syzkaller login: [ 58.720155] sshd (229) used greatest stack depth: 24216 bytes left Warning: Permanently added '[localhost]:50061' (ECDSA) to the list of known hosts. 2025/01/28 19:42:49 fuzzer started 2025/01/28 19:42:49 dialing manager at localhost:40187 [ 61.382527] cgroup: Unknown subsys name 'net' [ 61.520185] cgroup: Unknown subsys name 'cpuset' [ 61.562206] cgroup: Unknown subsys name 'rlimit' [ 66.935769] kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) 2025/01/28 19:43:05 syscalls: 205 2025/01/28 19:43:05 code coverage: enabled 2025/01/28 19:43:05 comparison tracing: enabled 2025/01/28 19:43:05 extra coverage: enabled 2025/01/28 19:43:05 setuid sandbox: enabled 2025/01/28 19:43:05 namespace sandbox: enabled 2025/01/28 19:43:05 Android sandbox: enabled 2025/01/28 19:43:05 fault injection: enabled 2025/01/28 19:43:05 leak checking: enabled 2025/01/28 19:43:05 net packet injection: enabled 2025/01/28 19:43:05 net device setup: enabled 2025/01/28 19:43:05 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/01/28 19:43:05 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/01/28 19:43:05 USB emulation: enabled 2025/01/28 19:43:05 hci packet injection: enabled 2025/01/28 19:43:05 wifi device emulation: enabled 2025/01/28 19:43:05 802.15.4 emulation: enabled 2025/01/28 19:43:05 fetching corpus: 0, signal 0/0 (executing program) 2025/01/28 19:43:06 starting 8 fuzzer processes 19:43:06 executing program 0: epoll_create(0x1) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x100, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000040)={0x80000000}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x1e3200, 0x0) execveat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)=[&(0x7f0000000100)='.log\x00', &(0x7f0000000140)='${{\x00', &(0x7f0000000180)='.log\x00', &(0x7f00000001c0)='@\'/-\x82*(\x00', &(0x7f0000000200)='\x00', &(0x7f0000000240)='%%\x00', &(0x7f0000000280)='.log\x00', &(0x7f00000002c0)='.log\x00', &(0x7f0000000300)='\x00'], &(0x7f0000000600)=[&(0x7f00000003c0)='.log\x00', &(0x7f0000000400)='l*}\x00', &(0x7f0000000440)='.log\x00', &(0x7f0000000480)='.log\x00', &(0x7f00000004c0)='.log\x00', &(0x7f0000000500)='.\x00', &(0x7f0000000540)='.log\x00', &(0x7f0000000580)='.log\x00', &(0x7f00000005c0)='^#:{-\\%!\x00'], 0x1000) recvfrom$unix(r0, &(0x7f0000000680)=""/127, 0x7f, 0x0, &(0x7f0000000700)=@abs={0x0, 0x0, 0x4e21}, 0x6e) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000780)={'wg0\x00'}) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f00000007c0)=0x2, 0x4) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r2, 0xc0189378, &(0x7f0000000800)={{0x1, 0x1, 0x18, r2, {r0}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f0000000840)={{0x1, 0x1, 0x18, r3, {0x7d1897d7}}, './file0\x00'}) recvfrom$unix(r5, &(0x7f0000000880)=""/53, 0x35, 0x0, &(0x7f00000008c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r5, 0x40106614, &(0x7f0000000940)) epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, r4) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r4, 0x40106614, &(0x7f0000000980)) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r5, 0xc080661a, &(0x7f00000009c0)={@desc={0x1, 0x0, @desc4}}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000a40)=@IORING_OP_FALLOCATE={0x11, 0x1, 0x0, @fd_index=0x1, 0x200, 0x0, 0xbab9, 0x0, 0x1}, 0x4) mknodat(r5, &(0x7f0000000a80)='./file0\x00', 0x40, 0x7) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000ac0)={0x0, 0x9, 0x80000001, 0x0, 0x5}) 19:43:06 executing program 2: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x20202) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0x40103d0b, &(0x7f0000000040)={0x7f, 0x5}) read$ptp(0xffffffffffffffff, &(0x7f0000000080)=""/94, 0x5e) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x10001}}, './file0\x00'}) stat(&(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000180)) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x2000) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, &(0x7f0000000440)={{0x1, 0x1, 0x18, r0, {r2, r3}}, './file0/file0\x00'}) fchmodat(r1, &(0x7f0000000480)='./file0\x00', 0x10) r5 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0x2002) r6 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000500)) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r5, 0xc018937e, &(0x7f0000000540)={{0x1, 0x1, 0x18, r6, @out_args}, './file0/file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r5, 0xc0189377, &(0x7f0000000580)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7, 0xe25}}, './file0/file0\x00'}) mknodat$loop(r8, &(0x7f00000005c0)='./file0/file0\x00', 0x40, 0x1) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r0, &(0x7f0000000600)) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000640)={{0x1, 0x1, 0x18, r4, {0x3f4f}}, './file0/file0\x00'}) mknodat$loop(r9, &(0x7f0000000680)='./file0/file0\x00', 0x20, 0x1) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc0189379, &(0x7f00000006c0)={{0x1, 0x1, 0x18}, './file0\x00'}) io_uring_setup(0x6c9c, &(0x7f0000000700)={0x0, 0x55b5, 0x20, 0x0, 0x1d6, 0x0, r7}) 19:43:06 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) r4 = io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) r5 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x6d6d, &(0x7f0000000280)={0x0, 0xda8, 0x2, 0x2, 0x14a, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000380)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x1, 0x3, 0x0, 0x862b}, 0x9) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x200000a, r2) pkey_alloc(0x0, 0x2) pkey_free(r2) 19:43:06 executing program 1: getpgrp(0x0) r0 = fork() waitid(0x1, r0, &(0x7f0000000000), 0x1, &(0x7f0000000080)) mount_setattr(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x800, &(0x7f0000000180)={0x0, 0x84, 0x40000}, 0x20) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), 0xffffffffffffffff) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) syz_genetlink_get_family_id$wireguard(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {r2, r3}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r4, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r6 = openat$random(0xffffffffffffff9c, &(0x7f0000000380), 0x8a8a81, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r5, 0xc0189377, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r6, {0x6, 0x8}}, './file0\x00'}) clock_gettime(0x0, &(0x7f0000000440)={0x0, 0x0}) futimesat(r7, &(0x7f0000000400)='./file0\x00', &(0x7f0000000480)={{r8, r9/1000+10000}, {0x0, 0xea60}}) getsockopt$inet6_udp_int(r7, 0x11, 0xa, &(0x7f00000004c0), &(0x7f0000000500)=0x4) getsockname$packet(r7, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000840)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000600)={0x1f0, r1, 0x800, 0x70bd26, 0x25dfdbff, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x3}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r10}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e24}, @WGDEVICE_A_PEERS={0x190, 0x8, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x164, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x101}, @WGPEER_A_ALLOWEDIPS={0x150, 0x9, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}]}, {0x118, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0xcb, 0x0}}, {0x5}}]}]}, @WGPEER_A_FLAGS={0x8, 0x3, 0x1}]}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x80}, 0x4000) setsockopt$inet6_udp_encap(r5, 0x11, 0x64, &(0x7f0000000880)=0x5, 0x4) ioctl$RNDCLEARPOOL(r6, 0x5206, &(0x7f00000008c0)=0x9) r11 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000900)='./file0/file0\x00', &(0x7f0000000940)={0x200240, 0x0, 0x2}, 0x18) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000000980)={{0x1, 0x1, 0x18, r11, {0x6a}}, './file0/file0\x00'}) 19:43:06 executing program 4: ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4bb, 0x1}}, './file0\x00'}) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @a}, 0x10, 0x0, '\x00', @d}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) execveat(r1, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), &(0x7f0000000400)=[&(0x7f0000000180)='abcdefghijklmnop', &(0x7f00000001c0)='abcdefghijklmnop', &(0x7f0000000200)=',\x00', &(0x7f0000000240)='abcdefghijklmnop', &(0x7f0000000280)='\x00', &(0x7f00000002c0)='^]\x00', &(0x7f0000000300)='\x00', &(0x7f0000000340)='@!]\x00', &(0x7f0000000380)='abcdefghijklmnop', &(0x7f00000003c0)='abcdefghijklmnop'], 0x800) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000480)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f00000004c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) execveat(r1, &(0x7f0000000500)='./file0\x00', &(0x7f0000000600)=[&(0x7f0000000540)='abcdefghijklmnop', &(0x7f0000000580)='@\x00', &(0x7f00000005c0)='abcdefghijklmnop'], &(0x7f0000000840)=[&(0x7f0000000640)='\\-,&(\x8b&*\x00', &(0x7f0000000680)='abcdefghijklmnop', &(0x7f00000006c0)='\x11-\x12##\x04{\x8d-C]@[[\x00', &(0x7f0000000700)='^]\x00', &(0x7f0000000740)=',\x00', &(0x7f0000000780)=',\x00', &(0x7f00000007c0)='@!]\x00', &(0x7f0000000800)='\x00'], 0x100) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000880)={{0x1, 0x1, 0x18, r1, {0x6}}, './file0\x00'}) mknodat$null(r6, &(0x7f00000008c0)='./file0\x00', 0x0, 0x103) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f0000000900)={{0x1, 0x1, 0x18, r5, {0x93b6}}, './file0\x00'}) unlinkat(r7, &(0x7f0000000940)='./file0\x00', 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000980)='net/rt_cache\x00') epoll_ctl$EPOLL_CTL_MOD(r8, 0x3, r0, &(0x7f00000009c0)) r9 = epoll_create(0x10000) epoll_ctl$EPOLL_CTL_MOD(r9, 0x3, r4, &(0x7f0000000a00)={0xc}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f0000000a40)={{0x1, 0x1, 0x18, r7}, './file1\x00'}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r10, 0x800c6613, &(0x7f0000000a80)=@v2={0x2, @aes128, 0x8, '\x00', @c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r5, 0xc018937b, &(0x7f0000000ac0)={{0x1, 0x1, 0x18, r9, {r2, r3}}, './file0\x00'}) inotify_init1(0x80000) [ 78.423928] audit: type=1400 audit(1738093386.846:7): avc: denied { execmem } for pid=274 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 19:43:06 executing program 5: ioctl$PTP_ENABLE_PPS(0xffffffffffffffff, 0x40043d04, 0x1) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000)=0xd, 0x4) r0 = syz_mount_image$nfs4(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x2, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="16c15c328b37fb3acd28bb3ec00bba8dc67ab6835f", 0x15, 0x4b36}, {&(0x7f0000000100)="694bd4ae2af3a4b037439d6f295dc1324baac2a4f57e74ca2ac0c895900e2dc2d5325d518277f498cec931aac6fc84d96bbfdad12f5eec8d90b6e44e3262032b7809b8a35b53bdb0b3f575d4b3349d8729a20ab5e5c0950f0ce5fbe6d61d3a3f742e8e01acd1400164086a", 0x6b, 0x2}], 0xc0000, &(0x7f00000001c0)={[{'Q'}, {'^#'}, {'::-&.'}, {'}/'}, {']%}\\{(]:'}, {'-\\[^]@'}, {',*,*()[{])\'\'-'}, {':'}], [{@subj_type={'subj_type', 0x3d, '%'}}, {@permit_directio}, {@subj_user={'subj_user', 0x3d, ']&\xf3)'}}, {@pcr={'pcr', 0x3d, 0x1a}}]}) setrlimit(0x2, &(0x7f0000000240)={0x1, 0x7890e1d3}) mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x3a0039, &(0x7f0000000300)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@loose}, {@cache_fscache}, {@version_u}, {@privport}, {@debug={'debug', 0x3d, 0x1}}, {@version_L}], [{@smackfsroot={'smackfsroot', 0x3d, '%'}}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x30, 0x63, 0x61, 0x69, 0x34, 0x33, 0x36], 0x2d, [0x66, 0x36, 0x31, 0x32], 0x2d, [0x30, 0x62, 0x32, 0x63], 0x2d, [0x30, 0x39, 0xb, 0x31], 0x2d, [0x63, 0x62, 0x35, 0x33, 0x65, 0x32, 0x35, 0x61]}}}, {@fsname={'fsname', 0x3d, ')),{'}}, {@smackfsdef}, {@euid_gt={'euid>', 0xee01}}, {@subj_type={'subj_type', 0x3d, '}/'}}]}}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000440)) ioctl$SIOCGSTAMPNS(0xffffffffffffffff, 0x8907, &(0x7f0000000480)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000004c0)={0x0, 0x0, 0x2}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000500)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8001}}, './file0\x00'}) inotify_rm_watch(r1, 0x0) semget(0x3, 0x0, 0x61) r2 = openat$incfs(r1, &(0x7f0000000540)='.pending_reads\x00', 0x1, 0x26) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000580)={0x0, 0x2, 0xffffffffffffffff, 0x1, 0x80000}) setrlimit(0x6, &(0x7f00000005c0)={0xffff, 0xff}) getpeername$unix(r2, &(0x7f0000000600), &(0x7f0000000680)=0x6e) accept4$packet(r2, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0xfffffffffffffffc, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r1, &(0x7f0000000700)={0x11, 0x0, 0x0}, &(0x7f0000000740)=0x14) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000780)={r4, 0x1, 0x6}, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000007c0)={0x0, 0x3, r3, 0x9}) 19:43:06 executing program 6: r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x2, 0x1, 0x8}, 0x18) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) inotify_add_watch(r1, &(0x7f00000000c0)='./file0\x00', 0x11000000) getpeername$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) execveat(r0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)=[&(0x7f0000000200)='^(-!%$&]{-[-(\xea!\x00', &(0x7f0000000240)=':\\(%}]{-\x00', &(0x7f0000000280)='J%)[+()/', &(0x7f00000002c0)='.\x00', &(0x7f0000000300)='\x00', &(0x7f0000000340)='%$\xa3-\x00'], &(0x7f0000000480)=[&(0x7f00000003c0)='[\x00', &(0x7f0000000400)='-%{.%@[)\x00', &(0x7f0000000440)='&\x88{}\xff]*--\x00'], 0x400) unlinkat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x200) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000500), 0xc0002, 0x0) epoll_pwait2(r2, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0xa, &(0x7f00000005c0)={0x77359400}, &(0x7f0000000600)={[0x10001]}, 0x8) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000640)={{0x1, 0x1, 0x18, r2, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r3, 0xc018937e, &(0x7f0000000680)={{0x1, 0x1, 0x18, r1, @in_args={0x1}}, './file0\x00'}) faccessat(r4, &(0x7f00000006c0)='./file0\x00', 0x5) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r2, 0xc018937c, &(0x7f0000000700)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) getdents(r5, &(0x7f0000000740)=""/85, 0x55) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f00000007c0)={{0x1, 0x1, 0x18, r3, {0x5}}, './file0\x00'}) r7 = syz_io_uring_setup(0x5aa4, &(0x7f0000000800)={0x0, 0x8bc3, 0x8, 0x0, 0x2c9, 0x0, r1}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000000880), &(0x7f00000008c0)) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r6, 0xc018937c, &(0x7f0000000900)={{0x1, 0x1, 0x18, r7, {0x2}}, './file0\x00'}) r8 = syz_open_procfs(0x0, &(0x7f0000000940)='net/rt_acct\x00') inotify_add_watch(r8, &(0x7f0000000980)='./file0\x00', 0x4000000) epoll_pwait2(r4, &(0x7f00000009c0)=[{}], 0x1, &(0x7f0000000a00)={0x0, 0x989680}, &(0x7f0000000a40)={[0x1000]}, 0x8) execve(&(0x7f0000000a80)='./file1\x00', &(0x7f0000000ac0), &(0x7f0000000c80)=[&(0x7f0000000b00)='^(-!%$&]{-[-(\xea!\x00', &(0x7f0000000b40)='@-\x00', &(0x7f0000000b80)='%$\xa3-\x00', &(0x7f0000000bc0)='^(-!%$&]{-[-(\xea!\x00', &(0x7f0000000c00)='&\x88{}\xff]*--\x00', &(0x7f0000000c40)='],\r{[#(\x00']) 19:43:06 executing program 7: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x6, 0x80000000}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, @out_args}, './file0\x00'}) socket$unix(0x1, 0x5, 0x0) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000080)=0x1, 0x4) epoll_create(0x401) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000000c0)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x3, &(0x7f0000000100)) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {0x10000}}, './file0\x00'}) setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000180)=0xc829, 0x4) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f00000001c0)=0x4, 0x4) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000200)) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x4, 0x4, 0x4, 0x0, 0x25, @empty, @rand_addr=' \x01\x00', 0x20, 0x7800, 0x8, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'syztnl1\x00', &(0x7f0000000300)={'ip6tnl0\x00', r4, 0x2f, 0x1f, 0x6, 0x401, 0x18, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x80, 0x10, 0x2, 0x7e2d0958}}) getresuid(&(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)=0x0) getgroups(0x4, &(0x7f00000004c0)=[0xee00, 0xee01, 0x0, 0xee00]) fchownat(r1, &(0x7f00000003c0)='./file0\x00', r6, r7, 0x100) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000580)={'sit0\x00', &(0x7f0000000500)={'sit0\x00', r5, 0x2f, 0x2, 0x3, 0x2, 0xa, @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8, 0x20, 0x0, 0xff}}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f00000005c0)={{0x1, 0x1, 0x18}, './file0\x00'}) [ 79.951999] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.955560] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.965921] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.970043] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.972433] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.979702] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.981917] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.988363] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 79.995914] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 80.005919] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.008707] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.010366] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.015604] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.017047] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.019735] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.021451] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.043631] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.053917] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.056662] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.062608] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 80.062784] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 80.065021] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.066357] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 80.074858] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 80.077569] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.079895] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.085939] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 80.087861] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 80.093940] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 80.095740] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 80.096341] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 80.099671] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 80.105719] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 80.110899] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 80.113814] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 80.115858] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 80.117640] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 80.121735] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 80.124490] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 80.139915] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 80.142083] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 80.143959] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 80.154129] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 80.155934] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 80.163262] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 80.193585] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 80.195008] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 80.198191] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 82.094071] Bluetooth: hci0: command tx timeout [ 82.094856] Bluetooth: hci1: command tx timeout [ 82.156334] Bluetooth: hci5: command tx timeout [ 82.157148] Bluetooth: hci2: command tx timeout [ 82.221415] Bluetooth: hci4: command tx timeout [ 82.222306] Bluetooth: hci7: command tx timeout [ 82.222833] Bluetooth: hci3: command tx timeout [ 82.286334] Bluetooth: hci6: command tx timeout [ 84.141412] Bluetooth: hci1: command tx timeout [ 84.141890] Bluetooth: hci0: command tx timeout [ 84.205470] Bluetooth: hci5: command tx timeout [ 84.205926] Bluetooth: hci2: command tx timeout [ 84.268470] Bluetooth: hci3: command tx timeout [ 84.268893] Bluetooth: hci7: command tx timeout [ 84.269460] Bluetooth: hci4: command tx timeout [ 84.333406] Bluetooth: hci6: command tx timeout [ 86.188647] Bluetooth: hci0: command tx timeout [ 86.189160] Bluetooth: hci1: command tx timeout [ 86.253286] Bluetooth: hci2: command tx timeout [ 86.253757] Bluetooth: hci5: command tx timeout [ 86.317316] Bluetooth: hci7: command tx timeout [ 86.317787] Bluetooth: hci4: command tx timeout [ 86.318626] Bluetooth: hci3: command tx timeout [ 86.381361] Bluetooth: hci6: command tx timeout [ 88.237413] Bluetooth: hci0: command tx timeout [ 88.237931] Bluetooth: hci1: command tx timeout [ 88.301376] Bluetooth: hci5: command tx timeout [ 88.301883] Bluetooth: hci2: command tx timeout [ 88.365801] Bluetooth: hci3: command tx timeout [ 88.366282] Bluetooth: hci4: command tx timeout [ 88.366712] Bluetooth: hci7: command tx timeout [ 88.428269] Bluetooth: hci6: command tx timeout [ 136.221565] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.222316] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 136.551099] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.552079] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.091243] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.091909] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.360556] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.361241] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.582743] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.583525] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.779556] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.780671] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 138.146296] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.146962] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 138.488287] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.489396] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 19:44:07 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) r4 = io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) r5 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x6d6d, &(0x7f0000000280)={0x0, 0xda8, 0x2, 0x2, 0x14a, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000380)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x1, 0x3, 0x0, 0x862b}, 0x9) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x200000a, r2) pkey_alloc(0x0, 0x2) pkey_free(r2) [ 138.839357] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.840548] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 19:44:07 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) r4 = io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) r5 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x6d6d, &(0x7f0000000280)={0x0, 0xda8, 0x2, 0x2, 0x14a, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000380)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x1, 0x3, 0x0, 0x862b}, 0x9) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x200000a, r2) pkey_alloc(0x0, 0x2) pkey_free(r2) [ 139.252245] [ 139.252467] ====================================================== [ 139.253054] WARNING: possible circular locking dependency detected [ 139.253647] 6.13.0-next-20250128 #1 Not tainted [ 139.254301] ------------------------------------------------------ [ 139.255302] kworker/u8:1/64 is trying to acquire lock: [ 139.256150] ffffffff8621d9a8 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.257603] [ 139.257603] but task is already holding lock: [ 139.258495] ffff888033d58768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 139.259930] [ 139.259930] which lock already depends on the new lock. [ 139.259930] [ 139.261106] [ 139.261106] the existing dependency chain (in reverse order) is: [ 139.262573] [ 139.262573] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 139.263543] __mutex_lock+0x13d/0xb50 [ 139.264276] wiphy_register+0x1b2e/0x25d0 [ 139.265003] ieee80211_register_hw+0x23a4/0x3d60 [ 139.265919] mac80211_hwsim_new_radio+0x2759/0x4d60 [ 139.267118] init_mac80211_hwsim+0x389/0x870 [ 139.267642] do_one_initcall+0xf9/0x640 [ 139.268112] kernel_init_freeable+0x53d/0x7a0 [ 139.268632] kernel_init+0x1e/0x2d0 [ 139.269046] ret_from_fork+0x48/0x80 [ 139.269467] ret_from_fork_asm+0x1a/0x30 [ 139.269944] [ 139.269944] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 139.270549] __lock_acquire+0x29fd/0x4580 [ 139.271026] lock_acquire+0x19b/0x520 [ 139.271468] __mutex_lock+0x13d/0xb50 [ 139.271931] unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.272535] unregister_netdevice_queue+0x224/0x2e0 [ 139.273076] _cfg80211_unregister_wdev+0x57b/0x700 [ 139.273622] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 139.274164] ieee80211_unregister_hw+0x55/0x3a0 [ 139.274679] hwsim_exit_net+0x3a0/0x730 [ 139.275133] ops_exit_list+0xb3/0x180 [ 139.275575] cleanup_net+0x546/0xad0 [ 139.276007] process_one_work+0x8ee/0x1a10 [ 139.276505] worker_thread+0x674/0xe70 [ 139.276979] kthread+0x3ab/0x720 [ 139.277392] ret_from_fork+0x48/0x80 [ 139.277812] ret_from_fork_asm+0x1a/0x30 [ 139.278290] [ 139.278290] other info that might help us debug this: [ 139.278290] [ 139.279032] Possible unsafe locking scenario: [ 139.279032] [ 139.279596] CPU0 CPU1 [ 139.279983] ---- ---- [ 139.280370] lock(&rdev->wiphy.mtx); [ 139.280715] lock(rtnl_mutex); [ 139.281211] lock(&rdev->wiphy.mtx); [ 139.281745] lock(rtnl_mutex); [ 139.282051] [ 139.282051] *** DEADLOCK *** [ 139.282051] [ 139.282555] 4 locks held by kworker/u8:1/64: [ 139.282934] #0: ffff888008fdb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12b6/0x1a10 [ 139.283925] #1: ffff88800f3cfd30 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x861/0x1a10 [ 139.284881] #2: ffffffff862119d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xad0 [ 139.285772] #3: ffff888033d58768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 139.286784] [ 139.286784] stack backtrace: [ 139.287221] CPU: 0 UID: 0 PID: 64 Comm: kworker/u8:1 Not tainted 6.13.0-next-20250128 #1 [ 139.287260] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 139.287282] Workqueue: netns cleanup_net [ 139.287324] Call Trace: [ 139.287333] [ 139.287345] dump_stack_lvl+0xca/0x120 [ 139.287403] print_circular_bug+0x47b/0x750 [ 139.287449] check_noncircular+0x2e9/0x3c0 [ 139.287502] ? __pfx_check_noncircular+0x10/0x10 [ 139.287545] ? hlock_class+0x4e/0x130 [ 139.287575] ? srso_return_thunk+0x5/0x5f [ 139.287630] ? mark_lock+0xac/0xed0 [ 139.287674] ? lockdep_lock+0xba/0x1b0 [ 139.287731] ? __pfx_lockdep_lock+0x10/0x10 [ 139.287794] __lock_acquire+0x29fd/0x4580 [ 139.287847] ? __pfx___lock_acquire+0x10/0x10 [ 139.287890] ? lock_release+0x20f/0x6f0 [ 139.287935] ? __pfx_lock_release+0x10/0x10 [ 139.287978] ? srso_return_thunk+0x5/0x5f [ 139.288038] lock_acquire+0x19b/0x520 [ 139.288081] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.288130] ? __pfx_lock_acquire+0x10/0x10 [ 139.288177] ? srso_return_thunk+0x5/0x5f [ 139.288233] ? lock_is_held_type+0x9e/0x120 [ 139.288288] ? srso_return_thunk+0x5/0x5f [ 139.288348] __mutex_lock+0x13d/0xb50 [ 139.288400] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.288446] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.288492] ? srso_return_thunk+0x5/0x5f [ 139.288547] ? synchronize_rcu_expedited+0x38a/0x420 [ 139.288591] ? __pfx___mutex_lock+0x10/0x10 [ 139.288650] ? srso_return_thunk+0x5/0x5f [ 139.288709] ? srso_return_thunk+0x5/0x5f [ 139.288765] ? kasan_quarantine_put+0x84/0x1e0 [ 139.288825] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 139.288860] ? srso_return_thunk+0x5/0x5f [ 139.288920] unregister_netdevice_many_notify+0x1612/0x1c80 [ 139.288966] ? __virt_addr_valid+0x2e8/0x5d0 [ 139.289019] ? __pfx_lock_release+0x10/0x10 [ 139.289063] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 139.289110] ? find_held_lock+0x2c/0x110 [ 139.289168] ? srso_return_thunk+0x5/0x5f [ 139.289226] ? kernfs_remove_by_name_ns+0xc7/0x130 [ 139.289287] ? srso_return_thunk+0x5/0x5f [ 139.289342] ? lock_release+0x20f/0x6f0 [ 139.289386] ? __pfx_lock_release+0x10/0x10 [ 139.289430] ? srso_return_thunk+0x5/0x5f [ 139.289485] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 139.289533] ? srso_return_thunk+0x5/0x5f [ 139.289594] unregister_netdevice_queue+0x224/0x2e0 [ 139.289640] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 139.289687] ? up_write+0x195/0x520 [ 139.289741] _cfg80211_unregister_wdev+0x57b/0x700 [ 139.289794] ? srso_return_thunk+0x5/0x5f [ 139.289853] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 139.289892] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 139.289931] ? srso_return_thunk+0x5/0x5f [ 139.289987] ? srso_return_thunk+0x5/0x5f [ 139.290043] ? synchronize_rcu+0x1ff/0x260 [ 139.290085] ieee80211_unregister_hw+0x55/0x3a0 [ 139.290130] hwsim_exit_net+0x3a0/0x730 [ 139.290172] ? __pfx_hwsim_exit_net+0x10/0x10 [ 139.290213] ? srso_return_thunk+0x5/0x5f [ 139.290269] ? netdev_run_todo+0x788/0x1040 [ 139.290318] ? __pfx_hwsim_exit_net+0x10/0x10 [ 139.290361] ops_exit_list+0xb3/0x180 [ 139.290403] cleanup_net+0x546/0xad0 [ 139.290448] ? __pfx_cleanup_net+0x10/0x10 [ 139.290502] process_one_work+0x8ee/0x1a10 [ 139.290567] ? __pfx_lock_acquire+0x10/0x10 [ 139.290612] ? __pfx_process_one_work+0x10/0x10 [ 139.290671] ? srso_return_thunk+0x5/0x5f [ 139.290726] ? move_linked_works+0x172/0x270 [ 139.290771] ? srso_return_thunk+0x5/0x5f [ 139.290826] ? assign_work+0x196/0x240 [ 139.290884] worker_thread+0x674/0xe70 [ 139.290942] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 139.290994] ? __pfx_worker_thread+0x10/0x10 [ 139.291054] kthread+0x3ab/0x720 [ 139.291106] ? __pfx_kthread+0x10/0x10 [ 139.291158] ? srso_return_thunk+0x5/0x5f [ 139.291214] ? finish_task_switch.isra.0+0x206/0x840 [ 139.291265] ? __pfx_kthread+0x10/0x10 [ 139.291319] ret_from_fork+0x48/0x80 [ 139.291350] ? __pfx_kthread+0x10/0x10 [ 139.291403] ret_from_fork_asm+0x1a/0x30 [ 139.291469] 19:44:07 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) r4 = io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) r5 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x6d6d, &(0x7f0000000280)={0x0, 0xda8, 0x2, 0x2, 0x14a, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000380)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x1, 0x3, 0x0, 0x862b}, 0x9) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x200000a, r2) pkey_alloc(0x0, 0x2) pkey_free(r2) [ 139.550517] syz-executor.5 (287) used greatest stack depth: 24064 bytes left 19:44:08 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) r4 = io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) r5 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x6d6d, &(0x7f0000000280)={0x0, 0xda8, 0x2, 0x2, 0x14a, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000380)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x1, 0x3, 0x0, 0x862b}, 0x9) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x200000a, r2) pkey_alloc(0x0, 0x2) 19:44:08 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) r4 = io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) r5 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x6d6d, &(0x7f0000000280)={0x0, 0xda8, 0x2, 0x2, 0x14a, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000380)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index=0x1, 0x3, 0x0, 0x862b}, 0x9) pkey_alloc(0x0, 0x2) 19:44:08 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) r4 = io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x6d6d, &(0x7f0000000280)={0x0, 0xda8, 0x2, 0x2, 0x14a, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) pkey_alloc(0x0, 0x2) 19:44:08 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) pkey_alloc(0x0, 0x2) 19:44:08 executing program 3: pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0xffffffffffffffff) r0 = syz_io_uring_setup(0x4c1e, &(0x7f0000000000)={0x0, 0x4517, 0x4, 0x0, 0x63}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000b, 0x50, r0, 0x0) fork() pkey_mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000008, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file1\x00'}) epoll_wait(r3, &(0x7f0000000180)=[{}, {}, {}, {}], 0x4, 0x8001) io_uring_setup(0x3e22, &(0x7f00000001c0)={0x0, 0xf3c7, 0x9d5645cd85743bf3, 0x2, 0x2b1, 0x0, r3}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x1) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, 0xffffffffffffffff, 0x8000000) pkey_alloc(0x0, 0x2) [ 141.369692] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 141.370983] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 141.373165] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 141.375650] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 141.379745] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 141.382845] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 141.507128] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 141.509087] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 141.510033] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 141.513494] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 141.517476] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 141.518498] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 141.567267] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 141.571294] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 141.574936] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 141.578860] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 141.587597] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 141.591882] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 141.684224] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 141.689674] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 141.690485] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 141.695258] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 141.696420] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 141.699086] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 141.729440] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 141.732702] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 141.734760] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 141.738478] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 141.743638] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 141.746850] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 141.774879] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 141.779502] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 141.781248] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 141.807445] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 141.830646] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 141.845291] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 141.847548] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 141.851494] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 141.856486] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 141.908611] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 141.921342] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 141.924584] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 143.404326] Bluetooth: hci0: command tx timeout [ 143.533160] Bluetooth: hci1: command tx timeout [ 143.660278] Bluetooth: hci3: command tx timeout [ 143.724290] Bluetooth: hci4: command tx timeout [ 143.788308] Bluetooth: hci5: command tx timeout [ 143.918231] Bluetooth: hci6: command tx timeout [ 143.980316] Bluetooth: hci7: command tx timeout [ 145.452240] Bluetooth: hci0: command tx timeout [ 145.581624] Bluetooth: hci1: command tx timeout [ 145.709312] Bluetooth: hci3: command tx timeout [ 145.773450] Bluetooth: hci4: command tx timeout [ 145.839217] Bluetooth: hci5: command tx timeout [ 145.964444] Bluetooth: hci6: command tx timeout [ 146.029319] Bluetooth: hci7: command tx timeout [ 147.501308] Bluetooth: hci0: command tx timeout [ 147.629252] Bluetooth: hci1: command tx timeout [ 147.757342] Bluetooth: hci3: command tx timeout [ 147.821243] Bluetooth: hci4: command tx timeout [ 147.886032] Bluetooth: hci5: command tx timeout [ 148.012395] Bluetooth: hci6: command tx timeout [ 148.078252] Bluetooth: hci7: command tx timeout VM DIAGNOSIS: 19:44:07 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff8283f415 RDI=ffffffff886970a0 RBP=ffffffff88697060 RSP=ffff88800f3ced00 R8 =0000000000000001 R9 =ffffed1001e79d96 R10=0000000000000000 R11=7369786520656874 R12=0000000000000000 R13=ffffffff886970b0 R14=ffffffff88697060 R15=ffffffff88697320 RIP=ffffffff8283f46d RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000c00572b000 CR3=0000000022152000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=79656b700a3a33206d6172676f727020 XMM02=30303278302f30303065666630303030 XMM03=6666666666666666667830202c397830 XMM04=5f6f695f7a7973203d2030720a296666 XMM05=202c327830202c303030317830202c6c XMM06=66303030306637783028262874636574 XMM07=66666666666666666666667830286565 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=000000206cebd13d RBX=ffff8880095ed340 RCX=1ffff110012bdaff RDX=dffffc0000000000 RSI=1ffffffff0c80a4e RDI=ffff8880095ed7d8 RBP=ffff88803321f9e8 RSP=ffff88803321f8b8 R8 =ffff8880095ed7f8 R9 =ffff88806cf3c3d0 R10=ffffffff864044d7 R11=ffff888033202078 R12=ffff88806cf3b940 R13=ffff888033201bc0 R14=ffff88806cf3c498 R15=0000000000000000 RIP=ffffffff84a9a934 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00005600bce6a540 CR3=000000000f1c6000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=7465677261742e79636e656772656d65 XMM02=ffffffffffffffffffffff0f0e0d0c0b XMM03=00000000000000210065630065636900 XMM04=40404040404040404040404040404040 XMM05=5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a XMM06=20202020202020202020202020202020 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000ff0000000000 XMM10=00000000000000000000200000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000