last executing test programs: 1.304080552s ago: executing program 1 (id=2): socket$inet6(0xa, 0x1, 0x0) 1.285500701s ago: executing program 0 (id=1): socket$can_raw(0x1d, 0x3, 0x1) 1.220926108s ago: executing program 3 (id=4): unlink(&(0x7f0000000000)) 887.622442ms ago: executing program 4 (id=5): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 713.03438ms ago: executing program 1 (id=6): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 501.494856ms ago: executing program 0 (id=8): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 432.535871ms ago: executing program 2 (id=12): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x1, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x1, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x1, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xb, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xb, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xb, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xb, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x15, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x15, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x15, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x15, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x1f, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x1f, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x1f, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x1f, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x29, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x29, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x29, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x29, 0x800) 357.940128ms ago: executing program 2 (id=14): syz_open_dev$usbfs(&(0x7f0000000040), 0x3, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x3, 0x1) syz_open_dev$usbfs(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x3, 0x800) syz_open_dev$usbfs(&(0x7f0000000140), 0xd, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0xd, 0x1) syz_open_dev$usbfs(&(0x7f00000001c0), 0xd, 0x2) syz_open_dev$usbfs(&(0x7f0000000200), 0xd, 0x800) syz_open_dev$usbfs(&(0x7f0000000240), 0x17, 0x0) syz_open_dev$usbfs(&(0x7f0000000280), 0x17, 0x1) syz_open_dev$usbfs(&(0x7f00000002c0), 0x17, 0x2) syz_open_dev$usbfs(&(0x7f0000000300), 0x17, 0x800) syz_open_dev$usbfs(&(0x7f0000000340), 0x21, 0x0) syz_open_dev$usbfs(&(0x7f0000000380), 0x21, 0x1) syz_open_dev$usbfs(&(0x7f00000003c0), 0x21, 0x2) syz_open_dev$usbfs(&(0x7f0000000400), 0x21, 0x800) syz_open_dev$usbfs(&(0x7f0000000440), 0x2b, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x2b, 0x1) syz_open_dev$usbfs(&(0x7f00000004c0), 0x2b, 0x2) syz_open_dev$usbfs(&(0x7f0000000500), 0x2b, 0x800) 340.532548ms ago: executing program 2 (id=15): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x2, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x2, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x2, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xc, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xc, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xc, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xc, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x16, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x16, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x16, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x16, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x20, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x20, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x20, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x20, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2a, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2a, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2a, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2a, 0x800) 315.428159ms ago: executing program 2 (id=16): syz_open_dev$usbfs(&(0x7f0000000040), 0x4, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x4, 0x1) syz_open_dev$usbfs(&(0x7f00000000c0), 0x4, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x4, 0x800) syz_open_dev$usbfs(&(0x7f0000000140), 0xe, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0xe, 0x1) syz_open_dev$usbfs(&(0x7f00000001c0), 0xe, 0x2) syz_open_dev$usbfs(&(0x7f0000000200), 0xe, 0x800) syz_open_dev$usbfs(&(0x7f0000000240), 0x18, 0x0) syz_open_dev$usbfs(&(0x7f0000000280), 0x18, 0x1) syz_open_dev$usbfs(&(0x7f00000002c0), 0x18, 0x2) syz_open_dev$usbfs(&(0x7f0000000300), 0x18, 0x800) syz_open_dev$usbfs(&(0x7f0000000340), 0x22, 0x0) syz_open_dev$usbfs(&(0x7f0000000380), 0x22, 0x1) syz_open_dev$usbfs(&(0x7f00000003c0), 0x22, 0x2) syz_open_dev$usbfs(&(0x7f0000000400), 0x22, 0x800) syz_open_dev$usbfs(&(0x7f0000000440), 0x2c, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x2c, 0x1) syz_open_dev$usbfs(&(0x7f00000004c0), 0x2c, 0x2) syz_open_dev$usbfs(&(0x7f0000000500), 0x2c, 0x800) 251.852273ms ago: executing program 2 (id=17): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x3, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x3, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x3, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xd, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xd, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xd, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xd, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x17, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x17, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x17, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x17, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x21, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x21, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x21, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x21, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2b, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2b, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2b, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2b, 0x800) 251.767407ms ago: executing program 4 (id=10): lchown(&(0x7f0000000000), 0x0, 0x0) 250.543009ms ago: executing program 2 (id=18): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x4, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x4, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x4, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x4, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xe, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xe, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xe, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xe, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x18, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x18, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x18, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x18, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x22, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x22, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x22, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x22, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2c, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2c, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2c, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2c, 0x800) 129.116272ms ago: executing program 1 (id=11): syz_open_dev$sndpcmc(&(0x7f0000000040), 0x1, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000080), 0x1, 0x1) syz_open_dev$sndpcmc(&(0x7f00000000c0), 0x1, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000100), 0x1, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000140), 0xb, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000180), 0xb, 0x1) syz_open_dev$sndpcmc(&(0x7f00000001c0), 0xb, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000200), 0xb, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000240), 0x15, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000280), 0x15, 0x1) syz_open_dev$sndpcmc(&(0x7f00000002c0), 0x15, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000300), 0x15, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000340), 0x1f, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000380), 0x1f, 0x1) syz_open_dev$sndpcmc(&(0x7f00000003c0), 0x1f, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000400), 0x1f, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000440), 0x29, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000480), 0x29, 0x1) syz_open_dev$sndpcmc(&(0x7f00000004c0), 0x29, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000500), 0x29, 0x800) 0s ago: executing program 0 (id=13): syz_open_dev$sndmidi(&(0x7f0000000040), 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f0000000080), 0x1, 0x1) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x1, 0x2) syz_open_dev$sndmidi(&(0x7f0000000100), 0x1, 0x800) syz_open_dev$sndmidi(&(0x7f0000000140), 0xb, 0x0) syz_open_dev$sndmidi(&(0x7f0000000180), 0xb, 0x1) syz_open_dev$sndmidi(&(0x7f00000001c0), 0xb, 0x2) syz_open_dev$sndmidi(&(0x7f0000000200), 0xb, 0x800) syz_open_dev$sndmidi(&(0x7f0000000240), 0x15, 0x0) syz_open_dev$sndmidi(&(0x7f0000000280), 0x15, 0x1) syz_open_dev$sndmidi(&(0x7f00000002c0), 0x15, 0x2) syz_open_dev$sndmidi(&(0x7f0000000300), 0x15, 0x800) syz_open_dev$sndmidi(&(0x7f0000000340), 0x1f, 0x0) syz_open_dev$sndmidi(&(0x7f0000000380), 0x1f, 0x1) syz_open_dev$sndmidi(&(0x7f00000003c0), 0x1f, 0x2) syz_open_dev$sndmidi(&(0x7f0000000400), 0x1f, 0x800) syz_open_dev$sndmidi(&(0x7f0000000440), 0x29, 0x0) syz_open_dev$sndmidi(&(0x7f0000000480), 0x29, 0x1) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x29, 0x2) syz_open_dev$sndmidi(&(0x7f0000000500), 0x29, 0x800) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.135' (ED25519) to the list of known hosts. [ 44.265695][ T29] audit: type=1400 audit(1737810761.963:88): avc: denied { mounton } for pid=5803 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 44.268694][ T5803] cgroup: Unknown subsys name 'net' [ 44.288420][ T29] audit: type=1400 audit(1737810761.963:89): avc: denied { mount } for pid=5803 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 44.317194][ T29] audit: type=1400 audit(1737810762.013:90): avc: denied { unmount } for pid=5803 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 44.482022][ T5803] cgroup: Unknown subsys name 'cpuset' [ 44.489229][ T5803] cgroup: Unknown subsys name 'rlimit' [ 44.611408][ T29] audit: type=1400 audit(1737810762.313:91): avc: denied { setattr } for pid=5803 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 44.640726][ T29] audit: type=1400 audit(1737810762.313:92): avc: denied { create } for pid=5803 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 44.661738][ T29] audit: type=1400 audit(1737810762.313:93): avc: denied { write } for pid=5803 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 44.682361][ T29] audit: type=1400 audit(1737810762.313:94): avc: denied { read } for pid=5803 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 44.702779][ T29] audit: type=1400 audit(1737810762.313:95): avc: denied { mounton } for pid=5803 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 44.727708][ T29] audit: type=1400 audit(1737810762.313:96): avc: denied { mount } for pid=5803 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 44.729431][ T5805] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 44.751074][ T29] audit: type=1400 audit(1737810762.343:97): avc: denied { read } for pid=5485 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 45.601387][ T5803] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.433996][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 47.452022][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 47.463407][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 47.583902][ T80] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 47.617568][ T80] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 47.646192][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 47.948941][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.957908][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.967876][ T5833] bridge_slave_0: entered allmulticast mode [ 47.986235][ T5833] bridge_slave_0: entered promiscuous mode [ 48.015338][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.031064][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.038169][ T5833] bridge_slave_1: entered allmulticast mode [ 48.046089][ T5833] bridge_slave_1: entered promiscuous mode [ 48.188766][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.205362][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.237992][ T5833] team0: Port device team_slave_0 added [ 48.246292][ T5833] team0: Port device team_slave_1 added [ 48.289456][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.296914][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 48.323213][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.336886][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.343995][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 48.369954][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.427554][ T5833] hsr_slave_0: entered promiscuous mode [ 48.434551][ T5833] hsr_slave_1: entered promiscuous mode [ 48.568509][ T5833] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.578453][ T5833] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.590425][ T5833] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.606630][ T5833] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.633991][ T1159] [ 48.636326][ T1159] ====================================================== [ 48.643335][ T1159] WARNING: possible circular locking dependency detected [ 48.650342][ T1159] 6.13.0-syzkaller-07078-gb46c89c08f41 #0 Not tainted [ 48.657090][ T1159] ------------------------------------------------------ [ 48.658284][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.664088][ T1159] kworker/u8:6/1159 is trying to acquire lock: [ 48.664099][ T1159] ffffffff8fef5028 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1a51/0x21a0 [ 48.664149][ T1159] [ 48.664149][ T1159] but task is already holding lock: [ 48.664153][ T1159] ffff88806ab68768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720 [ 48.664194][ T1159] [ 48.664194][ T1159] which lock already depends on the new lock. [ 48.664194][ T1159] [ 48.664200][ T1159] [ 48.664200][ T1159] the existing dependency chain (in reverse order) is: [ 48.664205][ T1159] [ 48.664205][ T1159] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 48.664228][ T1159] __mutex_lock+0x19b/0xb10 [ 48.675975][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.676901][ T1159] wiphy_register+0x1c9c/0x2860 [ 48.690665][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.694605][ T1159] ieee80211_register_hw+0x2455/0x4060 [ 48.704847][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.715174][ T1159] mac80211_hwsim_new_radio+0x304e/0x54d0 [ 48.715192][ T1159] init_mac80211_hwsim+0x432/0x8c0 [ 48.780652][ T1159] do_one_initcall+0x128/0x700 [ 48.785916][ T1159] kernel_init_freeable+0x5c7/0x900 [ 48.791623][ T1159] kernel_init+0x1c/0x2b0 [ 48.796453][ T1159] ret_from_fork+0x45/0x80 [ 48.801375][ T1159] ret_from_fork_asm+0x1a/0x30 [ 48.806650][ T1159] [ 48.806650][ T1159] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 48.813839][ T1159] __lock_acquire+0x249e/0x3c40 [ 48.819193][ T1159] lock_acquire.part.0+0x11b/0x380 [ 48.824809][ T1159] __mutex_lock+0x19b/0xb10 [ 48.829819][ T1159] unregister_netdevice_many_notify+0x1a51/0x21a0 [ 48.836734][ T1159] unregister_netdevice_queue+0x307/0x3f0 [ 48.842952][ T1159] _cfg80211_unregister_wdev+0x64b/0x830 [ 48.849093][ T1159] ieee80211_remove_interfaces+0x34f/0x720 [ 48.855403][ T1159] ieee80211_unregister_hw+0x55/0x3a0 [ 48.861279][ T1159] hwsim_exit_net+0x3ad/0x7d0 [ 48.866462][ T1159] ops_exit_list+0xb0/0x180 [ 48.871467][ T1159] cleanup_net+0x5c6/0xbf0 [ 48.876385][ T1159] process_one_work+0x9c5/0x1ba0 [ 48.881826][ T1159] worker_thread+0x6c8/0xf00 [ 48.886920][ T1159] kthread+0x3af/0x750 [ 48.891491][ T1159] ret_from_fork+0x45/0x80 [ 48.896411][ T1159] ret_from_fork_asm+0x1a/0x30 [ 48.901674][ T1159] [ 48.901674][ T1159] other info that might help us debug this: [ 48.901674][ T1159] [ 48.911878][ T1159] Possible unsafe locking scenario: [ 48.911878][ T1159] [ 48.919301][ T1159] CPU0 CPU1 [ 48.924644][ T1159] ---- ---- [ 48.929983][ T1159] lock(&rdev->wiphy.mtx); [ 48.934468][ T1159] lock(rtnl_mutex); [ 48.940947][ T1159] lock(&rdev->wiphy.mtx); [ 48.947958][ T1159] lock(rtnl_mutex); [ 48.951918][ T1159] [ 48.951918][ T1159] *** DEADLOCK *** [ 48.951918][ T1159] [ 48.960035][ T1159] 4 locks held by kworker/u8:6/1159: [ 48.965292][ T1159] #0: ffff88801beeb148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 [ 48.975621][ T1159] #1: ffffc90004037d18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 [ 48.985515][ T1159] #2: ffffffff8fedf410 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xbf0 [ 48.994799][ T1159] #3: ffff88806ab68768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf1/0x720 [ 49.005477][ T1159] [ 49.005477][ T1159] stack backtrace: [ 49.011346][ T1159] CPU: 1 UID: 0 PID: 1159 Comm: kworker/u8:6 Not tainted 6.13.0-syzkaller-07078-gb46c89c08f41 #0 [ 49.011361][ T1159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 49.011371][ T1159] Workqueue: netns cleanup_net [ 49.011384][ T1159] Call Trace: [ 49.011389][ T1159] [ 49.011394][ T1159] dump_stack_lvl+0x116/0x1f0 [ 49.011413][ T1159] print_circular_bug+0x490/0x760 [ 49.011431][ T1159] check_noncircular+0x31a/0x400 [ 49.011448][ T1159] ? __pfx_check_noncircular+0x10/0x10 [ 49.011466][ T1159] ? lockdep_lock+0xc6/0x200 [ 49.011479][ T1159] ? __pfx_lockdep_lock+0x10/0x10 [ 49.011492][ T1159] ? __pfx_lock_release+0x10/0x10 [ 49.011510][ T1159] __lock_acquire+0x249e/0x3c40 [ 49.011529][ T1159] ? __pfx___lock_acquire+0x10/0x10 [ 49.011546][ T1159] ? synchronize_rcu_expedited+0x424/0x450 [ 49.011565][ T1159] ? __pfx_lock_release+0x10/0x10 [ 49.011582][ T1159] lock_acquire.part.0+0x11b/0x380 [ 49.011600][ T1159] ? unregister_netdevice_many_notify+0x1a51/0x21a0 [ 49.011615][ T1159] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 49.011633][ T1159] ? rcu_is_watching+0x12/0xc0 [ 49.011646][ T1159] ? trace_lock_acquire+0x14e/0x1f0 [ 49.011660][ T1159] ? unregister_netdevice_many_notify+0x1a51/0x21a0 [ 49.011674][ T1159] ? lock_acquire+0x2f/0xb0 [ 49.011690][ T1159] ? unregister_netdevice_many_notify+0x1a51/0x21a0 [ 49.011705][ T1159] __mutex_lock+0x19b/0xb10 [ 49.011723][ T1159] ? unregister_netdevice_many_notify+0x1a51/0x21a0 [ 49.011737][ T1159] ? unregister_netdevice_many_notify+0x1a51/0x21a0 [ 49.011752][ T1159] ? __pfx___mutex_lock+0x10/0x10 [ 49.011771][ T1159] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 49.011789][ T1159] ? __pfx___might_resched+0x10/0x10 [ 49.011808][ T1159] ? unregister_netdevice_many_notify+0x959/0x21a0 [ 49.011823][ T1159] ? unregister_netdevice_many_notify+0x1a51/0x21a0 [ 49.011837][ T1159] unregister_netdevice_many_notify+0x1a51/0x21a0 [ 49.011853][ T1159] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 49.011868][ T1159] ? find_held_lock+0x2d/0x110 [ 49.011881][ T1159] ? kernfs_remove_by_name_ns+0xc4/0x130 [ 49.011894][ T1159] ? __pfx_lock_release+0x10/0x10 [ 49.011911][ T1159] ? __call_rcu_common.constprop.0+0x3ea/0x870 [ 49.011931][ T1159] unregister_netdevice_queue+0x307/0x3f0 [ 49.011945][ T1159] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 49.011960][ T1159] _cfg80211_unregister_wdev+0x64b/0x830 [ 49.011983][ T1159] ieee80211_remove_interfaces+0x34f/0x720 [ 49.011999][ T1159] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 49.012017][ T1159] ieee80211_unregister_hw+0x55/0x3a0 [ 49.012035][ T1159] hwsim_exit_net+0x3ad/0x7d0 [ 49.012054][ T1159] ? __pfx_hwsim_exit_net+0x10/0x10 [ 49.012072][ T1159] ? __pfx___might_resched+0x10/0x10 [ 49.012090][ T1159] ? ip_vs_sync_net_cleanup+0x72/0xb0 [ 49.012108][ T1159] ? __ip_vs_dev_cleanup_batch+0xb1/0x290 [ 49.012133][ T1159] ? __pfx_hwsim_exit_net+0x10/0x10 [ 49.012151][ T1159] ops_exit_list+0xb0/0x180 [ 49.012163][ T1159] cleanup_net+0x5c6/0xbf0 [ 49.012177][ T1159] ? __pfx_cleanup_net+0x10/0x10 [ 49.012191][ T1159] ? lock_acquire+0x2f/0xb0 [ 49.012207][ T1159] ? process_one_work+0x921/0x1ba0 [ 49.012224][ T1159] process_one_work+0x9c5/0x1ba0 [ 49.012242][ T1159] ? __pfx_netdevice_event_work_handler+0x10/0x10 [ 49.012262][ T1159] ? __pfx_process_one_work+0x10/0x10 [ 49.012278][ T1159] ? rcu_is_watching+0x12/0xc0 [ 49.012292][ T1159] ? assign_work+0x1a0/0x250 [ 49.012307][ T1159] worker_thread+0x6c8/0xf00 [ 49.012325][ T1159] ? __kthread_parkme+0x148/0x220 [ 49.012337][ T1159] ? __pfx_worker_thread+0x10/0x10 [ 49.012353][ T1159] kthread+0x3af/0x750 [ 49.012368][ T1159] ? __pfx_kthread+0x10/0x10 [ 49.012382][ T1159] ? lock_acquire+0x2f/0xb0 [ 49.012400][ T1159] ? __pfx_kthread+0x10/0x10 [ 49.012414][ T1159] ret_from_fork+0x45/0x80 [ 49.012430][ T1159] ? __pfx_kthread+0x10/0x10 [ 49.012445][ T1159] ret_from_fork_asm+0x1a/0x30 [ 49.012460][ T1159] [ 49.018612][ T5833] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 49.400748][ T5833] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.412611][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.419677][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.563336][ T29] kauditd_printk_skb: 27 callbacks suppressed [ 50.563350][ T29] audit: type=1400 audit(1737810768.263:125): avc: denied { search } for pid=5485 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.592173][ T1159] bridge_slave_1: left allmulticast mode [ 50.597819][ T1159] bridge_slave_1: left promiscuous mode [ 50.603559][ T1159] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.611612][ T1159] bridge_slave_0: left allmulticast mode [ 50.617249][ T1159] bridge_slave_0: left promiscuous mode [ 50.623282][ T29] audit: type=1400 audit(1737810768.313:126): avc: denied { read } for pid=5879 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1706 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.625535][ T1159] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.654030][ T29] audit: type=1400 audit(1737810768.313:127): avc: denied { open } for pid=5879 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1706 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.698575][ T29] audit: type=1400 audit(1737810768.313:128): avc: denied { getattr } for pid=5879 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1706 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.736697][ T29] audit: type=1400 audit(1737810768.433:129): avc: denied { write } for pid=5878 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1705 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.763404][ T29] audit: type=1400 audit(1737810768.433:130): avc: denied { add_name } for pid=5878 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.788763][ T29] audit: type=1400 audit(1737810768.463:131): avc: denied { remove_name } for pid=5889 comm="rm" name="resolv.conf.eth1.link" dev="tmpfs" ino=1871 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 50.864829][ T1159] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 50.874287][ T1159] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 50.883212][ T1159] bond0 (unregistering): Released all slaves [ 50.984440][ T1159] hsr_slave_0: left promiscuous mode [ 50.990549][ T1159] hsr_slave_1: left promiscuous mode [ 50.996125][ T1159] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 51.003787][ T1159] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 51.059000][ T1159] team0 (unregistering): Port device team_slave_1 removed [ 51.076675][ T1159] team0 (unregistering): Port device team_slave_0 removed