Warning: Permanently added '10.128.1.166' (ECDSA) to the list of known hosts. syzkaller login: [ 68.121655][ T3545] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.129353][ T3545] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.137235][ T3545] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.145304][ T3545] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.153609][ T3545] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 68.161273][ T3545] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.261653][ T3543] chnl_net:caif_netlink_parms(): no params data found [ 68.312237][ T3543] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.320641][ T3543] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.328685][ T3543] device bridge_slave_0 entered promiscuous mode [ 68.338229][ T3543] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.345358][ T3543] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.353470][ T3543] device bridge_slave_1 entered promiscuous mode [ 68.379368][ T3543] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.390678][ T3543] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.416453][ T3543] team0: Port device team_slave_0 added [ 68.423733][ T3543] team0: Port device team_slave_1 added [ 68.445266][ T3543] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.452387][ T3543] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.478380][ T3543] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.490906][ T3543] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.498090][ T3543] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.524088][ T3543] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.557404][ T3543] device hsr_slave_0 entered promiscuous mode [ 68.564339][ T3543] device hsr_slave_1 entered promiscuous mode [ 68.665812][ T3543] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.678870][ T3543] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.688872][ T3543] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.698325][ T3543] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.723145][ T3543] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.730403][ T3543] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.738335][ T3543] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.745441][ T3543] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.799359][ T3543] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.813030][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.823834][ T3016] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.833269][ T3016] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.841703][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 68.855587][ T3543] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.868418][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.877467][ T151] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.884538][ T151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.910087][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.918777][ T3555] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.925994][ T3555] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.934618][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.944125][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.954979][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.965233][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.979722][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.989663][ T3543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 69.010329][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 69.017937][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 69.030909][ T3543] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.051986][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.071665][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.080133][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.088330][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.098692][ T3543] device veth0_vlan entered promiscuous mode [ 69.113190][ T3543] device veth1_vlan entered promiscuous mode [ 69.132712][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.140793][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 69.149459][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.161285][ T3543] device veth0_macvtap entered promiscuous mode [ 69.172027][ T3543] device veth1_macvtap entered promiscuous mode [ 69.190500][ T3543] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.198170][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.207962][ T3016] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 69.221011][ T3543] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.229580][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program [ 69.241177][ T3543] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.251203][ T3543] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.261673][ T3543] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.271789][ T3543] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.545665][ T3557] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 69.545769][ T3543] syz-executor138 (3543) used greatest stack depth: 19288 bytes left [ 69.556744][ T3557] nci: nci_start_poll: failed to set local general bytes [ 72.579706][ T56] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.265197][ T56] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.332291][ T56] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.395454][ T56] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.115005][ T56] device hsr_slave_0 left promiscuous mode [ 76.121901][ T56] device hsr_slave_1 left promiscuous mode [ 76.130413][ T56] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.138512][ T56] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 76.149610][ T56] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.157144][ T56] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 76.167663][ T56] device bridge_slave_1 left promiscuous mode [ 76.174678][ T56] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.188687][ T56] device bridge_slave_0 left promiscuous mode [ 76.194971][ T56] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.211997][ T56] device veth1_macvtap left promiscuous mode [ 76.218464][ T56] device veth0_macvtap left promiscuous mode [ 76.224621][ T56] device veth1_vlan left promiscuous mode [ 76.231884][ T56] device veth0_vlan left promiscuous mode [ 76.393888][ T56] team0 (unregistering): Port device team_slave_1 removed [ 76.407046][ T56] team0 (unregistering): Port device team_slave_0 removed [ 76.419929][ T56] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 76.433660][ T56] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 76.488675][ T56] bond0 (unregistering): Released all slaves [ 77.616735][ T3557] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 77.625453][ T3557] [ 77.627900][ T3557] ====================================================== [ 77.634938][ T3557] WARNING: possible circular locking dependency detected [ 77.642066][ T3557] 6.1.34-syzkaller #0 Not tainted [ 77.647105][ T3557] ------------------------------------------------------ [ 77.654135][ T3557] syz-executor138/3557 is trying to acquire lock: [ 77.660566][ T3557] ffffffff8d7cd808 (nci_mutex){+.+.}-{3:3}, at: virtual_nci_close+0x13/0x40 [ 77.669329][ T3557] [ 77.669329][ T3557] but task is already holding lock: [ 77.676713][ T3557] ffff88807a2e0350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0x106/0x5f0 [ 77.686088][ T3557] [ 77.686088][ T3557] which lock already depends on the new lock. [ 77.686088][ T3557] [ 77.696508][ T3557] [ 77.696508][ T3557] the existing dependency chain (in reverse order) is: [ 77.705545][ T3557] [ 77.705545][ T3557] -> #3 (&ndev->req_lock){+.+.}-{3:3}: [ 77.713227][ T3557] lock_acquire+0x1f8/0x5a0 [ 77.718290][ T3557] __mutex_lock_common+0x1d4/0x2520 [ 77.724048][ T3557] mutex_lock_nested+0x17/0x20 [ 77.729375][ T3557] nci_start_poll+0x59f/0xf20 [ 77.734612][ T3557] nfc_start_poll+0x184/0x2f0 [ 77.739853][ T3557] nfc_genl_start_poll+0x1e7/0x350 [ 77.745517][ T3557] genl_rcv_msg+0xc1a/0xf70 [ 77.750658][ T3557] netlink_rcv_skb+0x1cd/0x410 [ 77.755986][ T3557] genl_rcv+0x24/0x40 [ 77.760530][ T3557] netlink_unicast+0x7bf/0x990 [ 77.765944][ T3557] netlink_sendmsg+0xa26/0xd60 [ 77.771260][ T3557] ____sys_sendmsg+0x59e/0x8f0 [ 77.776584][ T3557] __sys_sendmsg+0x2a9/0x390 [ 77.781737][ T3557] do_syscall_64+0x3d/0xb0 [ 77.786721][ T3557] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 77.793180][ T3557] [ 77.793180][ T3557] -> #2 (&genl_data->genl_data_mutex){+.+.}-{3:3}: [ 77.801910][ T3557] lock_acquire+0x1f8/0x5a0 [ 77.807072][ T3557] __mutex_lock_common+0x1d4/0x2520 [ 77.812837][ T3557] mutex_lock_nested+0x17/0x20 [ 77.818340][ T3557] nfc_urelease_event_work+0x113/0x2f0 [ 77.824443][ T3557] process_one_work+0x8aa/0x11f0 [ 77.829939][ T3557] worker_thread+0xa5f/0x1210 [ 77.836139][ T3557] kthread+0x26e/0x300 [ 77.840766][ T3557] ret_from_fork+0x1f/0x30 [ 77.845741][ T3557] [ 77.845741][ T3557] -> #1 (nfc_devlist_mutex){+.+.}-{3:3}: [ 77.853601][ T3557] lock_acquire+0x1f8/0x5a0 [ 77.858682][ T3557] __mutex_lock_common+0x1d4/0x2520 [ 77.864452][ T3557] mutex_lock_nested+0x17/0x20 [ 77.869836][ T3557] nfc_register_device+0x38/0x310 [ 77.875412][ T3557] nci_register_device+0x7be/0x900 [ 77.881084][ T3557] virtual_ncidev_open+0x55/0xc0 [ 77.886578][ T3557] misc_open+0x304/0x380 [ 77.891381][ T3557] chrdev_open+0x54a/0x630 [ 77.896352][ T3557] do_dentry_open+0x7f9/0x10f0 [ 77.902167][ T3557] path_openat+0x2644/0x2e60 [ 77.907314][ T3557] do_filp_open+0x230/0x480 [ 77.912375][ T3557] do_sys_openat2+0x13b/0x500 [ 77.917610][ T3557] __x64_sys_openat+0x243/0x290 [ 77.923028][ T3557] do_syscall_64+0x3d/0xb0 [ 77.928027][ T3557] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 77.934505][ T3557] [ 77.934505][ T3557] -> #0 (nci_mutex){+.+.}-{3:3}: [ 77.941667][ T3557] validate_chain+0x1667/0x58e0 [ 77.947076][ T3557] __lock_acquire+0x125b/0x1f80 [ 77.952476][ T3557] lock_acquire+0x1f8/0x5a0 [ 77.957523][ T3557] __mutex_lock_common+0x1d4/0x2520 [ 77.963279][ T3557] mutex_lock_nested+0x17/0x20 [ 77.968610][ T3557] virtual_nci_close+0x13/0x40 [ 77.973930][ T3557] nci_close_device+0x3a8/0x5f0 [ 77.979355][ T3557] nci_unregister_device+0x3c/0x230 [ 77.985109][ T3557] virtual_ncidev_close+0x55/0x90 [ 77.990694][ T3557] __fput+0x3b7/0x890 [ 77.995225][ T3557] task_work_run+0x246/0x300 [ 78.000372][ T3557] do_exit+0x6fb/0x2300 [ 78.005087][ T3557] do_group_exit+0x202/0x2b0 [ 78.010232][ T3557] get_signal+0x16f7/0x17d0 [ 78.015292][ T3557] arch_do_signal_or_restart+0xb0/0x1a10 [ 78.021487][ T3557] exit_to_user_mode_loop+0x6a/0x100 [ 78.027325][ T3557] exit_to_user_mode_prepare+0xb1/0x140 [ 78.033422][ T3557] syscall_exit_to_user_mode+0x60/0x270 [ 78.039516][ T3557] do_syscall_64+0x49/0xb0 [ 78.044501][ T3557] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 78.050949][ T3557] [ 78.050949][ T3557] other info that might help us debug this: [ 78.050949][ T3557] [ 78.061201][ T3557] Chain exists of: [ 78.061201][ T3557] nci_mutex --> &genl_data->genl_data_mutex --> &ndev->req_lock [ 78.061201][ T3557] [ 78.074808][ T3557] Possible unsafe locking scenario: [ 78.074808][ T3557] [ 78.082280][ T3557] CPU0 CPU1 [ 78.087668][ T3557] ---- ---- [ 78.093048][ T3557] lock(&ndev->req_lock); [ 78.097490][ T3557] lock(&genl_data->genl_data_mutex); [ 78.105589][ T3557] lock(&ndev->req_lock); [ 78.112556][ T3557] lock(nci_mutex); [ 78.116476][ T3557] [ 78.116476][ T3557] *** DEADLOCK *** [ 78.116476][ T3557] [ 78.124643][ T3557] 1 lock held by syz-executor138/3557: [ 78.130115][ T3557] #0: ffff88807a2e0350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0x106/0x5f0 [ 78.139914][ T3557] [ 78.139914][ T3557] stack backtrace: [ 78.145825][ T3557] CPU: 1 PID: 3557 Comm: syz-executor138 Not tainted 6.1.34-syzkaller #0 [ 78.154261][ T3557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 78.164342][ T3557] Call Trace: [ 78.167642][ T3557] [ 78.170596][ T3557] dump_stack_lvl+0x1e3/0x2cb [ 78.175321][ T3557] ? nf_tcp_handle_invalid+0x642/0x642 [ 78.180830][ T3557] ? print_circular_bug+0x12b/0x1a0 [ 78.186065][ T3557] check_noncircular+0x2fa/0x3b0 [ 78.191036][ T3557] ? add_chain_block+0x850/0x850 [ 78.196005][ T3557] ? lockdep_lock+0x11f/0x2a0 [ 78.200723][ T3557] ? prb_read_valid+0xf0/0xf0 [ 78.205438][ T3557] ? _find_first_zero_bit+0xd0/0x100 [ 78.210768][ T3557] validate_chain+0x1667/0x58e0 [ 78.215667][ T3557] ? __lock_acquire+0x125b/0x1f80 [ 78.220736][ T3557] ? desc_read+0x200/0x3f0 [ 78.225196][ T3557] ? memcpy+0x3c/0x60 [ 78.229219][ T3557] ? reacquire_held_locks+0x660/0x660 [ 78.234626][ T3557] ? desc_read+0x1a2/0x3f0 [ 78.239077][ T3557] ? _prb_read_valid+0xb46/0xbe0 [ 78.244062][ T3557] ? mark_lock+0x9a/0x340 [ 78.248421][ T3557] __lock_acquire+0x125b/0x1f80 [ 78.253309][ T3557] lock_acquire+0x1f8/0x5a0 [ 78.257838][ T3557] ? virtual_nci_close+0x13/0x40 [ 78.262820][ T3557] ? read_lock_is_recursive+0x10/0x10 [ 78.268223][ T3557] ? __might_sleep+0xb0/0xb0 [ 78.272847][ T3557] ? find_next_clump8+0x1a0/0x1a0 [ 78.277905][ T3557] ? console_unlock+0x311/0x6e0 [ 78.282784][ T3557] ? console_unlock+0x6aa/0x6e0 [ 78.287672][ T3557] __mutex_lock_common+0x1d4/0x2520 [ 78.292915][ T3557] ? virtual_nci_close+0x13/0x40 [ 78.297892][ T3557] ? irq_work_queue+0xc6/0x150 [ 78.302692][ T3557] ? __wake_up_klogd+0xd5/0x100 [ 78.307577][ T3557] ? vprintk_emit+0x109/0x1f0 [ 78.312290][ T3557] ? virtual_nci_close+0x13/0x40 [ 78.317262][ T3557] ? _printk+0xd1/0x111 [ 78.321458][ T3557] ? mutex_lock_io_nested+0x60/0x60 [ 78.326700][ T3557] ? panic+0x75d/0x75d [ 78.330812][ T3557] ? _raw_spin_unlock_irq+0x1f/0x40 [ 78.336042][ T3557] mutex_lock_nested+0x17/0x20 [ 78.340847][ T3557] virtual_nci_close+0x13/0x40 [ 78.345654][ T3557] nci_close_device+0x3a8/0x5f0 [ 78.350543][ T3557] ? nci_unregister_device+0x230/0x230 [ 78.356043][ T3557] ? mutex_unlock+0x10/0x10 [ 78.360587][ T3557] nci_unregister_device+0x3c/0x230 [ 78.365832][ T3557] ? virtual_ncidev_open+0xc0/0xc0 [ 78.370983][ T3557] virtual_ncidev_close+0x55/0x90 [ 78.376041][ T3557] ? virtual_ncidev_open+0xc0/0xc0 [ 78.381270][ T3557] __fput+0x3b7/0x890 [ 78.385378][ T3557] task_work_run+0x246/0x300 [ 78.390001][ T3557] ? kasan_quarantine_put+0xd4/0x220 [ 78.395325][ T3557] ? task_work_cancel+0x2b0/0x2b0 [ 78.400826][ T3557] ? kmem_cache_free+0x292/0x510 [ 78.405808][ T3557] ? do_exit+0x6f6/0x2300 [ 78.410269][ T3557] do_exit+0x6fb/0x2300 [ 78.414470][ T3557] ? put_task_struct+0x80/0x80 [ 78.419286][ T3557] ? get_signal+0x137e/0x17d0 [ 78.424003][ T3557] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 78.430017][ T3557] ? print_irqtrace_events+0x210/0x210 [ 78.435536][ T3557] ? _raw_spin_lock_irq+0xdb/0x110 [ 78.440683][ T3557] do_group_exit+0x202/0x2b0 [ 78.445316][ T3557] ? _raw_spin_unlock_irq+0x1f/0x40 [ 78.450551][ T3557] ? lockdep_hardirqs_on+0x94/0x130 [ 78.455812][ T3557] get_signal+0x16f7/0x17d0 [ 78.460362][ T3557] ? ptrace_notify+0x370/0x370 [ 78.465171][ T3557] arch_do_signal_or_restart+0xb0/0x1a10 [ 78.470841][ T3557] ? ____sys_sendmsg+0x8f0/0x8f0 [ 78.475836][ T3557] ? get_sigframe_size+0x10/0x10 [ 78.480807][ T3557] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 78.486833][ T3557] ? exit_to_user_mode_loop+0x39/0x100 [ 78.492330][ T3557] exit_to_user_mode_loop+0x6a/0x100 [ 78.497651][ T3557] exit_to_user_mode_prepare+0xb1/0x140 [ 78.503253][ T3557] syscall_exit_to_user_mode+0x60/0x270 [ 78.508845][ T3557] do_syscall_64+0x49/0xb0 [ 78.513305][ T3557] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 78.519232][ T3557] RIP: 0033:0x7f89b2568b29 [ 78.523671][ T3557] Code: Unable to access opcode bytes at 0x7f89b2568aff. [ 78.530708][ T3557] RSP: 002b:00007f89b1d0c1d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 78.539325][ T3557] RAX: 0000000000000024 RBX: 00007f89b25ea4c8 RCX: 00007f89b2568b29 [ 78.547328][ T3557] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000005 [ 78.555329][ T3557] RBP: 00007f89b25ea4c0 R08: 0000000000000000 R09: 0000000000000000 [ 78.563330][ T3557] R10: 0000000000000001 R11: 0000000000000246 R12: 00007f89b25ea4cc [ 78.571337][ T3557] R13: 00007ffc1a9a49af R14: 00007f89b1d0c300 R15: 0000000000022000 [ 78.579363][ T3557]