./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1552033751 <...> Warning: Permanently added '10.128.0.103' (ED25519) to the list of known hosts. execve("./syz-executor1552033751", ["./syz-executor1552033751"], 0x7ffe8a52f5f0 /* 10 vars */) = 0 brk(NULL) = 0x55556a9e1000 brk(0x55556a9e1d00) = 0x55556a9e1d00 arch_prctl(ARCH_SET_FS, 0x55556a9e1380) = 0 set_tid_address(0x55556a9e1650) = 5065 set_robust_list(0x55556a9e1660, 24) = 0 rseq(0x55556a9e1ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1552033751", 4096) = 28 getrandom("\x2b\x7c\x48\x7b\xa2\xb6\x82\x87", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556a9e1d00 brk(0x55556aa02d00) = 0x55556aa02d00 brk(0x55556aa03000) = 0x55556aa03000 mprotect(0x7f2afc0dd000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556a9e1650) = 5066 ./strace-static-x86_64: Process 5066 attached [pid 5066] set_robust_list(0x55556a9e1660, 24) = 0 [pid 5066] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5066] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5066] setsid() = 1 [pid 5066] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5066] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5066] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5066] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5066] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5066] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5066] unshare(CLONE_NEWNS) = 0 [pid 5066] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5066] unshare(CLONE_NEWIPC) = 0 [pid 5066] unshare(CLONE_NEWCGROUP) = 0 [pid 5066] unshare(CLONE_NEWUTS) = 0 [pid 5066] unshare(CLONE_SYSVSEM) = 0 [pid 5066] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "16777216", 8) = 8 [pid 5066] close(3) = 0 [pid 5066] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "536870912", 9) = 9 [pid 5066] close(3) = 0 [pid 5066] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "1024", 4) = 4 [pid 5066] close(3) = 0 [pid 5066] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "8192", 4) = 4 [pid 5066] close(3) = 0 [pid 5066] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "1024", 4) = 4 [pid 5066] close(3) = 0 [pid 5066] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "1024", 4) = 4 [pid 5066] close(3) = 0 [pid 5066] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5066] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5066] close(3) = 0 [pid 5066] getpid() = 1 [pid 5066] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<team_lock_key){+.+.}-{3:3}, at: team_del_slave+0x32/0x1d0 [ 72.445459][ T5066] [ 72.445459][ T5066] but task is already holding lock: [ 72.452811][ T5066] ffff88802a270768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 72.462647][ T5066] [ 72.462647][ T5066] which lock already depends on the new lock. [ 72.462647][ T5066] [ 72.473094][ T5066] [ 72.473094][ T5066] the existing dependency chain (in reverse order) is: [ 72.482086][ T5066] [ 72.482086][ T5066] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 72.489857][ T5066] lock_acquire+0x1e4/0x530 [ 72.494890][ T5066] __mutex_lock+0x136/0xd70 [ 72.499924][ T5066] ieee80211_open+0xe7/0x200 [ 72.505024][ T5066] __dev_open+0x2d3/0x450 [ 72.509858][ T5066] dev_open+0xae/0x1b0 [ 72.514429][ T5066] team_add_slave+0x9b3/0x2750 [ 72.519701][ T5066] do_setlink+0xe70/0x41f0 [ 72.524640][ T5066] rtnl_setlink+0x40d/0x5a0 [ 72.529672][ T5066] rtnetlink_rcv_msg+0x89b/0x10d0 [ 72.535213][ T5066] netlink_rcv_skb+0x1e3/0x430 [ 72.540494][ T5066] netlink_unicast+0x7ea/0x980 [ 72.545779][ T5066] netlink_sendmsg+0x8e1/0xcb0 [ 72.551163][ T5066] __sock_sendmsg+0x221/0x270 [ 72.556365][ T5066] ____sys_sendmsg+0x525/0x7d0 [ 72.561648][ T5066] __sys_sendmsg+0x2b0/0x3a0 [ 72.566766][ T5066] do_syscall_64+0xfb/0x240 [ 72.571793][ T5066] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 72.578227][ T5066] [ 72.578227][ T5066] -> #0 (team->team_lock_key){+.+.}-{3:3}: [ 72.586216][ T5066] validate_chain+0x18cb/0x58e0 [ 72.591580][ T5066] __lock_acquire+0x1346/0x1fd0 [ 72.596941][ T5066] lock_acquire+0x1e4/0x530 [ 72.601952][ T5066] __mutex_lock+0x136/0xd70 [ 72.606962][ T5066] team_del_slave+0x32/0x1d0 [ 72.612055][ T5066] team_device_event+0x200/0x5b0 [ 72.617496][ T5066] notifier_call_chain+0x18f/0x3b0 [ 72.623138][ T5066] unregister_netdevice_many_notify+0xd96/0x16d0 [ 72.629993][ T5066] unregister_netdevice_queue+0x303/0x370 [ 72.636227][ T5066] _cfg80211_unregister_wdev+0x162/0x560 [ 72.642375][ T5066] ieee80211_if_remove+0x25d/0x3a0 [ 72.647996][ T5066] ieee80211_del_iface+0x19/0x30 [ 72.653449][ T5066] cfg80211_remove_virtual_intf+0x230/0x3f0 [ 72.659849][ T5066] genl_rcv_msg+0xb14/0xec0 [ 72.664869][ T5066] netlink_rcv_skb+0x1e3/0x430 [ 72.670142][ T5066] genl_rcv+0x28/0x40 [ 72.674628][ T5066] netlink_unicast+0x7ea/0x980 [ 72.679892][ T5066] netlink_sendmsg+0x8e1/0xcb0 [ 72.685162][ T5066] __sock_sendmsg+0x221/0x270 [ 72.690489][ T5066] ____sys_sendmsg+0x525/0x7d0 [ 72.695759][ T5066] __sys_sendmsg+0x2b0/0x3a0 [ 72.700861][ T5066] do_syscall_64+0xfb/0x240 [ 72.705872][ T5066] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 72.712295][ T5066] [ 72.712295][ T5066] other info that might help us debug this: [ 72.712295][ T5066] [ 72.722507][ T5066] Possible unsafe locking scenario: [ 72.722507][ T5066] [ 72.729989][ T5066] CPU0 CPU1 [ 72.735358][ T5066] ---- ---- [ 72.740716][ T5066] lock(&rdev->wiphy.mtx); [ 72.745223][ T5066] lock(team->team_lock_key); [ 72.752584][ T5066] lock(&rdev->wiphy.mtx); [ 72.759603][ T5066] lock(team->team_lock_key); [ 72.764354][ T5066] [ 72.764354][ T5066] *** DEADLOCK *** [ 72.764354][ T5066] [ 72.772478][ T5066] 3 locks held by syz-executor155/5066: [ 72.778006][ T5066] #0: ffffffff8f3ea5b0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 [ 72.786179][ T5066] #1: ffffffff8f385a08 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 [ 72.795380][ T5066] #2: ffff88802a270768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 72.805638][ T5066] [ 72.805638][ T5066] stack backtrace: [ 72.811520][ T5066] CPU: 1 PID: 5066 Comm: syz-executor155 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 [ 72.821581][ T5066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 72.831647][ T5066] Call Trace: [ 72.834926][ T5066] [ 72.837870][ T5066] dump_stack_lvl+0x1e7/0x2e0 [ 72.842554][ T5066] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.847751][ T5066] ? print_circular_bug+0x130/0x1a0 [ 72.852952][ T5066] check_noncircular+0x36a/0x4a0 [ 72.857894][ T5066] ? __pfx_check_noncircular+0x10/0x10 [ 72.863354][ T5066] ? lockdep_lock+0x123/0x2b0 [ 72.868029][ T5066] ? lockdep_unlock+0x16a/0x300 [ 72.872899][ T5066] ? __pfx_lockdep_unlock+0x10/0x10 [ 72.878112][ T5066] ? _find_first_zero_bit+0xd4/0x100 [ 72.883400][ T5066] validate_chain+0x18cb/0x58e0 [ 72.888245][ T5066] ? __pfx_validate_chain+0x10/0x10 [ 72.893439][ T5066] ? __pfx_validate_chain+0x10/0x10 [ 72.898647][ T5066] ? stack_trace_save+0x118/0x1d0 [ 72.903662][ T5066] ? __pfx_stack_trace_save+0x10/0x10 [ 72.909019][ T5066] ? lockdep_unlock+0x16a/0x300 [ 72.913876][ T5066] ? mark_lock+0x9a/0x350 [ 72.918187][ T5066] __lock_acquire+0x1346/0x1fd0 [ 72.923025][ T5066] lock_acquire+0x1e4/0x530 [ 72.927508][ T5066] ? team_del_slave+0x32/0x1d0 [ 72.932256][ T5066] ? __pfx_lock_acquire+0x10/0x10 [ 72.937264][ T5066] ? __pfx___might_resched+0x10/0x10 [ 72.942539][ T5066] ? __pfx___might_resched+0x10/0x10 [ 72.947809][ T5066] ? xsk_notifier+0x218/0x230 [ 72.952494][ T5066] __mutex_lock+0x136/0xd70 [ 72.957062][ T5066] ? team_del_slave+0x32/0x1d0 [ 72.961821][ T5066] ? trace_contention_end+0x3c/0x100 [ 72.967201][ T5066] ? __mutex_lock+0x2ef/0xd70 [ 72.971875][ T5066] ? bond_netdev_event+0xdd/0xf20 [ 72.976900][ T5066] ? team_del_slave+0x32/0x1d0 [ 72.981990][ T5066] ? __pfx___mutex_lock+0x10/0x10 [ 72.987018][ T5066] ? __asan_memset+0x23/0x50 [ 72.991610][ T5066] team_del_slave+0x32/0x1d0 [ 72.996226][ T5066] team_device_event+0x200/0x5b0 [ 73.001168][ T5066] ? notifier_call_chain+0x166/0x3b0 [ 73.006449][ T5066] notifier_call_chain+0x18f/0x3b0 [ 73.011555][ T5066] unregister_netdevice_many_notify+0xd96/0x16d0 [ 73.017886][ T5066] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 73.023599][ T5066] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 73.030370][ T5066] ? kasan_quarantine_put+0xdc/0x230 [ 73.035648][ T5066] unregister_netdevice_queue+0x303/0x370 [ 73.041368][ T5066] ? __pfx_up_write+0x10/0x10 [ 73.046049][ T5066] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 73.052366][ T5066] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 73.058103][ T5066] _cfg80211_unregister_wdev+0x162/0x560 [ 73.063750][ T5066] ieee80211_if_remove+0x25d/0x3a0 [ 73.068877][ T5066] ieee80211_del_iface+0x19/0x30 [ 73.073804][ T5066] cfg80211_remove_virtual_intf+0x230/0x3f0 [ 73.079704][ T5066] genl_rcv_msg+0xb14/0xec0 [ 73.084200][ T5066] ? mark_lock+0x9a/0x350 [ 73.088547][ T5066] ? __pfx_genl_rcv_msg+0x10/0x10 [ 73.093561][ T5066] ? __pfx_lock_acquire+0x10/0x10 [ 73.098571][ T5066] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 73.103951][ T5066] ? __pfx_nl80211_del_interface+0x10/0x10 [ 73.109740][ T5066] ? __pfx_nl80211_post_doit+0x10/0x10 [ 73.115181][ T5066] ? __pfx___might_resched+0x10/0x10 [ 73.120480][ T5066] netlink_rcv_skb+0x1e3/0x430 [ 73.125236][ T5066] ? __pfx_genl_rcv_msg+0x10/0x10 [ 73.130247][ T5066] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 73.135514][ T5066] ? __pfx_lock_release+0x10/0x10 [ 73.140523][ T5066] ? __netlink_deliver_tap+0x77e/0x7c0 [ 73.145966][ T5066] genl_rcv+0x28/0x40 [ 73.149934][ T5066] netlink_unicast+0x7ea/0x980 [ 73.154681][ T5066] ? __pfx_netlink_unicast+0x10/0x10 [ 73.159949][ T5066] ? __virt_addr_valid+0x44e/0x520 [ 73.165047][ T5066] ? __phys_addr_symbol+0x2f/0x70 [ 73.170054][ T5066] ? __check_object_size+0x4bc/0xa00 [ 73.175327][ T5066] ? bpf_lsm_netlink_send+0x9/0x10 [ 73.180428][ T5066] netlink_sendmsg+0x8e1/0xcb0 [ 73.185181][ T5066] ? __pfx_netlink_sendmsg+0x10/0x10 [ 73.190466][ T5066] ? __import_iovec+0x536/0x820 [ 73.195563][ T5066] ? aa_sock_msg_perm+0x91/0x160 [ 73.200486][ T5066] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 73.205757][ T5066] ? security_socket_sendmsg+0x87/0xb0 [ 73.211292][ T5066] ? __pfx_netlink_sendmsg+0x10/0x10 [ 73.216561][ T5066] __sock_sendmsg+0x221/0x270 [ 73.221226][ T5066] ____sys_sendmsg+0x525/0x7d0 [ 73.225978][ T5066] ? __pfx_____sys_sendmsg+0x10/0x10 [ 73.231249][ T5066] ? do_raw_spin_lock+0x14f/0x370 [ 73.236260][ T5066] __sys_sendmsg+0x2b0/0x3a0 [ 73.240834][ T5066] ? __pfx___sys_sendmsg+0x10/0x10 [ 73.245936][ T5066] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 73.252256][ T5066] ? _raw_spin_unlock_irq+0x2e/0x50 [ 73.257440][ T5066] ? ptrace_notify+0x279/0x380 [ 73.262204][ T5066] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 73.268528][ T5066] ? do_syscall_64+0x10a/0x240 [ 73.273286][ T5066] ? syscall_trace_enter+0x5f/0x150 [ 73.278469][ T5066] do_syscall_64+0xfb/0x240 [ 73.282963][ T5066] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 73.288844][ T5066] RIP: 0033:0x7f2afc0651a9 [ 73.293243][ T5066] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 73.312853][ T5066] RSP: 002b:00007ffce9d59db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 73.321290][ T5066] RAX: ffffffffffffffda RBX: 00007f2afc0b23f6 RCX: 00007f2afc0651a9 [ 73.329271][ T5066] RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000004 [ 73.337328][ T5066] RBP: 00007f2afc0e4440 R08: 0000000000000000 R09: 0000000000000000 [ 73.345298][ T5066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000031 [ 73.353263][ T5066] R13: 0000000000000003 R14: 0000000000050012 R15: 00007ffce9d59e12 [ 73.361233][ T5066] [ 73.370390][ T5066] team0: Port device wlan0 removed [pid 5066] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x1c\x00\x00\x00\x23\x00\x37\x95\x00\x00\x9f\x83\x3d\x32\x34\xd3\x08\xf8\x00\x00\x08\x00\x03\x00\x47\x00\x00\x00", iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5066] exit_group(1) = ? [pid 5066] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5066, si_uid=0, si_status=1, si_utime=0, si_stime=115 /* 1.15 s */} --- exit_group(0) = ? +++ exited with 0 +++