[ 84.368473][ T40] audit: type=1400 audit(1772610537.131:116): avc: denied { transition } for pid=6134 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 84.378754][ T40] audit: type=1400 audit(1772610537.141:117): avc: denied { noatsecure } for pid=6134 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 84.387713][ T40] audit: type=1400 audit(1772610537.151:118): avc: denied { rlimitinh } for pid=6134 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 84.396234][ T40] audit: type=1400 audit(1772610537.151:119): avc: denied { siginh } for pid=6134 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 86.871619][ T10] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:13506' (ED25519) to the list of known hosts. 2026/03/04 07:49:05 parsed 1 programs [ 92.399434][ T40] audit: type=1400 audit(1772610545.161:120): avc: denied { node_bind } for pid=6173 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 95.419077][ T40] audit: type=1400 audit(1772610548.181:121): avc: denied { read write } for pid=6182 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 95.431341][ T40] audit: type=1400 audit(1772610548.181:122): avc: denied { open } for pid=6182 comm="syz-executor" path="/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 95.472511][ T40] audit: type=1400 audit(1772610548.241:123): avc: denied { unlink } for pid=6182 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 95.873751][ T40] audit: type=1400 audit(1772610548.641:124): avc: denied { relabelto } for pid=6186 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 96.683479][ T6182] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 98.557076][ T63] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.562008][ T63] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.565798][ T63] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.569428][ T63] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.573699][ T63] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 99.621971][ T6225] chnl_net:caif_netlink_parms(): no params data found [ 99.670747][ T6225] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.673343][ T6225] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.676031][ T6225] bridge_slave_0: entered allmulticast mode [ 99.681067][ T6225] bridge_slave_0: entered promiscuous mode [ 99.687269][ T6225] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.690278][ T6225] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.692868][ T6225] bridge_slave_1: entered allmulticast mode [ 99.697074][ T6225] bridge_slave_1: entered promiscuous mode [ 99.718324][ T6225] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.724816][ T6225] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.745300][ T6225] team0: Port device team_slave_0 added [ 99.749103][ T6225] team0: Port device team_slave_1 added [ 99.770641][ T6225] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.773280][ T6225] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.782933][ T6225] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.787519][ T6225] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.790153][ T6225] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.799791][ T6225] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.823385][ T6225] hsr_slave_0: entered promiscuous mode [ 99.825852][ T6225] hsr_slave_1: entered promiscuous mode [ 100.459202][ T6225] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 100.470048][ T6225] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 100.476132][ T6225] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 100.483552][ T6225] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 100.505813][ T6225] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.508880][ T6225] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.512373][ T6225] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.515500][ T6225] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.559065][ T6225] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.568591][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.572299][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.582728][ T6225] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.594608][ T100] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.597224][ T100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.605005][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.607667][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.665567][ T40] audit: type=1400 audit(1772610553.431:125): avc: denied { sys_module } for pid=6225 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 100.760722][ T6225] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.796735][ T6225] veth0_vlan: entered promiscuous mode [ 100.803561][ T6225] veth1_vlan: entered promiscuous mode [ 100.819152][ T6225] veth0_macvtap: entered promiscuous mode [ 100.824744][ T6225] veth1_macvtap: entered promiscuous mode [ 100.833577][ T6225] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.842663][ T6225] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.851118][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.855726][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.859824][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.864877][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.972097][ T59] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.043665][ T59] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.122051][ T59] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.216165][ T59] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.287325][ T40] audit: type=1401 audit(1772610554.051:126): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 101.505311][ T823] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.509060][ T823] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.527383][ T823] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.531767][ T823] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/03/04 07:49:15 executed programs: 0 [ 102.416001][ T63] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 102.422368][ T63] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 102.426928][ T63] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 102.432067][ T63] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 102.435970][ T63] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.556160][ T6351] chnl_net:caif_netlink_parms(): no params data found [ 102.622003][ T6351] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.624474][ T6351] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.626989][ T6351] bridge_slave_0: entered allmulticast mode [ 102.630330][ T6351] bridge_slave_0: entered promiscuous mode [ 102.634028][ T6351] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.636933][ T6351] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.639936][ T6351] bridge_slave_1: entered allmulticast mode [ 102.642928][ T6351] bridge_slave_1: entered promiscuous mode [ 102.660674][ T6351] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.665469][ T6351] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.682462][ T6351] team0: Port device team_slave_0 added [ 102.685998][ T6351] team0: Port device team_slave_1 added [ 102.701308][ T6351] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.703688][ T6351] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.713001][ T6351] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.719501][ T6351] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.723640][ T6351] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.735758][ T6351] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.779612][ T6351] hsr_slave_0: entered promiscuous mode [ 102.782969][ T6351] hsr_slave_1: entered promiscuous mode [ 102.786010][ T6351] debugfs: 'hsr0' already exists in 'hsr' [ 102.788747][ T6351] Cannot create hsr debugfs directory [ 103.813236][ T59] bridge_slave_1: left allmulticast mode [ 103.815246][ T59] bridge_slave_1: left promiscuous mode [ 103.817289][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.821973][ T59] bridge_slave_0: left allmulticast mode [ 103.824132][ T59] bridge_slave_0: left promiscuous mode [ 103.826325][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.985027][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 103.989726][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 103.994524][ T59] bond0 (unregistering): Released all slaves [ 104.167443][ T59] hsr_slave_0: left promiscuous mode [ 104.175861][ T59] hsr_slave_1: left promiscuous mode [ 104.179461][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 104.183181][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 104.187156][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.191046][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 104.198551][ T59] veth1_macvtap: left promiscuous mode [ 104.201377][ T59] veth0_macvtap: left promiscuous mode [ 104.204119][ T59] veth1_vlan: left promiscuous mode [ 104.206701][ T59] veth0_vlan: left promiscuous mode [ 104.366808][ T59] team0 (unregistering): Port device team_slave_1 removed [ 104.378622][ T59] team0 (unregistering): Port device team_slave_0 removed [ 104.470225][ T63] Bluetooth: hci0: command tx timeout [ 104.861384][ T6351] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.866285][ T6351] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.870879][ T6351] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.876588][ T6351] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.957667][ T6351] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.968581][ T6351] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.975949][ T823] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.979133][ T823] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.989100][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.991622][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.335441][ T6351] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.358783][ T6351] veth0_vlan: entered promiscuous mode [ 105.365665][ T6351] veth1_vlan: entered promiscuous mode [ 105.389032][ T6351] veth0_macvtap: entered promiscuous mode [ 105.414822][ T6351] veth1_macvtap: entered promiscuous mode [ 105.426448][ T6351] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.434683][ T6351] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.449209][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.453589][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.457574][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.463523][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.523552][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.527298][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.586727][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.590417][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.629856][ T40] audit: type=1400 audit(1772610558.401:127): avc: denied { read write } for pid=6398 comm="syz.0.17" name="uinput" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 105.641837][ T40] audit: type=1400 audit(1772610558.401:128): avc: denied { open } for pid=6398 comm="syz.0.17" path="/dev/uinput" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 105.644119][ T6399] input: syz1 as /devices/virtual/input/input5 [ 105.652602][ T40] audit: type=1400 audit(1772610558.411:129): avc: denied { ioctl } for pid=6398 comm="syz.0.17" path="/dev/uinput" dev="devtmpfs" ino=943 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 105.661177][ T6399] [ 105.666091][ T40] audit: type=1400 audit(1772610558.431:130): avc: denied { read } for pid=6398 comm="syz.0.17" name="event4" dev="devtmpfs" ino=2845 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 105.666968][ T6399] ====================================================== [ 105.677060][ T40] audit: type=1400 audit(1772610558.431:131): avc: denied { open } for pid=6398 comm="syz.0.17" path="/dev/input/event4" dev="devtmpfs" ino=2845 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 105.680036][ T6399] WARNING: possible circular locking dependency detected [ 105.680047][ T6399] syzkaller #0 Not tainted [ 105.680056][ T6399] ------------------------------------------------------ [ 105.680061][ T6399] syz.0.17/6399 is trying to acquire lock: [ 105.680072][ T6399] ffff88802610e070 (&newdev->mutex [ 105.690061][ T40] audit: type=1400 audit(1772610558.431:132): avc: denied { ioctl } for pid=6398 comm="syz.0.17" path="/dev/input/event4" dev="devtmpfs" ino=2845 ioctlcmd=0x4580 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 105.693148][ T6399] ){+.+.}-{4:4}, at: uinput_request_submit.part.0+0x25/0x2e0 [ 105.714604][ T6399] [ 105.714604][ T6399] but task is already holding lock: [ 105.717385][ T6399] ffff88803219a8b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1d7/0xc60 [ 105.721052][ T6399] [ 105.721052][ T6399] which lock already depends on the new lock. [ 105.721052][ T6399] [ 105.725103][ T6399] [ 105.725103][ T6399] the existing dependency chain (in reverse order) is: [ 105.728874][ T6399] [ 105.728874][ T6399] -> #3 (&ff->mutex){+.+.}-{4:4}: [ 105.732039][ T6399] __mutex_lock+0x1a2/0x1b90 [ 105.734330][ T6399] input_ff_flush+0x63/0x1b0 [ 105.736682][ T6399] uinput_dev_flush+0x2a/0x40 [ 105.739203][ T6399] input_flush_device+0xc9/0x140 [ 105.741984][ T6399] evdev_release+0x344/0x420 [ 105.744445][ T6399] __fput+0x3ff/0xb40 [ 105.746487][ T6399] fput_close_sync+0x118/0x250 [ 105.748801][ T6399] __x64_sys_close+0x8b/0x120 [ 105.751174][ T6399] do_syscall_64+0x106/0xf80 [ 105.753468][ T6399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.756332][ T6399] [ 105.756332][ T6399] -> #2 (&dev->mutex#2){+.+.}-{4:4}: [ 105.760159][ T6399] __mutex_lock+0x1a2/0x1b90 [ 105.762569][ T6399] input_register_handle+0xca/0x630 [ 105.765075][ T6399] kbd_connect+0xce/0x180 [ 105.767231][ T6399] input_attach_handler.isra.0+0x177/0x1e0 [ 105.770031][ T6399] input_register_device.cold+0x139/0x375 [ 105.772864][ T6399] acpi_button_probe+0x5d3/0xbc0 [ 105.775407][ T6399] platform_probe+0x106/0x1d0 [ 105.777875][ T6399] really_probe+0x241/0xa60 [ 105.780197][ T6399] __driver_probe_device+0x1de/0x400 [ 105.782912][ T6399] driver_probe_device+0x4c/0x1b0 [ 105.785397][ T6399] __driver_attach+0x2f4/0x6a0 [ 105.787790][ T6399] bus_for_each_dev+0x13e/0x1d0 [ 105.790325][ T6399] bus_add_driver+0x305/0x5b0 [ 105.792882][ T6399] driver_register+0x1e2/0x360 [ 105.795463][ T6399] acpi_button_init+0xe4/0x100 [ 105.797720][ T6399] do_one_initcall+0x11d/0x760 [ 105.800017][ T6399] kernel_init_freeable+0x6e5/0x7a0 [ 105.802559][ T6399] kernel_init+0x1f/0x1e0 [ 105.804706][ T6399] ret_from_fork+0x754/0xd80 [ 105.807119][ T6399] ret_from_fork_asm+0x1a/0x30 [ 105.809380][ T6399] [ 105.809380][ T6399] -> #1 (input_mutex){+.+.}-{4:4}: [ 105.812212][ T6399] __mutex_lock+0x1a2/0x1b90 [ 105.813926][ T6399] input_register_device.cold+0x5b/0x375 [ 105.816070][ T6399] uinput_ioctl_handler.isra.0+0x8d8/0x1d10 [ 105.818787][ T6399] __x64_sys_ioctl+0x18e/0x210 [ 105.820733][ T6399] do_syscall_64+0x106/0xf80 [ 105.822714][ T6399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.824945][ T6399] [ 105.824945][ T6399] -> #0 (&newdev->mutex){+.+.}-{4:4}: [ 105.827638][ T6399] __lock_acquire+0x14b8/0x2630 [ 105.829783][ T6399] lock_acquire+0x1cf/0x380 [ 105.832191][ T6399] __mutex_lock+0x1a2/0x1b90 [ 105.834507][ T6399] uinput_request_submit.part.0+0x25/0x2e0 [ 105.836719][ T6399] uinput_dev_upload_effect+0x174/0x1f0 [ 105.838824][ T6399] input_ff_upload+0x578/0xc60 [ 105.840404][ T6399] evdev_do_ioctl+0x1228/0x1b60 [ 105.842576][ T6399] evdev_ioctl+0x16f/0x1a0 [ 105.844251][ T6399] __x64_sys_ioctl+0x18e/0x210 [ 105.846051][ T6399] do_syscall_64+0x106/0xf80 [ 105.847818][ T6399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.850003][ T6399] [ 105.850003][ T6399] other info that might help us debug this: [ 105.850003][ T6399] [ 105.853675][ T6399] Chain exists of: [ 105.853675][ T6399] &newdev->mutex --> &dev->mutex#2 --> &ff->mutex [ 105.853675][ T6399] [ 105.858082][ T6399] Possible unsafe locking scenario: [ 105.858082][ T6399] [ 105.860788][ T6399] CPU0 CPU1 [ 105.863038][ T6399] ---- ---- [ 105.865238][ T6399] lock(&ff->mutex); [ 105.866700][ T6399] lock(&dev->mutex#2); [ 105.869153][ T6399] lock(&ff->mutex); [ 105.871608][ T6399] lock(&newdev->mutex); [ 105.873021][ T6399] [ 105.873021][ T6399] *** DEADLOCK *** [ 105.873021][ T6399] [ 105.875588][ T6399] 2 locks held by syz.0.17/6399: [ 105.877393][ T6399] #0: ffff888036c91118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_ioctl+0x7f/0x1a0 [ 105.880934][ T6399] #1: ffff88803219a8b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_upload+0x1d7/0xc60 [ 105.884324][ T6399] [ 105.884324][ T6399] stack backtrace: [ 105.886451][ T6399] CPU: 0 UID: 0 PID: 6399 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 105.886466][ T6399] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.886472][ T6399] Call Trace: [ 105.886478][ T6399] [ 105.886483][ T6399] dump_stack_lvl+0x100/0x190 [ 105.886503][ T6399] print_circular_bug.cold+0x178/0x1c7 [ 105.886526][ T6399] check_noncircular+0x146/0x160 [ 105.886544][ T6399] __lock_acquire+0x14b8/0x2630 [ 105.886567][ T6399] lock_acquire+0x1cf/0x380 [ 105.886583][ T6399] ? uinput_request_submit.part.0+0x25/0x2e0 [ 105.886600][ T6399] ? __pfx___might_resched+0x10/0x10 [ 105.886614][ T6399] __mutex_lock+0x1a2/0x1b90 [ 105.886627][ T6399] ? uinput_request_submit.part.0+0x25/0x2e0 [ 105.886643][ T6399] ? uinput_request_submit.part.0+0x25/0x2e0 [ 105.886657][ T6399] ? find_held_lock+0x2b/0x80 [ 105.886671][ T6399] ? uinput_request_reserve_slot+0x3ca/0x4d0 [ 105.886687][ T6399] ? __pfx___mutex_lock+0x10/0x10 [ 105.886698][ T6399] ? do_raw_spin_unlock+0x145/0x1e0 [ 105.886710][ T6399] ? _raw_spin_unlock+0x28/0x50 [ 105.886727][ T6399] ? __pfx_uinput_request_reserve_slot+0x10/0x10 [ 105.886743][ T6399] ? trace_contention_end+0x140/0x180 [ 105.886755][ T6399] ? uinput_request_submit.part.0+0x25/0x2e0 [ 105.886770][ T6399] uinput_request_submit.part.0+0x25/0x2e0 [ 105.886786][ T6399] uinput_dev_upload_effect+0x174/0x1f0 [ 105.886801][ T6399] ? __pfx_uinput_dev_upload_effect+0x10/0x10 [ 105.886820][ T6399] input_ff_upload+0x578/0xc60 [ 105.886836][ T6399] evdev_do_ioctl+0x1228/0x1b60 [ 105.886849][ T6399] ? __pfx_evdev_do_ioctl+0x10/0x10 [ 105.886861][ T6399] ? __pfx___mutex_lock+0x10/0x10 [ 105.886876][ T6399] evdev_ioctl+0x16f/0x1a0 [ 105.886888][ T6399] ? __pfx_evdev_ioctl+0x10/0x10 [ 105.886900][ T6399] __x64_sys_ioctl+0x18e/0x210 [ 105.886917][ T6399] do_syscall_64+0x106/0xf80 [ 105.886928][ T6399] ? clear_bhb_loop+0x40/0x90 [ 105.886940][ T6399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.886951][ T6399] RIP: 0033:0x7f9c5099af39 [ 105.886961][ T6399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.886972][ T6399] RSP: 002b:00007f9c518b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 105.886982][ T6399] RAX: ffffffffffffffda RBX: 00007f9c50c05fa0 RCX: 00007f9c5099af39 [ 105.886989][ T6399] RDX: 0000200000000300 RSI: 0000000040304580 RDI: 0000000000000004 [ 105.886996][ T6399] RBP: 00007f9c50a2fee0 R08: 0000000000000000 R09: 0000000000000000 [ 105.887002][ T6399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.887008][ T6399] R13: 00007f9c50c06038 R14: 00007f9c50c05fa0 R15: 00007fff80b0d7a8 [ 105.887018][ T6399] [ 106.476617][ T6401] input: syz1 as /devices/virtual/input/input6 [ 106.559650][ T63] Bluetooth: hci0: command tx timeout [ 107.323519][ T6403] input: syz1 as /devices/virtual/input/input7 [ 108.166713][ T6405] input: syz1 as /devices/virtual/input/input8 2026/03/04 07:49:20 executed programs: 5 [ 108.629824][ T63] Bluetooth: hci0: command tx timeout [ 109.012368][ T6407] input: syz1 as /devices/virtual/input/input9 [ 109.859459][ T6409] input: syz1 as /devices/virtual/input/input10 [ 110.710305][ T6411] input: syz1 as /devices/virtual/input/input11 [ 110.719779][ T63] Bluetooth: hci0: command tx timeout [ 111.551275][ T6413] input: syz1 as /devices/virtual/input/input12 [ 112.399172][ T6415] input: syz1 as /devices/virtual/input/input13 [ 113.244572][ T6417] input: syz1 as /devices/virtual/input/input14 2026/03/04 07:49:26 executed programs: 11 [ 114.089060][ T6419] input: syz1 as /devices/virtual/input/input15 [ 114.943240][ T6421] input: syz1 as /devices/virtual/input/input16