L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. ====================================================== WARNING: possible circular locking dependency detected 4.14.206-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.3/9852 is trying to acquire lock: ("%s"hdev->name#2){+.+.}, at: [] start_flush_work kernel/workqueue.c:2860 [inline] ("%s"hdev->name#2){+.+.}, at: [] flush_work+0x387/0x770 kernel/workqueue.c:2892 but task is already holding lock: (&hdev->lock){+.+.}, at: [] hci_dev_do_close+0x21c/0xca0 net/bluetooth/hci_core.c:1607 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&hdev->lock){+.+.}: __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893 hci_cc_write_scan_enable net/bluetooth/hci_event.c:375 [inline] hci_cmd_complete_evt+0x4d34/0xb490 net/bluetooth/hci_event.c:2831 hci_event_packet+0x21ce/0x750f net/bluetooth/hci_event.c:5327 hci_rx_work+0x427/0xb40 net/bluetooth/hci_core.c:4244 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 -> #1 ((&hdev->rx_work)){+.+.}: process_one_work+0x736/0x14a0 kernel/workqueue.c:2092 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 -> #0 ("%s"hdev->name#2){+.+.}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 start_flush_work kernel/workqueue.c:2861 [inline] flush_work+0x3ac/0x770 kernel/workqueue.c:2892 __cancel_work_timer+0x321/0x460 kernel/workqueue.c:2964 hci_conn_del+0x52/0x6f0 net/bluetooth/hci_conn.c:575 hci_conn_hash_flush+0x19c/0x260 net/bluetooth/hci_conn.c:1394 hci_dev_do_close+0x535/0xca0 net/bluetooth/hci_core.c:1620 hci_rfkill_set_block+0xaf/0x120 net/bluetooth/hci_core.c:2050 rfkill_set_block+0x1b2/0x4a0 net/rfkill/core.c:337 rfkill_fop_write+0x1b6/0x3c0 net/rfkill/core.c:1233 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb other info that might help us debug this: Chain exists of: "%s"hdev->name#2 --> (&hdev->rx_work) --> &hdev->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&hdev->lock); lock((&hdev->rx_work)); lock(&hdev->lock); lock("%s"hdev->name#2); *** DEADLOCK *** 3 locks held by syz-executor.3/9852: #0: (rfkill_global_mutex){+.+.}, at: [] rfkill_fop_write+0xbf/0x3c0 net/rfkill/core.c:1225 #1: (&hdev->req_lock){+.+.}, at: [] hci_dev_do_close+0x109/0xca0 net/bluetooth/hci_core.c:1576 #2: (&hdev->lock){+.+.}, at: [] hci_dev_do_close+0x21c/0xca0 net/bluetooth/hci_core.c:1607 stack backtrace: CPU: 1 PID: 9852 Comm: syz-executor.3 Not tainted 4.14.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 start_flush_work kernel/workqueue.c:2861 [inline] flush_work+0x3ac/0x770 kernel/workqueue.c:2892 __cancel_work_timer+0x321/0x460 kernel/workqueue.c:2964 hci_conn_del+0x52/0x6f0 net/bluetooth/hci_conn.c:575 hci_conn_hash_flush+0x19c/0x260 net/bluetooth/hci_conn.c:1394 hci_dev_do_close+0x535/0xca0 net/bluetooth/hci_core.c:1620 hci_rfkill_set_block+0xaf/0x120 net/bluetooth/hci_core.c:2050 rfkill_set_block+0x1b2/0x4a0 net/rfkill/core.c:337 rfkill_fop_write+0x1b6/0x3c0 net/rfkill/core.c:1233 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45deb9 RSP: 002b:00007f4e7f328c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000003af80 RCX: 000000000045deb9 RDX: 0000000000000008 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffd6944d2cf R14: 00007f4e7f3299c0 R15: 000000000118bf2c netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. Bluetooth: hci5 command 0x0405 tx timeout netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. ip6_tables: ip6tables: counters copy to user failed while replacing table EXT4-fs (loop1): VFS: Can't find ext4 filesystem EXT4-fs (loop1): VFS: Can't find ext4 filesystem ieee80211 phy2: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:02:00) ieee80211 phy2: BCN EN: 0 (BI=100) ieee80211 phy2: beaconing vifs remaining: 0 ieee80211 phy2: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:02:00) ieee80211 phy2: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy2: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy2: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:02:00) ieee80211 phy2: mac80211_hwsim_stop ieee80211 phy3: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:03:00) ieee80211 phy3: BCN EN: 0 (BI=100) ieee80211 phy3: beaconing vifs remaining: 0 ieee80211 phy3: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:03:00) ieee80211 phy3: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ip6_tables: ip6tables: counters copy to user failed while replacing table ieee80211 phy3: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy3: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:03:00) ieee80211 phy3: mac80211_hwsim_stop ip6_tables: ip6tables: counters copy to user failed while replacing table ieee80211 phy4: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:04:00) ieee80211 phy4: BCN EN: 0 (BI=100) ieee80211 phy4: beaconing vifs remaining: 0 ieee80211 phy4: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:04:00) ieee80211 phy4: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy4: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy4: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:04:00) ieee80211 phy4: mac80211_hwsim_stop ieee80211 phy5: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:05:00) ieee80211 phy5: BCN EN: 0 (BI=100) ieee80211 phy5: beaconing vifs remaining: 0 ieee80211 phy5: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:05:00) ieee80211 phy5: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy5: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy5: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:05:00) ieee80211 phy5: mac80211_hwsim_stop ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:06:00) ieee80211 phy6: BCN EN: 0 (BI=100) ieee80211 phy6: beaconing vifs remaining: 0 ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:06:00) ieee80211 phy6: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy6: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy6: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:06:00) ieee80211 phy6: mac80211_hwsim_stop ieee80211 phy8: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:08:00) ieee80211 phy8: BCN EN: 0 (BI=100) ieee80211 phy8: beaconing vifs remaining: 0 ieee80211 phy8: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:08:00) ieee80211 phy8: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy8: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy8: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:08:00) ieee80211 phy8: mac80211_hwsim_stop ieee80211 phy10: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:0a:00) ieee80211 phy10: BCN EN: 0 (BI=100) ieee80211 phy10: beaconing vifs remaining: 0 ieee80211 phy10: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:0a:00) ieee80211 phy10: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy10: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy10: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:0a:00) ieee80211 phy10: mac80211_hwsim_stop ieee80211 phy11: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:0b:00) ieee80211 phy11: BCN EN: 0 (BI=100) ieee80211 phy11: beaconing vifs remaining: 0 ieee80211 phy11: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:0b:00) ieee80211 phy11: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy11: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy11: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:0b:00) ieee80211 phy11: mac80211_hwsim_stop ieee80211 phy12: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:0c:00) ieee80211 phy12: BCN EN: 0 (BI=100) ieee80211 phy12: beaconing vifs remaining: 0 ieee80211 phy12: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:0c:00) ieee80211 phy12: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy12: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy12: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:0c:00) ieee80211 phy12: mac80211_hwsim_stop ieee80211 phy13: mac80211_hwsim_bss_info_changed(changed=0xa00 vif->addr=02:00:00:00:0d:00) ieee80211 phy13: BCN EN: 0 (BI=100) ieee80211 phy13: beaconing vifs remaining: 0 ieee80211 phy13: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:0d:00) ieee80211 phy13: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy13: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy13: mac80211_hwsim_remove_interface (type=1 mac_addr=02:00:00:00:0d:00) ieee80211 phy13: mac80211_hwsim_stop ceph: device name is missing path (no : separator in ) kvm: pic: single mode not supported kvm: pic: single mode not supported md: could not open unknown-block(186,0). ceph: device name is missing path (no : separator in ) md: md_import_device returned -6 kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported ceph: device name is missing path (no : separator in [d::],ô Á¤Ù#ýZ:¨ÓÏO=Â0Ø»¡ÒþêB+>æ§u’ÚŒ¼ ê~ÝÓ\á·¡äàŒ‘„€·6ì¯Ð ¡Yè´Ú\‡xKÁ`>’Å {‚m?Ÿ‡ß²ÅVžEÁƒÉtBÈ+dŠÉZ´-žáF½¬§Ÿªg“‹·wÿ×,—¯Üeá¯P{ãÂI€»vÔó`R'·“Jo*¿´›‡±ø÷ñËƒ|œ2`hKŽ¢MØ©ÓMô<Ý&”þ¾† Tyr/&?Þ{ "x) kvm: pic: single mode not supported kvm: pic: single mode not supported md: could not open unknown-block(186,0). md: md_import_device returned -6 Unknown ioctl -2080330098 Unknown ioctl -2080330098 IPVS: ftp: loaded support on port[0] = 21 audit: type=1804 audit(1605467242.418:2): pid=10180 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.5" name="/root/syzkaller-testdir394038309/syzkaller.fvRpBU/12/bus" dev="sda1" ino=15798 res=1 audit: type=1804 audit(1605467242.438:3): pid=10180 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.5" name="/root/syzkaller-testdir394038309/syzkaller.fvRpBU/12/bus" dev="sda1" ino=15798 res=1 audit: type=1804 audit(1605467242.518:4): pid=10198 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.5" name="/root/syzkaller-testdir394038309/syzkaller.fvRpBU/12/bus" dev="sda1" ino=15798 res=1 audit: type=1804 audit(1605467242.548:5): pid=10180 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.5" name="/root/syzkaller-testdir394038309/syzkaller.fvRpBU/12/bus" dev="sda1" ino=15798 res=1 audit: type=1804 audit(1605467242.598:6): pid=10180 uid=0 auid=0 ses=4 op="invalid_pcr" cause="ToMToU" comm="syz-executor.5" name="/root/syzkaller-testdir394038309/syzkaller.fvRpBU/12/bus" dev="sda1" ino=15798 res=1 IPVS: ftp: loaded support on port[0] = 21 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 bond1: Enslaving veth5 as an active interface with an up link netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. overlayfs: filesystem on './bus' not supported as upperdir device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode IPVS: ftp: loaded support on port[0] = 21 UDF-fs: error (device loop5): udf_process_sequence: Block 96 of volume descriptor sequence is corrupted or we could not read it netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. UDF-fs: error (device loop5): udf_process_sequence: Block 1984 of volume descriptor sequence is corrupted or we could not read it device veth3 entered promiscuous mode UDF-fs: Scanning with blocksize 512 failed UDF-fs: warning (device loop5): udf_load_vrs: No anchor found UDF-fs: Scanning with blocksize 1024 failed UDF-fs: warning (device loop5): udf_load_vrs: No anchor found UDF-fs: Scanning with blocksize 2048 failed UDF-fs: warning (device loop5): udf_load_vrs: No VRS found UDF-fs: Scanning with blocksize 4096 failed QAT: failed to copy from user cfg_data. device veth3 left promiscuous mode QAT: failed to copy from user cfg_data. UDF-fs: error (device loop5): udf_process_sequence: Block 96 of volume descriptor sequence is corrupted or we could not read it UDF-fs: error (device loop5): udf_process_sequence: Block 1984 of volume descriptor sequence is corrupted or we could not read it UDF-fs: Scanning with blocksize 512 failed netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. UDF-fs: warning (device loop5): udf_load_vrs: No anchor found UDF-fs: Scanning with blocksize 1024 failed UDF-fs: warning (device loop5): udf_load_vrs: No anchor found UDF-fs: Scanning with blocksize 2048 failed UDF-fs: warning (device loop5): udf_load_vrs: No VRS found UDF-fs: Scanning with blocksize 4096 failed EXT4-fs (loop5): Unrecognized mount option "UŒ¨’3knuqñ" or missing value EXT4-fs (loop5): Unrecognized mount option "UŒ¨’3knuqñ" or missing value netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. pic_ioport_write: 60 callbacks suppressed kvm: pic: single mode not supported BTRFS: device fsid f90cac8b-044b-4fa8-8bee-4b8d3da88dc2 devid 1 transid 7 /dev/loop5 kvm: pic: single mode not supported kvm: pic: single mode not supported BTRFS error (device loop5): superblock checksum mismatch kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported BTRFS error (device loop5): open_ctree failed kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported print_req_error: I/O error, dev loop5, sector 0 kvm: pic: single mode not supported netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. device veth3 entered promiscuous mode 8021q: adding VLAN 0 to HW filter on device ipvlan2 device veth3 left promiscuous mode netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. device veth3 entered promiscuous mode netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. device veth3 left promiscuous mode netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 8021q: adding VLAN 0 to HW filter on device ipvlan3 netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 8021q: adding VLAN 0 to HW filter on device ipvlan4 netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 8021q: adding VLAN 0 to HW filter on device ipvlan5