last executing test programs: 377.013886ms ago: executing program 1 (id=2): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\'], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 0s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400, 0x9) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.13' (ED25519) to the list of known hosts. [ 70.350801][ T5600] cgroup: Unknown subsys name 'net' [ 70.471146][ T5600] cgroup: Unknown subsys name 'cpuset' [ 70.479924][ T5600] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.620104][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.620174][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.780453][ T5600] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 73.822695][ T5611] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.823763][ T5611] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.826878][ T5611] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 73.851502][ T5611] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.853588][ T5611] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 73.886668][ T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 73.896540][ T5615] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 73.904860][ T5615] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 73.915955][ T5615] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 73.917157][ T5615] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 74.013363][ T4930] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 74.015083][ T4930] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 74.016309][ T4930] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 74.016577][ T4930] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 74.017330][ T4930] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 74.019164][ T4930] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 74.021515][ T4930] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 74.022044][ T4930] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 74.022312][ T4930] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 74.023442][ T4930] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 75.271345][ T5622] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.271461][ T5622] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.271838][ T5622] bridge_slave_0: entered allmulticast mode [ 75.275003][ T5622] bridge_slave_0: entered promiscuous mode [ 75.305626][ T5622] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.305737][ T5622] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.305955][ T5622] bridge_slave_1: entered allmulticast mode [ 75.310425][ T5622] bridge_slave_1: entered promiscuous mode [ 75.389638][ T5622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.419762][ T5622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.495183][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.495275][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.495424][ T5614] bridge_slave_0: entered allmulticast mode [ 75.496744][ T5614] bridge_slave_0: entered promiscuous mode [ 75.511760][ T5622] team0: Port device team_slave_0 added [ 75.512346][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.512445][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.512560][ T5610] bridge_slave_0: entered allmulticast mode [ 75.514915][ T5610] bridge_slave_0: entered promiscuous mode [ 75.551868][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.551965][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.552088][ T5614] bridge_slave_1: entered allmulticast mode [ 75.553713][ T5614] bridge_slave_1: entered promiscuous mode [ 75.557609][ T5622] team0: Port device team_slave_1 added [ 75.557793][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.557934][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.558055][ T5610] bridge_slave_1: entered allmulticast mode [ 75.560082][ T5610] bridge_slave_1: entered promiscuous mode [ 75.561260][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.561352][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.561713][ T5623] bridge_slave_0: entered allmulticast mode [ 75.563423][ T5623] bridge_slave_0: entered promiscuous mode [ 75.605828][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.605923][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.606283][ T5623] bridge_slave_1: entered allmulticast mode [ 75.608131][ T5623] bridge_slave_1: entered promiscuous mode [ 75.671022][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.672018][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.672034][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.672055][ T5622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.674770][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.676982][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.693585][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.694180][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.694192][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.694214][ T5622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.721975][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.739335][ T5614] team0: Port device team_slave_0 added [ 75.771544][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.773753][ T5614] team0: Port device team_slave_1 added [ 75.799314][ T5623] team0: Port device team_slave_0 added [ 75.841529][ T5623] team0: Port device team_slave_1 added [ 75.867135][ T5622] hsr_slave_0: entered promiscuous mode [ 75.868476][ T5622] hsr_slave_1: entered promiscuous mode [ 75.883021][ T5610] team0: Port device team_slave_0 added [ 75.883676][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.883688][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.883711][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.885805][ T5610] team0: Port device team_slave_1 added [ 75.901242][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.901258][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.901280][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.938294][ T4930] Bluetooth: hci0: command tx timeout [ 75.938299][ T55] Bluetooth: hci1: command tx timeout [ 75.940128][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.940141][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.940163][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.960377][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.960394][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.960417][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.963318][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.963333][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.963356][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.118794][ T55] Bluetooth: hci3: command tx timeout [ 76.145072][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.145087][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.145108][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.182012][ T55] Bluetooth: hci2: command tx timeout [ 76.221288][ T5610] hsr_slave_0: entered promiscuous mode [ 76.221858][ T5610] hsr_slave_1: entered promiscuous mode [ 76.222249][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 76.222316][ T5610] Cannot create hsr debugfs directory [ 76.238305][ T5614] hsr_slave_0: entered promiscuous mode [ 76.239339][ T5614] hsr_slave_1: entered promiscuous mode [ 76.240043][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 76.240059][ T5614] Cannot create hsr debugfs directory [ 76.332733][ T5623] hsr_slave_0: entered promiscuous mode [ 76.333396][ T5623] hsr_slave_1: entered promiscuous mode [ 76.333775][ T5623] debugfs: 'hsr0' already exists in 'hsr' [ 76.333793][ T5623] Cannot create hsr debugfs directory [ 76.639840][ T5622] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 76.646390][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 76.655319][ T5622] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 76.668843][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 76.669701][ T5622] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 76.674111][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 76.691968][ T5622] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 76.695163][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 76.755182][ T5614] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.767079][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 76.775464][ T5614] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.779672][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 76.782594][ T5614] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.789704][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 76.805239][ T5614] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.810960][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 76.882513][ T5610] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 76.886300][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 76.887197][ T5610] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 76.904755][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 76.918568][ T5610] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 76.921697][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 76.937599][ T5610] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 76.944934][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 76.985928][ T5622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.037665][ T5622] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.041454][ T5623] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 77.044098][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 77.071127][ T5623] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 77.074333][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 77.076504][ T101] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.077014][ T101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.088716][ T101] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.088809][ T101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.126106][ T5623] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 77.130617][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 77.131493][ T5623] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 77.137342][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 77.274711][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.276682][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.346926][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.356061][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.377475][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.377572][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.381884][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.381978][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.426935][ T101] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.427031][ T101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.455303][ T47] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.455421][ T47] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.550124][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.587684][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.622209][ T47] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.622330][ T47] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.656885][ T47] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.656978][ T47] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.018832][ T55] Bluetooth: hci1: command tx timeout [ 78.018866][ T55] Bluetooth: hci0: command tx timeout [ 78.119646][ T5622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.179553][ T4930] Bluetooth: hci3: command tx timeout [ 78.236959][ T5622] veth0_vlan: entered promiscuous mode [ 78.259079][ T4930] Bluetooth: hci2: command tx timeout [ 78.285186][ T5622] veth1_vlan: entered promiscuous mode [ 78.426266][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.431379][ T5622] veth0_macvtap: entered promiscuous mode [ 78.459740][ T5622] veth1_macvtap: entered promiscuous mode [ 78.515736][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.551017][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.614402][ T5610] veth0_vlan: entered promiscuous mode [ 78.639648][ T5610] veth1_vlan: entered promiscuous mode [ 78.719633][ T33] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.719870][ T33] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.719907][ T33] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.764527][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.768170][ T101] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.784495][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.830188][ T5610] veth0_macvtap: entered promiscuous mode [ 78.862638][ T5610] veth1_macvtap: entered promiscuous mode [ 78.865485][ T47] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.865506][ T47] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.945575][ T47] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.945596][ T47] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.951398][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.965661][ T5614] veth0_vlan: entered promiscuous mode [ 78.983817][ T5614] veth1_vlan: entered promiscuous mode [ 78.997140][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.057062][ T5623] veth0_vlan: entered promiscuous mode [ 79.064387][ T5622] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 79.150444][ T5623] veth1_vlan: entered promiscuous mode [ 79.191217][ T3401] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.191935][ T3401] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.191990][ T3401] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.192022][ T3401] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.220522][ T5614] veth0_macvtap: entered promiscuous mode [ 79.261526][ T5614] veth1_macvtap: entered promiscuous mode [ 79.263413][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.263431][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.278387][ T5762] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 79.363004][ T47] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.363025][ T47] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.381155][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.393595][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.415626][ T5623] veth0_macvtap: entered promiscuous mode [ 79.431964][ T5623] veth1_macvtap: entered promiscuous mode [ 79.487384][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.520132][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.608587][ T5766] ======================================================= [ 79.608587][ T5766] WARNING: The mand mount option has been deprecated and [ 79.608587][ T5766] and is ignored by this kernel. Remove the mand [ 79.608587][ T5766] option from the mount to silence this warning. [ 79.608587][ T5766] ======================================================= ** replaying previous printk message ** [ 79.608587][ T5766] ======================================================= [ 79.608587][ T5766] WARNING: The mand mount option has been deprecated and [ 79.608587][ T5766] and is ignored by this kernel. Remove the mand [ 79.608587][ T5766] option from the mount to silence this warning. [ 79.608587][ T5766] ======================================================= [ 79.652474][ T5766] [ 79.693406][ T5766] ====================================================== [ 79.700424][ T5766] WARNING: possible circular locking dependency detected [ 79.707459][ T5766] syzkaller #0 Not tainted [ 79.711876][ T5766] ------------------------------------------------------ [ 79.718889][ T5766] syz.3.4/5766 is trying to acquire lock: [ 79.724611][ T5766] ffff88807a20c460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 79.733407][ T5766] [ 79.733407][ T5766] but task is already holding lock: [ 79.740768][ T5766] ffff888059675960 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: __d_alloc_parallel+0x39e/0x1700 [ 79.750539][ T5766] [ 79.750539][ T5766] which lock already depends on the new lock. [ 79.750539][ T5766] [ 79.760956][ T5766] [ 79.760956][ T5766] the existing dependency chain (in reverse order) is: [ 79.769959][ T5766] [ 79.769959][ T5766] -> #2 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}: [ 79.777858][ T5766] __d_alloc_parallel+0xc32/0x1700 [ 79.783489][ T5766] __lookup_slow+0x82/0x2f0 [ 79.788509][ T5766] lookup_slow+0x59/0x80 [ 79.793260][ T5766] link_path_walk+0xd22/0x1910 [ 79.798538][ T5766] path_openat+0x1c4/0x1da0 [ 79.803551][ T5766] do_file_open+0x23e/0x4a0 [ 79.808564][ T5766] do_sys_openat2+0x115/0x200 [ 79.813756][ T5766] __x64_sys_openat+0x138/0x170 [ 79.819118][ T5766] do_syscall_64+0x166/0x520 [ 79.824275][ T5766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.830677][ T5766] [ 79.830677][ T5766] -> #1 (&type->i_mutex_dir_key#5){++++}-{4:4}: [ 79.839101][ T5766] down_write+0x91/0x200 [ 79.843865][ T5766] lookup_open+0x246/0x1970 [ 79.848879][ T5766] path_openat+0x673/0x1da0 [ 79.853893][ T5766] do_file_open+0x23e/0x4a0 [ 79.858905][ T5766] do_sys_openat2+0x115/0x200 [ 79.864102][ T5766] __x64_sys_openat+0x138/0x170 [ 79.869465][ T5766] do_syscall_64+0x166/0x520 [ 79.874572][ T5766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.880979][ T5766] [ 79.880979][ T5766] -> #0 (sb_writers#5){.+.+}-{0:0}: [ 79.888361][ T5766] __lock_acquire+0x164c/0x2de0 [ 79.893725][ T5766] lock_acquire+0x115/0x350 [ 79.898738][ T5766] sb_start_write+0x48/0x1c0 [ 79.903853][ T5766] mnt_want_write+0x41/0x90 [ 79.908885][ T5766] ovl_lookup+0xb93/0x1c80 [ 79.913829][ T5766] lookup_open+0x94b/0x1970 [ 79.918852][ T5766] path_openat+0x673/0x1da0 [ 79.923870][ T5766] do_file_open+0x23e/0x4a0 [ 79.928882][ T5766] do_sys_openat2+0x115/0x200 [ 79.934079][ T5766] __x64_sys_openat+0x138/0x170 [ 79.939447][ T5766] do_syscall_64+0x166/0x520 [ 79.944562][ T5766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.950969][ T5766] [ 79.950969][ T5766] other info that might help us debug this: [ 79.950969][ T5766] [ 79.961184][ T5766] Chain exists of: [ 79.961184][ T5766] sb_writers#5 --> &type->i_mutex_dir_key#5 --> DCACHE_PAR_LOOKUP [ 79.961184][ T5766] [ 79.975001][ T5766] Possible unsafe locking scenario: [ 79.975001][ T5766] [ 79.982435][ T5766] CPU0 CPU1 [ 79.987795][ T5766] ---- ---- [ 79.993152][ T5766] lock(DCACHE_PAR_LOOKUP); [ 79.997738][ T5766] lock(&type->i_mutex_dir_key#5); [ 80.005452][ T5766] lock(DCACHE_PAR_LOOKUP); [ 80.012550][ T5766] rlock(sb_writers#5); [ 80.016800][ T5766] [ 80.016800][ T5766] *** DEADLOCK *** [ 80.016800][ T5766] [ 80.024927][ T5766] locks held by syz.3.4/5766: 2, last CPU#1: [ 80.030896][ T5766] #0: ffff888059762230 (&ovl_i_mutex_dir_key[depth]){.+.+}-{4:4}, at: lookup_open+0x221/0x1970 [ 80.041330][ T5766] #1: ffff888059675960 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: __d_alloc_parallel+0x39e/0x1700 [ 80.051504][ T5766] [ 80.051504][ T5766] stack backtrace: [ 80.057406][ T5766] CPU: 1 UID: 0 PID: 5766 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 80.066423][ T5766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 80.076563][ T5766] Call Trace: [ 80.079840][ T5766] [ 80.082769][ T5766] dump_stack_lvl+0xe8/0x150 [ 80.087352][ T5766] print_circular_bug+0x2e2/0x300 [ 80.092399][ T5766] check_noncircular+0x12f/0x150 [ 80.097329][ T5766] __lock_acquire+0x164c/0x2de0 [ 80.099095][ T4930] Bluetooth: hci0: command tx timeout [ 80.099117][ T4930] Bluetooth: hci1: command tx timeout [ 80.112865][ T5766] ? do_raw_spin_unlock+0xf5/0x200 [ 80.117976][ T5766] lock_acquire+0x115/0x350 [ 80.122473][ T5766] ? mnt_want_write+0x41/0x90 [ 80.127143][ T5766] sb_start_write+0x48/0x1c0 [ 80.131719][ T5766] ? mnt_want_write+0x41/0x90 [ 80.136385][ T5766] mnt_want_write+0x41/0x90 [ 80.140871][ T5766] ovl_lookup+0xb93/0x1c80 [ 80.145282][ T5766] ? lock_acquire+0x115/0x350 [ 80.149953][ T5766] ? __pfx_ovl_lookup+0x10/0x10 [ 80.154795][ T5766] ? __d_lookup+0x66/0x790 [ 80.159197][ T5766] ? __pfx___d_alloc_parallel+0x10/0x10 [ 80.164732][ T5766] ? __d_lookup+0x6f3/0x790 [ 80.169221][ T5766] ? d_lookup+0x1f/0xa0 [ 80.173373][ T5766] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 80.179520][ T5766] ? lockdep_hardirqs_on+0x7b/0x110 [ 80.184719][ T5766] lookup_open+0x94b/0x1970 [ 80.189221][ T5766] path_openat+0x673/0x1da0 [ 80.193721][ T5766] do_file_open+0x23e/0x4a0 [ 80.198217][ T5766] ? __pfx_do_file_open+0x10/0x10 [ 80.203239][ T5766] ? _raw_spin_unlock+0x28/0x50 [ 80.208079][ T5766] ? alloc_fd+0x6af/0x760 [ 80.212402][ T5766] do_sys_openat2+0x115/0x200 [ 80.217068][ T5766] ? __se_sys_futex+0x3a8/0x450 [ 80.221912][ T5766] ? __pfx_do_sys_openat2+0x10/0x10 [ 80.227101][ T5766] ? rcu_is_watching+0x16/0xb0 [ 80.231853][ T5766] __x64_sys_openat+0x138/0x170 [ 80.236695][ T5766] do_syscall_64+0x166/0x520 [ 80.241277][ T5766] ? trace_irq_disable+0x3b/0x140 [ 80.246292][ T5766] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.252348][ T5766] ? clear_bhb_loop+0x70/0xc0 [ 80.257017][ T5766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.258188][ T55] Bluetooth: hci3: command tx timeout [ 80.268272][ T5766] RIP: 0033:0x7f29a639e1d9 [ 80.272694][ T5766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.292287][ T5766] RSP: 002b:00007f29a7213028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 80.300697][ T5766] RAX: ffffffffffffffda RBX: 00007f29a6625fa0 RCX: 00007f29a639e1d9 [ 80.308659][ T5766] RDX: 0000000000000400 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 80.316616][ T5766] RBP: 00007f29a6435888 R08: 0000000000000000 R09: 0000000000000000 [ 80.324579][ T5766] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000000 [ 80.332543][ T5766] R13: 00007f29a6626038 R14: 00007f29a6625fa0 R15: 00007ffd07218788 [ 80.337669][ T55] Bluetooth: hci2: command tx timeout [ 80.345867][ T5766] [ 80.363543][ T47] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.363560][ T47] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.386237][ T5614] ieee80211 phy8: Selected rate control algorithm 'minstrel_ht' [ 80.415434][ T5623] ieee80211 phy9: Selected rate control algorithm 'minstrel_ht' [ 80.433474][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.433492][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.438859][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.438875][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.453484][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.453698][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.453907][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.454106][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.454266][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.454570][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.454788][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.460573][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.472395][ T5623] ieee80211 phy10: Selected rate control algorithm 'minstrel_ht' [ 80.508463][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.508481][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.177693][ T55] Bluetooth: hci1: command tx timeout [ 82.177722][ T55] Bluetooth: hci0: command tx timeout [ 82.337611][ T4930] Bluetooth: hci3: command tx timeout [ 82.417813][ T4930] Bluetooth: hci2: command tx timeout [ 86.981334][ T1927] cfg80211: failed to load regulatory.db