syzbot


possible deadlock in cleanup_net (3)

Status: internal: reported on 2025/01/28 01:30
Subsystems: wireless
[Documentation on labels]
Fix commit: e759e1e4a4bd net: revert RTNL changes in unregister_netdevice_many_notify()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32]
First crash: 25d, last: 23d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 possible deadlock in cleanup_net C done 5212 1302d 1564d 1/1 fixed on 2021/08/30 09:32
upstream possible deadlock in cleanup_net (2) wireless 1 97d 97d 0/28 closed as invalid on 2025/01/15 13:14
upstream possible deadlock in cleanup_net net C done 281 1627d 1635d 15/28 fixed on 2020/11/16 12:12

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
6.13.0-syzkaller-08265-g9c5968db9e62 #0 Not tainted
------------------------------------------------------
kworker/u8:4/61 is trying to acquire lock:
ffffffff8fef6168 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline]
ffffffff8fef6168 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1a51/0x21a0 net/core/dev.c:11792
but task is already holding lock:
which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:
-> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
       do_one_initcall+0x128/0x700 init/main.c:1257
-> #0 (rtnl_mutex){+.+.}-{4:4}:
other info that might help us debug this:



 *** DEADLOCK ***

 #2: ffffffff8fee0550 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xbf0 net/core/net_namespace.c:606
 #3: ffff888023358768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline]
 #3: ffff888023358768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720 net/mac80211/iface.c:2280

stack backtrace:
CPU: 1 UID: 0 PID: 61 Comm: kworker/u8:4 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208
 check_prev_add kernel/locking/lockdep.c:3163 [inline]
 check_prevs_add kernel/locking/lockdep.c:3282 [inline]
 validate_chain kernel/locking/lockdep.c:3906 [inline]
 __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
 rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline]
 unregister_netdevice_many_notify+0x1a51/0x21a0 net/core/dev.c:11792
 unregister_netdevice_many net/core/dev.c:11875 [inline]
 unregister_netdevice_queue+0x307/0x3f0 net/core/dev.c:11741
 unregister_netdevice include/linux/netdevice.h:3329 [inline]
 _cfg80211_unregister_wdev+0x64b/0x830 net/wireless/core.c:1251
 ieee80211_remove_interfaces+0x34f/0x720 net/mac80211/iface.c:2305
 ieee80211_unregister_hw+0x55/0x3a0 net/mac80211/main.c:1681
 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim.c:5664 [inline]
 hwsim_exit_net+0x3ad/0x7d0 drivers/net/wireless/virtual/mac80211_hwsim.c:6544
 ops_exit_list+0xb0/0x180 net/core/net_namespace.c:172
 cleanup_net+0x5c6/0xbf0 net/core/net_namespace.c:652
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/29 14:38 upstream 9c5968db9e62 865ef71e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root possible deadlock in cleanup_net
2025/01/29 21:59 upstream 805ba04cb7cc 08fa8553 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in cleanup_net
2025/01/29 20:39 upstream 805ba04cb7cc 08fa8553 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in cleanup_net
2025/01/29 07:34 upstream 805ba04cb7cc 865ef71e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in cleanup_net
2025/01/28 11:38 upstream 805ba04cb7cc ac37c1f8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in cleanup_net
2025/01/28 01:29 upstream 805ba04cb7cc 18070896 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in cleanup_net
* Struck through repros no longer work on HEAD.