syzbot
possible deadlock in ovl_copy_up_start (6)
Status:
moderation: reported on 2026/11/12 22:56
Subsystems:
kernfs
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+49dbd5ef4b42abbf20cc@syzkaller.appspotmail.com
First crash: 2h35m, last: 2h35m
✨ AI-generated root cause summary:
Lockdep detected a false positive circular dependency between overlayfs directory locking, superblock write protection, IMA integrity locking, and kernfs file locking. OverlayFS by design acquires an inode's i_rwsem (&ovl_i_mutex_dir_key) followed by ovl_inode_lock (&ovl_i_lock_key) on the same inode during copy-up, and then takes upper filesystem freeze protection (sb_writers). A reverse chain was registered because do_open() holds sb_writers across security_file_post_open(), kernfs open files share a single &of->mutex class, IMA shares &ima_iint_mutex_key[0] across all non-stacked filesystems (both upper-fs regular files and kernfs files), and resume_store() performs a full VFS path walk (lookup_bdev) under &of->mutex that re-enters OverlayFS directory locking. Because the intermediate lock instances belong to disjoint objects on different filesystems, no actual deadlock can materialize at runtime.
▶
▼
✨ Full AI root cause analysis
Root Cause Analysis
The reported issue is a lockdep warning (possible circular locking dependency detected) triggered when calling lsetxattr() / vfs_setxattr() on an OverlayFS directory residing in a nested OverlayFS mount (s_stack_depth = 2, depth = 1).
1. Structures and Lock Invariants Involved
struct inode::i_rwsem:
For an OverlayFS directory inode, this rw-semaphore is annotated with the lockdep class &ovl_i_mutex_dir_key[depth] (fs/overlayfs/inode.c:841). In this trace, depth = 1, and lockdep assigned it the name version &ovl_i_mutex_dir_key[depth]#2 because ovl_i_mutex_dir_key[0] had already been registered earlier.struct ovl_inode::lock:
A struct mutex located at offset +0x470 of struct ovl_inode (with its embedded dep_map at +0x4d0, exactly 0x370 bytes past i_rwsem.dep_map at +0x160). It is annotated with &ovl_i_lock_key[depth] (fs/overlayfs/inode.c:845).- Superblock Freeze Protection (
sb_writers):
Per-superblock rw-semaphores accessed via mnt_want_write(), sb_start_write(), and file_start_write().
struct ima_iint_cache::mutex:
Mutex protecting integrity metadata for an inode. In security/integrity/ima/ima_iint.c, ima_iint_lockdep_annotate() sets its class key to ima_iint_mutex_key[depth], where depth = inode->i_sb->s_stack_depth. For any non-stacked filesystem (the upper filesystem of OverlayFS, ext4/tmpfs, or kernfs/sysfs), s_stack_depth == 0, meaning all these disparate filesystems share &ima_iint_mutex_key[0].struct kernfs_open_file::mutex:
Per-open-file mutex of->mutex (fs/kernfs/file.c:673-677) initialized with generic mutex_init(&of->mutex) and sharing the single lock class &of->mutex.
OverlayFS's intended top-down locking hierarchy is documented in fs/overlayfs/inode.c:808-826:
inode->i_rwsem (ovl_i_mutex_dir_key[depth])
-> OVL_I(inode)->lock (ovl_i_lock_key[depth])
-> upper_sb->s_writers (sb_writers[0])
2. How the Dependency Chain Was Constructed
Lockdep connected 5 edges into a circular dependency:
-
Stack #0 (&ovl_i_mutex_dir_key[depth]#2 $\rightarrow$ &ovl_i_lock_key[depth]):
A user process calls setxattr() / lsetxattr() on an OverlayFS directory. vfs_setxattr() (fs/xattr.c:343) acquires inode_lock(inode) on the directory (&ovl_i_mutex_dir_key[depth]#2). Downstream, ovl_xattr_set() (fs/overlayfs/xattrs.c:54) calls ovl_copy_up() $\rightarrow$ ovl_copy_up_one() $\rightarrow$ ovl_copy_up_start(), which acquires ovl_inode_lock_interruptible(inode) (&ovl_i_lock_key[depth]). Both locks belong to the exact same directory inode. This acquisition order is valid and intended by OverlayFS.
-
Stack #1 (&ovl_i_lock_key[depth] $\rightarrow$ sb_writers#5):
In ovl_copy_up_one(), holding ovl_inode_lock() (&ovl_i_lock_key[depth]), OverlayFS invokes ovl_do_copy_up() $\rightarrow$ ovl_start_write(), which executes sb_start_write(upper_sb) (sb_writers#5 of the underlying upper filesystem at s_stack_depth = 0).
-
Stack #2 (sb_writers#5 $\rightarrow$ &ima_iint_mutex_key[depth]):
In fs/namei.c:4944-4959 (do_open()), opening a file on the upper filesystem with O_TRUNC calls mnt_want_write(nd->path.mnt), acquiring sb_start_write (sb_writers#5). While mnt_want_write is still held, do_open() calls security_file_post_open(), which invokes ima_file_check() $\rightarrow$ process_measurement() (security/integrity/ima/ima_main.c:319), acquiring mutex_lock(&iint->mutex) on the upper-fs file. Because upper_sb->s_stack_depth == 0, lockdep assigns it &ima_iint_mutex_key[0].
-
Stack #3 (&ima_iint_mutex_key[depth] $\rightarrow$ &of->mutex):
When a kernfs/sysfs file is opened and measured by IMA, process_measurement() acquires iint->mutex for that kernfs inode (which also gets class &ima_iint_mutex_key[0] because kernfs has s_stack_depth == 0). Holding iint->mutex, ima_collect_measurement() calls __kernel_read(), invoking kernfs_fop_read_iter() (fs/kernfs/file.c:251), which acquires mutex_lock(&of->mutex) for the open kernfs file.
-
Stack #4 (&of->mutex $\rightarrow$ &ovl_i_mutex_dir_key[depth]#2):
A user writes to /sys/power/resume. kernfs_fop_write_iter() (fs/kernfs/file.c:336-345) acquires mutex_lock(&of->mutex) on the open file and calls ops->write() $\rightarrow$ resume_store() (kernel/power/hibernate.c:1292). resume_store() calls lookup_bdev() $\rightarrow$ kern_path(), initiating a VFS path walk based on user-supplied path data. When the path resolves a path component on the OverlayFS mount, lookup_slow() acquires inode_lock_shared() on the directory, taking &ovl_i_mutex_dir_key[depth]#2.
3. Root Cause Assessment
The reported deadlock is a lockdep false positive caused by:
- Lock-class aggregation in IMA:
security/integrity/ima/ima_iint.c indexes ima_iint_mutex_key strictly by s_stack_depth. Both regular upper-layer filesystems and pseudo-filesystems (kernfs) share depth = 0, causing lockdep to treat iint->mutex of a disk file and iint->mutex of a sysfs file as the same lock class.
- Lock-class aggregation in kernfs: All
struct kernfs_open_file instances share the global &of->mutex lock class.
- Path lookup under
of->mutex: kernel/power/hibernate.c::resume_store() calls lookup_bdev() / kern_path() while holding kernfs of->mutex, allowing an operation started under a pseudo-filesystem lock to enter arbitrary filesystem directory locking (inode_lock_shared).
- LSM hook placement in
do_open(): Superblock freeze write protection (mnt_want_write()) spans across security_file_post_open(), establishing sb_writers $\rightarrow$ iint->mutex.
Because the iint->mutex of the disk file and the iint->mutex of the sysfs file are distinct struct mutex instances, and of->mutex of /sys/power/resume is distinct from any sysfs file being read by IMA, no real runtime circular wait or deadlock is possible.
Sample crash report:
overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
overlayfs: getxattr(12/file1, "trusted.overlay.origin", "", 0, 0) = -61
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G L
------------------------------------------------------
syz.0.4657/23299 is trying to acquire lock:
ffff8880587977a8 (&ovl_i_lock_key[depth]){+.+.}-{4:4}, at: ovl_inode_lock_interruptible fs/overlayfs/overlayfs.h:731 [inline]
ffff8880587977a8 (&ovl_i_lock_key[depth]){+.+.}-{4:4}, at: ovl_copy_up_start+0x56/0x330 fs/overlayfs/util.c:744
but task is already holding lock:
ffff888058797438 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
ffff888058797438 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}, at: vfs_setxattr+0x12b/0x370 fs/xattr.c:343
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}:
down_read+0x45/0x320 kernel/locking/rwsem.c:1574
inode_lock_shared include/linux/fs.h:1042 [inline]
lookup_slow+0x46/0x80 fs/namei.c:1979
walk_component fs/namei.c:2325 [inline]
lookup_last fs/namei.c:2839 [inline]
path_lookupat+0x3f5/0x8c0 fs/namei.c:2864
filename_lookup+0x265/0x5d0 fs/namei.c:2893
kern_path+0x3d/0x150 fs/namei.c:3087
lookup_bdev+0xc8/0x2b0 block/bdev.c:1268
resume_store+0x181/0x500 kernel/power/hibernate.c:1292
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:575 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:667
ksys_write+0x150/0x270 fs/read_write.c:1016
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x171/0x540 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (&of->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
kernfs_file_read_iter fs/kernfs/file.c:251 [inline]
kernfs_fop_read_iter+0x18b/0x6a0 fs/kernfs/file.c:291
__kernel_read+0x4ca/0x960 fs/read_write.c:512
integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:222 [inline]
ima_calc_file_hash+0x451/0x890 security/integrity/ima/ima_crypto.c:280
ima_collect_measurement+0x51b/0xa00 security/integrity/ima/ima_api.c:300
process_measurement+0x1272/0x1c10 security/integrity/ima/ima_main.c:425
ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686
security_file_post_open+0xb3/0x260 security/security.c:2777
do_open fs/namei.c:4959 [inline]
path_openat+0x179e/0x20e0 fs/namei.c:5122
do_file_open+0x23e/0x4a0 fs/namei.c:5151
do_sys_openat2+0x115/0x200 fs/open.c:1492
do_sys_open fs/open.c:1498 [inline]
__do_sys_openat fs/open.c:1838 [inline]
__se_sys_openat fs/open.c:1833 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1833
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x171/0x540 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
process_measurement+0x7d0/0x1c10 security/integrity/ima/ima_main.c:319
ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686
security_file_post_open+0xb3/0x260 security/security.c:2777
do_open fs/namei.c:4959 [inline]
path_openat+0x179e/0x20e0 fs/namei.c:5122
do_file_open+0x23e/0x4a0 fs/namei.c:5151
do_sys_openat2+0x115/0x200 fs/open.c:1492
do_sys_open fs/open.c:1498 [inline]
__do_sys_openat fs/open.c:1838 [inline]
__se_sys_openat fs/open.c:1833 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1833
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x171/0x540 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (sb_writers#5){.+.+}-{0:0}:
percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline]
percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline]
__sb_start_write include/linux/fs/super.h:19 [inline]
sb_start_write include/linux/fs/super.h:125 [inline]
ovl_start_write+0x115/0x290 fs/overlayfs/util.c:32
ovl_do_copy_up fs/overlayfs/copy_up.c:992 [inline]
ovl_copy_up_one fs/overlayfs/copy_up.c:1221 [inline]
ovl_copy_up_flags+0xe90/0x3890 fs/overlayfs/copy_up.c:1275
ovl_fileattr_set+0x204/0x580 fs/overlayfs/inode.c:669
vfs_fileattr_set+0xa2b/0xd10 fs/file_attr.c:306
ioctl_fssetxattr+0x349/0x3b0 fs/file_attr.c:372
do_vfs_ioctl+0x914/0x15a0 fs/ioctl.c:573
__do_sys_ioctl fs/ioctl.c:602 [inline]
__se_sys_ioctl+0x82/0x170 fs/ioctl.c:590
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x171/0x540 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ovl_i_lock_key[depth]){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
ovl_inode_lock_interruptible fs/overlayfs/overlayfs.h:731 [inline]
ovl_copy_up_start+0x56/0x330 fs/overlayfs/util.c:744
ovl_copy_up_one fs/overlayfs/copy_up.c:1214 [inline]
ovl_copy_up_flags+0xaf7/0x3890 fs/overlayfs/copy_up.c:1275
ovl_xattr_set+0x395/0x5e0 fs/overlayfs/xattrs.c:54
__vfs_setxattr+0x442/0x480 fs/xattr.c:223
__vfs_setxattr_noperm+0x12a/0x660 fs/xattr.c:257
vfs_setxattr+0x151/0x370 fs/xattr.c:344
do_setxattr fs/xattr.c:662 [inline]
filename_setxattr+0x296/0x630 fs/xattr.c:690
path_setxattrat+0x408/0x450 fs/xattr.c:734
__do_sys_lsetxattr fs/xattr.c:775 [inline]
__se_sys_lsetxattr fs/xattr.c:771 [inline]
__x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:771
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x171/0x540 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&ovl_i_lock_key[depth] --> &of->mutex --> &ovl_i_mutex_dir_key[depth]#2
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ovl_i_mutex_dir_key[depth]#2);
lock(&of->mutex);
lock(&ovl_i_mutex_dir_key[depth]#2);
lock(&ovl_i_lock_key[depth]);
*** DEADLOCK ***
locks held by syz.0.4657/23299: 2, on CPU#0:
#0: ffff888035472478 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:534
#1: ffff888058797438 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#1: ffff888058797438 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}, at: vfs_setxattr+0x12b/0x370 fs/xattr.c:343
stack backtrace:
CPU: 0 UID: 0 PID: 23299 Comm: syz.0.4657 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
ovl_inode_lock_interruptible fs/overlayfs/overlayfs.h:731 [inline]
ovl_copy_up_start+0x56/0x330 fs/overlayfs/util.c:744
ovl_copy_up_one fs/overlayfs/copy_up.c:1214 [inline]
ovl_copy_up_flags+0xaf7/0x3890 fs/overlayfs/copy_up.c:1275
ovl_xattr_set+0x395/0x5e0 fs/overlayfs/xattrs.c:54
__vfs_setxattr+0x442/0x480 fs/xattr.c:223
__vfs_setxattr_noperm+0x12a/0x660 fs/xattr.c:257
vfs_setxattr+0x151/0x370 fs/xattr.c:344
do_setxattr fs/xattr.c:662 [inline]
filename_setxattr+0x296/0x630 fs/xattr.c:690
path_setxattrat+0x408/0x450 fs/xattr.c:734
__do_sys_lsetxattr fs/xattr.c:775 [inline]
__se_sys_lsetxattr fs/xattr.c:771 [inline]
__x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:771
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x171/0x540 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x00007f47a49a94d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f47a5807028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 00007f47a4c25fa0 RCX: 00007f47a49a94d9
RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000200000000340
RBP: 00007f47a4a3804e R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f47a4c26038 R14: 00007f47a4c25fa0 R15: 00007ffc5b6de328
</TASK>
overlayfs: setxattr(12/file0, "trusted.overlay.impure", "y", 1, 0) = 0
overlayfs: mkdir(index/#5d, 040000)
overlayfs: ...mkdir = 0
overlayfs: setxattr(index/#5d, "trusted.overlay.origin", "\0!\0\0012,\023dO<\202\024(4xI+\202V\0\0\0\0\0\0\0", 33, 0) = 0
overlayfs: rename(index/#5d, file0/file1, 0x0)
overlayfs: setxattr(file0/file1, "trusted.upperdir", "", 0, 2) = -61
kcov: kcov_task_exit: t = ffff888029733e80, kcov->t = ffff888029733e80
ffff888029b44000 name hci5 bus 0
hci5: Updating devcoredump state from IDLE to IDLE.
hci5: err 0x13
hci5 ffff888029b44000
hci5:
hci5: err 0x13
hci5: cancelling interleave scan
All LE pending actions cleared
hdev hci5
hcon ffff888037a84000 reason 22
hcon ffff888037a84000 conn ffff888037a0a800, err 103
hci5 hcon ffff888037a84000 chan ffff888077237700
hci5 hcon ffff888037a84000 handle 200
hci5: hcon ffff888037a84000
hcon ffff888037a84000
hci5: conn ffff888037a84000
device: 'hci5:200': device_unregister
kernfs runtime_status: removing
kernfs control: removing
kernfs runtime_suspended_time: removing
kernfs runtime_active_time: removing
kernfs autosuspend_delay_ms: removing
kernfs power: removing
kernfs device: removing
kernfs subsystem: removing
kernfs hci5:200: removing
kernfs uevent: removing
PM: Removing info for No Bus:hci5:200
kobject: 'hci5:200' (ffff888037a84cf8): kobject_uevent_env
kobject: 'hci5:200' (ffff888037a84cf8): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5/hci5:200'
kernfs hci5:200: removing
kobject: 'hci5:200' (ffff888037a84cf8): kobject_cleanup, parent 0000000000000000
kobject: 'hci5:200' (ffff888037a84cf8): calling ktype release
kobject: 'hci5:200': free name
hci5 orig refcnt 11
hcon ffff88807cc40000 reason 22
hcon ffff88807cc40000 conn ffff888037a0f000, err 103
hci5 hcon ffff88807cc40000 chan ffff8880597fe100
hci5 hcon ffff88807cc40000 handle 201
hci5: hcon ffff88807cc40000
hcon ffff88807cc40000
hci5: conn ffff88807cc40000
device: 'hci5:201': device_unregister
kernfs runtime_status: removing
kernfs control: removing
kernfs runtime_suspended_time: removing
kernfs runtime_active_time: removing
kernfs autosuspend_delay_ms: removing
kernfs power: removing
kernfs device: removing
kernfs subsystem: removing
kernfs hci5:201: removing
kernfs uevent: removing
PM: Removing info for No Bus:hci5:201
kobject: 'hci5:201' (ffff88807cc40cf8): kobject_uevent_env
kobject: 'hci5:201' (ffff88807cc40cf8): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5/hci5:201'
kernfs hci5:201: removing
kobject: 'hci5:201' (ffff88807cc40cf8): kobject_cleanup, parent 0000000000000000
kobject: 'hci5:201' (ffff88807cc40cf8): calling ktype release
kobject: 'hci5:201': free name
hci5 orig refcnt 7
hdev hci5 event 4
hdev 0000000000000000 len 8
hci5: Cleanup of MSFT extension
hdev hci5 event 8
hci5 orig refcnt 6
channel 3 len 6
channel 3 len 8
hdev hci5 event 2
hdev 0000000000000000 len 8
kernfs runtime_status: removing
kernfs control: removing
kernfs runtime_suspended_time: removing
kernfs runtime_active_time: removing
kernfs autosuspend_delay_ms: removing
kernfs power: removing
kernfs device: removing
kernfs subsystem: removing
kernfs rfkill88: removing
kernfs uevent: removing
kernfs name: removing
kernfs type: removing
kernfs index: removing
kernfs persistent: removing
kernfs state: removing
kernfs soft: removing
kernfs hard: removing
kernfs hard_block_reasons: removing
PM: Removing info for No Bus:rfkill88
kobject: 'rfkill88' (ffff88802cb86118): kobject_uevent_env
kobject: 'rfkill88' (ffff88802cb86118): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5/rfkill88'
kernfs rfkill88: removing
kobject: 'rfkill88' (ffff88802cb86118): kobject_cleanup, parent 0000000000000000
kobject: 'rfkill88' (ffff88802cb86118): calling ktype release
kobject: 'rfkill88': free name
kernfs runtime_status: removing
kernfs control: removing
kernfs runtime_suspended_time: removing
kernfs runtime_active_time: removing
kernfs autosuspend_delay_ms: removing
kernfs power: removing
kernfs subsystem: removing
kernfs hci5: removing
kernfs uevent: removing
kernfs reset: removing
PM: Removing info for No Bus:hci5
kobject: 'hci5' (ffff888029b455d8): kobject_uevent_env
kobject: 'hci5' (ffff888029b455d8): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5'
kernfs hci5: removing
hci5 orig refcnt 2
kobject: 'hci5' (ffff888029b455d8): kobject_cleanup, parent 0000000000000000
kobject: 'hci5' (ffff888029b455d8): calling ktype release
All LE connection parameters were removed
hci5: Unregister MSFT extension
kobject: 'hci5': free name
syz_tun: bond_netdev_event received NETDEV_GOING_DOWN
net syz_tun: siw: event 10
In tnode_resize ffff888022f14120 inflate_threshold=50 threshold=25
In tnode_resize ffff888058988020 inflate_threshold=50 threshold=25
In tnode_resize ffff888067c91820 inflate_threshold=50 threshold=25
In tnode_resize ffff888051684520 inflate_threshold=50 threshold=25
In tnode_resize ffff88807d0908a0 inflate_threshold=50 threshold=25
In tnode_resize ffff88804393b1a0 inflate_threshold=50 threshold=25
In tnode_resize ffff88802af88420 inflate_threshold=50 threshold=25
trie_flush found=1
In tnode_resize ffff888022f14120 inflate_threshold=50 threshold=25
In tnode_resize ffff888058988020 inflate_threshold=50 threshold=25
In tnode_resize ffff888067c91820 inflate_threshold=50 threshold=25
In tnode_resize ffff888051684520 inflate_threshold=50 threshold=25
In tnode_resize ffff88807d0908a0 inflate_threshold=50 threshold=25
In tnode_resize ffff88804393b1a0 inflate_threshold=50 threshold=25
In tnode_resize ffff88802af88420 inflate_threshold=50 threshold=25
trie_flush found=1
IPv6: walker ffffc90003727140 adjusted by unlink of ffff88803831b000
IPv6: walker ffffc90003727140 adjusted by unlink of ffff88803ba18000
IPv6: walker ffffc90003727140 adjusted by unlink of ffff888039a5f800
IPv6: fixing tree: plen=128 iter=0
IPv6: W ffffc90003727140 adjusted by delnode 1, s=4/2
IPv6: fixing tree: plen=120 iter=1
IPv6: W ffffc90003727140 adjusted by delnode 2, s=2
IPv6: fixing tree: plen=97 iter=2
IPv6: walker ffffc90003727140 adjusted by unlink of ffff88803ba18400
IPv6: fixing tree: plen=128 iter=0
IPv6: W ffffc90003727140 adjusted by delnode 1, s=4/2
IPv6: fixing tree: plen=120 iter=1
IPv6: W ffffc90003727140 adjusted by delnode 2, s=2
IPv6: fixing tree: plen=73 iter=2
IPv6: walker ffffc90003727140 adjusted by unlink of ffff88803ba18800
syz_tun: bond_netdev_event received NETDEV_DOWN
net syz_tun: siw: event 2
Deleting ac141400/24 dsfield=0x00 t=ffff88803002c6b8
Deleting ac1414ff/32 dsfield=0x00 t=ffff88803002c6b8
Deleting ac1414aa/32 dsfield=0x00 t=ffff88803002c6b8
In tnode_resize ffff888051684520 inflate_threshold=50 threshold=25
In tnode_resize ffff88802af88420 inflate_threshold=50 threshold=25
syz_tun (unregistering): bond_netdev_event received NETDEV_UNREGISTER
net syz_tun: siw: event 6
syz_tun (unregistering): bond_netdev_event received NETDEV_PRE_UNINIT
net syz_tun: siw: event 18
kernfs rps_cpus: removing
kernfs rps_flow_cnt: removing
kobject: 'rx-0' (ffff888059944c50): kobject_cleanup, parent ffff888013a47b50
kobject: 'rx-0' (ffff888059944c50): auto cleanup kobject_del
kobject: 'rx-0' (ffff888059944c50): auto cleanup 'remove' event
kobject: 'rx-0' (ffff888059944c50): kobject_uevent_env
kobject: 'rx-0' (ffff888059944c50): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0'
kernfs rx-0: removing
kobject: 'rx-0' (ffff888059944c50): calling ktype release
kobject: 'rx-0': free name
kernfs tx_timeout: removing
kernfs traffic_class: removing
kernfs xps_cpus: removing
kernfs xps_rxqs: removing
kernfs tx_maxrate: removing
kobject: 'tx-0' (ffff888050658420): kobject_cleanup, parent ffff888013a47b50
kobject: 'tx-0' (ffff888050658420): auto cleanup kobject_del
kobject: 'tx-0' (ffff888050658420): auto cleanup 'remove' event
kobject: 'tx-0' (ffff888050658420): kobject_uevent_env
kobject: 'tx-0' (ffff888050658420): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0'
kernfs tx-0: removing
kobject: 'tx-0' (ffff888050658420): calling ktype release
kobject: 'tx-0': free name
kernfs queues: removing
kobject: 'queues' (ffff888013a47b50): kobject_cleanup, parent 0000000000000000
kobject: 'queues' (ffff888013a47b50): calling ktype release
kobject: 'queues' (ffff888013a47b50): kset_release
kobject: 'queues': free name
kernfs runtime_status: removing
kernfs control: removing
kernfs runtime_suspended_time: removing
kernfs runtime_active_time: removing
kernfs autosuspend_delay_ms: removing
kernfs power: removing
kernfs subsystem: removing
kernfs syz_tun: removing
kernfs uevent: removing
kernfs tun_flags: removing
kernfs owner: removing
kernfs group: removing
kernfs rx_packets: removing
kernfs tx_packets: removing
kernfs rx_bytes: removing
kernfs tx_bytes: removing
kernfs rx_errors: removing
kernfs tx_errors: removing
kernfs rx_dropped: removing
kernfs tx_dropped: removing
kernfs multicast: removing
kernfs collisions: removing
kernfs rx_length_errors: removing
kernfs rx_over_errors: removing
kernfs rx_crc_errors: removing
kernfs rx_frame_errors: removing
kernfs rx_fifo_errors: removing
kernfs rx_missed_errors: removing
kernfs tx_aborted_errors: removing
kernfs tx_carrier_errors: removing
kernfs tx_fifo_errors: removing
kernfs tx_heartbeat_errors: removing
kernfs tx_window_errors: removing
kernfs rx_compressed: removing
kernfs tx_compressed: removing
kernfs rx_nohandler: removing
kernfs statistics: removing
kernfs netdev_group: removing
kernfs type: removing
kernfs dev_id: removing
kernfs dev_port: removing
kernfs iflink: removing
kernfs ifindex: removing
kernfs name_assign_type: removing
kernfs addr_assign_type: removing
kernfs addr_len: removing
kernfs link_mode: removing
kernfs address: removing
kernfs broadcast: removing
kernfs speed: removing
kernfs duplex: removing
kernfs dormant: removing
kernfs testing: removing
kernfs operstate: removing
kernfs carrier_changes: removing
kernfs ifalias: removing
kernfs carrier: removing
kernfs mtu: removing
kernfs flags: removing
kernfs tx_queue_len: removing
kernfs gro_flush_timeout: removing
kernfs napi_defer_hard_irqs: removing
kernfs proto_down: removing
kernfs carrier_up_count: removing
kernfs carrier_down_count: removing
kernfs threaded: removing
PM: Removing info for No Bus:syz_tun
kobject: 'syz_tun' (ffff888037e107e0): kobject_uevent_env
kobject: 'syz_tun' (ffff888037e107e0): fill_kobj_path: path = '/devices/virtual/net/syz_tun'
kernfs syz_tun: removing
kobject: 'syz_tun' (ffff888037e107e0): kobject_cleanup, parent 0000000000000000
kobject: 'syz_tun' (ffff888037e107e0): calling ktype release
kobject: 'syz_tun': free name
Struck through repros no longer work on HEAD.