./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4053108391 <...> Warning: Permanently added '10.128.0.177' (ED25519) to the list of known hosts. execve("./syz-executor4053108391", ["./syz-executor4053108391"], 0x7fff67a02de0 /* 10 vars */) = 0 brk(NULL) = 0x55557a01d000 brk(0x55557a01dd00) = 0x55557a01dd00 arch_prctl(ARCH_SET_FS, 0x55557a01d380) = 0 set_tid_address(0x55557a01d650) = 5083 set_robust_list(0x55557a01d660, 24) = 0 rseq(0x55557a01dca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4053108391", 4096) = 28 getrandom("\x37\x84\xdb\xb1\xa8\xd5\xa2\x2c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557a01dd00 brk(0x55557a03ed00) = 0x55557a03ed00 brk(0x55557a03f000) = 0x55557a03f000 mprotect(0x7f182d094000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557a01d650) = 5084 ./strace-static-x86_64: Process 5084 attached [pid 5084] set_robust_list(0x55557a01d660, 24) = 0 [pid 5084] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5084] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5084] setsid() = 1 [pid 5084] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5084] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5084] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5084] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5084] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5084] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5084] unshare(CLONE_NEWNS) = 0 [pid 5084] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5084] unshare(CLONE_NEWIPC) = 0 [pid 5084] unshare(CLONE_NEWCGROUP) = 0 [pid 5084] unshare(CLONE_NEWUTS) = 0 [pid 5084] unshare(CLONE_SYSVSEM) = 0 [pid 5084] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "16777216", 8) = 8 [pid 5084] close(3) = 0 [pid 5084] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "536870912", 9) = 9 [pid 5084] close(3) = 0 [pid 5084] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "1024", 4) = 4 [pid 5084] close(3) = 0 [pid 5084] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "8192", 4) = 4 [pid 5084] close(3) = 0 [pid 5084] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "1024", 4) = 4 [pid 5084] close(3) = 0 [pid 5084] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "1024", 4) = 4 [pid 5084] close(3) = 0 [pid 5084] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5084] close(3) = 0 [pid 5084] getpid() = 1 [pid 5084] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<team_lock_key){+.+.}-{3:3}, at: team_del_slave+0x32/0x1d0 [ 81.141485][ T5084] [ 81.141485][ T5084] but task is already holding lock: [ 81.148827][ T5084] ffff888029cc0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 81.158674][ T5084] [ 81.158674][ T5084] which lock already depends on the new lock. [ 81.158674][ T5084] [ 81.169064][ T5084] [ 81.169064][ T5084] the existing dependency chain (in reverse order) is: [ 81.178144][ T5084] [ 81.178144][ T5084] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 81.185871][ T5084] lock_acquire+0x1ed/0x550 [ 81.190885][ T5084] __mutex_lock+0x136/0xd70 [ 81.195897][ T5084] ieee80211_open+0xe7/0x200 [ 81.200992][ T5084] __dev_open+0x2d5/0x450 [ 81.205837][ T5084] dev_open+0xae/0x1b0 [ 81.210422][ T5084] team_add_slave+0x9b3/0x2750 [ 81.215702][ T5084] do_setlink+0xe72/0x41f0 [ 81.220633][ T5084] rtnl_newlink+0x180b/0x20a0 [ 81.225816][ T5084] rtnetlink_rcv_msg+0x89d/0x10d0 [ 81.231354][ T5084] netlink_rcv_skb+0x1e5/0x430 [ 81.236627][ T5084] netlink_unicast+0x7ec/0x980 [ 81.241909][ T5084] netlink_sendmsg+0x8e1/0xcb0 [ 81.247179][ T5084] __sock_sendmsg+0x223/0x270 [ 81.252372][ T5084] ____sys_sendmsg+0x525/0x7d0 [ 81.257645][ T5084] __sys_sendmsg+0x2b0/0x3a0 [ 81.262745][ T5084] do_syscall_64+0xf5/0x240 [ 81.267766][ T5084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.274170][ T5084] [ 81.274170][ T5084] -> #0 (team->team_lock_key){+.+.}-{3:3}: [ 81.282156][ T5084] validate_chain+0x18cb/0x58e0 [ 81.287521][ T5084] __lock_acquire+0x1346/0x1fd0 [ 81.292879][ T5084] lock_acquire+0x1ed/0x550 [ 81.297888][ T5084] __mutex_lock+0x136/0xd70 [ 81.302902][ T5084] team_del_slave+0x32/0x1d0 [ 81.308124][ T5084] team_device_event+0x200/0x5b0 [ 81.313580][ T5084] notifier_call_chain+0x1a1/0x3e0 [ 81.319291][ T5084] unregister_netdevice_many_notify+0xd9b/0x16e0 [ 81.326129][ T5084] unregister_netdevice_queue+0x303/0x370 [ 81.332381][ T5084] _cfg80211_unregister_wdev+0x162/0x560 [ 81.338522][ T5084] ieee80211_if_remove+0x25d/0x3a0 [ 81.344162][ T5084] ieee80211_del_iface+0x19/0x30 [ 81.349615][ T5084] cfg80211_remove_virtual_intf+0x241/0x410 [ 81.356024][ T5084] genl_rcv_msg+0xb16/0xec0 [ 81.361045][ T5084] netlink_rcv_skb+0x1e5/0x430 [ 81.366317][ T5084] genl_rcv+0x28/0x40 [ 81.370813][ T5084] netlink_unicast+0x7ec/0x980 [ 81.376092][ T5084] netlink_sendmsg+0x8e1/0xcb0 [ 81.381363][ T5084] __sock_sendmsg+0x223/0x270 [ 81.386554][ T5084] ____sys_sendmsg+0x525/0x7d0 [ 81.391859][ T5084] __sys_sendmsg+0x2b0/0x3a0 [ 81.396957][ T5084] do_syscall_64+0xf5/0x240 [ 81.401987][ T5084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.408435][ T5084] [ 81.408435][ T5084] other info that might help us debug this: [ 81.408435][ T5084] [ 81.418650][ T5084] Possible unsafe locking scenario: [ 81.418650][ T5084] [ 81.426080][ T5084] CPU0 CPU1 [ 81.431428][ T5084] ---- ---- [ 81.436777][ T5084] lock(&rdev->wiphy.mtx); [ 81.441270][ T5084] lock(team->team_lock_key); [ 81.448548][ T5084] lock(&rdev->wiphy.mtx); [ 81.455588][ T5084] lock(team->team_lock_key); [ 81.460354][ T5084] [ 81.460354][ T5084] *** DEADLOCK *** [ 81.460354][ T5084] [ 81.468491][ T5084] 3 locks held by syz-executor405/5084: [ 81.474025][ T5084] #0: ffffffff8f60b8b0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 [ 81.482226][ T5084] #1: ffffffff8f5a6ac8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 [ 81.491661][ T5084] #2: ffff888029cc0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 81.501974][ T5084] [ 81.501974][ T5084] stack backtrace: [ 81.508005][ T5084] CPU: 1 PID: 5084 Comm: syz-executor405 Not tainted 6.9.0-syzkaller-00967-gcd97950cbcab #0 [ 81.518066][ T5084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 81.528138][ T5084] Call Trace: [ 81.531506][ T5084] [ 81.534432][ T5084] dump_stack_lvl+0x241/0x360 [ 81.539118][ T5084] ? __pfx_dump_stack_lvl+0x10/0x10 [ 81.544409][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.550039][ T5084] ? print_circular_bug+0x130/0x1a0 [ 81.555248][ T5084] check_noncircular+0x36a/0x4a0 [ 81.560194][ T5084] ? __pfx_check_noncircular+0x10/0x10 [ 81.565663][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.571414][ T5084] ? lockdep_lock+0x123/0x2b0 [ 81.576096][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.581736][ T5084] ? lockdep_unlock+0x16a/0x300 [ 81.586581][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.592215][ T5084] ? _find_first_zero_bit+0xd4/0x100 [ 81.597505][ T5084] validate_chain+0x18cb/0x58e0 [ 81.602368][ T5084] ? __pfx_validate_chain+0x10/0x10 [ 81.607567][ T5084] ? __pfx_validate_chain+0x10/0x10 [ 81.612765][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.618484][ T5084] ? stack_trace_save+0x118/0x1d0 [ 81.623511][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.629143][ T5084] ? __pfx_stack_trace_save+0x10/0x10 [ 81.634525][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.640169][ T5084] ? lockdep_unlock+0x16a/0x300 [ 81.645025][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.650658][ T5084] ? mark_lock+0x9a/0x350 [ 81.654993][ T5084] __lock_acquire+0x1346/0x1fd0 [ 81.659848][ T5084] lock_acquire+0x1ed/0x550 [ 81.664343][ T5084] ? team_del_slave+0x32/0x1d0 [ 81.669495][ T5084] ? __pfx_lock_acquire+0x10/0x10 [ 81.674516][ T5084] ? __pfx___might_resched+0x10/0x10 [ 81.679799][ T5084] ? __pfx___might_resched+0x10/0x10 [ 81.685165][ T5084] ? xsk_notifier+0x218/0x230 [ 81.689844][ T5084] __mutex_lock+0x136/0xd70 [ 81.694342][ T5084] ? team_del_slave+0x32/0x1d0 [ 81.699101][ T5084] ? trace_contention_end+0x3c/0x120 [ 81.704387][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.710018][ T5084] ? __mutex_lock+0x2ef/0xd70 [ 81.714688][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.720316][ T5084] ? bond_netdev_event+0xdd/0xf20 [ 81.725331][ T5084] ? team_del_slave+0x32/0x1d0 [ 81.730085][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.735726][ T5084] ? __pfx___mutex_lock+0x10/0x10 [ 81.740759][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.746400][ T5084] ? __asan_memset+0x23/0x50 [ 81.750993][ T5084] team_del_slave+0x32/0x1d0 [ 81.755589][ T5084] team_device_event+0x200/0x5b0 [ 81.760527][ T5084] ? notifier_call_chain+0x162/0x3e0 [ 81.765809][ T5084] notifier_call_chain+0x1a1/0x3e0 [ 81.770916][ T5084] unregister_netdevice_many_notify+0xd9b/0x16e0 [ 81.777246][ T5084] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 81.782965][ T5084] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 81.789727][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.795359][ T5084] unregister_netdevice_queue+0x303/0x370 [ 81.801070][ T5084] ? __pfx_up_write+0x10/0x10 [ 81.805746][ T5084] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 81.811985][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.817620][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.823248][ T5084] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 81.828965][ T5084] _cfg80211_unregister_wdev+0x162/0x560 [ 81.834593][ T5084] ieee80211_if_remove+0x25d/0x3a0 [ 81.839693][ T5084] ieee80211_del_iface+0x19/0x30 [ 81.844630][ T5084] cfg80211_remove_virtual_intf+0x241/0x410 [ 81.850524][ T5084] genl_rcv_msg+0xb16/0xec0 [ 81.855031][ T5084] ? mark_lock+0x9a/0x350 [ 81.859357][ T5084] ? __pfx_genl_rcv_msg+0x10/0x10 [ 81.864388][ T5084] ? __pfx_lock_acquire+0x10/0x10 [ 81.869402][ T5084] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 81.874761][ T5084] ? __pfx_nl80211_del_interface+0x10/0x10 [ 81.880563][ T5084] ? __pfx_nl80211_post_doit+0x10/0x10 [ 81.886014][ T5084] ? __pfx___might_resched+0x10/0x10 [ 81.891298][ T5084] netlink_rcv_skb+0x1e5/0x430 [ 81.896056][ T5084] ? __pfx_genl_rcv_msg+0x10/0x10 [ 81.901077][ T5084] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 81.906377][ T5084] ? __netlink_deliver_tap+0x77e/0x7c0 [ 81.911848][ T5084] genl_rcv+0x28/0x40 [ 81.915827][ T5084] netlink_unicast+0x7ec/0x980 [ 81.920598][ T5084] ? __pfx_netlink_unicast+0x10/0x10 [ 81.925882][ T5084] ? __virt_addr_valid+0x44e/0x520 [ 81.930993][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.936624][ T5084] ? __phys_addr_symbol+0x2f/0x70 [ 81.941657][ T5084] ? __check_object_size+0x4bc/0xa00 [ 81.946950][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.952591][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.958224][ T5084] netlink_sendmsg+0x8e1/0xcb0 [ 81.962988][ T5084] ? __pfx_netlink_sendmsg+0x10/0x10 [ 81.968264][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.973893][ T5084] ? aa_sock_msg_perm+0x91/0x160 [ 81.978819][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.984445][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 81.990072][ T5084] ? security_socket_sendmsg+0x87/0xb0 [ 81.995527][ T5084] ? __pfx_netlink_sendmsg+0x10/0x10 [ 82.000799][ T5084] __sock_sendmsg+0x223/0x270 [ 82.005475][ T5084] ____sys_sendmsg+0x525/0x7d0 [ 82.010230][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 82.015863][ T5084] ? __pfx_____sys_sendmsg+0x10/0x10 [ 82.021139][ T5084] ? do_raw_spin_lock+0x14f/0x370 [ 82.026161][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 82.031795][ T5084] __sys_sendmsg+0x2b0/0x3a0 [ 82.036375][ T5084] ? __pfx___sys_sendmsg+0x10/0x10 [ 82.041481][ T5084] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 82.047805][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 82.053440][ T5084] ? _raw_spin_unlock_irq+0x2e/0x50 [ 82.058648][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 82.064282][ T5084] ? ptrace_notify+0x279/0x380 [ 82.069041][ T5084] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 82.075360][ T5084] ? do_syscall_64+0x102/0x240 [ 82.080124][ T5084] ? srso_alias_return_thunk+0x5/0xfbef5 [ 82.085756][ T5084] do_syscall_64+0xf5/0x240 [ 82.090263][ T5084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.096237][ T5084] RIP: 0033:0x7f182d01be39 [ 82.100640][ T5084] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 82.120247][ T5084] RSP: 002b:00007ffc8692bf78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 82.128658][ T5084] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f182d01be39 [ 82.136620][ T5084] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000007 [ 82.144588][ T5084] RBP: 00007f182d09b460 R08: 0000000000000000 R09: 00007ffc8692bfc0 [ 82.152554][ T5084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 82.160514][ T5084] R13: 0000000000000031 R14: 0000000000000047 R15: 0000000000050012 [ 82.168480][ T5084] [ 82.198803][ T5084] team0: Port device wlan1 removed [pid 5084] sendmsg(7, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x1c\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x08\x00\x03\x00\x47\x00\x00\x00", iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5084] exit_group(1) = ? [pid 5084] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5084, si_uid=0, si_status=1, si_utime=0, si_stime=151 /* 1.51 s */} --- exit_group(0) = ? +++ exited with 0 +++