Warning: Permanently added '10.128.0.56' (ED25519) to the list of known hosts. 2026/09/07 05:20:25 parsed 1 programs 2026/09/07 05:20:25 serving rpc on tcp://34465 Setting up swapspace version 1, size = 127995904 bytes [ 98.395936][ T4493] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 100.859405][ T156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.868123][ T156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.878862][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 100.916966][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.925320][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.933924][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 103.099756][ T145] ODEBUG: Out of memory. ODEBUG disabled [ 103.118884][ T4661] chnl_net:caif_netlink_parms(): no params data found [ 103.183714][ T4661] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.191113][ T4661] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.203667][ T4661] device bridge_slave_0 entered promiscuous mode [ 103.212136][ T4661] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.225098][ T4661] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.233507][ T4661] device bridge_slave_1 entered promiscuous mode [ 103.252031][ T4661] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.264607][ T4661] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.290141][ T4661] team0: Port device team_slave_0 added [ 103.303978][ T4661] team0: Port device team_slave_1 added [ 103.329403][ T4661] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.341250][ T4661] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.369171][ T4661] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.382689][ T4661] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.389793][ T4661] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.417624][ T4661] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.453895][ T4661] device hsr_slave_0 entered promiscuous mode [ 103.460554][ T4661] device hsr_slave_1 entered promiscuous mode [ 103.995098][ T4661] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.005441][ T4661] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.040866][ T4661] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.050774][ T4661] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.101173][ T4661] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.108445][ T4661] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.115933][ T4661] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.123093][ T4661] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.135001][ T156] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.145688][ T156] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.263857][ T4661] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.278784][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 104.287317][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.299937][ T4661] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.311694][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 104.323768][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 104.332308][ T156] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.339471][ T156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.373452][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 104.385387][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 104.395409][ T156] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.402668][ T156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.434302][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 104.453635][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 104.463268][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 104.472257][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 104.484234][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 104.494749][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 104.511915][ T4661] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 104.525425][ T4661] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 104.538996][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 104.551075][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 104.560081][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 104.571284][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 104.580792][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 104.592789][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 104.780987][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 104.790279][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 104.804998][ T4661] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.835662][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 104.853282][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 104.893739][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 104.915258][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 104.933626][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 104.953003][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 104.978257][ T4661] device veth0_vlan entered promiscuous mode [ 104.997964][ T4661] device veth1_vlan entered promiscuous mode [ 105.048523][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 105.063245][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 105.083741][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 105.093430][ T4222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 105.114938][ T4661] device veth0_macvtap entered promiscuous mode [ 105.135225][ T4661] device veth1_macvtap entered promiscuous mode [ 105.142807][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 105.163144][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 105.180668][ T4661] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.202824][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 105.212099][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 105.239379][ T4661] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.264402][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 105.276566][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 105.294817][ T4661] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.305614][ T4661] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.315002][ T4661] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.325656][ T4661] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/09/07 05:20:37 executed programs: 0 [ 106.985911][ T145] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.099605][ T4815] chnl_net:caif_netlink_parms(): no params data found [ 107.158610][ T4815] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.165952][ T4815] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.174347][ T4815] device bridge_slave_0 entered promiscuous mode [ 107.183131][ T4815] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.190312][ T4815] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.198634][ T4815] device bridge_slave_1 entered promiscuous mode [ 107.225304][ T4815] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.237206][ T4815] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.264370][ T4815] team0: Port device team_slave_0 added [ 107.272400][ T4815] team0: Port device team_slave_1 added [ 107.294045][ T4815] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 107.301222][ T4815] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 107.328031][ T4815] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 107.341135][ T4815] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 107.348349][ T4815] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 107.374479][ T4815] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 107.410770][ T4815] device hsr_slave_0 entered promiscuous mode [ 107.418296][ T4815] device hsr_slave_1 entered promiscuous mode [ 107.425123][ T4815] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 107.432950][ T4815] Cannot create hsr debugfs directory [ 109.012723][ T4306] Bluetooth: hci0: command 0x0409 tx timeout [ 110.168355][ T145] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.248340][ T145] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.301383][ T145] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.093947][ T4248] Bluetooth: hci0: command 0x041b tx timeout [ 111.203570][ T4815] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 111.213776][ T4815] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 111.222819][ T4815] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 111.232010][ T4815] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 111.287664][ T4815] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.310844][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 111.318753][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 111.329235][ T4815] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.348986][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 111.357882][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 111.366627][ T4364] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.373740][ T4364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.381451][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 111.396657][ T145] device hsr_slave_0 left promiscuous mode [ 111.403168][ T145] device hsr_slave_1 left promiscuous mode [ 111.409682][ T145] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 111.418838][ T145] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 111.426626][ T145] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 111.434416][ T145] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 111.441911][ T145] device bridge_slave_1 left promiscuous mode [ 111.448240][ T145] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.457002][ T145] device bridge_slave_0 left promiscuous mode [ 111.463718][ T145] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.474694][ T145] device veth1_macvtap left promiscuous mode [ 111.480729][ T145] device veth0_macvtap left promiscuous mode [ 111.490706][ T145] device veth1_vlan left promiscuous mode [ 111.496723][ T145] device veth0_vlan left promiscuous mode [ 111.618288][ T145] team0 (unregistering): Port device team_slave_1 removed [ 111.631729][ T145] team0 (unregistering): Port device team_slave_0 removed [ 111.643882][ T145] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 111.657076][ T145] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 111.704207][ T145] bond0 (unregistering): Released all slaves [ 111.755873][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 111.764986][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 111.773500][ T4364] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.780761][ T4364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.790934][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 111.805607][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 111.815015][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 111.824779][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 111.838585][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 111.858813][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 111.867444][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 111.881514][ T4815] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 111.895811][ T4815] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 111.907858][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 111.916763][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 111.925579][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 111.934502][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 111.943165][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 112.047884][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 112.055603][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 112.068542][ T4815] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 112.088708][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 112.097619][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 112.114197][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 112.123052][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 112.131596][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 112.139964][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 112.157719][ T4815] device veth0_vlan entered promiscuous mode [ 112.170262][ T4815] device veth1_vlan entered promiscuous mode [ 112.196457][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 112.205678][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 112.214762][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 112.224577][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 112.236760][ T4815] device veth0_macvtap entered promiscuous mode [ 112.248317][ T4815] device veth1_macvtap entered promiscuous mode [ 112.267356][ T4815] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.275472][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 112.285069][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 112.293863][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 112.303248][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 112.316981][ T4815] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.334759][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 112.344119][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 112.355708][ T4815] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.365958][ T4815] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.376011][ T4815] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.385020][ T4815] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.440228][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.450907][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.460583][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 112.478066][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 2026/09/07 05:20:43 executed programs: 2 [ 112.487345][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.495353][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 112.559964][ T147] Bluetooth: hci0: hardware error 0x04 [ 112.566761][ T147] [ 112.569420][ T147] ====================================================== [ 112.576894][ T147] WARNING: possible circular locking dependency detected [ 112.583926][ T147] syzkaller #0 Not tainted [ 112.588351][ T147] ------------------------------------------------------ [ 112.595385][ T147] kworker/u5:0/147 is trying to acquire lock: [ 112.601471][ T147] ffff88807d01c120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_del+0x13e/0x350 [ 112.612205][ T147] [ 112.612205][ T147] but task is already holding lock: [ 112.619608][ T147] ffffffff8d593488 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 [ 112.629409][ T147] [ 112.629409][ T147] which lock already depends on the new lock. [ 112.629409][ T147] [ 112.639978][ T147] [ 112.639978][ T147] the existing dependency chain (in reverse order) is: [ 112.649009][ T147] [ 112.649009][ T147] -> #2 (hci_cb_list_lock){+.+.}-{3:3}: [ 112.656768][ T147] __mutex_lock_common+0x1e5/0x2400 [ 112.662617][ T147] mutex_lock_nested+0x17/0x20 [ 112.668011][ T147] hci_remote_features_evt+0x5d9/0xa10 [ 112.674102][ T147] hci_event_packet+0x600/0x1310 [ 112.679588][ T147] hci_rx_work+0x255/0xa10 [ 112.684541][ T147] process_one_work+0x867/0xff0 [ 112.689938][ T147] worker_thread+0xad7/0x12a0 [ 112.695152][ T147] kthread+0x42e/0x520 [ 112.699760][ T147] ret_from_fork+0x1f/0x30 [ 112.704709][ T147] [ 112.704709][ T147] -> #1 (&hdev->lock){+.+.}-{3:3}: [ 112.712019][ T147] __mutex_lock_common+0x1e5/0x2400 [ 112.717757][ T147] mutex_lock_nested+0x17/0x20 [ 112.723046][ T147] sco_sock_connect+0x189/0x940 [ 112.728525][ T147] __sys_connect+0x3cb/0x450 [ 112.733635][ T147] __x64_sys_connect+0x76/0x80 [ 112.738920][ T147] do_syscall_64+0x4c/0xa0 [ 112.743886][ T147] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 112.750305][ T147] [ 112.750305][ T147] -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}: [ 112.759445][ T147] __lock_acquire+0x2c66/0x7b50 [ 112.764902][ T147] lock_acquire+0x19e/0x400 [ 112.769938][ T147] lock_sock_nested+0x44/0x100 [ 112.775219][ T147] sco_conn_del+0x13e/0x350 [ 112.780327][ T147] hci_conn_hash_flush+0x107/0x220 [ 112.785974][ T147] hci_dev_do_close+0x918/0x1020 [ 112.791484][ T147] hci_error_reset+0x101/0x2c0 [ 112.796854][ T147] process_one_work+0x867/0xff0 [ 112.802221][ T147] worker_thread+0xad7/0x12a0 [ 112.807414][ T147] kthread+0x42e/0x520 [ 112.812000][ T147] ret_from_fork+0x1f/0x30 [ 112.817017][ T147] [ 112.817017][ T147] other info that might help us debug this: [ 112.817017][ T147] [ 112.827253][ T147] Chain exists of: [ 112.827253][ T147] sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock [ 112.827253][ T147] [ 112.841669][ T147] Possible unsafe locking scenario: [ 112.841669][ T147] [ 112.849129][ T147] CPU0 CPU1 [ 112.854577][ T147] ---- ---- [ 112.859939][ T147] lock(hci_cb_list_lock); [ 112.864436][ T147] lock(&hdev->lock); [ 112.871108][ T147] lock(hci_cb_list_lock); [ 112.878147][ T147] lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); [ 112.884122][ T147] [ 112.884122][ T147] *** DEADLOCK *** [ 112.884122][ T147] [ 112.892781][ T147] 5 locks held by kworker/u5:0/147: [ 112.897976][ T147] #0: ffff8880241da938 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 [ 112.908064][ T147] #1: ffffc9000168fd00 ((work_completion)(&hdev->error_reset)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 [ 112.919728][ T147] #2: ffff88805cf8d3f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 [ 112.929554][ T147] #3: ffff88805cf8c478 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x408/0x1020 [ 112.939286][ T147] #4: ffffffff8d593488 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 [ 112.949545][ T147] [ 112.949545][ T147] stack backtrace: [ 112.955610][ T147] CPU: 1 PID: 147 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 112.963194][ T147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.973336][ T147] Workqueue: hci0 hci_error_reset [ 112.978448][ T147] Call Trace: [ 112.981728][ T147] [ 112.984656][ T147] dump_stack_lvl+0x188/0x250 [ 112.989363][ T147] ? load_image+0x410/0x410 [ 112.993864][ T147] ? show_regs_print_info+0x20/0x20 [ 112.999149][ T147] ? print_circular_bug+0x12b/0x1a0 [ 113.004520][ T147] check_noncircular+0x296/0x330 [ 113.009550][ T147] ? add_chain_block+0x9b0/0x9b0 [ 113.014493][ T147] ? lockdep_lock+0xf1/0x1f0 [ 113.019091][ T147] ? lockdep_unlock+0x143/0x2e0 [ 113.023945][ T147] ? mark_lock+0x94/0x320 [ 113.028274][ T147] ? _find_first_zero_bit+0xd1/0xf0 [ 113.033483][ T147] __lock_acquire+0x2c66/0x7b50 [ 113.038341][ T147] ? verify_lock_unused+0x140/0x140 [ 113.043539][ T147] lock_acquire+0x19e/0x400 [ 113.048128][ T147] ? sco_conn_del+0x13e/0x350 [ 113.052818][ T147] ? read_lock_is_recursive+0x10/0x10 [ 113.058912][ T147] ? __lock_acquire+0x7b50/0x7b50 [ 113.063957][ T147] ? __rwlock_init+0x140/0x140 [ 113.068732][ T147] lock_sock_nested+0x44/0x100 [ 113.073506][ T147] ? sco_conn_del+0x13e/0x350 [ 113.078198][ T147] sco_conn_del+0x13e/0x350 [ 113.082743][ T147] ? sco_connect_cfm+0xd00/0xd00 [ 113.087803][ T147] hci_conn_hash_flush+0x107/0x220 [ 113.093037][ T147] hci_dev_do_close+0x918/0x1020 [ 113.098008][ T147] hci_error_reset+0x101/0x2c0 [ 113.102871][ T147] process_one_work+0x867/0xff0 [ 113.107911][ T147] ? worker_detach_from_pool+0x240/0x240 [ 113.113648][ T147] ? lockdep_hardirqs_off+0x70/0x100 [ 113.118958][ T147] ? _raw_spin_lock_irq+0xb7/0xf0 [ 113.123986][ T147] ? _raw_spin_lock_irqsave+0x100/0x100 [ 113.129540][ T147] ? wq_worker_running+0x97/0x170 [ 113.134576][ T147] worker_thread+0xad7/0x12a0 [ 113.139541][ T147] kthread+0x42e/0x520 [ 113.143619][ T147] ? rcu_lock_release+0x20/0x20 [ 113.148487][ T147] ? kthread_blkcg+0xd0/0xd0 [ 113.153098][ T147] ret_from_fork+0x1f/0x30 [ 113.157619][ T147] [ 113.172189][ T4255] Bluetooth: hci0: command 0x040f tx timeout 2026/09/07 05:20:48 executed programs: 256 2026/09/07 05:20:53 executed programs: 550