syzbot

netlink: 'syz.3.481': attribute type 10 has an invalid length.
======================================================
WARNING: possible circular locking dependency detected
6.14.0-syzkaller-07540-geff5f16bfd87 #0 Not tainted
------------------------------------------------------
syz.3.481/8068 is trying to acquire lock:
ffff88805a128768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6092 [inline]
ffff88805a128768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_open+0xe9/0x1e0 net/mac80211/iface.c:445

but task is already holding lock:
ffff88805ec2ce00 (team->team_lock_key#2){+.+.}-{4:4}, at: team_add_slave+0xb5/0x28b0 drivers/net/team/team_core.c:1988

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (team->team_lock_key#2){+.+.}-{4:4}:
       lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
       __mutex_lock_common kernel/locking/mutex.c:587 [inline]
       __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:732
       team_set_mac_address+0x122/0x280 drivers/net/team/team_core.c:1817
       netif_set_mac_address+0x329/0x510 net/core/dev.c:9600
       do_setlink+0xa79/0x4370 net/core/rtnetlink.c:3100
       rtnl_changelink net/core/rtnetlink.c:3766 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3925 [inline]
       rtnl_newlink+0x17e2/0x1fe0 net/core/rtnetlink.c:4062
       rtnetlink_rcv_msg+0x80f/0xd70 net/core/rtnetlink.c:6952
       netlink_rcv_skb+0x208/0x480 net/netlink/af_netlink.c:2534
       netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
       netlink_unicast+0x7f8/0x9a0 net/netlink/af_netlink.c:1339
       netlink_sendmsg+0x8e8/0xce0 net/netlink/af_netlink.c:1883
       sock_sendmsg_nosec net/socket.c:712 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:727
       __sys_sendto+0x365/0x4c0 net/socket.c:2180
       __do_sys_sendto net/socket.c:2187 [inline]
       __se_sys_sendto net/socket.c:2183 [inline]
       __x64_sys_sendto+0xde/0x100 net/socket.c:2183
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #2 (dev_addr_sem){++++}-{4:4}:
       lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
       down_read+0xb3/0xa50 kernel/locking/rwsem.c:1524
       address_show+0x25/0x250 net/core/net-sysfs.c:266
       dev_attr_show+0x55/0xc0 drivers/base/core.c:2424
       sysfs_kf_seq_show+0x331/0x4c0 fs/sysfs/file.c:59
       seq_read_iter+0x471/0xda0 fs/seq_file.c:230
       new_sync_read fs/read_write.c:489 [inline]
       vfs_read+0x9a0/0xb90 fs/read_write.c:570
       ksys_read+0x19d/0x2d0 fs/read_write.c:713
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (kn->active#28){++++}-{0:0}:
       lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
       kernfs_drain+0x2e2/0x650 fs/kernfs/dir.c:500
       __kernfs_remove+0x400/0x870 fs/kernfs/dir.c:1487
       kernfs_remove_by_name_ns+0xdc/0x160 fs/kernfs/dir.c:1695
       kernfs_remove_by_name include/linux/kernfs.h:625 [inline]
       remove_files fs/sysfs/group.c:28 [inline]
       sysfs_remove_group+0xfe/0x2c0 fs/sysfs/group.c:322
       sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:346
       device_remove_groups drivers/base/core.c:2820 [inline]
       device_remove_attrs+0x25a/0x2b0 drivers/base/core.c:2956
       device_del+0x574/0x9b0 drivers/base/core.c:3854
       unregister_netdevice_many_notify+0x1f37/0x2510 net/core/dev.c:12009
       unregister_netdevice_many net/core/dev.c:12037 [inline]
       unregister_netdevice_queue+0x383/0x400 net/core/dev.c:11889
       unregister_netdevice include/linux/netdevice.h:3374 [inline]
       _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1256
       ieee80211_remove_interfaces+0x4f1/0x700 net/mac80211/iface.c:2316
       ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681
       mac80211_hwsim_del_radio+0x2c6/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5665
       remove_user_radios drivers/net/wireless/virtual/mac80211_hwsim.c:6465 [inline]
       mac80211_hwsim_netlink_notify+0x5e5/0x940 drivers/net/wireless/virtual/mac80211_hwsim.c:6479
       notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
       blocking_notifier_call_chain+0x69/0x90 kernel/notifier.c:380
       netlink_release+0x11d9/0x1b80 net/netlink/af_netlink.c:764
       __sock_release net/socket.c:647 [inline]
       sock_close+0xbc/0x240 net/socket.c:1391
       __fput+0x3e9/0x9f0 fs/file_table.c:465
       fput_close_sync+0x1ef/0x270 fs/file_table.c:570
       __do_sys_close fs/open.c:1581 [inline]
       __se_sys_close fs/open.c:1566 [inline]
       __x64_sys_close+0x7f/0x110 fs/open.c:1566
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3166 [inline]
       check_prevs_add kernel/locking/lockdep.c:3285 [inline]
       validate_chain+0xa69/0x24e0 kernel/locking/lockdep.c:3909
       __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235
       lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
       __mutex_lock_common kernel/locking/mutex.c:587 [inline]
       __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:732
       class_wiphy_constructor include/net/cfg80211.h:6092 [inline]
       ieee80211_open+0xe9/0x1e0 net/mac80211/iface.c:445
       __dev_open+0x484/0x900 net/core/dev.c:1636
       netif_open+0xaf/0x1b0 net/core/dev.c:1659
       dev_open+0x13e/0x260 net/core/dev_api.c:206
       team_port_add drivers/net/team/team_core.c:1230 [inline]
       team_add_slave+0xac0/0x28b0 drivers/net/team/team_core.c:1989
       do_set_master+0x579/0x730 net/core/rtnetlink.c:2943
       do_setlink+0x1120/0x4370 net/core/rtnetlink.c:3156
       rtnl_changelink net/core/rtnetlink.c:3766 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3925 [inline]
       rtnl_newlink+0x17e2/0x1fe0 net/core/rtnetlink.c:4062
       rtnetlink_rcv_msg+0x80f/0xd70 net/core/rtnetlink.c:6952
       netlink_rcv_skb+0x208/0x480 net/netlink/af_netlink.c:2534
       netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
       netlink_unicast+0x7f8/0x9a0 net/netlink/af_netlink.c:1339
       netlink_sendmsg+0x8e8/0xce0 net/netlink/af_netlink.c:1883
       sock_sendmsg_nosec net/socket.c:712 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:727
       ____sys_sendmsg+0x53c/0x870 net/socket.c:2566
       ___sys_sendmsg net/socket.c:2620 [inline]
       __sys_sendmsg+0x271/0x360 net/socket.c:2652
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  &rdev->wiphy.mtx --> dev_addr_sem --> team->team_lock_key#2

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(team->team_lock_key#2);
                               lock(dev_addr_sem);
                               lock(team->team_lock_key#2);
  lock(&rdev->wiphy.mtx);

 *** DEADLOCK ***

2 locks held by syz.3.481/8068:
 #0: ffffffff900d0648 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff900d0648 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff900d0648 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xd68/0x1fe0 net/core/rtnetlink.c:4061
 #1: ffff88805ec2ce00 (team->team_lock_key#2){+.+.}-{4:4}, at: team_add_slave+0xb5/0x28b0 drivers/net/team/team_core.c:1988

stack backtrace:
CPU: 0 UID: 0 PID: 8068 Comm: syz.3.481 Not tainted 6.14.0-syzkaller-07540-geff5f16bfd87 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2079
 check_noncircular+0x142/0x160 kernel/locking/lockdep.c:2211
 check_prev_add kernel/locking/lockdep.c:3166 [inline]
 check_prevs_add kernel/locking/lockdep.c:3285 [inline]
 validate_chain+0xa69/0x24e0 kernel/locking/lockdep.c:3909
 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235
 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
 __mutex_lock_common kernel/locking/mutex.c:587 [inline]
 __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:732
 class_wiphy_constructor include/net/cfg80211.h:6092 [inline]
 ieee80211_open+0xe9/0x1e0 net/mac80211/iface.c:445
 __dev_open+0x484/0x900 net/core/dev.c:1636
 netif_open+0xaf/0x1b0 net/core/dev.c:1659
 dev_open+0x13e/0x260 net/core/dev_api.c:206
 team_port_add drivers/net/team/team_core.c:1230 [inline]
 team_add_slave+0xac0/0x28b0 drivers/net/team/team_core.c:1989
 do_set_master+0x579/0x730 net/core/rtnetlink.c:2943
 do_setlink+0x1120/0x4370 net/core/rtnetlink.c:3156
 rtnl_changelink net/core/rtnetlink.c:3766 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3925 [inline]
 rtnl_newlink+0x17e2/0x1fe0 net/core/rtnetlink.c:4062
 rtnetlink_rcv_msg+0x80f/0xd70 net/core/rtnetlink.c:6952
 netlink_rcv_skb+0x208/0x480 net/netlink/af_netlink.c:2534
 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
 netlink_unicast+0x7f8/0x9a0 net/netlink/af_netlink.c:1339
 netlink_sendmsg+0x8e8/0xce0 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:727
 ____sys_sendmsg+0x53c/0x870 net/socket.c:2566
 ___sys_sendmsg net/socket.c:2620 [inline]
 __sys_sendmsg+0x271/0x360 net/socket.c:2652
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7179b8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f717aa12038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7179da6080 RCX: 00007f7179b8d169
RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000003
RBP: 00007f7179c0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f7179da6080 R15: 00007ffcbefe5fa8
 </TASK>
team0: Device wlan1 failed to register rx_handler