./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2323195947 <...> Warning: Permanently added '10.128.0.126' (ED25519) to the list of known hosts. execve("./syz-executor2323195947", ["./syz-executor2323195947"], 0x7ffd7d923170 /* 10 vars */) = 0 brk(NULL) = 0x5555789ab000 brk(0x5555789abd00) = 0x5555789abd00 arch_prctl(ARCH_SET_FS, 0x5555789ab380) = 0 set_tid_address(0x5555789ab650) = 5067 set_robust_list(0x5555789ab660, 24) = 0 rseq(0x5555789abca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2323195947", 4096) = 28 getrandom("\xae\xc5\xf7\x74\xea\x42\x39\x6f", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555789abd00 brk(0x5555789ccd00) = 0x5555789ccd00 brk(0x5555789cd000) = 0x5555789cd000 mprotect(0x7f24f462c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555789ab650) = 5068 ./strace-static-x86_64: Process 5068 attached [pid 5068] set_robust_list(0x5555789ab660, 24) = 0 [pid 5068] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5068] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5068] setsid() = 1 [pid 5068] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5068] unshare(CLONE_NEWNS) = 0 [pid 5068] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5068] unshare(CLONE_NEWIPC) = 0 [pid 5068] unshare(CLONE_NEWCGROUP) = 0 [pid 5068] unshare(CLONE_NEWUTS) = 0 [pid 5068] unshare(CLONE_SYSVSEM) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "16777216", 8) = 8 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "536870912", 9) = 9 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "8192", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5068] close(3) = 0 [pid 5068] getpid() = 1 [pid 5068] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<team_lock_key){+.+.}-{3:3}, at: team_del_slave+0x32/0x1d0 [ 65.826303][ T5068] [ 65.826303][ T5068] but task is already holding lock: [ 65.833654][ T5068] ffff88807b3f0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 65.843494][ T5068] [ 65.843494][ T5068] which lock already depends on the new lock. [ 65.843494][ T5068] [ 65.853876][ T5068] [ 65.853876][ T5068] the existing dependency chain (in reverse order) is: [ 65.863344][ T5068] [ 65.863344][ T5068] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 65.871065][ T5068] lock_acquire+0x1e4/0x530 [ 65.876077][ T5068] __mutex_lock+0x136/0xd70 [ 65.881084][ T5068] ieee80211_open+0xe7/0x200 [ 65.886193][ T5068] __dev_open+0x2d3/0x450 [ 65.891024][ T5068] dev_open+0xae/0x1b0 [ 65.895593][ T5068] team_add_slave+0x9b3/0x2750 [ 65.900880][ T5068] do_setlink+0xe70/0x41f0 [ 65.905804][ T5068] rtnl_setlink+0x40d/0x5a0 [ 65.910807][ T5068] rtnetlink_rcv_msg+0x89b/0x10d0 [ 65.916336][ T5068] netlink_rcv_skb+0x1e3/0x430 [ 65.921601][ T5068] netlink_unicast+0x7ea/0x980 [ 65.926883][ T5068] netlink_sendmsg+0x8e1/0xcb0 [ 65.932146][ T5068] __sock_sendmsg+0x221/0x270 [ 65.937339][ T5068] ____sys_sendmsg+0x525/0x7d0 [ 65.942605][ T5068] __sys_sendmsg+0x2b0/0x3a0 [ 65.947704][ T5068] do_syscall_64+0xfb/0x240 [ 65.952729][ T5068] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 65.959133][ T5068] [ 65.959133][ T5068] -> #0 (team->team_lock_key){+.+.}-{3:3}: [ 65.968417][ T5068] validate_chain+0x18cb/0x58e0 [ 65.974144][ T5068] __lock_acquire+0x1346/0x1fd0 [ 65.979495][ T5068] lock_acquire+0x1e4/0x530 [ 65.984526][ T5068] __mutex_lock+0x136/0xd70 [ 65.989548][ T5068] team_del_slave+0x32/0x1d0 [ 65.994660][ T5068] team_device_event+0x200/0x5b0 [ 66.000119][ T5068] notifier_call_chain+0x18f/0x3b0 [ 66.005750][ T5068] unregister_netdevice_many_notify+0xd96/0x16d0 [ 66.012594][ T5068] unregister_netdevice_queue+0x303/0x370 [ 66.018862][ T5068] _cfg80211_unregister_wdev+0x162/0x560 [ 66.024993][ T5068] ieee80211_if_remove+0x25d/0x3a0 [ 66.030617][ T5068] ieee80211_del_iface+0x19/0x30 [ 66.036053][ T5068] cfg80211_remove_virtual_intf+0x230/0x3f0 [ 66.042455][ T5068] genl_rcv_msg+0xb14/0xec0 [ 66.047461][ T5068] netlink_rcv_skb+0x1e3/0x430 [ 66.052810][ T5068] genl_rcv+0x28/0x40 [ 66.057296][ T5068] netlink_unicast+0x7ea/0x980 [ 66.062679][ T5068] netlink_sendmsg+0x8e1/0xcb0 [ 66.068644][ T5068] __sock_sendmsg+0x221/0x270 [ 66.074027][ T5068] ____sys_sendmsg+0x525/0x7d0 [ 66.079327][ T5068] __sys_sendmsg+0x2b0/0x3a0 [ 66.084425][ T5068] do_syscall_64+0xfb/0x240 [ 66.089438][ T5068] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 66.095843][ T5068] [ 66.095843][ T5068] other info that might help us debug this: [ 66.095843][ T5068] [ 66.106047][ T5068] Possible unsafe locking scenario: [ 66.106047][ T5068] [ 66.113578][ T5068] CPU0 CPU1 [ 66.118922][ T5068] ---- ---- [ 66.124274][ T5068] lock(&rdev->wiphy.mtx); [ 66.128761][ T5068] lock(team->team_lock_key); [ 66.136024][ T5068] lock(&rdev->wiphy.mtx); [ 66.143024][ T5068] lock(team->team_lock_key); [ 66.147766][ T5068] [ 66.147766][ T5068] *** DEADLOCK *** [ 66.147766][ T5068] [ 66.156080][ T5068] 3 locks held by syz-executor232/5068: [ 66.161644][ T5068] #0: ffffffff8f3ea5b0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 [ 66.169823][ T5068] #1: ffffffff8f385a08 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 [ 66.179039][ T5068] #2: ffff88807b3f0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 66.189287][ T5068] [ 66.189287][ T5068] stack backtrace: [ 66.195154][ T5068] CPU: 0 PID: 5068 Comm: syz-executor232 Not tainted 6.8.0-syzkaller-05204-g237bb5f7f7f5 #0 [ 66.205191][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 66.215244][ T5068] Call Trace: [ 66.218523][ T5068] [ 66.221436][ T5068] dump_stack_lvl+0x1e7/0x2e0 [ 66.226120][ T5068] ? __pfx_dump_stack_lvl+0x10/0x10 [ 66.231331][ T5068] ? print_circular_bug+0x130/0x1a0 [ 66.236958][ T5068] check_noncircular+0x36a/0x4a0 [ 66.241883][ T5068] ? __pfx_check_noncircular+0x10/0x10 [ 66.247412][ T5068] ? lockdep_lock+0x123/0x2b0 [ 66.252073][ T5068] ? lockdep_unlock+0x16a/0x300 [ 66.257018][ T5068] ? __pfx_lockdep_unlock+0x10/0x10 [ 66.263129][ T5068] ? _find_first_zero_bit+0xd4/0x100 [ 66.269027][ T5068] validate_chain+0x18cb/0x58e0 [ 66.273879][ T5068] ? __pfx_validate_chain+0x10/0x10 [ 66.279255][ T5068] ? __pfx_validate_chain+0x10/0x10 [ 66.284452][ T5068] ? stack_trace_save+0x118/0x1d0 [ 66.289479][ T5068] ? __pfx_stack_trace_save+0x10/0x10 [ 66.294935][ T5068] ? lockdep_unlock+0x16a/0x300 [ 66.299770][ T5068] ? mark_lock+0x9a/0x350 [ 66.304076][ T5068] __lock_acquire+0x1346/0x1fd0 [ 66.308930][ T5068] lock_acquire+0x1e4/0x530 [ 66.313409][ T5068] ? team_del_slave+0x32/0x1d0 [ 66.318155][ T5068] ? __pfx_lock_acquire+0x10/0x10 [ 66.323155][ T5068] ? __pfx___might_resched+0x10/0x10 [ 66.328421][ T5068] ? __pfx___might_resched+0x10/0x10 [ 66.333685][ T5068] ? xsk_notifier+0x218/0x230 [ 66.338344][ T5068] __mutex_lock+0x136/0xd70 [ 66.342827][ T5068] ? team_del_slave+0x32/0x1d0 [ 66.347571][ T5068] ? trace_contention_end+0x3c/0x100 [ 66.352836][ T5068] ? __mutex_lock+0x2ef/0xd70 [ 66.357515][ T5068] ? bond_netdev_event+0xdd/0xf20 [ 66.362528][ T5068] ? team_del_slave+0x32/0x1d0 [ 66.367269][ T5068] ? __pfx___mutex_lock+0x10/0x10 [ 66.372819][ T5068] ? __asan_memset+0x23/0x50 [ 66.377409][ T5068] team_del_slave+0x32/0x1d0 [ 66.382003][ T5068] team_device_event+0x200/0x5b0 [ 66.387036][ T5068] ? notifier_call_chain+0x166/0x3b0 [ 66.392339][ T5068] notifier_call_chain+0x18f/0x3b0 [ 66.397445][ T5068] unregister_netdevice_many_notify+0xd96/0x16d0 [ 66.403769][ T5068] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 66.409473][ T5068] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 66.416222][ T5068] ? kasan_quarantine_put+0xdc/0x230 [ 66.421490][ T5068] unregister_netdevice_queue+0x303/0x370 [ 66.427190][ T5068] ? __pfx_up_write+0x10/0x10 [ 66.431847][ T5068] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 66.438067][ T5068] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 66.443767][ T5068] _cfg80211_unregister_wdev+0x162/0x560 [ 66.449385][ T5068] ieee80211_if_remove+0x25d/0x3a0 [ 66.454477][ T5068] ieee80211_del_iface+0x19/0x30 [ 66.459393][ T5068] cfg80211_remove_virtual_intf+0x230/0x3f0 [ 66.466041][ T5068] genl_rcv_msg+0xb14/0xec0 [ 66.470700][ T5068] ? mark_lock+0x9a/0x350 [ 66.475014][ T5068] ? __pfx_genl_rcv_msg+0x10/0x10 [ 66.480025][ T5068] ? __pfx_lock_acquire+0x10/0x10 [ 66.485127][ T5068] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 66.490494][ T5068] ? __pfx_nl80211_del_interface+0x10/0x10 [ 66.496281][ T5068] ? __pfx_nl80211_post_doit+0x10/0x10 [ 66.501719][ T5068] ? __pfx___might_resched+0x10/0x10 [ 66.506987][ T5068] netlink_rcv_skb+0x1e3/0x430 [ 66.511914][ T5068] ? __pfx_genl_rcv_msg+0x10/0x10 [ 66.516942][ T5068] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 66.522210][ T5068] ? __pfx_lock_release+0x10/0x10 [ 66.527211][ T5068] ? __netlink_deliver_tap+0x77e/0x7c0 [ 66.532654][ T5068] genl_rcv+0x28/0x40 [ 66.536619][ T5068] netlink_unicast+0x7ea/0x980 [ 66.541364][ T5068] ? __pfx_netlink_unicast+0x10/0x10 [ 66.546628][ T5068] ? __virt_addr_valid+0x44e/0x520 [ 66.551724][ T5068] ? __phys_addr_symbol+0x2f/0x70 [ 66.556752][ T5068] ? __check_object_size+0x4bc/0xa00 [ 66.562036][ T5068] ? bpf_lsm_netlink_send+0x9/0x10 [ 66.567848][ T5068] netlink_sendmsg+0x8e1/0xcb0 [ 66.572790][ T5068] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.578071][ T5068] ? __import_iovec+0x536/0x820 [ 66.583429][ T5068] ? aa_sock_msg_perm+0x91/0x160 [ 66.588356][ T5068] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 66.593644][ T5068] ? security_socket_sendmsg+0x87/0xb0 [ 66.599083][ T5068] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.604351][ T5068] __sock_sendmsg+0x221/0x270 [ 66.609012][ T5068] ____sys_sendmsg+0x525/0x7d0 [ 66.613759][ T5068] ? __pfx_____sys_sendmsg+0x10/0x10 [ 66.619041][ T5068] ? do_raw_spin_lock+0x14f/0x370 [ 66.624048][ T5068] __sys_sendmsg+0x2b0/0x3a0 [ 66.628622][ T5068] ? __pfx___sys_sendmsg+0x10/0x10 [ 66.633716][ T5068] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 66.640024][ T5068] ? _raw_spin_unlock_irq+0x2e/0x50 [ 66.645203][ T5068] ? ptrace_notify+0x279/0x380 [ 66.649972][ T5068] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 66.656284][ T5068] ? do_syscall_64+0x10a/0x240 [ 66.661379][ T5068] ? syscall_trace_enter+0x5f/0x150 [ 66.666962][ T5068] do_syscall_64+0xfb/0x240 [ 66.671493][ T5068] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 66.677409][ T5068] RIP: 0033:0x7f24f45b41a9 [ 66.681826][ T5068] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 66.701447][ T5068] RSP: 002b:00007ffd60d83638 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 66.709871][ T5068] RAX: ffffffffffffffda RBX: 00007f24f46013f6 RCX: 00007f24f45b41a9 [ 66.717825][ T5068] RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000004 [ 66.725775][ T5068] RBP: 00007f24f4633440 R08: 0000000000000000 R09: 0000000000000000 [ 66.733729][ T5068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000031 [ 66.741680][ T5068] R13: 0000000000000003 R14: 0000000000050012 R15: 00007ffd60d83692 [ 66.749640][ T5068] [ 66.762452][ T5068] team0: Port device wlan0 removed [pid 5068] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x1c\x00\x00\x00\x23\x00\x37\x95\x00\x00\x9f\x83\x3d\x32\x34\xd3\x08\xf8\x00\x00\x08\x00\x03\x00\x47\x00\x00\x00", iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5068] exit_group(1) = ? [pid 5068] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5068, si_uid=0, si_status=1, si_utime=0, si_stime=122 /* 1.22 s */} --- exit_group(0) = ? +++ exited with 0 +++