[ 89.417632][ T897] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 89.427990][ T897] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 89.436156][ T897] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 89.443919][ T897] device bridge_slave_1 left promiscuous mode [ 89.451573][ T897] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.461164][ T897] device bridge_slave_0 left promiscuous mode [ 89.468620][ T897] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.481963][ T897] device veth1_macvtap left promiscuous mode [ 89.488689][ T897] device veth0_macvtap left promiscuous mode [ 89.495359][ T897] device veth1_vlan left promiscuous mode [ 89.501694][ T897] device veth0_vlan left promiscuous mode [ 89.630721][ T897] team0 (unregistering): Port device team_slave_1 removed [ 89.643624][ T897] team0 (unregistering): Port device team_slave_0 removed [ 89.656843][ T897] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 89.673489][ T897] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 89.719315][ T897] bond0 (unregistering): Released all slaves [ 92.296190][ T1835] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts. 2026/10/21 09:41:48 parsed 1 programs 2026/10/21 09:41:48 serving rpc on tcp://43463 Setting up swapspace version 1, size = 127995904 bytes [ 99.105896][ T4484] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 102.188922][ T4561] chnl_net:caif_netlink_parms(): no params data found [ 102.281298][ T4561] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.292170][ T4561] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.305146][ T4561] device bridge_slave_0 entered promiscuous mode [ 102.319724][ T4561] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.327389][ T4561] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.336477][ T4561] device bridge_slave_1 entered promiscuous mode [ 102.364024][ T4561] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.378882][ T4561] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.421841][ T4561] team0: Port device team_slave_0 added [ 102.447937][ T4561] team0: Port device team_slave_1 added [ 102.480807][ T4561] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.488258][ T4561] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.515632][ T4561] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.537005][ T4561] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.564639][ T4561] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.614384][ T4561] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.678620][ T4561] device hsr_slave_0 entered promiscuous mode [ 102.688981][ T4561] device hsr_slave_1 entered promiscuous mode [ 102.730499][ T897] ODEBUG: Out of memory. ODEBUG disabled [ 103.373801][ T4561] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.405564][ T4561] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.416490][ T4561] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.426569][ T4561] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.519209][ T4561] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.556359][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 103.567515][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.579822][ T4561] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.611486][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 103.623157][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 103.632640][ T140] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.639980][ T140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.685663][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 103.695489][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 103.706576][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 103.720933][ T140] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.729126][ T140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.743890][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 103.758008][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 103.770813][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 103.781705][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 103.791660][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 103.805496][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 103.822880][ T4561] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 103.835970][ T4561] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 103.850007][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 103.861745][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 103.870577][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 103.880650][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 103.890696][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 103.944988][ T140] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 104.075215][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 104.083434][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 104.099411][ T4561] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.123317][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 104.133400][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 104.153945][ T4561] device veth0_vlan entered promiscuous mode [ 104.164583][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 104.173880][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 104.183920][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 104.192626][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 104.220956][ T4561] device veth1_vlan entered promiscuous mode [ 104.247332][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 104.257688][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 104.273170][ T4561] device veth0_macvtap entered promiscuous mode [ 104.319299][ T4561] device veth1_macvtap entered promiscuous mode [ 104.348265][ T4561] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.357449][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 104.367428][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 104.380009][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 104.389566][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 104.403704][ T4561] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.416653][ T4561] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.426756][ T4561] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.439401][ T4561] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.448936][ T4561] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.462266][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 104.472347][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 104.991380][ T4231] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.008185][ T4231] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.030032][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 105.049821][ T4231] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.061151][ T4231] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.085268][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2026/10/21 09:41:58 executed programs: 0 [ 106.565752][ T897] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.592004][ T4757] chnl_net:caif_netlink_parms(): no params data found [ 106.650105][ T4757] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.657324][ T4757] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.665663][ T4757] device bridge_slave_0 entered promiscuous mode [ 106.674663][ T4757] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.682025][ T4757] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.691359][ T4757] device bridge_slave_1 entered promiscuous mode [ 106.713969][ T4757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 106.729889][ T4757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 106.761648][ T4757] team0: Port device team_slave_0 added [ 106.769670][ T4757] team0: Port device team_slave_1 added [ 106.789019][ T4757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 106.796607][ T4757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 106.827397][ T4757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 106.840498][ T4757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 106.848223][ T4757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 106.875905][ T4757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 106.909963][ T4757] device hsr_slave_0 entered promiscuous mode [ 106.918048][ T4757] device hsr_slave_1 entered promiscuous mode [ 106.925613][ T4757] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 106.933331][ T4757] Cannot create hsr debugfs directory [ 108.534483][ T4256] Bluetooth: hci0: command 0x0409 tx timeout [ 109.057655][ T897] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.099125][ T897] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.140215][ T897] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.013820][ T4757] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.027397][ T4757] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.037642][ T4757] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.051644][ T4757] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.109662][ T4757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.133719][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 110.142475][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 110.152412][ T4757] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.162755][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 110.171731][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 110.181281][ T4231] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.189014][ T4231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.196985][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 110.209926][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 110.219298][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 110.228705][ T4231] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.237272][ T4231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.248199][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 110.269461][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 110.285838][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 110.296246][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 110.305499][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 110.316642][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 110.326132][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 110.335420][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 110.343913][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 110.355089][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 110.363604][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 110.385744][ T4757] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 110.459265][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 110.467454][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 110.482737][ T4757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.508309][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 110.517295][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 110.552779][ T897] device hsr_slave_0 left promiscuous mode [ 110.559507][ T897] device hsr_slave_1 left promiscuous mode [ 110.566210][ T897] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 110.574136][ T897] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 110.582494][ T897] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 110.590741][ T897] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 110.599313][ T897] device bridge_slave_1 left promiscuous mode [ 110.606172][ T897] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.615902][ T897] device bridge_slave_0 left promiscuous mode [ 110.622207][ T897] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.624569][ T1108] Bluetooth: hci0: command 0x041b tx timeout [ 110.638608][ T897] device veth1_macvtap left promiscuous mode [ 110.645806][ T897] device veth0_macvtap left promiscuous mode [ 110.651994][ T897] device veth1_vlan left promiscuous mode [ 110.658112][ T897] device veth0_vlan left promiscuous mode [ 110.769850][ T897] team0 (unregistering): Port device team_slave_1 removed [ 110.781665][ T897] team0 (unregistering): Port device team_slave_0 removed [ 110.793462][ T897] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 110.807580][ T897] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 110.851201][ T897] bond0 (unregistering): Released all slaves [ 110.867546][ T4757] device veth0_vlan entered promiscuous mode [ 110.875706][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 110.884003][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 110.894216][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 110.903078][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 110.918330][ T4757] device veth1_vlan entered promiscuous mode [ 110.942577][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 110.950798][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 110.959674][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 110.968760][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 110.980468][ T4757] device veth0_macvtap entered promiscuous mode [ 110.990563][ T4757] device veth1_macvtap entered promiscuous mode [ 111.007987][ T4757] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.017529][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 111.026025][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 111.034164][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 111.043067][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 111.054663][ T4757] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.064765][ T4757] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.073666][ T4757] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.084588][ T4757] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.093960][ T4757] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.105676][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 111.114425][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 111.172320][ T4231] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.184239][ T4231] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.197515][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 111.213784][ T4312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.222665][ T4312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.231383][ T4231] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 111.282178][ T4987] [ 111.284542][ T4987] ====================================================== [ 111.291924][ T4987] WARNING: possible circular locking dependency detected [ 111.299410][ T4987] syzkaller #0 Not tainted [ 111.304013][ T4987] ------------------------------------------------------ [ 111.311315][ T4987] syz.0.17/4987 is trying to acquire lock: [ 111.317330][ T4987] ffffffff8dd20988 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x1d/0x2c0 [ 111.326594][ T4987] [ 111.326594][ T4987] but task is already holding lock: [ 111.333972][ T4987] ffff888073eb1310 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x55/0x250 [ 111.343303][ T4987] [ 111.343303][ T4987] which lock already depends on the new lock. [ 111.343303][ T4987] [ 111.353895][ T4987] [ 111.353895][ T4987] the existing dependency chain (in reverse order) is: [ 111.363085][ T4987] [ 111.363085][ T4987] -> #2 (&gi->lock){+.+.}-{3:3}: [ 111.370232][ T4987] __mutex_lock_common+0x1e5/0x2400 [ 111.376051][ T4987] mutex_lock_nested+0x17/0x20 [ 111.381341][ T4987] config_usb_cfg_link+0x55/0x250 [ 111.386944][ T4987] configfs_symlink+0x5a4/0x13b0 [ 111.392414][ T4987] vfs_symlink+0x245/0x3d0 [ 111.397362][ T4987] do_symlinkat+0x1ab/0x6b0 [ 111.402491][ T4987] __x64_sys_symlinkat+0x95/0xa0 [ 111.407951][ T4987] do_syscall_64+0x4c/0xa0 [ 111.412973][ T4987] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 111.419518][ T4987] [ 111.419518][ T4987] -> #1 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}: [ 111.428439][ T4987] down_write+0x38/0x60 [ 111.433128][ T4987] configfs_depend_item_unlocked+0x14c/0x450 [ 111.439642][ T4987] usbg_make_tpg+0x1dd/0x550 [ 111.444756][ T4987] target_fabric_make_tpg+0xa0/0x6d0 [ 111.450997][ T4987] configfs_mkdir+0x511/0x9e0 [ 111.458145][ T4987] vfs_mkdir+0x386/0x570 [ 111.463714][ T4987] do_mkdirat+0x1dd/0x5c0 [ 111.468673][ T4987] __x64_sys_mkdirat+0x85/0x90 [ 111.474188][ T4987] do_syscall_64+0x4c/0xa0 [ 111.479314][ T4987] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 111.485882][ T4987] [ 111.485882][ T4987] -> #0 (tpg_instances_lock){+.+.}-{3:3}: [ 111.493984][ T4987] __lock_acquire+0x38f7/0x7d40 [ 111.499750][ T4987] lock_acquire+0x19f/0x400 [ 111.504812][ T4987] __mutex_lock_common+0x1e5/0x2400 [ 111.512437][ T4987] mutex_lock_nested+0x17/0x20 [ 111.518171][ T4987] tcm_alloc+0x1d/0x2c0 [ 111.523250][ T4987] usb_get_function+0x59/0xa0 [ 111.528645][ T4987] config_usb_cfg_link+0x144/0x250 [ 111.534631][ T4987] configfs_symlink+0x5a4/0x13b0 [ 111.540429][ T4987] vfs_symlink+0x245/0x3d0 [ 111.545361][ T4987] do_symlinkat+0x1ab/0x6b0 [ 111.550396][ T4987] __x64_sys_symlinkat+0x95/0xa0 [ 111.555933][ T4987] do_syscall_64+0x4c/0xa0 [ 111.561213][ T4987] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 111.567802][ T4987] [ 111.567802][ T4987] other info that might help us debug this: [ 111.567802][ T4987] [ 111.578298][ T4987] Chain exists of: [ 111.578298][ T4987] tpg_instances_lock --> &sb->s_type->i_mutex_key#21 --> &gi->lock [ 111.578298][ T4987] [ 111.592214][ T4987] Possible unsafe locking scenario: [ 111.592214][ T4987] [ 111.599921][ T4987] CPU0 CPU1 [ 111.605457][ T4987] ---- ---- [ 111.610831][ T4987] lock(&gi->lock); [ 111.614873][ T4987] lock(&sb->s_type->i_mutex_key#21); [ 111.623001][ T4987] lock(&gi->lock); [ 111.629408][ T4987] lock(tpg_instances_lock); [ 111.634434][ T4987] [ 111.634434][ T4987] *** DEADLOCK *** [ 111.634434][ T4987] [ 111.642759][ T4987] 3 locks held by syz.0.17/4987: [ 111.647853][ T4987] #0: ffff88801e432460 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 [ 111.657246][ T4987] #1: ffff8880740a1fb0 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: configfs_symlink+0x47b/0x13b0 [ 111.668210][ T4987] #2: ffff888073eb1310 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x55/0x250 [ 111.677948][ T4987] [ 111.677948][ T4987] stack backtrace: [ 111.683887][ T4987] CPU: 0 PID: 4987 Comm: syz.0.17 Not tainted syzkaller #0 [ 111.691072][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 111.701398][ T4987] Call Trace: [ 111.704669][ T4987] [ 111.707583][ T4987] dump_stack_lvl+0x188/0x250 [ 111.712297][ T4987] ? load_image+0x410/0x410 [ 111.716940][ T4987] ? show_regs_print_info+0x20/0x20 [ 111.722135][ T4987] ? print_circular_bug+0x12b/0x1a0 [ 111.727327][ T4987] check_noncircular+0x2f8/0x400 [ 111.732448][ T4987] ? print_deadlock_bug+0x5d0/0x5d0 [ 111.737673][ T4987] ? lockdep_lock+0xf1/0x1f0 [ 111.742265][ T4987] ? mark_lock+0x94/0x320 [ 111.746788][ T4987] ? _find_first_zero_bit+0xd1/0xf0 [ 111.752148][ T4987] __lock_acquire+0x38f7/0x7d40 [ 111.757341][ T4987] ? stack_trace_snprint+0xe0/0xe0 [ 111.762543][ T4987] ? verify_lock_unused+0x140/0x140 [ 111.767826][ T4987] ? verify_lock_unused+0x140/0x140 [ 111.773375][ T4987] ? add_lock_to_list+0x18d/0x280 [ 111.778617][ T4987] lock_acquire+0x19f/0x400 [ 111.783286][ T4987] ? tcm_alloc+0x1d/0x2c0 [ 111.787887][ T4987] ? __might_sleep+0xf0/0xf0 [ 111.792664][ T4987] ? read_lock_is_recursive+0x10/0x10 [ 111.798064][ T4987] ? __mutex_trylock_common+0x15c/0x260 [ 111.804931][ T4987] __mutex_lock_common+0x1e5/0x2400 [ 111.810498][ T4987] ? tcm_alloc+0x1d/0x2c0 [ 111.814929][ T4987] ? __mutex_lock_common+0x435/0x2400 [ 111.820378][ T4987] ? lock_chain_count+0x20/0x20 [ 111.825343][ T4987] ? tcm_alloc+0x1d/0x2c0 [ 111.830745][ T4987] ? mutex_lock_io_nested+0x60/0x60 [ 111.836906][ T4987] ? mutex_lock_io_nested+0x60/0x60 [ 111.842865][ T4987] mutex_lock_nested+0x17/0x20 [ 111.847827][ T4987] tcm_alloc+0x1d/0x2c0 [ 111.852223][ T4987] usb_get_function+0x59/0xa0 [ 111.858037][ T4987] config_usb_cfg_link+0x144/0x250 [ 111.863345][ T4987] configfs_symlink+0x5a4/0x13b0 [ 111.868580][ T4987] ? end_current_label_crit_section+0x14b/0x170 [ 111.875020][ T4987] ? common_perm+0x15d/0x1b0 [ 111.879934][ T4987] ? from_kgid+0x14f/0x6a0 [ 111.884747][ T4987] ? apparmor_path_symlink+0x1ac/0x230 [ 111.890510][ T4987] ? lookup_one_qstr_excl+0x11c/0x240 [ 111.895889][ T4987] ? detach_groups+0x370/0x370 [ 111.900828][ T4987] ? inode_permission+0xef/0x480 [ 111.905875][ T4987] ? bpf_lsm_inode_symlink+0x5/0x10 [ 111.911392][ T4987] ? security_inode_symlink+0xb2/0x100 [ 111.918261][ T4987] vfs_symlink+0x245/0x3d0 [ 111.922805][ T4987] do_symlinkat+0x1ab/0x6b0 [ 111.927676][ T4987] ? strncpy_from_user+0x1f4/0x350 [ 111.933331][ T4987] ? vfs_symlink+0x3d0/0x3d0 [ 111.938335][ T4987] __x64_sys_symlinkat+0x95/0xa0 [ 111.943746][ T4987] do_syscall_64+0x4c/0xa0 [ 111.950163][ T4987] ? clear_bhb_loop+0x30/0x80 [ 111.957069][ T4987] ? clear_bhb_loop+0x30/0x80 [ 111.962895][ T4987] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 111.969553][ T4987] RIP: 0033:0x7f8097d17159 [ 111.974388][ T4987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.996031][ T4987] RSP: 002b:00007f8097377028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 112.006192][ T4987] RAX: ffffffffffffffda RBX: 00007f8097f9efa0 RCX: 00007f8097d17159 [ 112.016137][ T4987] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 112.025188][ T4987] RBP: 00007f8097dae06b R08: 0000000000000000 R09: 0000000000000000 [ 112.033435][ T4987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.041622][ T4987] R13: 00007f8097f9f038 R14: 00007f8097f9efa0 R15: 00007ffd4c759ea8 [ 112.049770][ T4987] 2026/10/21 09:42:04 executed programs: 3 [ 112.694560][ T1108] Bluetooth: hci0: command 0x040f tx timeout [ 114.774742][ T4612] Bluetooth: hci0: command 0x0419 tx timeout 2026/10/21 09:42:09 executed programs: 294