[ 71.554169][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.554230][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.539717][ T42] audit: type=1400 audit(1792445167.709:199): avc: denied { write } for pid=5962 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 72.596189][ T42] audit: type=1400 audit(1792445167.769:200): avc: denied { write } for pid=5965 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.568450][ T42] audit: type=1400 audit(1792445168.739:201): avc: denied { write } for pid=5972 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.660343][ T42] audit: type=1400 audit(1792445168.829:202): avc: denied { write } for pid=5975 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.768110][ T42] audit: type=1400 audit(1792445168.939:203): avc: denied { write } for pid=5979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.847308][ T42] audit: type=1400 audit(1792445169.019:204): avc: denied { write } for pid=5984 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:2952' (ED25519) to the list of known hosts. [ 75.267626][ T42] audit: type=1400 audit(1792445170.439:205): avc: denied { write } for pid=5998 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.327576][ T42] audit: type=1400 audit(1792445170.499:206): avc: denied { write } for pid=6001 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 2026/10/19 21:26:10 parsed 1 programs 2026/10/19 21:26:10 serving rpc on tcp://36167 [ 76.673177][ T34] cfg80211: failed to load regulatory.db [ 78.080518][ T42] audit: type=1400 audit(1792445173.249:207): avc: denied { read write } for pid=6006 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 78.080810][ T42] audit: type=1400 audit(1792445173.249:208): avc: denied { open } for pid=6006 comm="syz-executor" path="/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 78.103614][ T42] audit: type=1400 audit(1792445173.279:209): avc: denied { unlink } for pid=6006 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 78.579282][ T42] audit: type=1400 audit(1792445173.749:210): avc: denied { relabelto } for pid=6011 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 79.581099][ T6006] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 81.704007][ T42] audit: type=1401 audit(1792445176.879:211): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 82.620800][ T6041] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.620885][ T6041] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.620942][ T6041] bridge_slave_0: entered allmulticast mode [ 82.621797][ T6041] bridge_slave_0: entered promiscuous mode [ 82.623588][ T6041] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.623745][ T6041] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.623839][ T6041] bridge_slave_1: entered allmulticast mode [ 82.625135][ T6041] bridge_slave_1: entered promiscuous mode [ 82.652382][ T6041] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.654972][ T6041] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.677547][ T6041] team0: Port device team_slave_0 added [ 82.679799][ T6041] team0: Port device team_slave_1 added [ 82.701560][ T6041] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.701576][ T6041] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.701596][ T6041] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.702689][ T6041] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.702703][ T6041] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.702715][ T6041] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.724030][ T6041] hsr_slave_0: entered promiscuous mode [ 82.724734][ T6041] hsr_slave_1: entered promiscuous mode [ 82.850724][ T42] audit: type=1400 audit(1792445178.019:212): avc: denied { write } for pid=6058 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.902110][ T42] audit: type=1400 audit(1792445178.069:213): avc: denied { write } for pid=6061 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.013080][ T42] audit: type=1400 audit(1792445178.189:214): avc: denied { write } for pid=6063 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.066911][ T42] audit: type=1400 audit(1792445178.239:215): avc: denied { write } for pid=6066 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.142230][ T42] audit: type=1400 audit(1792445178.319:216): avc: denied { write } for pid=6068 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.202581][ T6041] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.203169][ T42] audit: type=1400 audit(1792445178.379:217): avc: denied { write } for pid=6071 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.204556][ T6041] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.205058][ T6041] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.206576][ T6041] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.207102][ T6041] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.208636][ T6041] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.209193][ T6041] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.210636][ T6041] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.270910][ T6041] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.275611][ T42] audit: type=1400 audit(1792445178.449:218): avc: denied { write } for pid=6079 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.279339][ T6041] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.284688][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.284732][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.290048][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.290154][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.333598][ T42] audit: type=1400 audit(1792445178.509:219): avc: denied { write } for pid=6082 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.425116][ T42] audit: type=1400 audit(1792445178.599:220): avc: denied { write } for pid=6088 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.479365][ T42] audit: type=1400 audit(1792445178.649:221): avc: denied { write } for pid=6094 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.537128][ T42] audit: type=1400 audit(1792445178.709:222): avc: denied { write } for pid=6098 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.542721][ T6041] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.576214][ T6041] veth0_vlan: entered promiscuous mode [ 83.579296][ T6041] veth1_vlan: entered promiscuous mode [ 83.596664][ T6041] veth0_macvtap: entered promiscuous mode [ 83.598782][ T6041] veth1_macvtap: entered promiscuous mode [ 83.599956][ T42] audit: type=1400 audit(1792445178.769:223): avc: denied { write } for pid=6102 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.607134][ T6041] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.614721][ T6041] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.651789][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.653188][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.653212][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.653230][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.679748][ T42] audit: type=1400 audit(1792445178.849:224): avc: denied { write } for pid=6104 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.736680][ T65] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.738094][ T65] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.739054][ T65] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.739083][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.740129][ T65] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.740431][ T65] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.748643][ T42] audit: type=1400 audit(1792445178.919:225): avc: denied { write } for pid=6111 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 83.820821][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.905889][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.995250][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.703317][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.703331][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.723166][ T1160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.723188][ T1160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/10/19 21:26:20 executed programs: 0 [ 85.252319][ T65] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.253254][ T65] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.253720][ T65] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.254706][ T65] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.255123][ T65] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.704052][ T6187] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.704140][ T6187] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.704203][ T6187] bridge_slave_0: entered allmulticast mode [ 85.705060][ T6187] bridge_slave_0: entered promiscuous mode [ 85.706749][ T6187] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.706816][ T6187] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.707056][ T6187] bridge_slave_1: entered allmulticast mode [ 85.708281][ T6187] bridge_slave_1: entered promiscuous mode [ 85.728761][ T6187] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.732540][ T6187] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.748272][ T6187] team0: Port device team_slave_0 added [ 85.750077][ T6187] team0: Port device team_slave_1 added [ 85.764173][ T6187] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.764184][ T6187] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.764196][ T6187] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.765264][ T6187] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.765275][ T6187] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.765295][ T6187] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.798146][ T6187] hsr_slave_0: entered promiscuous mode [ 85.799059][ T6187] hsr_slave_1: entered promiscuous mode [ 85.799623][ T6187] debugfs: 'hsr0' already exists in 'hsr' [ 85.799642][ T6187] Cannot create hsr debugfs directory [ 86.675412][ T13] bridge_slave_1: left allmulticast mode [ 86.675429][ T13] bridge_slave_1: left promiscuous mode [ 86.675539][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.677562][ T13] bridge_slave_0: left allmulticast mode [ 86.677574][ T13] bridge_slave_0: left promiscuous mode [ 86.677668][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.764227][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 86.768684][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 86.769677][ T13] bond0 (unregistering): Released all slaves [ 86.844866][ T5443] 8021q: adding VLAN 0 to HW filter on device eth2 [ 86.848212][ T13] hsr_slave_0: left promiscuous mode [ 86.848764][ T13] hsr_slave_1: left promiscuous mode [ 86.849373][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.849388][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.850039][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.850052][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.854852][ T13] veth1_macvtap: left promiscuous mode [ 86.854871][ T13] veth0_macvtap: left promiscuous mode [ 86.854949][ T13] veth1_vlan: left promiscuous mode [ 86.854979][ T13] veth0_vlan: left promiscuous mode [ 86.972809][ T13] team0 (unregistering): Port device team_slave_1 removed [ 86.977282][ T13] team0 (unregistering): Port device team_slave_0 removed [ 87.251685][ T6187] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.253386][ T6187] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.253832][ T6187] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.256568][ T6187] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.257432][ T6187] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.259137][ T6187] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.259672][ T6187] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.265324][ T6187] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.313136][ T5090] Bluetooth: hci0: command tx timeout [ 87.318977][ T6187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.334416][ T6187] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.339134][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.339213][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.344808][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.344885][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.376390][ T6187] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 87.824871][ T6187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.850927][ T6187] veth0_vlan: entered promiscuous mode [ 87.858852][ T6187] veth1_vlan: entered promiscuous mode [ 87.887541][ T6187] veth0_macvtap: entered promiscuous mode [ 87.889471][ T6187] veth1_macvtap: entered promiscuous mode [ 87.895990][ T6187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.900135][ T6187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.986407][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.986429][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.006452][ T74] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.006472][ T74] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.012113][ T5754] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.012150][ T5754] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.012180][ T5754] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.012209][ T5754] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.062122][ T6251] [ 88.062951][ T6251] ====================================================== [ 88.065130][ T6251] WARNING: possible circular locking dependency detected [ 88.067306][ T6251] syzkaller #0 Not tainted [ 88.068716][ T6251] ------------------------------------------------------ [ 88.070954][ T6251] syz.0.17/6251 is trying to acquire lock: [ 88.072770][ T6251] ffffffff91481f80 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 88.075539][ T6251] [ 88.075539][ T6251] but task is already holding lock: [ 88.077807][ T6251] ffff88802f3d6390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 88.080590][ T6251] [ 88.080590][ T6251] which lock already depends on the new lock. [ 88.080590][ T6251] [ 88.083813][ T6251] [ 88.083813][ T6251] the existing dependency chain (in reverse order) is: [ 88.086569][ T6251] [ 88.086569][ T6251] -> #2 (&gi->lock){+.+.}-{4:4}: [ 88.088872][ T6251] lock_acquire+0x1d1/0x380 [ 88.090477][ T6251] __mutex_lock+0x1a4/0x1bd0 [ 88.092280][ T6251] config_usb_cfg_link+0x57/0x3a0 [ 88.094058][ T6251] configfs_symlink+0x695/0x1340 [ 88.095773][ T6251] vfs_symlink+0x178/0x4d0 [ 88.097321][ T6251] filename_symlinkat+0x2a6/0x560 [ 88.099046][ T6251] __x64_sys_symlinkat+0x9c/0xe0 [ 88.100833][ T6251] do_syscall_64+0x123/0x790 [ 88.102388][ T6251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.104401][ T6251] [ 88.104401][ T6251] -> #1 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}: [ 88.107097][ T6251] lock_acquire+0x1d1/0x380 [ 88.108688][ T6251] down_write+0x8b/0x1f0 [ 88.110192][ T6251] configfs_depend_item_unlocked+0xf3/0x6a0 [ 88.112407][ T6251] usbg_make_tpg+0x251/0x610 [ 88.114042][ T6251] target_fabric_make_tpg+0xab/0x8c0 [ 88.115888][ T6251] configfs_mkdir+0x525/0xd40 [ 88.117509][ T6251] vfs_mkdir+0x364/0x850 [ 88.119018][ T6251] filename_mkdirat+0x48b/0x5e0 [ 88.120749][ T6251] __x64_sys_mkdirat+0x89/0xc0 [ 88.122527][ T6251] do_syscall_64+0x123/0x790 [ 88.124241][ T6251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.126204][ T6251] [ 88.126204][ T6251] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 88.128636][ T6251] check_prev_add+0xeb/0xe60 [ 88.130242][ T6251] __lock_acquire+0x1528/0x1f40 [ 88.132154][ T6251] lock_acquire+0x1d1/0x380 [ 88.133782][ T6251] __mutex_lock+0x1a4/0x1bd0 [ 88.135397][ T6251] tcm_alloc+0x20/0x440 [ 88.136874][ T6251] usb_get_function+0x5e/0xd0 [ 88.138592][ T6251] config_usb_cfg_link+0x1ed/0x3a0 [ 88.140365][ T6251] configfs_symlink+0x695/0x1340 [ 88.142126][ T6251] vfs_symlink+0x178/0x4d0 [ 88.143806][ T6251] filename_symlinkat+0x2a6/0x560 [ 88.145558][ T6251] __x64_sys_symlinkat+0x9c/0xe0 [ 88.147283][ T6251] do_syscall_64+0x123/0x790 [ 88.148893][ T6251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.150880][ T6251] [ 88.150880][ T6251] other info that might help us debug this: [ 88.150880][ T6251] [ 88.154026][ T6251] Chain exists of: [ 88.154026][ T6251] tpg_instances_lock --> &sb->s_type->i_mutex_key#25 --> &gi->lock [ 88.154026][ T6251] [ 88.158208][ T6251] Possible unsafe locking scenario: [ 88.158208][ T6251] [ 88.160536][ T6251] CPU0 CPU1 [ 88.162197][ T6251] ---- ---- [ 88.163875][ T6251] lock(&gi->lock); [ 88.165119][ T6251] lock(&sb->s_type->i_mutex_key#25); [ 88.167617][ T6251] lock(&gi->lock); [ 88.169607][ T6251] lock(tpg_instances_lock); [ 88.171095][ T6251] [ 88.171095][ T6251] *** DEADLOCK *** [ 88.171095][ T6251] [ 88.173596][ T6251] locks held by syz.0.17/6251: 3, last CPU#3: [ 88.175499][ T6251] #0: ffff888025dcc460 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 88.178415][ T6251] #1: ffff88804a0dbf00 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 88.181806][ T6251] #2: ffff88802f3d6390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 88.184731][ T6251] [ 88.184731][ T6251] stack backtrace: [ 88.187407][ T6251] CPU: 3 UID: 0 PID: 6251 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 88.190200][ T6251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.193352][ T6251] Call Trace: [ 88.194440][ T6251] [ 88.195387][ T6251] dump_stack_lvl+0x100/0x190 [ 88.196798][ T6251] print_circular_bug.cold+0x178/0x1be [ 88.198501][ T6251] check_noncircular+0x146/0x160 [ 88.200070][ T6251] check_prev_add+0xeb/0xe60 [ 88.201557][ T6251] __lock_acquire+0x1528/0x1f40 [ 88.203064][ T6251] lock_acquire+0x1d1/0x380 [ 88.204495][ T6251] ? tcm_alloc+0x20/0x440 [ 88.205860][ T6251] ? __pfx___might_resched+0x10/0x10 [ 88.207533][ T6251] ? config_usb_cfg_link+0x57/0x3a0 [ 88.209160][ T6251] __mutex_lock+0x1a4/0x1bd0 [ 88.210636][ T6251] ? tcm_alloc+0x20/0x440 [ 88.211998][ T6251] ? tcm_alloc+0x20/0x440 [ 88.213358][ T6251] ? __mutex_lock+0x26c/0x1bd0 [ 88.214876][ T6251] ? config_usb_cfg_link+0x57/0x3a0 [ 88.216515][ T6251] ? __pfx___mutex_lock+0x10/0x10 [ 88.218101][ T6251] ? __pfx_selinux_inode_permission+0x10/0x10 [ 88.220007][ T6251] ? tcm_alloc+0x20/0x440 [ 88.221411][ T6251] tcm_alloc+0x20/0x440 [ 88.222744][ T6251] usb_get_function+0x5e/0xd0 [ 88.224226][ T6251] config_usb_cfg_link+0x1ed/0x3a0 [ 88.225822][ T6251] ? mntput_no_expire+0xe8/0x220 [ 88.227439][ T6251] configfs_symlink+0x695/0x1340 [ 88.229027][ T6251] ? __pfx_configfs_symlink+0x10/0x10 [ 88.230764][ T6251] vfs_symlink+0x178/0x4d0 [ 88.232184][ T6251] filename_symlinkat+0x2a6/0x560 [ 88.233759][ T6251] ? __pfx_filename_symlinkat+0x10/0x10 [ 88.235524][ T6251] ? strncpy_from_user+0x19d/0x2d0 [ 88.237129][ T6251] ? do_getname+0x191/0x390 [ 88.238554][ T6251] __x64_sys_symlinkat+0x9c/0xe0 [ 88.240120][ T6251] do_syscall_64+0x123/0x790 [ 88.241762][ T6251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.243729][ T6251] RIP: 0033:0x7f2ce399e159 [ 88.245200][ T6251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.251266][ T6251] RSP: 002b:00007f2ce4849028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 88.253863][ T6251] RAX: ffffffffffffffda RBX: 00007f2ce3c25fa0 RCX: 00007f2ce399e159 [ 88.256292][ T6251] RDX: 0000200000000540 RSI: ffffffffffffff9c RDI: 0000200000000500 [ 88.258715][ T6251] RBP: 00007f2ce3a35024 R08: 0000000000000000 R09: 0000000000000000 [ 88.261202][ T6251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.263676][ T6251] R13: 00007f2ce3c26038 R14: 00007f2ce3c25fa0 R15: 00007ffce6b200b8 [ 88.266126][ T6251] [ 88.271402][ T42] kauditd_printk_skb: 60 callbacks suppressed [ 88.271416][ T42] audit: type=1400 audit(1792445183.439:286): avc: denied { unmount } for pid=6187 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 89.391546][ T5090] Bluetooth: hci0: command tx timeout 2026/10/19 21:26:25 executed programs: 111 [ 91.471732][ T5090] Bluetooth: hci0: command tx timeout [ 93.551483][ T5090] Bluetooth: hci0: command tx timeout 2026/10/19 21:26:30 executed programs: 408