last executing test programs: 5.45107304s ago: executing program 3 (id=4): connect(0xffffffffffffffff, &(0x7f0000000000), 0x0) 5.403356088s ago: executing program 3 (id=15): setsockopt(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x0) 5.380312076s ago: executing program 3 (id=18): recvfrom(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) 5.331145142s ago: executing program 3 (id=25): bind(0xffffffffffffffff, &(0x7f0000000000), 0x0) 5.267473252s ago: executing program 3 (id=30): pause() 2.455752119s ago: executing program 0 (id=415): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/init_regions', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/init_regions', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/init_regions', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/init_regions', 0x800, 0x0) 2.433854216s ago: executing program 0 (id=418): syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) 2.396821337s ago: executing program 4 (id=422): preadv2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) 2.396238614s ago: executing program 0 (id=423): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load', 0x2, 0x0) 2.39565576s ago: executing program 4 (id=426): getrandom(&(0x7f0000000000), 0x0, 0x0) 2.350971272s ago: executing program 4 (id=427): timer_delete(0x0) 2.350842712s ago: executing program 0 (id=428): sched_getaffinity(0x0, 0x0, &(0x7f0000000000)) 2.350469221s ago: executing program 1 (id=431): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/pmem0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pmem0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pmem0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pmem0', 0x800, 0x0) 2.350340318s ago: executing program 4 (id=432): syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$media(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$media(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$media(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$media(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$media(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$media(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$media(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$media(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$media(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$media(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$media(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$media(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$media(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$media(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$media(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$media(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$media(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$media(&(0x7f0000000500), 0x4, 0x800) 1.944487895s ago: executing program 1 (id=435): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.747061534s ago: executing program 0 (id=434): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.519870514s ago: executing program 1 (id=438): lseek(0xffffffffffffffff, 0x0, 0x0) 1.490086933s ago: executing program 1 (id=441): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce', 0x800, 0x0) 1.45963965s ago: executing program 1 (id=442): geteuid() 924.59305ms ago: executing program 4 (id=437): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 420.514303ms ago: executing program 2 (id=440): getitimer(0x0, &(0x7f0000000000)) 396.395255ms ago: executing program 2 (id=445): socket$nl_xfrm(0x10, 0x3, 0x6) 375.423676ms ago: executing program 2 (id=446): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x1, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x1, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x1, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xb, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xb, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xb, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xb, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x15, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x15, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x15, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x15, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x1f, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x1f, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x1f, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x1f, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x29, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x29, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x29, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x29, 0x800) 336.880553ms ago: executing program 2 (id=447): syz_open_dev$sndhw(&(0x7f0000000040), 0x1, 0x0) syz_open_dev$sndhw(&(0x7f0000000080), 0x1, 0x1) syz_open_dev$sndhw(&(0x7f00000000c0), 0x1, 0x2) syz_open_dev$sndhw(&(0x7f0000000100), 0x1, 0x800) syz_open_dev$sndhw(&(0x7f0000000140), 0xb, 0x0) syz_open_dev$sndhw(&(0x7f0000000180), 0xb, 0x1) syz_open_dev$sndhw(&(0x7f00000001c0), 0xb, 0x2) syz_open_dev$sndhw(&(0x7f0000000200), 0xb, 0x800) syz_open_dev$sndhw(&(0x7f0000000240), 0x15, 0x0) syz_open_dev$sndhw(&(0x7f0000000280), 0x15, 0x1) syz_open_dev$sndhw(&(0x7f00000002c0), 0x15, 0x2) syz_open_dev$sndhw(&(0x7f0000000300), 0x15, 0x800) syz_open_dev$sndhw(&(0x7f0000000340), 0x1f, 0x0) syz_open_dev$sndhw(&(0x7f0000000380), 0x1f, 0x1) syz_open_dev$sndhw(&(0x7f00000003c0), 0x1f, 0x2) syz_open_dev$sndhw(&(0x7f0000000400), 0x1f, 0x800) syz_open_dev$sndhw(&(0x7f0000000440), 0x29, 0x0) syz_open_dev$sndhw(&(0x7f0000000480), 0x29, 0x1) syz_open_dev$sndhw(&(0x7f00000004c0), 0x29, 0x2) syz_open_dev$sndhw(&(0x7f0000000500), 0x29, 0x800) 246.384045ms ago: executing program 2 (id=448): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x2, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x2, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x2, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xc, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xc, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xc, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xc, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x16, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x16, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x16, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x16, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x20, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x20, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x20, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x20, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2a, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2a, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2a, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2a, 0x800) 214.698552ms ago: executing program 1 (id=443): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 213.918048ms ago: executing program 2 (id=449): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x3, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x3, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x3, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xd, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xd, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xd, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xd, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x17, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x17, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x17, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x17, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x21, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x21, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x21, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x21, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2b, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2b, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2b, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2b, 0x800) 3.358082ms ago: executing program 0 (id=439): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=444): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.84' (ED25519) to the list of known hosts. [ 57.283715][ T5808] cgroup: Unknown subsys name 'net' [ 57.390908][ T5808] cgroup: Unknown subsys name 'cpuset' [ 57.399162][ T5808] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 58.722026][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 61.379619][ T5938] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 63.313013][ T6199] mmap: syz.4.367 (6199) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 63.660387][ T6246] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 64.149313][ T6273] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 64.612976][ T1338] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.682232][ T1338] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.794516][ T6305] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.807927][ T6305] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.815983][ T6305] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.824355][ T6305] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.832080][ T6305] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 64.845316][ T6305] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.893336][ T6274] chnl_net:caif_netlink_parms(): no params data found [ 64.955247][ T1103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.987444][ T1103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.984213][ T6274] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.997884][ T6274] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.005977][ T6274] bridge_slave_0: entered allmulticast mode [ 66.016376][ T6274] bridge_slave_0: entered promiscuous mode [ 66.050708][ T6274] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.057965][ T6274] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.065343][ T6274] bridge_slave_1: entered allmulticast mode [ 66.073213][ T6274] bridge_slave_1: entered promiscuous mode [ 66.172958][ T6274] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.211020][ T6274] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.260766][ T6274] team0: Port device team_slave_0 added [ 66.269242][ T6274] team0: Port device team_slave_1 added [ 66.291031][ T6274] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.298168][ T6274] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.324057][ C0] vkms_vblank_simulate: vblank timer overrun [ 66.330703][ T6274] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.343753][ T6274] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.350932][ T6274] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.377896][ T6274] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.423955][ T6274] hsr_slave_0: entered promiscuous mode [ 66.430655][ T6274] hsr_slave_1: entered promiscuous mode [ 66.574411][ T6274] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 66.585689][ T6274] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 66.596708][ T6274] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 66.613735][ T6274] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 66.645413][ T2982] [ 66.647784][ T2982] ====================================================== [ 66.652838][ T6274] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.654788][ T2982] WARNING: possible circular locking dependency detected [ 66.661899][ T6274] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.668786][ T2982] 6.13.0-syzkaller-05252-gbc8198dc7ebc #0 Not tainted [ 66.668796][ T2982] ------------------------------------------------------ [ 66.668802][ T2982] kworker/u8:9/2982 is trying to acquire lock: [ 66.668811][ T2982] ffffffff8fcb1d88 (rtnl_mutex [ 66.676143][ T6274] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.682827][ T2982] ){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 [ 66.689955][ T6274] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.695970][ T2982] [ 66.695970][ T2982] but task is already holding lock: [ 66.730285][ T2982] ffff8880792c0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 [ 66.740666][ T2982] [ 66.740666][ T2982] which lock already depends on the new lock. [ 66.740666][ T2982] [ 66.751061][ T2982] [ 66.751061][ T2982] the existing dependency chain (in reverse order) is: [ 66.760060][ T2982] [ 66.760060][ T2982] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 66.767791][ T2982] lock_acquire+0x1ed/0x550 [ 66.772808][ T2982] __mutex_lock+0x19c/0x1010 [ 66.777906][ T2982] wiphy_register+0x1a49/0x27b0 [ 66.783278][ T2982] ieee80211_register_hw+0x354e/0x4240 [ 66.789252][ T2982] mac80211_hwsim_new_radio+0x2a9f/0x4a90 [ 66.795486][ T2982] init_mac80211_hwsim+0x87a/0xb00 [ 66.801117][ T2982] do_one_initcall+0x248/0x870 [ 66.806392][ T2982] do_initcall_level+0x157/0x210 [ 66.811840][ T2982] do_initcalls+0x3f/0x80 [ 66.816680][ T2982] kernel_init_freeable+0x435/0x5d0 [ 66.822389][ T2982] kernel_init+0x1d/0x2b0 [ 66.827235][ T2982] ret_from_fork+0x4b/0x80 [ 66.832165][ T2982] ret_from_fork_asm+0x1a/0x30 [ 66.837447][ T2982] [ 66.837447][ T2982] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 66.844694][ T2982] validate_chain+0x18ef/0x5920 [ 66.850064][ T2982] __lock_acquire+0x1397/0x2100 [ 66.855445][ T2982] lock_acquire+0x1ed/0x550 [ 66.860471][ T2982] __mutex_lock+0x19c/0x1010 [ 66.865666][ T2982] unregister_netdevice_many_notify+0xac2/0x2030 [ 66.872514][ T2982] unregister_netdevice_queue+0x303/0x370 [ 66.878759][ T2982] _cfg80211_unregister_wdev+0x163/0x590 [ 66.884904][ T2982] ieee80211_remove_interfaces+0x4ef/0x700 [ 66.891228][ T2982] ieee80211_unregister_hw+0x5d/0x2c0 [ 66.897107][ T2982] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 66.903161][ T2982] hwsim_exit_net+0x5c1/0x670 [ 66.908346][ T2982] cleanup_net+0x812/0xd60 [ 66.913272][ T2982] process_scheduled_works+0xa66/0x1840 [ 66.919525][ T2982] worker_thread+0x870/0xd30 [ 66.924633][ T2982] kthread+0x7a9/0x920 [ 66.929234][ T2982] ret_from_fork+0x4b/0x80 [ 66.934166][ T2982] ret_from_fork_asm+0x1a/0x30 [ 66.939451][ T2982] [ 66.939451][ T2982] other info that might help us debug this: [ 66.939451][ T2982] [ 66.949667][ T2982] Possible unsafe locking scenario: [ 66.949667][ T2982] [ 66.957103][ T2982] CPU0 CPU1 [ 66.962468][ T2982] ---- ---- [ 66.967917][ T2982] lock(&rdev->wiphy.mtx); [ 66.972511][ T2982] lock(rtnl_mutex); [ 66.979012][ T2982] lock(&rdev->wiphy.mtx); [ 66.986030][ T2982] lock(rtnl_mutex); [ 66.990033][ T2982] [ 66.990033][ T2982] *** DEADLOCK *** [ 66.990033][ T2982] [ 66.998684][ T2982] 4 locks held by kworker/u8:9/2982: [ 67.003960][ T2982] #0: ffff88801baf3148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 [ 67.014920][ T2982] #1: ffffc9000c867c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 [ 67.025444][ T2982] #2: ffffffff8fca57d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 [ 67.034831][ T2982] #3: ffff8880792c0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 67.045713][ T2982] [ 67.045713][ T2982] stack backtrace: [ 67.051612][ T2982] CPU: 1 UID: 0 PID: 2982 Comm: kworker/u8:9 Not tainted 6.13.0-syzkaller-05252-gbc8198dc7ebc #0 [ 67.051630][ T2982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 67.051639][ T2982] Workqueue: netns cleanup_net [ 67.051658][ T2982] Call Trace: [ 67.051666][ T2982] [ 67.051672][ T2982] dump_stack_lvl+0x241/0x360 [ 67.051692][ T2982] ? __pfx_dump_stack_lvl+0x10/0x10 [ 67.051708][ T2982] ? __pfx__printk+0x10/0x10 [ 67.051726][ T2982] print_circular_bug+0x13a/0x1b0 [ 67.051746][ T2982] check_noncircular+0x36a/0x4a0 [ 67.051763][ T2982] ? __pfx_check_noncircular+0x10/0x10 [ 67.051779][ T2982] ? lockdep_lock+0x123/0x2b0 [ 67.051792][ T2982] ? rcu_read_lock_sched_held+0x8d/0x130 [ 67.051811][ T2982] validate_chain+0x18ef/0x5920 [ 67.051833][ T2982] ? __pfx_validate_chain+0x10/0x10 [ 67.051852][ T2982] ? mark_lock+0x9a/0x360 [ 67.051866][ T2982] ? __lock_acquire+0x1397/0x2100 [ 67.051885][ T2982] ? mark_lock+0x9a/0x360 [ 67.051899][ T2982] __lock_acquire+0x1397/0x2100 [ 67.051917][ T2982] lock_acquire+0x1ed/0x550 [ 67.051929][ T2982] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 67.051949][ T2982] ? __pfx_lock_acquire+0x10/0x10 [ 67.051963][ T2982] ? __pfx___might_resched+0x10/0x10 [ 67.051982][ T2982] ? finish_wait+0xd4/0x1e0 [ 67.051997][ T2982] __mutex_lock+0x19c/0x1010 [ 67.052010][ T2982] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 67.052030][ T2982] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 67.052047][ T2982] ? __pfx___mutex_lock+0x10/0x10 [ 67.052060][ T2982] ? __pfx___might_resched+0x10/0x10 [ 67.052078][ T2982] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 67.052096][ T2982] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 67.052113][ T2982] unregister_netdevice_many_notify+0xac2/0x2030 [ 67.052130][ T2982] ? mark_lock+0x9a/0x360 [ 67.052147][ T2982] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 67.052164][ T2982] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 67.052179][ T2982] ? __pfx_lock_release+0x10/0x10 [ 67.052197][ T2982] unregister_netdevice_queue+0x303/0x370 [ 67.052213][ T2982] ? __pfx_up_write+0x10/0x10 [ 67.052229][ T2982] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 67.052246][ T2982] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 67.052260][ T2982] _cfg80211_unregister_wdev+0x163/0x590 [ 67.052280][ T2982] ieee80211_remove_interfaces+0x4ef/0x700 [ 67.052299][ T2982] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 67.052322][ T2982] ? rcu_is_watching+0x15/0xb0 [ 67.052340][ T2982] ieee80211_unregister_hw+0x5d/0x2c0 [ 67.052355][ T2982] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 67.052374][ T2982] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 67.052393][ T2982] hwsim_exit_net+0x5c1/0x670 [ 67.052408][ T2982] ? __pfx_hwsim_exit_net+0x10/0x10 [ 67.052422][ T2982] ? __ip_vs_dev_cleanup_batch+0x239/0x260 [ 67.052436][ T2982] cleanup_net+0x812/0xd60 [ 67.052450][ T2982] ? __pfx_cleanup_net+0x10/0x10 [ 67.052466][ T2982] ? process_scheduled_works+0x976/0x1840 [ 67.052485][ T2982] process_scheduled_works+0xa66/0x1840 [ 67.052510][ T2982] ? __pfx_process_scheduled_works+0x10/0x10 [ 67.052530][ T2982] ? assign_work+0x364/0x3d0 [ 67.052548][ T2982] worker_thread+0x870/0xd30 [ 67.052562][ T2982] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 67.052580][ T2982] ? __kthread_parkme+0x169/0x1d0 [ 67.052593][ T2982] ? __pfx_worker_thread+0x10/0x10 [ 67.052605][ T2982] kthread+0x7a9/0x920 [ 67.052618][ T2982] ? __pfx_kthread+0x10/0x10 [ 67.052631][ T2982] ? __pfx_worker_thread+0x10/0x10 [ 67.052643][ T2982] ? __pfx_kthread+0x10/0x10 [ 67.052655][ T2982] ? __pfx_kthread+0x10/0x10 [ 67.052669][ T2982] ? __pfx_kthread+0x10/0x10 [ 67.052681][ T2982] ? _raw_spin_unlock_irq+0x23/0x50 [ 67.052697][ T2982] ? lockdep_hardirqs_on+0x99/0x150 [ 67.052721][ T2982] ? __pfx_kthread+0x10/0x10 [ 67.052735][ T2982] ret_from_fork+0x4b/0x80 [ 67.052747][ T2982] ? __pfx_kthread+0x10/0x10 [ 67.052760][ T2982] ret_from_fork_asm+0x1a/0x30 [ 67.052782][ T2982] [ 67.440429][ T5134] Bluetooth: hci0: command tx timeout [ 67.467029][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.476430][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.882759][ T2982] bridge_slave_1: left allmulticast mode [ 67.889483][ T2982] bridge_slave_1: left promiscuous mode [ 67.895241][ T2982] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.904539][ T2982] bridge_slave_0: left allmulticast mode [ 67.910289][ T2982] bridge_slave_0: left promiscuous mode [ 67.915984][ T2982] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.080562][ T2982] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 68.090796][ T2982] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 68.100463][ T2982] bond0 (unregistering): Released all slaves [ 68.229121][ T2982] hsr_slave_0: left promiscuous mode [ 68.235130][ T2982] hsr_slave_1: left promiscuous mode [ 68.242552][ T2982] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 68.251042][ T2982] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 68.300943][ T2982] team0 (unregistering): Port device team_slave_1 removed [ 68.314012][ T2982] team0 (unregistering): Port device team_slave_0 removed [ 71.709009][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.715298][ T1295] ieee802154 phy1 wpan1: encryption failed: -22