T5921] hci_auth_complete_evt+0x811/0x1180 [ 58.020345][ T5921] hci_event_packet+0x8e9/0xcd0 [ 58.022010][ T5921] hci_rx_work+0x451/0xfc0 [ 58.023551][ T5921] process_one_work+0xac7/0x1b10 [ 58.025235][ T5921] worker_thread+0x5ef/0xe50 [ 58.026823][ T5921] kthread+0x373/0x450 [ 58.028260][ T5921] ret_from_fork+0x730/0xd60 [ 58.029840][ T5921] ret_from_fork_asm+0x1a/0x30 [ 58.031456][ T5921] [ 58.031456][ T5921] -> #1 (hci_cb_list_lock){+.+.}-{4:4}: [ 58.033837][ T5921] lock_acquire+0x1d1/0x380 [ 58.035376][ T5921] __mutex_lock+0x1a4/0x1bd0 [ 58.036968][ T5921] hci_remote_features_evt+0x485/0x9b0 [ 58.038825][ T5921] hci_event_packet+0x8e9/0xcd0 [ 58.040484][ T5921] hci_rx_work+0x451/0xfc0 [ 58.042014][ T5921] process_one_work+0xac7/0x1b10 [ 58.043670][ T5921] worker_thread+0x5ef/0xe50 [ 58.045213][ T5921] kthread+0x373/0x450 [ 58.046614][ T5921] ret_from_fork+0x730/0xd60 [ 58.048184][ T5921] ret_from_fork_asm+0x1a/0x30 [ 58.050064][ T5921] [ 58.050064][ T5921] -> #0 (&hdev->lock){+.+.}-{4:4}: [ 58.052395][ T5921] check_prev_add+0xeb/0xe60 [ 58.054021][ T5921] __lock_acquire+0x1528/0x1f40 [ 58.055666][ T5921] lock_acquire+0x1d1/0x380 [ 58.057200][ T5921] __mutex_lock+0x1a4/0x1bd0 [ 58.058824][ T5921] l2cap_chan_connect+0xac/0x2110 [ 58.060486][ T5921] l2cap_sock_connect+0x37a/0x770 [ 58.062252][ T5921] kernel_connect+0x107/0x160 [ 58.063930][ T5921] rfcomm_dlc_open+0x838/0xac0 [ 58.065669][ T5921] rfcomm_sock_connect+0x42c/0x690 [ 58.067461][ T5921] __sys_connect_file+0x146/0x1a0 [ 58.069229][ T5921] __sys_connect+0x141/0x170 [ 58.070870][ T5921] __x64_sys_connect+0x72/0xb0 [ 58.072499][ T5921] do_syscall_64+0x123/0x790 [ 58.074102][ T5921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.076093][ T5921] [ 58.076093][ T5921] other info that might help us debug this: [ 58.076093][ T5921] [ 58.079300][ T5921] Chain exists of: [ 58.079300][ T5921] &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex [ 58.079300][ T5921] [ 58.083161][ T5921] Possible unsafe locking scenario: [ 58.083161][ T5921] [ 58.085516][ T5921] CPU0 CPU1 [ 58.087360][ T5921] ---- ---- [ 58.089509][ T5921] lock(rfcomm_mutex); [ 58.091211][ T5921] lock(hci_cb_list_lock); [ 58.093470][ T5921] lock(rfcomm_mutex); [ 58.095594][ T5921] lock(&hdev->lock); [ 58.096900][ T5921] [ 58.096900][ T5921] *** DEADLOCK *** [ 58.096900][ T5921] [ 58.099459][ T5921] locks held by syz.0.17/5921: 1, last CPU#3: [ 58.101375][ T5921] #0: ffffffff90f83f60 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0x92/0xac0 [ 58.104294][ T5921] [ 58.104294][ T5921] stack backtrace: [ 58.106191][ T5921] CPU: 3 UID: 0 PID: 5921 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 58.109088][ T5921] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 58.112298][ T5921] Call Trace: [ 58.113686][ T5921] [ 58.114905][ T5921] dump_stack_lvl+0x100/0x190 [ 58.116783][ T5921] print_circular_bug.cold+0x178/0x1be [ 58.118619][ T5921] check_noncircular+0x146/0x160 [ 58.120195][ T5921] check_prev_add+0xeb/0xe60 [ 58.121656][ T5921] __lock_acquire+0x1528/0x1f40 [ 58.123206][ T5921] lock_acquire+0x1d1/0x380 [ 58.124597][ T5921] ? l2cap_chan_connect+0xac/0x2110 [ 58.126324][ T5921] ? __pfx___might_resched+0x10/0x10 [ 58.128164][ T5921] __mutex_lock+0x1a4/0x1bd0 [ 58.130034][ T5921] ? l2cap_chan_connect+0xac/0x2110 [ 58.132011][ T5921] ? l2cap_chan_connect+0xac/0x2110 [ 58.133677][ T5921] ? hci_get_route+0x368/0x520 [ 58.135248][ T5921] ? hci_get_route+0x368/0x520 [ 58.136782][ T5921] ? __pfx___mutex_lock+0x10/0x10 [ 58.138430][ T5921] ? _raw_read_unlock+0x28/0x50 [ 58.140012][ T5921] ? hci_get_route+0x368/0x520 [ 58.141549][ T5921] ? __pfx_hci_get_route+0x10/0x10 [ 58.143165][ T5921] ? reacquire_held_locks+0xdd/0x1f0 [ 58.144871][ T5921] ? release_sock+0x21/0x280 [ 58.146721][ T5921] ? l2cap_chan_connect+0xac/0x2110 [ 58.148778][ T5921] l2cap_chan_connect+0xac/0x2110 [ 58.150367][ T5921] ? __local_bh_enable_ip+0xa5/0x120 [ 58.152034][ T5921] l2cap_sock_connect+0x37a/0x770 [ 58.153644][ T5921] ? __pfx_l2cap_sock_connect+0x10/0x10 [ 58.155377][ T5921] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 58.157189][ T5921] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 58.159135][ T5921] kernel_connect+0x107/0x160 [ 58.160637][ T5921] ? __pfx_kernel_connect+0x10/0x10 [ 58.162297][ T5921] ? timer_init_key+0x150/0x310 [ 58.164678][ T5921] rfcomm_dlc_open+0x838/0xac0 [ 58.166249][ T5921] ? __pfx_rfcomm_dlc_open+0x10/0x10 [ 58.168030][ T5921] ? rfcomm_sock_connect+0x3e8/0x690 [ 58.169866][ T5921] ? find_held_lock+0x2b/0x80 [ 58.171342][ T5921] ? rfcomm_sock_connect+0x3e8/0x690 [ 58.173113][ T5921] ? __local_bh_enable_ip+0xa5/0x120 [ 58.174852][ T5921] rfcomm_sock_connect+0x42c/0x690 [ 58.176469][ T5921] __sys_connect_file+0x146/0x1a0 [ 58.178119][ T5921] __sys_connect+0x141/0x170 [ 58.179624][ T5921] ? __pfx___sys_connect+0x10/0x10 [ 58.181265][ T5921] __x64_sys_connect+0x72/0xb0 [ 58.182821][ T5921] ? lockdep_hardirqs_on+0x7d/0x110 [ 58.184475][ T5921] do_syscall_64+0x123/0x790 [ 58.185970][ T5921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.187866][ T5921] RIP: 0033:0x7fa5d1b9e199 [ 58.189310][ T5921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 58.195181][ T5921] RSP: 002b:00007ffc664cdb68 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 58.197706][ T5921] RAX: ffffffffffffffda RBX: 00007fa5d1e25fa0 RCX: 00007fa5d1b9e199 [ 58.200162][ T5921] RDX: 000000000000000a RSI: 0000200000000040 RDI: 0000000000000004 [ 58.202543][ T5921] RBP: 00007fa5d1c358e0 R08: 0000000000000000 R09: 0000000000000000 [ 58.205315][ T5921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.207839][ T5921] R13: 00007fa5d1e25fac R14: 00007fa5d1e25fa0 R15: 00007fa5d1e25fa0 [ 58.210299][ T5921] [ 58.426086][ T65] Bluetooth: hci0: command tx timeout [ 60.506073][ T65] Bluetooth: hci0: command 0x040f tx timeout [ 61.379987][ T5785] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.448530][ T5785] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.500966][ T5785] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.541447][ T5785] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.634754][ T5785] bridge_slave_1: left allmulticast mode [ 61.634777][ T5785] bridge_slave_1: left promiscuous mode [ 61.634889][ T5785] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.636481][ T5785] bridge_slave_0: left allmulticast mode [ 61.636499][ T5785] bridge_slave_0: left promiscuous mode [ 61.636620][ T5785] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.685321][ T5785] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 61.690485][ T5785] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 61.691294][ T5785] bond0 (unregistering): Released all slaves [ 61.803627][ T5445] 8021q: adding VLAN 0 to HW filter on device eth2 [ 61.890825][ T5785] hsr_slave_0: left promiscuous mode [ 61.891042][ T5785] hsr_slave_1: left promiscuous mode [ 61.891260][ T5785] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 61.891275][ T5785] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 61.891626][ T5785] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 61.891635][ T5785] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 61.894118][ T5785] veth1_macvtap: left promiscuous mode [ 61.894140][ T5785] veth0_macvtap: left promiscuous mode [ 61.894187][ T5785] veth1_vlan: left promiscuous mode [ 61.894220][ T5785] veth0_vlan: left promiscuous mode [ 61.966663][ T5785] team0 (unregistering): Port device team_slave_1 removed [ 61.970379][ T5785] team0 (unregistering): Port device team_slave_0 removed [ 62.023274][ T5445] 8021q: adding VLAN 0 to HW filter on device eth3 [ 62.075667][ T44] kauditd_printk_skb: 7 callbacks suppressed [ 62.075687][ T44] audit: type=1400 audit(1791275857.213:205): avc: denied { write } for pid=5938 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.119848][ T44] audit: type=1400 audit(1791275857.263:206): avc: denied { write } for pid=5941 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.139129][ T5445] 8021q: adding VLAN 0 to HW filter on device eth4 [ 62.194640][ T44] audit: type=1400 audit(1791275857.333:207): avc: denied { write } for pid=5944 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.224627][ T44] audit: type=1400 audit(1791275857.363:208): avc: denied { write } for pid=5947 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.249548][ T5445] 8021q: adding VLAN 0 to HW filter on device eth5