./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1322433471 <...> =process permissive=1 [ 49.702378][ T30] audit: type=1400 audit(1748144850.268:65): avc: denied { siginh } for pid=5662 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.150' (ED25519) to the list of known hosts. execve("./syz-executor1322433471", ["./syz-executor1322433471"], 0x7fffe967c6e0 /* 10 vars */) = 0 brk(NULL) = 0x5555728a6000 brk(0x5555728a6d00) = 0x5555728a6d00 [ 75.127541][ T30] audit: type=1400 audit(1748144875.788:66): avc: denied { write } for pid=5814 comm="strace-static-x" path="pipe:[3993]" dev="pipefs" ino=3993 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 arch_prctl(ARCH_SET_FS, 0x5555728a6380) = 0 set_tid_address(0x5555728a6650) = 5817 set_robust_list(0x5555728a6660, 24) = 0 rseq(0x5555728a6ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1322433471", 4096) = 28 getrandom("\x58\x32\x8a\x55\xe7\xa1\x26\xdf", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555728a6d00 brk(0x5555728c7d00) = 0x5555728c7d00 brk(0x5555728c8000) = 0x5555728c8000 mprotect(0x7fe93ca08000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5818 attached , child_tidptr=0x5555728a6650) = 5818 [pid 5818] set_robust_list(0x5555728a6660, 24) = 0 [pid 5818] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 75.334269][ T30] audit: type=1400 audit(1748144875.998:67): avc: denied { execmem } for pid=5817 comm="syz-executor132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5818] getppid() = 0 [pid 5818] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5818] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5818] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5818] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5818] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5818] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5818] unshare(CLONE_NEWNS) = 0 [pid 5818] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5818] unshare(CLONE_NEWIPC) = 0 [pid 5818] unshare(CLONE_NEWCGROUP) = 0 [pid 5818] unshare(CLONE_NEWUTS) = 0 [ 75.442094][ T30] audit: type=1400 audit(1748144876.098:68): avc: denied { mounton } for pid=5818 comm="syz-executor132" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 5818] unshare(CLONE_SYSVSEM) = 0 [pid 5818] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "16777216", 8) = 8 [pid 5818] close(3) = 0 [pid 5818] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "536870912", 9) = 9 [pid 5818] close(3) = 0 [pid 5818] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "1024", 4) = 4 [pid 5818] close(3) = 0 [pid 5818] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "8192", 4) = 4 [pid 5818] close(3) = 0 [pid 5818] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "1024", 4) = 4 [pid 5818] close(3) = 0 [pid 5818] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "1024", 4) = 4 [pid 5818] close(3) = 0 [pid 5818] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5818] close(3) = 0 [pid 5818] getpid() = 1 [pid 5818] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<team_lock_key){+.+.}-{4:4}, at: team_del_slave+0x31/0x1b0 [ 91.455687][ T5818] [ 91.455687][ T5818] but task is already holding lock: [ 91.463025][ T5818] ffff88802b410768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: nl80211_del_interface+0xfb/0x190 [ 91.472773][ T5818] [ 91.472773][ T5818] which lock already depends on the new lock. [ 91.472773][ T5818] [ 91.483157][ T5818] [ 91.483157][ T5818] the existing dependency chain (in reverse order) is: [ 91.492149][ T5818] [ 91.492149][ T5818] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 91.499868][ T5818] __mutex_lock+0x199/0xb90 [ 91.504884][ T5818] ieee80211_open+0x132/0x210 [ 91.510087][ T5818] __dev_open+0x2e7/0x7d0 [ 91.514920][ T5818] netif_open+0xf2/0x160 [ 91.519675][ T5818] dev_open+0xb2/0x260 [ 91.524250][ T5818] team_add_slave+0xaf0/0x21a0 [ 91.529516][ T5818] do_set_master+0x40c/0x730 [ 91.534607][ T5818] do_setlink.constprop.0+0xe66/0x44b0 [ 91.540570][ T5818] rtnl_setlink+0x3cb/0x770 [ 91.545576][ T5818] rtnetlink_rcv_msg+0x95b/0xe90 [ 91.551032][ T5818] netlink_rcv_skb+0x16a/0x440 [ 91.556301][ T5818] netlink_unicast+0x53d/0x7f0 [ 91.561567][ T5818] netlink_sendmsg+0x8d1/0xdd0 [ 91.566839][ T5818] ____sys_sendmsg+0xa95/0xc70 [ 91.572109][ T5818] ___sys_sendmsg+0x134/0x1d0 [ 91.577290][ T5818] __sys_sendmsg+0x16d/0x220 [ 91.582381][ T5818] do_syscall_64+0xcd/0x260 [ 91.587390][ T5818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.593783][ T5818] [ 91.593783][ T5818] -> #0 (team->team_lock_key){+.+.}-{4:4}: [ 91.601756][ T5818] __lock_acquire+0x1173/0x1ba0 [ 91.607120][ T5818] lock_acquire+0x179/0x350 [ 91.612128][ T5818] __mutex_lock+0x199/0xb90 [ 91.617140][ T5818] team_del_slave+0x31/0x1b0 [ 91.622241][ T5818] team_device_event+0xd0/0x770 [ 91.627593][ T5818] notifier_call_chain+0xbc/0x410 [ 91.633128][ T5818] call_netdevice_notifiers_info+0xbe/0x140 [ 91.639529][ T5818] unregister_netdevice_many_notify+0xf9a/0x26f0 [ 91.646361][ T5818] unregister_netdevice_queue+0x305/0x3f0 [ 91.652582][ T5818] _cfg80211_unregister_wdev+0x64b/0x830 [ 91.658717][ T5818] ieee80211_if_remove+0x250/0x400 [ 91.664336][ T5818] ieee80211_del_iface+0x16/0x20 [ 91.669776][ T5818] cfg80211_remove_virtual_intf+0xda/0x2a0 [ 91.676091][ T5818] nl80211_del_interface+0x106/0x190 [ 91.681887][ T5818] genl_family_rcv_msg_doit+0x209/0x2f0 [ 91.687942][ T5818] genl_rcv_msg+0x55c/0x800 [ 91.692951][ T5818] netlink_rcv_skb+0x16a/0x440 [ 91.698235][ T5818] genl_rcv+0x28/0x40 [ 91.702722][ T5818] netlink_unicast+0x53d/0x7f0 [ 91.707990][ T5818] netlink_sendmsg+0x8d1/0xdd0 [ 91.713259][ T5818] ____sys_sendmsg+0xa95/0xc70 [ 91.718529][ T5818] ___sys_sendmsg+0x134/0x1d0 [ 91.723707][ T5818] __sys_sendmsg+0x16d/0x220 [ 91.728796][ T5818] do_syscall_64+0xcd/0x260 [ 91.733819][ T5818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.740215][ T5818] [ 91.740215][ T5818] other info that might help us debug this: [ 91.740215][ T5818] [ 91.750420][ T5818] Possible unsafe locking scenario: [ 91.750420][ T5818] [ 91.757845][ T5818] CPU0 CPU1 [ 91.763192][ T5818] ---- ---- [ 91.768533][ T5818] lock(&rdev->wiphy.mtx); [ 91.773017][ T5818] lock(team->team_lock_key); [ 91.780278][ T5818] lock(&rdev->wiphy.mtx); [ 91.787279][ T5818] lock(team->team_lock_key); [ 91.792022][ T5818] [ 91.792022][ T5818] *** DEADLOCK *** [ 91.792022][ T5818] [ 91.800142][ T5818] 3 locks held by syz-executor132/5818: [ 91.805661][ T5818] #0: ffffffff901cae10 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 91.813827][ T5818] #1: ffffffff90128ce8 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0xb4/0xb10 [ 91.823032][ T5818] #2: ffff88802b410768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: nl80211_del_interface+0xfb/0x190 [ 91.833192][ T5818] [ 91.833192][ T5818] stack backtrace: [ 91.839060][ T5818] CPU: 0 UID: 0 PID: 5818 Comm: syz-executor132 Not tainted 6.15.0-rc7-syzkaller-00144-gb1427432d3b6 #0 PREEMPT(full) [ 91.839079][ T5818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 91.839087][ T5818] Call Trace: [ 91.839093][ T5818] [ 91.839098][ T5818] dump_stack_lvl+0x116/0x1f0 [ 91.839119][ T5818] print_circular_bug+0x275/0x350 [ 91.839140][ T5818] check_noncircular+0x14c/0x170 [ 91.839162][ T5818] __lock_acquire+0x1173/0x1ba0 [ 91.839189][ T5818] lock_acquire+0x179/0x350 [ 91.839209][ T5818] ? team_del_slave+0x31/0x1b0 [ 91.839223][ T5818] ? __pfx___might_resched+0x10/0x10 [ 91.839241][ T5818] ? __pfx___mutex_trylock_common+0x10/0x10 [ 91.839264][ T5818] __mutex_lock+0x199/0xb90 [ 91.839283][ T5818] ? team_del_slave+0x31/0x1b0 [ 91.839296][ T5818] ? find_held_lock+0x2b/0x80 [ 91.839312][ T5818] ? team_del_slave+0x31/0x1b0 [ 91.839325][ T5818] ? __pfx___mutex_lock+0x10/0x10 [ 91.839349][ T5818] ? team_del_slave+0x31/0x1b0 [ 91.839361][ T5818] team_del_slave+0x31/0x1b0 [ 91.839375][ T5818] team_device_event+0xd0/0x770 [ 91.839389][ T5818] notifier_call_chain+0xbc/0x410 [ 91.839408][ T5818] ? __pfx_team_device_event+0x10/0x10 [ 91.839424][ T5818] call_netdevice_notifiers_info+0xbe/0x140 [ 91.839445][ T5818] unregister_netdevice_many_notify+0xf9a/0x26f0 [ 91.839466][ T5818] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 91.839488][ T5818] ? find_held_lock+0x2b/0x80 [ 91.839504][ T5818] unregister_netdevice_queue+0x305/0x3f0 [ 91.839522][ T5818] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 91.839541][ T5818] _cfg80211_unregister_wdev+0x64b/0x830 [ 91.839558][ T5818] ieee80211_if_remove+0x250/0x400 [ 91.839577][ T5818] ieee80211_del_iface+0x16/0x20 [ 91.839594][ T5818] cfg80211_remove_virtual_intf+0xda/0x2a0 [ 91.839616][ T5818] nl80211_del_interface+0x106/0x190 [ 91.839630][ T5818] genl_family_rcv_msg_doit+0x209/0x2f0 [ 91.839651][ T5818] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 91.839673][ T5818] ? bpf_lsm_capable+0x9/0x10 [ 91.839686][ T5818] ? security_capable+0x7e/0x260 [ 91.839702][ T5818] ? ns_capable+0xd7/0x110 [ 91.839718][ T5818] genl_rcv_msg+0x55c/0x800 [ 91.839739][ T5818] ? __pfx_genl_rcv_msg+0x10/0x10 [ 91.839757][ T5818] ? __pfx___dev_queue_xmit+0x10/0x10 [ 91.839778][ T5818] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 91.839796][ T5818] ? __pfx_nl80211_del_interface+0x10/0x10 [ 91.839810][ T5818] ? __pfx_nl80211_post_doit+0x10/0x10 [ 91.839829][ T5818] ? __lock_acquire+0xaa4/0x1ba0 [ 91.839850][ T5818] netlink_rcv_skb+0x16a/0x440 [ 91.839867][ T5818] ? __pfx_genl_rcv_msg+0x10/0x10 [ 91.839887][ T5818] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 91.839907][ T5818] ? __pfx_down_read+0x10/0x10 [ 91.839919][ T5818] ? netlink_deliver_tap+0x1ae/0xd30 [ 91.839936][ T5818] genl_rcv+0x28/0x40 [ 91.839953][ T5818] netlink_unicast+0x53d/0x7f0 [ 91.839971][ T5818] ? __pfx_netlink_unicast+0x10/0x10 [ 91.839990][ T5818] netlink_sendmsg+0x8d1/0xdd0 [ 91.840008][ T5818] ? __pfx_netlink_sendmsg+0x10/0x10 [ 91.840027][ T5818] ____sys_sendmsg+0xa95/0xc70 [ 91.840047][ T5818] ? copy_msghdr_from_user+0x10a/0x160 [ 91.840062][ T5818] ? __pfx_____sys_sendmsg+0x10/0x10 [ 91.840081][ T5818] ? rcu_is_watching+0x12/0xc0 [ 91.840097][ T5818] ? trace_sched_exit_tp+0xde/0x130 [ 91.840118][ T5818] ___sys_sendmsg+0x134/0x1d0 [ 91.840133][ T5818] ? __pfx____sys_sendmsg+0x10/0x10 [ 91.840147][ T5818] ? __lock_acquire+0xaa4/0x1ba0 [ 91.840174][ T5818] ? ptrace_stop.part.0+0x732/0x950 [ 91.840196][ T5818] __sys_sendmsg+0x16d/0x220 [ 91.840210][ T5818] ? __pfx___sys_sendmsg+0x10/0x10 [ 91.840227][ T5818] ? lockdep_hardirqs_on+0x7c/0x110 [ 91.840245][ T5818] ? _raw_spin_unlock_irq+0x2e/0x50 [ 91.840262][ T5818] ? ptrace_notify+0xf1/0x130 [ 91.840279][ T5818] do_syscall_64+0xcd/0x260 [ 91.840298][ T5818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.840312][ T5818] RIP: 0033:0x7fe93c990569 [ 91.840324][ T5818] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 91.840337][ T5818] RSP: 002b:00007ffe731971a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 91.840362][ T5818] RAX: ffffffffffffffda RBX: 00007fe93c9dd513 RCX: 00007fe93c990569 [ 91.840395][ T5818] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [pid 5818] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x1c\x00\x00\x00\x24\x00\x37\x95\x00\x00\x9f\x83\x3d\x32\x34\xd3\x08\xf8\x00\x00\x08\x00\x03\x00\x47\x00\x00\x00", iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [ 91.840439][ T5818] RBP: 00007fe93c9dd4e3 R08: 0000000000000000 R09: 0000000000000000 [ 91.840471][ T5818] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe93c9dd44b [ 91.840480][ T5818] R13: 0000000000000048 R14: 0000000000050012 R15: 0000000000000003 [ 91.840492][ T5818] [ 92.287164][ T5818] team0: Port device wlan0 removed [pid 5818] exit_group(1) = ? [pid 5818] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5818, si_uid=0, si_status=1, si_utime=0, si_stime=103 /* 1.03 s */} --- exit_group(0) = ? +++ exited with 0 +++