no interfaces have a carrier [ 55.521044][ T5451] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.544850][ T5451] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.173' (ED25519) to the list of known hosts. 2025/09/15 12:54:34 parsed 1 programs syzkaller login: [ 88.323723][ T5789] cgroup: Unknown subsys name 'net' [ 88.490062][ T5789] cgroup: Unknown subsys name 'rlimit' [ 90.255959][ T5789] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.204848][ T785] cfg80211: failed to load regulatory.db [ 93.881085][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.889623][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.929078][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.937739][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.091589][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 94.099788][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 94.108678][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 94.117682][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 94.131471][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 94.139708][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.144676][ T5871] chnl_net:caif_netlink_parms(): no params data found [ 96.235865][ T5871] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.243341][ T5871] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.250607][ T5871] bridge_slave_0: entered allmulticast mode [ 96.259556][ T5871] bridge_slave_0: entered promiscuous mode [ 96.268866][ T5871] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.277537][ T5871] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.284878][ T5871] bridge_slave_1: entered allmulticast mode [ 96.292640][ T5871] bridge_slave_1: entered promiscuous mode [ 96.328629][ T5871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.340429][ T5871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.374734][ T5871] team0: Port device team_slave_0 added [ 96.384123][ T5871] team0: Port device team_slave_1 added [ 96.415560][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.423185][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.449766][ T5871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.464543][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.471806][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.498522][ T5871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.580158][ T5871] hsr_slave_0: entered promiscuous mode [ 96.587329][ T5871] hsr_slave_1: entered promiscuous mode [ 96.752564][ T5871] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.767186][ T5871] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.790157][ T5871] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.804934][ T5871] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.851551][ T5871] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.859005][ T5871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.867291][ T5871] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.874632][ T5871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.937791][ T2916] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.947149][ T2916] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.989596][ T5871] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.012492][ T5871] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.025804][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.033033][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.052931][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.060091][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.326651][ T5871] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.378300][ T5871] veth0_vlan: entered promiscuous mode [ 97.396867][ T5871] veth1_vlan: entered promiscuous mode [ 97.438645][ T5871] veth0_macvtap: entered promiscuous mode [ 97.450569][ T5871] veth1_macvtap: entered promiscuous mode [ 97.482492][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.500369][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.515387][ T5871] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.526013][ T5871] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.535025][ T5871] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.543871][ T5871] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.713190][ T2916] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/09/15 12:54:47 executed programs: 0 [ 98.239091][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.248524][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.258373][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.267410][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.275931][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 98.285455][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.456377][ T5900] chnl_net:caif_netlink_parms(): no params data found [ 98.537276][ T5900] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.544611][ T5900] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.552015][ T5900] bridge_slave_0: entered allmulticast mode [ 98.559393][ T5900] bridge_slave_0: entered promiscuous mode [ 98.568788][ T5900] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.576771][ T5900] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.584109][ T5900] bridge_slave_1: entered allmulticast mode [ 98.591806][ T5900] bridge_slave_1: entered promiscuous mode [ 98.630478][ T5900] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.643327][ T5900] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.683857][ T5900] team0: Port device team_slave_0 added [ 98.697238][ T5900] team0: Port device team_slave_1 added [ 98.730555][ T5900] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.737766][ T5900] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.764400][ T5900] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.777778][ T5900] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.784932][ T5900] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.810934][ T5900] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.866998][ T5900] hsr_slave_0: entered promiscuous mode [ 98.874155][ T5900] hsr_slave_1: entered promiscuous mode [ 98.880622][ T5900] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 98.890161][ T5900] Cannot create hsr debugfs directory [ 100.015648][ T2916] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.362633][ T51] Bluetooth: hci0: command tx timeout [ 102.441780][ T51] Bluetooth: hci0: command tx timeout [ 102.593300][ T2916] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.668931][ T2916] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.574725][ T2916] hsr_slave_0: left promiscuous mode [ 103.582607][ T2916] hsr_slave_1: left promiscuous mode [ 103.589465][ T2916] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.599728][ T2916] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.610054][ T2916] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.620288][ T2916] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 103.629120][ T2916] bridge_slave_1: left allmulticast mode [ 103.637628][ T2916] bridge_slave_1: left promiscuous mode [ 103.645221][ T2916] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.663334][ T2916] bridge_slave_0: left allmulticast mode [ 103.669069][ T2916] bridge_slave_0: left promiscuous mode [ 103.677861][ T2916] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.716748][ T2916] veth1_macvtap: left promiscuous mode [ 103.723089][ T2916] veth0_macvtap: left promiscuous mode [ 103.728908][ T2916] veth1_vlan: left promiscuous mode [ 103.737567][ T2916] veth0_vlan: left promiscuous mode [ 104.198685][ T2916] team0 (unregistering): Port device team_slave_1 removed [ 104.233677][ T2916] team0 (unregistering): Port device team_slave_0 removed [ 104.268270][ T2916] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 104.307898][ T2916] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 104.533680][ T51] Bluetooth: hci0: command tx timeout [ 104.643535][ T2916] bond0 (unregistering): Released all slaves [ 104.759107][ T5900] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.770438][ T5900] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.780488][ T5900] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.791375][ T5900] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.898593][ T5900] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.936713][ T5900] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.949716][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.956907][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.974884][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.982139][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.223153][ T5900] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.270572][ T5900] veth0_vlan: entered promiscuous mode [ 105.294876][ T5900] veth1_vlan: entered promiscuous mode [ 105.332420][ T5900] veth0_macvtap: entered promiscuous mode [ 105.342375][ T5900] veth1_macvtap: entered promiscuous mode [ 105.374111][ T5900] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.389423][ T5900] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.402643][ T5900] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.415067][ T5900] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.423884][ T5900] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.432791][ T5900] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.509772][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.521992][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/09/15 12:54:54 executed programs: 2 [ 105.566935][ T2900] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.576970][ T2900] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.642823][ T5948] netlink: 'syz.0.17': attribute type 10 has an invalid length. [ 105.676168][ T5948] team0: Port device wlan1 added [ 105.710975][ T5949] netlink: 'syz.0.18': attribute type 10 has an invalid length. [ 105.766867][ T5950] netlink: 'syz.0.19': attribute type 10 has an invalid length. [ 105.829872][ T5951] netlink: 'syz.0.20': attribute type 10 has an invalid length. [ 105.860085][ T5952] netlink: 'syz.0.21': attribute type 10 has an invalid length. [ 105.898203][ T5953] netlink: 'syz.0.22': attribute type 10 has an invalid length. [ 105.926075][ T5954] netlink: 'syz.0.23': attribute type 10 has an invalid length. [ 105.958871][ T5955] netlink: 'syz.0.24': attribute type 10 has an invalid length. [ 105.992895][ T5956] netlink: 'syz.0.25': attribute type 10 has an invalid length. [ 106.031732][ T5957] netlink: 'syz.0.26': attribute type 10 has an invalid length. [ 106.603597][ T51] Bluetooth: hci0: command tx timeout 2025/09/15 12:54:59 executed programs: 199 [ 110.659050][ T6146] validate_nla: 188 callbacks suppressed [ 110.659066][ T6146] netlink: 'syz.0.215': attribute type 10 has an invalid length. [ 110.698336][ T6147] netlink: 'syz.0.216': attribute type 10 has an invalid length. [ 110.735936][ T6148] netlink: 'syz.0.217': attribute type 10 has an invalid length. [ 110.775124][ T6149] netlink: 'syz.0.218': attribute type 10 has an invalid length. [ 110.805868][ T6150] netlink: 'syz.0.219': attribute type 10 has an invalid length. [ 110.834548][ T6151] netlink: 'syz.0.220': attribute type 10 has an invalid length. [ 110.876196][ T6152] netlink: 'syz.0.221': attribute type 10 has an invalid length. [ 110.912636][ T6153] netlink: 'syz.0.222': attribute type 10 has an invalid length. [ 110.940707][ T6154] netlink: 'syz.0.223': attribute type 10 has an invalid length. [ 110.973396][ T6155] netlink: 'syz.0.224': attribute type 10 has an invalid length. [ 115.668966][ T6387] validate_nla: 230 callbacks suppressed [ 115.668988][ T6387] netlink: 'syz.0.455': attribute type 10 has an invalid length. [ 115.700489][ T6388] netlink: 'syz.0.456': attribute type 10 has an invalid length. 2025/09/15 12:55:04 executed programs: 441 [ 115.722939][ T6389] netlink: 'syz.0.457': attribute type 10 has an invalid length. [ 115.747383][ T6390] netlink: 'syz.0.458': attribute type 10 has an invalid length. [ 115.769888][ T6391] netlink: 'syz.0.459': attribute type 10 has an invalid length. [ 115.793865][ T6392] netlink: 'syz.0.460': attribute type 10 has an invalid length. [ 115.816735][ T6393] netlink: 'syz.0.461': attribute type 10 has an invalid length. [ 115.839012][ T6394] netlink: 'syz.0.462': attribute type 10 has an invalid length. [ 115.864942][ T6395] netlink: 'syz.0.463': attribute type 10 has an invalid length. [ 115.889287][ T6396] netlink: 'syz.0.464': attribute type 10 has an invalid length. [ 119.036976][ T5101] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 119.048212][ T5101] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 119.058289][ T5101] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 119.067749][ T5101] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 119.087747][ T5101] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 119.095655][ T5101] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 119.287868][ T42] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.308105][ T6554] chnl_net:caif_netlink_parms(): no params data found [ 119.381172][ T42] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.406564][ T6554] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.413976][ T6554] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.421324][ T6554] bridge_slave_0: entered allmulticast mode [ 119.428382][ T6554] bridge_slave_0: entered promiscuous mode [ 119.446822][ T42] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.462514][ T6554] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.469722][ T6554] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.477342][ T6554] bridge_slave_1: entered allmulticast mode [ 119.484540][ T6554] bridge_slave_1: entered promiscuous mode [ 119.528609][ T42] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.548534][ T6554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 119.562243][ T6554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 119.599893][ T6554] team0: Port device team_slave_0 added [ 119.609277][ T6554] team0: Port device team_slave_1 added [ 119.646396][ T6554] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 119.653763][ T6554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 119.680048][ T6554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 119.693244][ T6554] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 119.700227][ T6554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 119.727883][ T6554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 119.828845][ T6554] hsr_slave_0: entered promiscuous mode [ 119.835657][ T6554] hsr_slave_1: entered promiscuous mode [ 120.537313][ T6554] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 120.547592][ T6554] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 120.560468][ T6554] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 120.582531][ T6554] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 120.638851][ T42] [ 120.641246][ T42] ====================================================== [ 120.648332][ T42] WARNING: possible circular locking dependency detected [ 120.655479][ T42] syzkaller #0 Not tainted [ 120.659921][ T42] ------------------------------------------------------ [ 120.666961][ T42] kworker/u4:2/42 is trying to acquire lock: [ 120.672969][ T42] ffff888062e60d00 (team->team_lock_key#2){+.+.}-{3:3}, at: team_del_slave+0x32/0x1c0 [ 120.682673][ T42] [ 120.682673][ T42] but task is already holding lock: [ 120.690066][ T42] ffff88807bba0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x292/0x680 [ 120.700479][ T42] [ 120.700479][ T42] which lock already depends on the new lock. [ 120.700479][ T42] [ 120.710907][ T42] [ 120.710907][ T42] the existing dependency chain (in reverse order) is: [ 120.719954][ T42] [ 120.719954][ T42] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 120.727739][ T42] __mutex_lock+0x129/0xcc0 [ 120.732818][ T42] ieee80211_open+0x144/0x200 [ 120.738062][ T42] __dev_open+0x2bc/0x430 [ 120.742973][ T42] dev_open+0xab/0x170 [ 120.747621][ T42] team_add_slave+0xae7/0x2660 [ 120.752949][ T42] do_setlink+0xe14/0x3fb0 [ 120.757926][ T42] rtnl_newlink+0x175b/0x2020 [ 120.763600][ T42] rtnetlink_rcv_msg+0x7c7/0xf10 [ 120.769109][ T42] netlink_rcv_skb+0x216/0x480 [ 120.774432][ T42] netlink_unicast+0x751/0x8d0 [ 120.779754][ T42] netlink_sendmsg+0x8c1/0xbe0 [ 120.785078][ T42] ____sys_sendmsg+0x5bf/0x950 [ 120.790401][ T42] ___sys_sendmsg+0x220/0x290 [ 120.795643][ T42] __se_sys_sendmsg+0x1a5/0x270 [ 120.801065][ T42] do_syscall_64+0x55/0xb0 [ 120.806038][ T42] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 120.812495][ T42] [ 120.812495][ T42] -> #0 (team->team_lock_key#2){+.+.}-{3:3}: [ 120.820713][ T42] __lock_acquire+0x2ddb/0x7c80 [ 120.826127][ T42] lock_acquire+0x197/0x410 [ 120.831193][ T42] __mutex_lock+0x129/0xcc0 [ 120.836265][ T42] team_del_slave+0x32/0x1c0 [ 120.841429][ T42] team_device_event+0x28d/0xa20 [ 120.846977][ T42] notifier_call_chain+0x197/0x390 [ 120.852669][ T42] unregister_netdevice_many_notify+0xf36/0x1810 [ 120.859643][ T42] unregister_netdevice_queue+0x324/0x360 [ 120.865946][ T42] _cfg80211_unregister_wdev+0x16b/0x580 [ 120.872153][ T42] ieee80211_remove_interfaces+0x496/0x680 [ 120.878563][ T42] ieee80211_unregister_hw+0x5d/0x2a0 [ 120.884503][ T42] mac80211_hwsim_del_radio+0x274/0x450 [ 120.890703][ T42] hwsim_exit_net+0x585/0x640 [ 120.895958][ T42] cleanup_net+0x6f4/0xb90 [ 120.900933][ T42] process_scheduled_works+0xa45/0x15b0 [ 120.907041][ T42] worker_thread+0xa55/0xfc0 [ 120.912198][ T42] kthread+0x2fa/0x390 [ 120.916913][ T42] ret_from_fork+0x48/0x80 [ 120.921892][ T42] ret_from_fork_asm+0x11/0x20 [ 120.927229][ T42] [ 120.927229][ T42] other info that might help us debug this: [ 120.927229][ T42] [ 120.937483][ T42] Possible unsafe locking scenario: [ 120.937483][ T42] [ 120.944958][ T42] CPU0 CPU1 [ 120.950347][ T42] ---- ---- [ 120.955742][ T42] lock(&rdev->wiphy.mtx); [ 120.960287][ T42] lock(team->team_lock_key#2); [ 120.967794][ T42] lock(&rdev->wiphy.mtx); [ 120.974853][ T42] lock(team->team_lock_key#2); [ 120.979851][ T42] [ 120.979851][ T42] *** DEADLOCK *** [ 120.979851][ T42] [ 120.988034][ T42] 5 locks held by kworker/u4:2/42: [ 120.993178][ T42] #0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 [ 121.004127][ T42] #1: ffffc90000b2fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 [ 121.014762][ T42] #2: ffffffff8dfafad0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x136/0xb90 [ 121.024226][ T42] #3: ffffffff8dfbc908 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_unregister_hw+0x55/0x2a0 [ 121.034157][ T42] #4: ffff88807bba0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x292/0x680 [ 121.045012][ T42] [ 121.045012][ T42] stack backtrace: [ 121.050922][ T42] CPU: 0 PID: 42 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 121.058300][ T42] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 121.068362][ T42] Workqueue: netns cleanup_net [ 121.073149][ T42] Call Trace: [ 121.076473][ T42] [ 121.079432][ T42] dump_stack_lvl+0x16c/0x230 [ 121.084136][ T42] ? load_image+0x3b0/0x3b0 [ 121.088661][ T42] ? show_regs_print_info+0x20/0x20 [ 121.093979][ T42] ? print_circular_bug+0x12b/0x1a0 [ 121.099189][ T42] check_noncircular+0x2bd/0x3c0 [ 121.104162][ T42] ? print_deadlock_bug+0x5d0/0x5d0 [ 121.109372][ T42] ? lockdep_lock+0xe0/0x220 [ 121.113984][ T42] ? __lock_acquire+0x1334/0x7c80 [ 121.119015][ T42] ? _find_first_zero_bit+0xd3/0x100 [ 121.124459][ T42] __lock_acquire+0x2ddb/0x7c80 [ 121.129326][ T42] ? verify_lock_unused+0x140/0x140 [ 121.134530][ T42] ? verify_lock_unused+0x140/0x140 [ 121.139734][ T42] lock_acquire+0x197/0x410 [ 121.144242][ T42] ? team_del_slave+0x32/0x1c0 [ 121.149022][ T42] ? __might_sleep+0xe0/0xe0 [ 121.153706][ T42] ? read_lock_is_recursive+0x20/0x20 [ 121.159087][ T42] __mutex_lock+0x129/0xcc0 [ 121.163626][ T42] ? team_del_slave+0x32/0x1c0 [ 121.168449][ T42] ? __lock_acquire+0x7c80/0x7c80 [ 121.173506][ T42] ? rcu_is_watching+0x15/0xb0 [ 121.178346][ T42] ? trace_contention_end+0x39/0xe0 [ 121.183569][ T42] ? __mutex_lock+0x304/0xcc0 [ 121.188254][ T42] ? team_del_slave+0x32/0x1c0 [ 121.191510][ T5101] Bluetooth: hci1: command tx timeout [ 121.193012][ T42] ? mutex_lock_nested+0x20/0x20 [ 121.203443][ T42] ? bond_netdev_event+0xe1/0xef0 [ 121.208516][ T42] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 121.214615][ T42] ? bond_ipsec_offload_ok+0x410/0x410 [ 121.220084][ T42] team_del_slave+0x32/0x1c0 [ 121.224674][ T42] team_device_event+0x28d/0xa20 [ 121.229615][ T42] notifier_call_chain+0x197/0x390 [ 121.234735][ T42] unregister_netdevice_many_notify+0xf36/0x1810 [ 121.241069][ T42] ? lock_chain_count+0x20/0x20 [ 121.245930][ T42] ? unregister_netdevice_many+0x20/0x20 [ 121.251638][ T42] ? kernfs_remove_by_name_ns+0x117/0x150 [ 121.257368][ T42] ? __lock_acquire+0x7c80/0x7c80 [ 121.262841][ T42] unregister_netdevice_queue+0x324/0x360 [ 121.268567][ T42] ? list_netdevice+0x730/0x730 [ 121.273425][ T42] ? kernfs_remove_by_name_ns+0x117/0x150 [ 121.279147][ T42] _cfg80211_unregister_wdev+0x16b/0x580 [ 121.284886][ T42] ieee80211_remove_interfaces+0x496/0x680 [ 121.290713][ T42] ? ieee80211_do_stop+0x1db0/0x1db0 [ 121.296014][ T42] ? rcu_is_watching+0x15/0xb0 [ 121.300807][ T42] ieee80211_unregister_hw+0x5d/0x2a0 [ 121.306191][ T42] mac80211_hwsim_del_radio+0x274/0x450 [ 121.311762][ T42] ? rhashtable_remove_fast+0xbf0/0xbf0 [ 121.317312][ T42] hwsim_exit_net+0x585/0x640 [ 121.321993][ T42] ? hwsim_init_net+0x90/0x90 [ 121.326677][ T42] ? __ip_vs_dev_cleanup_batch+0x238/0x250 [ 121.332484][ T42] cleanup_net+0x6f4/0xb90 [ 121.336924][ T42] ? ops_free_list+0x3b0/0x3b0 [ 121.341702][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 121.346922][ T42] ? process_scheduled_works+0x957/0x15b0 [ 121.352654][ T42] ? process_scheduled_works+0x957/0x15b0 [ 121.358477][ T42] process_scheduled_works+0xa45/0x15b0 [ 121.364061][ T42] ? assign_work+0x400/0x400 [ 121.368692][ T42] ? assign_work+0x39e/0x400 [ 121.373292][ T42] worker_thread+0xa55/0xfc0 [ 121.377917][ T42] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 121.383825][ T42] ? _raw_spin_unlock+0x40/0x40 [ 121.388678][ T42] ? _raw_spin_unlock_irqrestore+0x86/0x110 [ 121.394588][ T42] kthread+0x2fa/0x390 [ 121.398664][ T42] ? pr_cont_work+0x560/0x560 [ 121.403352][ T42] ? kthread_blkcg+0xd0/0xd0 [ 121.407959][ T42] ret_from_fork+0x48/0x80 [ 121.412389][ T42] ? kthread_blkcg+0xd0/0xd0 [ 121.416993][ T42] ret_from_fork_asm+0x11/0x20 [ 121.421768][ T42] [ 121.432669][ T42] team0: Port device wlan1 removed [ 121.498294][ T6554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 121.523011][ T6554] 8021q: adding VLAN 0 to HW filter on device team0 [ 121.538841][ T42] hsr_slave_0: left promiscuous mode [ 121.545651][ T42] hsr_slave_1: left promiscuous mode [ 121.552484][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.559880][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 121.568218][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.576286][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 121.584180][ T42] bridge_slave_1: left allmulticast mode [ 121.589831][ T42] bridge_slave_1: left promiscuous mode [ 121.595655][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.604628][ T42] bridge_slave_0: left allmulticast mode [ 121.610284][ T42] bridge_slave_0: left promiscuous mode [ 121.616252][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.627052][ T42] veth1_macvtap: left promiscuous mode [ 121.632681][ T42] veth0_macvtap: left promiscuous mode [ 121.638296][ T42] veth1_vlan: left promiscuous mode [ 121.644408][ T42] veth0_vlan: left promiscuous mode [ 121.845479][ T42] team0 (unregistering): Port device team_slave_1 removed [ 121.869437][ T42] team0 (unregistering): Port device team_slave_0 removed [ 121.898893][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 121.922126][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 122.036800][ T42] bond0 (unregistering): Released all slaves [ 122.104989][ T2900] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.112176][ T2900] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.125490][ T2900] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.132699][ T2900] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.319267][ T6554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.368695][ T6554] veth0_vlan: entered promiscuous mode [ 122.381861][ T6554] veth1_vlan: entered promiscuous mode [ 122.410349][ T6554] veth0_macvtap: entered promiscuous mode [ 122.420988][ T6554] veth1_macvtap: entered promiscuous mode [ 122.437552][ T6554] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.449732][ T6554] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.464417][ T6554] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.473349][ T6554] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.482132][ T6554] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.490848][ T6554] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.522177][ T6554] ieee80211 phy7: Selected rate control algorithm 'minstrel_ht' [ 122.544772][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.546904][ T6554] ieee80211 phy8: Selected rate control algorithm 'minstrel_ht' [ 122.564899][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/09/15 12:55:11 executed programs: 602 [ 122.585880][ T2916] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.594716][ T2916] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.628892][ T6603] validate_nla: 152 callbacks suppressed [ 122.628905][ T6603] netlink: 'syz.0.617': attribute type 10 has an invalid length. [ 122.652880][ T6603] team0: Port device wlan1 added [ 122.676220][ T6604] netlink: 'syz.0.618': attribute type 10 has an invalid length. [ 122.703138][ T6605] netlink: 'syz.0.619': attribute type 10 has an invalid length. [ 122.723677][ T6606] netlink: 'syz.0.620': attribute type 10 has an invalid length. [ 122.742668][ T6607] netlink: 'syz.0.621': attribute type 10 has an invalid length. [ 122.766811][ T6608] netlink: 'syz.0.622': attribute type 10 has an invalid length. [ 122.787506][ T6609] netlink: 'syz.0.623': attribute type 10 has an invalid length. [ 122.808136][ T6610] netlink: 'syz.0.624': attribute type 10 has an invalid length. [ 122.826895][ T6611] netlink: 'syz.0.625': attribute type 10 has an invalid length. [ 122.846587][ T6612] netlink: 'syz.0.626': attribute type 10 has an invalid length. [ 123.253140][ T5101] Bluetooth: hci1: command tx timeout [ 125.321310][ T5101] Bluetooth: hci1: command tx timeout [ 127.401897][ T5101] Bluetooth: hci1: command tx timeout 2025/09/15 12:55:16 executed programs: 890 [ 127.649127][ T6893] validate_nla: 280 callbacks suppressed [ 127.649140][ T6893] netlink: 'syz.0.907': attribute type 10 has an invalid length. [ 127.675053][ T6894] netlink: 'syz.0.908': attribute type 10 has an invalid length. [ 127.693964][ T6895] netlink: 'syz.0.909': attribute type 10 has an invalid length. [ 127.716686][ T6896] netlink: 'syz.0.910': attribute type 10 has an invalid length. [ 127.738169][ T6897] netlink: 'syz.0.911': attribute type 10 has an invalid length. [ 127.756636][ T6898] netlink: 'syz.0.912': attribute type 10 has an invalid length. [ 127.777204][ T6899] netlink: 'syz.0.913': attribute type 10 has an invalid length. [ 127.796122][ T6900] netlink: 'syz.0.914': attribute type 10 has an invalid length. [ 127.815800][ T6901] netlink: 'syz.0.915': attribute type 10 has an invalid length. [ 127.837080][ T6902] netlink: 'syz.0.916': attribute type 10 has an invalid length.