[ 85.670605][ T40] audit: type=1400 audit(1772609688.288:116): avc: denied { transition } for pid=6131 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 85.680764][ T40] audit: type=1400 audit(1772609688.298:117): avc: denied { noatsecure } for pid=6131 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 85.689641][ T40] audit: type=1400 audit(1772609688.298:118): avc: denied { rlimitinh } for pid=6131 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 85.697803][ T40] audit: type=1400 audit(1772609688.298:119): avc: denied { siginh } for pid=6131 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 86.675420][ T1026] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:27201' (ED25519) to the list of known hosts. 2026/03/04 07:34:56 parsed 1 programs [ 93.759531][ T40] audit: type=1400 audit(1772609696.378:120): avc: denied { node_bind } for pid=6172 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 96.384066][ T40] audit: type=1400 audit(1772609698.998:121): avc: denied { read write } for pid=6183 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 96.396025][ T40] audit: type=1400 audit(1772609698.998:122): avc: denied { open } for pid=6183 comm="syz-executor" path="/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 96.458575][ T40] audit: type=1400 audit(1772609699.078:123): avc: denied { unlink } for pid=6183 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 96.987026][ T40] audit: type=1400 audit(1772609699.608:124): avc: denied { relabelto } for pid=6186 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 97.793275][ T6183] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 100.567862][ T5284] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.571979][ T5284] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.577578][ T5284] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.583101][ T5284] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.589076][ T5284] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 100.860235][ T6221] chnl_net:caif_netlink_parms(): no params data found [ 100.944832][ T6221] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.947309][ T6221] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.950188][ T6221] bridge_slave_0: entered allmulticast mode [ 100.953167][ T6221] bridge_slave_0: entered promiscuous mode [ 100.958601][ T6221] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.961802][ T6221] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.965430][ T6221] bridge_slave_1: entered allmulticast mode [ 100.968195][ T6221] bridge_slave_1: entered promiscuous mode [ 100.994688][ T6221] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.999722][ T6221] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.020817][ T6221] team0: Port device team_slave_0 added [ 101.025738][ T6221] team0: Port device team_slave_1 added [ 101.051217][ T6221] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.053598][ T6221] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.062817][ T6221] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.069281][ T6221] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.071895][ T6221] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.082908][ T6221] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.117751][ T6221] hsr_slave_0: entered promiscuous mode [ 101.121072][ T6221] hsr_slave_1: entered promiscuous mode [ 101.821935][ T6221] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 101.832617][ T6221] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 101.837667][ T6221] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 101.843082][ T6221] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 101.921848][ T6221] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.933084][ T6221] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.939726][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.942825][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.951185][ T499] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.953925][ T499] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.031453][ T40] audit: type=1400 audit(1772609704.648:125): avc: denied { sys_module } for pid=6221 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 102.122954][ T6221] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.150464][ T6221] veth0_vlan: entered promiscuous mode [ 102.158537][ T6221] veth1_vlan: entered promiscuous mode [ 102.173318][ T6221] veth0_macvtap: entered promiscuous mode [ 102.178572][ T6221] veth1_macvtap: entered promiscuous mode [ 102.187577][ T6221] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.194702][ T6221] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.201694][ T499] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.205180][ T499] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.211966][ T499] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.217717][ T499] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.338845][ T60] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.447803][ T60] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.535347][ T60] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.619263][ T40] audit: type=1401 audit(1772609705.238:126): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 102.649403][ T60] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.749679][ T499] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.753304][ T499] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.796090][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.798942][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/03/04 07:35:06 executed programs: 0 [ 103.738989][ T5284] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 103.743140][ T5284] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 103.747940][ T5284] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 103.751977][ T5284] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 103.757767][ T5284] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 103.878104][ T6347] chnl_net:caif_netlink_parms(): no params data found [ 103.966563][ T6347] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.970055][ T6347] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.973579][ T6347] bridge_slave_0: entered allmulticast mode [ 103.978542][ T6347] bridge_slave_0: entered promiscuous mode [ 103.983934][ T6347] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.987780][ T6347] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.991167][ T6347] bridge_slave_1: entered allmulticast mode [ 103.995597][ T6347] bridge_slave_1: entered promiscuous mode [ 104.016957][ T6347] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.023721][ T6347] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.043317][ T6347] team0: Port device team_slave_0 added [ 104.048061][ T6347] team0: Port device team_slave_1 added [ 104.067136][ T6347] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.069695][ T6347] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.079577][ T6347] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.085180][ T6347] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.088206][ T6347] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.099115][ T6347] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.123153][ T6347] hsr_slave_0: entered promiscuous mode [ 104.127019][ T6347] hsr_slave_1: entered promiscuous mode [ 104.129895][ T6347] debugfs: 'hsr0' already exists in 'hsr' [ 104.132271][ T6347] Cannot create hsr debugfs directory [ 105.203512][ T60] bridge_slave_1: left allmulticast mode [ 105.206221][ T60] bridge_slave_1: left promiscuous mode [ 105.209133][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.216153][ T60] bridge_slave_0: left allmulticast mode [ 105.218111][ T60] bridge_slave_0: left promiscuous mode [ 105.220189][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.366157][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 105.372886][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 105.378615][ T60] bond0 (unregistering): Released all slaves [ 105.487655][ T60] hsr_slave_0: left promiscuous mode [ 105.491012][ T60] hsr_slave_1: left promiscuous mode [ 105.494712][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 105.497932][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 105.501574][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 105.504918][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 105.514161][ T60] veth1_macvtap: left promiscuous mode [ 105.516713][ T60] veth0_macvtap: left promiscuous mode [ 105.519268][ T60] veth1_vlan: left promiscuous mode [ 105.521666][ T60] veth0_vlan: left promiscuous mode [ 105.646163][ T60] team0 (unregistering): Port device team_slave_1 removed [ 105.653947][ T60] team0 (unregistering): Port device team_slave_0 removed [ 105.804439][ T63] Bluetooth: hci0: command tx timeout [ 106.199036][ T6347] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.211634][ T6347] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.218180][ T6347] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.224925][ T6347] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.285615][ T6347] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.296709][ T6347] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.305183][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.307806][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.544801][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.547555][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.587551][ T6347] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 106.723819][ T6347] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.761540][ T6347] veth0_vlan: entered promiscuous mode [ 106.770016][ T6347] veth1_vlan: entered promiscuous mode [ 106.811238][ T6347] veth0_macvtap: entered promiscuous mode [ 106.819464][ T6347] veth1_macvtap: entered promiscuous mode [ 106.833349][ T6347] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.851222][ T6347] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.882704][ T14] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.888787][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.893475][ T14] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.898276][ T14] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.937901][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.942228][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.963311][ T92] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.967714][ T92] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.018964][ T40] audit: type=1400 audit(1772609709.638:127): avc: denied { read write } for pid=6394 comm="syz.0.17" name="uinput" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 107.030836][ T6395] input: syz0 as /devices/virtual/input/input5 [ 107.034687][ T40] audit: type=1400 audit(1772609709.638:128): avc: denied { open } for pid=6394 comm="syz.0.17" path="/dev/uinput" dev="devtmpfs" ino=943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 107.054386][ T40] audit: type=1400 audit(1772609709.638:129): avc: denied { ioctl } for pid=6394 comm="syz.0.17" path="/dev/uinput" dev="devtmpfs" ino=943 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 107.066764][ T40] audit: type=1400 audit(1772609709.658:130): avc: denied { read } for pid=6394 comm="syz.0.17" name="event4" dev="devtmpfs" ino=2845 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 107.076907][ T40] audit: type=1400 audit(1772609709.658:131): avc: denied { open } for pid=6394 comm="syz.0.17" path="/dev/input/event4" dev="devtmpfs" ino=2845 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 107.086946][ T40] audit: type=1400 audit(1772609709.658:132): avc: denied { ioctl } for pid=6394 comm="syz.0.17" path="/dev/input/event4" dev="devtmpfs" ino=2845 ioctlcmd=0x4580 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 107.849322][ T6395] [ 107.850492][ T6395] ====================================================== [ 107.853495][ T6395] WARNING: possible circular locking dependency detected [ 107.856749][ T6395] syzkaller #0 Not tainted [ 107.859058][ T6395] ------------------------------------------------------ [ 107.862234][ T6395] syz.0.17/6395 is trying to acquire lock: [ 107.864896][ T6395] ffff88803a4e50b0 (&ff->mutex){+.+.}-{4:4}, at: input_ff_flush+0x63/0x1b0 [ 107.868984][ T6395] [ 107.868984][ T6395] but task is already holding lock: [ 107.872206][ T6395] ffff88802c0c72c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4a/0x140 [ 107.874362][ T63] Bluetooth: hci0: command tx timeout [ 107.876550][ T6395] [ 107.876550][ T6395] which lock already depends on the new lock. [ 107.876550][ T6395] [ 107.876560][ T6395] [ 107.876560][ T6395] the existing dependency chain (in reverse order) is: [ 107.887298][ T6395] [ 107.887298][ T6395] -> #3 (&dev->mutex#2){+.+.}-{4:4}: [ 107.890840][ T6395] __mutex_lock+0x1a2/0x1b90 [ 107.893410][ T6395] input_register_handle+0xca/0x630 [ 107.896139][ T6395] kbd_connect+0xce/0x180 [ 107.898418][ T6395] input_attach_handler.isra.0+0x177/0x1e0 [ 107.901302][ T6395] input_register_device.cold+0x139/0x375 [ 107.904010][ T6395] acpi_button_probe+0x5d3/0xbc0 [ 107.905860][ T6395] platform_probe+0x106/0x1d0 [ 107.907838][ T6395] really_probe+0x241/0xa60 [ 107.909821][ T6395] __driver_probe_device+0x1de/0x400 [ 107.911950][ T6395] driver_probe_device+0x4c/0x1b0 [ 107.913813][ T6395] __driver_attach+0x2f4/0x6a0 [ 107.915554][ T6395] bus_for_each_dev+0x13e/0x1d0 [ 107.917296][ T6395] bus_add_driver+0x305/0x5b0 [ 107.919039][ T6395] driver_register+0x1e2/0x360 [ 107.920804][ T6395] acpi_button_init+0xe4/0x100 [ 107.922597][ T6395] do_one_initcall+0x11d/0x760 [ 107.924417][ T6395] kernel_init_freeable+0x6e5/0x7a0 [ 107.926386][ T6395] kernel_init+0x1f/0x1e0 [ 107.928018][ T6395] ret_from_fork+0x754/0xd80 [ 107.929747][ T6395] ret_from_fork_asm+0x1a/0x30 [ 107.931507][ T6395] [ 107.931507][ T6395] -> #2 (input_mutex){+.+.}-{4:4}: [ 107.933866][ T6395] __mutex_lock+0x1a2/0x1b90 [ 107.935592][ T6395] input_register_device.cold+0x5b/0x375 [ 107.937844][ T6395] uinput_ioctl_handler.isra.0+0x8d8/0x1d10 [ 107.940389][ T6395] __x64_sys_ioctl+0x18e/0x210 [ 107.942205][ T6395] do_syscall_64+0x106/0xf80 [ 107.943874][ T6395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.945975][ T6395] [ 107.945975][ T6395] -> #1 (&newdev->mutex){+.+.}-{4:4}: [ 107.948461][ T6395] __mutex_lock+0x1a2/0x1b90 [ 107.950154][ T6395] uinput_request_submit.part.0+0x25/0x2e0 [ 107.952217][ T6395] uinput_dev_upload_effect+0x174/0x1f0 [ 107.954206][ T6395] input_ff_upload+0x578/0xc60 [ 107.956059][ T6395] evdev_do_ioctl+0x1228/0x1b60 [ 107.957999][ T6395] evdev_ioctl+0x16f/0x1a0 [ 107.959838][ T6395] __x64_sys_ioctl+0x18e/0x210 [ 107.961715][ T6395] do_syscall_64+0x106/0xf80 [ 107.963400][ T6395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.965488][ T6395] [ 107.965488][ T6395] -> #0 (&ff->mutex){+.+.}-{4:4}: [ 107.967899][ T6395] __lock_acquire+0x14b8/0x2630 [ 107.969766][ T6395] lock_acquire+0x1cf/0x380 [ 107.971853][ T6395] __mutex_lock+0x1a2/0x1b90 [ 107.973726][ T6395] input_ff_flush+0x63/0x1b0 [ 107.975602][ T6395] uinput_dev_flush+0x2a/0x40 [ 107.977418][ T6395] input_flush_device+0xc9/0x140 [ 107.979279][ T6395] evdev_release+0x344/0x420 [ 107.980974][ T6395] __fput+0x3ff/0xb40 [ 107.982486][ T6395] task_work_run+0x150/0x240 [ 107.984219][ T6395] exit_to_user_mode_loop+0x100/0x4a0 [ 107.986278][ T6395] do_syscall_64+0x67c/0xf80 [ 107.988098][ T6395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.990382][ T6395] [ 107.990382][ T6395] other info that might help us debug this: [ 107.990382][ T6395] [ 107.993664][ T6395] Chain exists of: [ 107.993664][ T6395] &ff->mutex --> input_mutex --> &dev->mutex#2 [ 107.993664][ T6395] [ 107.997828][ T6395] Possible unsafe locking scenario: [ 107.997828][ T6395] [ 108.001093][ T6395] CPU0 CPU1 [ 108.003433][ T6395] ---- ---- [ 108.005531][ T6395] lock(&dev->mutex#2); [ 108.007361][ T6395] lock(input_mutex); [ 108.010455][ T6395] lock(&dev->mutex#2); [ 108.013447][ T6395] lock(&ff->mutex); [ 108.015250][ T6395] [ 108.015250][ T6395] *** DEADLOCK *** [ 108.015250][ T6395] [ 108.018864][ T6395] 2 locks held by syz.0.17/6395: [ 108.021195][ T6395] #0: ffff88802b5c3118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x79/0x420 [ 108.025687][ T6395] #1: ffff88802c0c72c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_flush_device+0x4a/0x140 [ 108.029953][ T6395] [ 108.029953][ T6395] stack backtrace: [ 108.032534][ T6395] CPU: 0 UID: 0 PID: 6395 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 108.032555][ T6395] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.032565][ T6395] Call Trace: [ 108.032578][ T6395] [ 108.032585][ T6395] dump_stack_lvl+0x100/0x190 [ 108.032614][ T6395] print_circular_bug.cold+0x178/0x1c7 [ 108.032641][ T6395] check_noncircular+0x146/0x160 [ 108.032668][ T6395] __lock_acquire+0x14b8/0x2630 [ 108.032696][ T6395] lock_acquire+0x1cf/0x380 [ 108.032720][ T6395] ? input_ff_flush+0x63/0x1b0 [ 108.032742][ T6395] ? __pfx___might_resched+0x10/0x10 [ 108.032762][ T6395] __mutex_lock+0x1a2/0x1b90 [ 108.032781][ T6395] ? input_ff_flush+0x63/0x1b0 [ 108.032802][ T6395] ? input_ff_flush+0x63/0x1b0 [ 108.032823][ T6395] ? trace_contention_end+0x140/0x180 [ 108.032840][ T6395] ? __mutex_lock+0x26a/0x1b90 [ 108.032857][ T6395] ? __pfx___mutex_lock+0x10/0x10 [ 108.032874][ T6395] ? __mutex_lock+0x26a/0x1b90 [ 108.032890][ T6395] ? input_flush_device+0x4a/0x140 [ 108.032914][ T6395] ? dput.part.0+0xce/0x570 [ 108.032935][ T6395] ? evdev_release+0x79/0x420 [ 108.032955][ T6395] ? dput+0x24/0x30 [ 108.032977][ T6395] ? input_ff_flush+0x63/0x1b0 [ 108.032998][ T6395] input_ff_flush+0x63/0x1b0 [ 108.033020][ T6395] uinput_dev_flush+0x2a/0x40 [ 108.033042][ T6395] ? __pfx_uinput_dev_flush+0x10/0x10 [ 108.033063][ T6395] input_flush_device+0xc9/0x140 [ 108.033085][ T6395] evdev_release+0x344/0x420 [ 108.033103][ T6395] ? evm_file_release+0x133/0x210 [ 108.033122][ T6395] ? __pfx_evdev_release+0x10/0x10 [ 108.033140][ T6395] __fput+0x3ff/0xb40 [ 108.033160][ T6395] task_work_run+0x150/0x240 [ 108.033177][ T6395] ? __pfx_task_work_run+0x10/0x10 [ 108.033196][ T6395] exit_to_user_mode_loop+0x100/0x4a0 [ 108.033224][ T6395] do_syscall_64+0x67c/0xf80 [ 108.033240][ T6395] ? clear_bhb_loop+0x40/0x90 [ 108.033258][ T6395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.033275][ T6395] RIP: 0033:0x7f730259af39 [ 108.033289][ T6395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.033304][ T6395] RSP: 002b:00007f730339e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 108.033321][ T6395] RAX: ffffffffffffffed RBX: 00007f7302805fa0 RCX: 00007f730259af39 [ 108.033332][ T6395] RDX: 0000200000000300 RSI: 0000000040304580 RDI: 0000000000000004 [ 108.033342][ T6395] RBP: 00007f730262fee0 R08: 0000000000000000 R09: 0000000000000000 [ 108.033352][ T6395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.033361][ T6395] R13: 00007f7302806038 R14: 00007f7302805fa0 R15: 00007ffc6fd4b7c8 [ 108.033377][ T6395] [ 108.157630][ T6397] input: syz0 as /devices/virtual/input/input6 [ 109.004006][ T6399] input: syz0 as /devices/virtual/input/input7 2026/03/04 07:35:11 executed programs: 4 [ 109.850698][ T6402] input: syz0 as /devices/virtual/input/input8 [ 109.954440][ T63] Bluetooth: hci0: command tx timeout [ 110.699589][ T6404] input: syz0 as /devices/virtual/input/input9 [ 111.547271][ T6406] input: syz0 as /devices/virtual/input/input10 [ 112.034683][ T63] Bluetooth: hci0: command tx timeout [ 112.399667][ T6408] input: syz0 as /devices/virtual/input/input11 [ 113.249701][ T6410] input: syz0 as /devices/virtual/input/input12 [ 114.091535][ T6412] input: syz0 as /devices/virtual/input/input13 2026/03/04 07:35:16 executed programs: 10 [ 114.939718][ T6414] input: syz0 as /devices/virtual/input/input14 [ 115.790214][ T6416] input: syz0 as /devices/virtual/input/input15 [ 116.643249][ T6418] input: syz0 as /devices/virtual/input/input16 [ 117.500969][ T6420] input: syz0 as /devices/virtual/input/input17