[ 77.226430][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.256501][ T154] device veth1_macvtap left promiscuous mode [ 77.267415][ T154] device veth0_macvtap left promiscuous mode [ 77.278107][ T154] device veth1_vlan left promiscuous mode [ 77.287265][ T154] device veth0_vlan left promiscuous mode [ 77.530697][ T154] team0 (unregistering): Port device team_slave_1 removed [ 77.549456][ T154] team0 (unregistering): Port device team_slave_0 removed [ 77.562792][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 77.581533][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 77.633581][ T154] bond0 (unregistering): Released all slaves [ 81.557635][ T21] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.1.180' (ED25519) to the list of known hosts. 2026/09/14 05:19:34 parsed 1 programs 2026/09/14 05:19:34 serving rpc on tcp://43605 Setting up swapspace version 1, size = 127995904 bytes [ 88.880658][ T4532] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 92.303417][ T4641] chnl_net:caif_netlink_parms(): no params data found [ 92.415828][ T4641] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.425352][ T4641] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.436037][ T4641] device bridge_slave_0 entered promiscuous mode [ 92.449497][ T4641] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.457291][ T4641] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.468577][ T4641] device bridge_slave_1 entered promiscuous mode [ 92.514591][ T4641] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.529731][ T4641] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.561470][ T4641] team0: Port device team_slave_0 added [ 92.571240][ T4641] team0: Port device team_slave_1 added [ 92.602406][ T4641] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.614989][ T4641] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.642695][ T4641] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.656240][ T4641] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.663299][ T4641] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.691269][ T4641] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.736204][ T4641] device hsr_slave_0 entered promiscuous mode [ 92.744751][ T4641] device hsr_slave_1 entered promiscuous mode [ 92.764292][ T154] ODEBUG: Out of memory. ODEBUG disabled [ 93.420829][ T4641] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.431887][ T4641] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.442260][ T4641] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.452341][ T4641] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.529212][ T4641] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.569710][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 93.579733][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 93.590124][ T4641] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.623360][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 93.645030][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 93.656346][ T4351] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.663619][ T4351] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.671712][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 93.715760][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 93.728023][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 93.737919][ T1263] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.745708][ T1263] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.755751][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 93.777048][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 93.793850][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 93.807988][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 93.818025][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 93.827689][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 93.837193][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 93.846816][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 93.860783][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 93.893774][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 93.902768][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 93.914432][ T4641] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 94.053965][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 94.063822][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 94.100248][ T4641] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.120416][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 94.130680][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 94.174550][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 94.184338][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 94.194830][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 94.203631][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 94.214123][ T4641] device veth0_vlan entered promiscuous mode [ 94.238352][ T4641] device veth1_vlan entered promiscuous mode [ 94.257974][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 94.291306][ T839] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 94.317352][ T839] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 94.343860][ T4641] device veth0_macvtap entered promiscuous mode [ 94.367673][ T4641] device veth1_macvtap entered promiscuous mode [ 94.391033][ T4641] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.401361][ T839] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 94.412390][ T839] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 94.423647][ T839] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 94.438955][ T839] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 94.469120][ T4641] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.485731][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 94.505465][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 94.529270][ T4641] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.539591][ T4641] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.565134][ T4641] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.574715][ T4641] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.478439][ T4351] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.499102][ T4351] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.535716][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 95.544417][ T4351] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.562737][ T4351] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.576905][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 96.372619][ T154] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/09/14 05:19:44 executed programs: 0 [ 96.638953][ T4823] chnl_net:caif_netlink_parms(): no params data found [ 96.692588][ T4823] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.699946][ T4823] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.708334][ T4823] device bridge_slave_0 entered promiscuous mode [ 96.717490][ T4823] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.726357][ T4823] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.734628][ T4823] device bridge_slave_1 entered promiscuous mode [ 96.756915][ T4823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.768176][ T4823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.792854][ T4823] team0: Port device team_slave_0 added [ 96.800924][ T4823] team0: Port device team_slave_1 added [ 96.824348][ T4823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.831649][ T4823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.860360][ T4823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.875890][ T4823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.883790][ T4823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.911248][ T4823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.952804][ T4823] device hsr_slave_0 entered promiscuous mode [ 96.960188][ T4823] device hsr_slave_1 entered promiscuous mode [ 96.969752][ T4823] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 96.978178][ T4823] Cannot create hsr debugfs directory [ 98.595592][ T4322] Bluetooth: hci0: command 0x0409 tx timeout [ 98.873957][ T154] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.943378][ T154] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.022672][ T154] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.800993][ T4823] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 99.810408][ T4823] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 99.830651][ T4823] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 99.840735][ T4823] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.897095][ T4823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.916832][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 99.924982][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 99.937644][ T4823] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.948280][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 99.957355][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 99.966508][ T4351] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.973691][ T4351] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.981960][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 100.002647][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 100.011955][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 100.021170][ T4351] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.028359][ T4351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.038143][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 100.047780][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 100.067690][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 100.080149][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 100.097420][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 100.105823][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 100.114366][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 100.124657][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 100.133754][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 100.142855][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 100.151840][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 100.171920][ T4823] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 100.184306][ T154] device hsr_slave_0 left promiscuous mode [ 100.192042][ T154] device hsr_slave_1 left promiscuous mode [ 100.199694][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 100.209165][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 100.217612][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 100.225950][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 100.233970][ T154] device bridge_slave_1 left promiscuous mode [ 100.240854][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.250939][ T154] device bridge_slave_0 left promiscuous mode [ 100.259660][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.273160][ T154] device veth1_macvtap left promiscuous mode [ 100.280144][ T154] device veth0_macvtap left promiscuous mode [ 100.287138][ T154] device veth1_vlan left promiscuous mode [ 100.294036][ T154] device veth0_vlan left promiscuous mode [ 100.403587][ T154] team0 (unregistering): Port device team_slave_1 removed [ 100.418491][ T154] team0 (unregistering): Port device team_slave_0 removed [ 100.430429][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 100.443724][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 100.488955][ T154] bond0 (unregistering): Released all slaves [ 100.607422][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 100.615426][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 100.628109][ T4823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.642634][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 100.653148][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 100.678305][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 100.686627][ T4322] Bluetooth: hci0: command 0x041b tx timeout [ 100.689915][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 100.702790][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 100.711976][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 100.722480][ T4823] device veth0_vlan entered promiscuous mode [ 100.733081][ T4823] device veth1_vlan entered promiscuous mode [ 100.752815][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 100.762128][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 100.771183][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 100.781786][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 100.795640][ T4823] device veth0_macvtap entered promiscuous mode [ 100.808759][ T4823] device veth1_macvtap entered promiscuous mode [ 100.823689][ T4823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.834776][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 100.844014][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 100.852517][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 100.862115][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 100.874029][ T4823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.884120][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 100.893847][ T1263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 100.904942][ T4823] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.914524][ T4823] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.924133][ T4823] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.933611][ T4823] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.998664][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.011976][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.021368][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 101.056624][ T4351] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.064473][ T4351] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.085854][ T4351] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 101.445218][ T23] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 101.835413][ T23] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 101.845372][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.899266][ T23] mdc800 1-1:1.0: Found Mustek MDC800 on USB. [ 102.096633][ T5030] [ 102.098974][ T5030] ====================================================== [ 102.106154][ T5030] WARNING: possible circular locking dependency detected [ 102.113162][ T5030] syzkaller #0 Not tainted [ 102.117790][ T5030] ------------------------------------------------------ [ 102.125739][ T5030] syz.0.17/5030 is trying to acquire lock: [ 102.131732][ T5030] ffff888148034a20 (&mdc800->io_lock){+.+.}-{3:3}, at: mdc800_device_open+0x2a/0x430 [ 102.141584][ T5030] [ 102.141584][ T5030] but task is already holding lock: [ 102.148944][ T5030] ffffffff8cdbaab0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x2c/0x300 [ 102.157839][ T5030] [ 102.157839][ T5030] which lock already depends on the new lock. [ 102.157839][ T5030] [ 102.168826][ T5030] [ 102.168826][ T5030] the existing dependency chain (in reverse order) is: [ 102.178015][ T5030] [ 102.178015][ T5030] -> #1 (minor_rwsem#2){++++}-{3:3}: [ 102.185859][ T5030] down_write+0x38/0x60 [ 102.191228][ T5030] usb_register_dev+0x2a3/0x7f0 [ 102.197017][ T5030] mdc800_usb_probe+0xf8a/0x1870 [ 102.202990][ T5030] usb_probe_interface+0x5be/0xae0 [ 102.208754][ T5030] really_probe+0x276/0xc70 [ 102.214030][ T5030] __driver_probe_device+0x1f5/0x390 [ 102.219952][ T5030] driver_probe_device+0x4f/0x420 [ 102.225483][ T5030] __device_attach_driver+0x2b0/0x500 [ 102.231827][ T5030] bus_for_each_drv+0x184/0x210 [ 102.237192][ T5030] __device_attach+0x2a7/0x480 [ 102.243002][ T5030] bus_probe_device+0xba/0x1d0 [ 102.248811][ T5030] device_add+0xbcf/0x1050 [ 102.254417][ T5030] usb_set_configuration+0x19d5/0x2030 [ 102.261534][ T5030] usb_generic_driver_probe+0x89/0x150 [ 102.269220][ T5030] usb_probe_device+0x126/0x250 [ 102.277498][ T5030] really_probe+0x276/0xc70 [ 102.283772][ T5030] __driver_probe_device+0x1f5/0x390 [ 102.290750][ T5030] driver_probe_device+0x4f/0x420 [ 102.298946][ T5030] __device_attach_driver+0x2b0/0x500 [ 102.305025][ T5030] bus_for_each_drv+0x184/0x210 [ 102.310776][ T5030] __device_attach+0x2a7/0x480 [ 102.316065][ T5030] bus_probe_device+0xba/0x1d0 [ 102.321758][ T5030] device_add+0xbcf/0x1050 [ 102.326687][ T5030] usb_new_device+0x9f6/0x15d0 [ 102.332072][ T5030] hub_event+0x2b8d/0x5260 [ 102.337082][ T5030] process_one_work+0x867/0xff0 [ 102.342535][ T5030] worker_thread+0xad7/0x12a0 [ 102.348029][ T5030] kthread+0x42e/0x520 [ 102.352629][ T5030] ret_from_fork+0x1f/0x30 [ 102.357578][ T5030] [ 102.357578][ T5030] -> #0 (&mdc800->io_lock){+.+.}-{3:3}: [ 102.365362][ T5030] __lock_acquire+0x2c66/0x7b50 [ 102.370765][ T5030] lock_acquire+0x19e/0x400 [ 102.375905][ T5030] __mutex_lock_common+0x1e5/0x2400 [ 102.381752][ T5030] mutex_lock_nested+0x17/0x20 [ 102.387617][ T5030] mdc800_device_open+0x2a/0x430 [ 102.393177][ T5030] usb_open+0x1fe/0x300 [ 102.398402][ T5030] chrdev_open+0x585/0x5f0 [ 102.403434][ T5030] do_dentry_open+0x7f7/0xf90 [ 102.408662][ T5030] path_openat+0x2718/0x2fb0 [ 102.414476][ T5030] do_filp_open+0x1df/0x400 [ 102.419501][ T5030] do_sys_openat2+0x14b/0x500 [ 102.424691][ T5030] __x64_sys_openat+0x135/0x160 [ 102.430137][ T5030] do_syscall_64+0x4c/0xa0 [ 102.435182][ T5030] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 102.441942][ T5030] [ 102.441942][ T5030] other info that might help us debug this: [ 102.441942][ T5030] [ 102.452367][ T5030] Possible unsafe locking scenario: [ 102.452367][ T5030] [ 102.460163][ T5030] CPU0 CPU1 [ 102.465528][ T5030] ---- ---- [ 102.470891][ T5030] lock(minor_rwsem#2); [ 102.475174][ T5030] lock(&mdc800->io_lock); [ 102.482175][ T5030] lock(minor_rwsem#2); [ 102.489109][ T5030] lock(&mdc800->io_lock); [ 102.493692][ T5030] [ 102.493692][ T5030] *** DEADLOCK *** [ 102.493692][ T5030] [ 102.502088][ T5030] 1 lock held by syz.0.17/5030: [ 102.507384][ T5030] #0: ffffffff8cdbaab0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x2c/0x300 [ 102.516474][ T5030] [ 102.516474][ T5030] stack backtrace: [ 102.522365][ T5030] CPU: 0 PID: 5030 Comm: syz.0.17 Not tainted syzkaller #0 [ 102.530056][ T5030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.540125][ T5030] Call Trace: [ 102.543619][ T5030] [ 102.546636][ T5030] dump_stack_lvl+0x188/0x250 [ 102.551485][ T5030] ? load_image+0x410/0x410 [ 102.556771][ T5030] ? show_regs_print_info+0x20/0x20 [ 102.562472][ T5030] ? print_circular_bug+0x12b/0x1a0 [ 102.568390][ T5030] check_noncircular+0x296/0x330 [ 102.573343][ T5030] ? add_chain_block+0x9b0/0x9b0 [ 102.578392][ T5030] ? lockdep_lock+0xf1/0x1f0 [ 102.583309][ T5030] ? mark_lock+0x94/0x320 [ 102.587918][ T5030] ? _find_first_zero_bit+0xd1/0xf0 [ 102.593591][ T5030] __lock_acquire+0x2c66/0x7b50 [ 102.598800][ T5030] ? lockdep_lock+0xf1/0x1f0 [ 102.603691][ T5030] ? verify_lock_unused+0x140/0x140 [ 102.609652][ T5030] ? lockdep_unlock+0x143/0x2e0 [ 102.614933][ T5030] ? lockdep_lock+0x1f0/0x1f0 [ 102.620210][ T5030] ? mark_lock+0x286/0x320 [ 102.624942][ T5030] ? _find_first_zero_bit+0xd1/0xf0 [ 102.630348][ T5030] ? __lock_acquire+0x2844/0x7b50 [ 102.635596][ T5030] lock_acquire+0x19e/0x400 [ 102.640392][ T5030] ? mdc800_device_open+0x2a/0x430 [ 102.645505][ T5030] ? __might_sleep+0xf0/0xf0 [ 102.650092][ T5030] ? read_lock_is_recursive+0x10/0x10 [ 102.655603][ T5030] ? verify_lock_unused+0x140/0x140 [ 102.660984][ T5030] __mutex_lock_common+0x1e5/0x2400 [ 102.666273][ T5030] ? mdc800_device_open+0x2a/0x430 [ 102.671492][ T5030] ? mdc800_device_open+0x2a/0x430 [ 102.676766][ T5030] ? mutex_lock_io_nested+0x60/0x60 [ 102.682105][ T5030] ? chrdev_open+0x381/0x5f0 [ 102.686702][ T5030] ? __lock_acquire+0x7b50/0x7b50 [ 102.691815][ T5030] ? do_raw_spin_lock+0x128/0x2f0 [ 102.696842][ T5030] ? mdc800_device_write+0x11d0/0x11d0 [ 102.702666][ T5030] mutex_lock_nested+0x17/0x20 [ 102.707630][ T5030] mdc800_device_open+0x2a/0x430 [ 102.712752][ T5030] ? mdc800_device_write+0x11d0/0x11d0 [ 102.718223][ T5030] usb_open+0x1fe/0x300 [ 102.722662][ T5030] chrdev_open+0x585/0x5f0 [ 102.727385][ T5030] ? cd_forget+0x160/0x160 [ 102.731969][ T5030] ? fsnotify_perm+0x3a7/0x560 [ 102.736726][ T5030] ? cd_forget+0x160/0x160 [ 102.741244][ T5030] do_dentry_open+0x7f7/0xf90 [ 102.745921][ T5030] ? vfs_open+0x2b/0x80 [ 102.750091][ T5030] path_openat+0x2718/0x2fb0 [ 102.754871][ T5030] ? __kasan_slab_alloc+0xa9/0xc0 [ 102.759997][ T5030] ? do_filp_open+0x400/0x400 [ 102.765233][ T5030] do_filp_open+0x1df/0x400 [ 102.769757][ T5030] ? vfs_tmpfile+0x300/0x300 [ 102.774449][ T5030] ? _raw_spin_unlock+0x24/0x40 [ 102.779382][ T5030] ? alloc_fd+0x59e/0x650 [ 102.783800][ T5030] do_sys_openat2+0x14b/0x500 [ 102.788493][ T5030] ? __lock_acquire+0x7b50/0x7b50 [ 102.793969][ T5030] ? do_sys_open+0xe0/0xe0 [ 102.795259][ T4322] Bluetooth: hci0: command 0x040f tx timeout [ 102.798558][ T5030] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 102.798589][ T5030] ? lock_chain_count+0x20/0x20 [ 102.816485][ T5030] __x64_sys_openat+0x135/0x160 [ 102.821341][ T5030] do_syscall_64+0x4c/0xa0 [ 102.825839][ T5030] ? clear_bhb_loop+0x30/0x80 [ 102.830513][ T5030] ? clear_bhb_loop+0x30/0x80 [ 102.835475][ T5030] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 102.841368][ T5030] RIP: 0033:0x7f153a27290e [ 102.845784][ T5030] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 102.866211][ T5030] RSP: 002b:00007f1539911b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 102.875335][ T5030] RAX: ffffffffffffffda RBX: 00007f15399126c0 RCX: 00007f153a27290e [ 102.884183][ T5030] RDX: 0000000000000002 RSI: 00007f1539911c00 RDI: ffffffffffffff9c [ 102.892471][ T5030] RBP: 00007f153a349024 R08: 0000000000000000 R09: 0000000000000000 [ 102.900522][ T5030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.908482][ T5030] R13: 00007f153a53a038 R14: 00007f153a539fa0 R15: 00007ffcc15eb898 [ 102.916539][ T5030] [ 102.945521][ T4256] usb 1-1: USB disconnect, device number 2 [ 102.953970][ T4256] mdc800 1-1:1.0: Mustek MDC800 disconnected from USB. 2026/09/14 05:19:51 executed programs: 3 [ 103.725416][ T23] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 104.125665][ T23] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 104.135587][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.195940][ T23] mdc800 1-1:1.0: Found Mustek MDC800 on USB. [ 104.415632][ T23] usb 1-1: USB disconnect, device number 3 [ 104.422675][ T23] mdc800 1-1:1.0: Mustek MDC800 disconnected from USB. [ 104.835204][ T23] Bluetooth: hci0: command 0x0419 tx timeout [ 105.195468][ T23] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 105.555363][ T23] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 105.565899][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.616075][ T23] mdc800 1-1:1.0: Found Mustek MDC800 on USB. [ 105.835741][ T23] usb 1-1: USB disconnect, device number 4 [ 105.842630][ T23] mdc800 1-1:1.0: Mustek MDC800 disconnected from USB. [ 106.615225][ T4264] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 106.995460][ T4264] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 107.004653][ T4264] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.046083][ T4264] mdc800 1-1:1.0: Found Mustek MDC800 on USB. [ 107.275818][ T4264] usb 1-1: USB disconnect, device number 5 [ 107.284326][ T4264] mdc800 1-1:1.0: Mustek MDC800 disconnected from USB. [ 108.055201][ T4322] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 108.415334][ T4322] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 108.424953][ T4322] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.466092][ T4322] mdc800 1-1:1.0: Found Mustek MDC800 on USB. [ 108.685633][ T4322] usb 1-1: USB disconnect, device number 6 [ 108.692508][ T4322] mdc800 1-1:1.0: Mustek MDC800 disconnected from USB. 2026/09/14 05:19:57 executed programs: 7 [ 109.455253][ T4264] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 109.835713][ T4264] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 109.845376][ T4264] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.895995][ T4264] mdc800 1-1:1.0: Found Mustek MDC800 on USB. [ 110.125694][ T4322] usb 1-1: USB disconnect, device number 7 [ 110.132736][ T4322] mdc800 1-1:1.0: Mustek MDC800 disconnected from USB. [ 110.895223][ T4264] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 111.275793][ T4264] usb 1-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 111.286448][ T4264] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.345948][ T4264] mdc800 1-1:1.0: Found Mustek MDC800 on USB. [ 111.565402][ T23] usb 1-1: USB disconnect, device number 8 [ 111.576372][ T23] mdc800 1-1:1.0: Mustek MDC800 disconnected from USB.