Warning: Permanently added '10.128.1.205' (ED25519) to the list of known hosts. 2026/03/27 19:57:41 parsed 1 programs [ 88.582207][ T5772] cgroup: Unknown subsys name 'net' [ 88.718120][ T5772] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 90.458374][ T5772] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.061894][ T8] cfg80211: failed to load regulatory.db [ 92.819887][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.827946][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.885463][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.894628][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.860786][ T5813] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.869049][ T5813] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.877809][ T5813] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.887169][ T5813] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.897604][ T5813] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 93.908611][ T5813] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 94.596075][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 94.687869][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.700931][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.708330][ T5826] bridge_slave_0: entered allmulticast mode [ 94.725063][ T5826] bridge_slave_0: entered promiscuous mode [ 94.751060][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.758626][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.768125][ T5826] bridge_slave_1: entered allmulticast mode [ 94.775703][ T5826] bridge_slave_1: entered promiscuous mode [ 94.810895][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.822650][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.852713][ T5826] team0: Port device team_slave_0 added [ 94.861797][ T5826] team0: Port device team_slave_1 added [ 94.887451][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.894486][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.920515][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.934574][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.941791][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.968230][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.011929][ T5826] hsr_slave_0: entered promiscuous mode [ 95.018719][ T5826] hsr_slave_1: entered promiscuous mode [ 95.235218][ T5826] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 95.250479][ T5826] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 95.288501][ T5826] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 95.300020][ T5826] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 95.429490][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.467867][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.486673][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.494070][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.525966][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.533200][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.821675][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.872097][ T5826] veth0_vlan: entered promiscuous mode [ 95.885023][ T5826] veth1_vlan: entered promiscuous mode [ 95.921354][ T5826] veth0_macvtap: entered promiscuous mode [ 95.931967][ T5826] veth1_macvtap: entered promiscuous mode [ 95.952014][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.968188][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.981241][ T5826] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.990863][ T5826] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.999681][ T5826] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.008427][ T5826] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.169569][ T61] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/03/27 19:57:53 executed programs: 0 [ 98.240694][ T5081] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.251796][ T5081] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.259827][ T5081] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.268095][ T5081] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.276890][ T5081] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 98.284990][ T5081] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.433823][ T5875] chnl_net:caif_netlink_parms(): no params data found [ 98.509818][ T5875] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.516991][ T5875] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.524909][ T5875] bridge_slave_0: entered allmulticast mode [ 98.532038][ T5875] bridge_slave_0: entered promiscuous mode [ 98.541805][ T5875] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.549218][ T5875] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.556401][ T5875] bridge_slave_1: entered allmulticast mode [ 98.564166][ T5875] bridge_slave_1: entered promiscuous mode [ 98.596932][ T5875] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.608616][ T5875] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.640662][ T5875] team0: Port device team_slave_0 added [ 98.650050][ T5875] team0: Port device team_slave_1 added [ 98.675550][ T5875] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.682994][ T5875] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.709160][ T5875] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.722156][ T5875] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.729431][ T5875] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.755415][ T5875] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.804665][ T5875] hsr_slave_0: entered promiscuous mode [ 98.811203][ T5875] hsr_slave_1: entered promiscuous mode [ 98.818064][ T5875] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 98.826186][ T5875] Cannot create hsr debugfs directory [ 98.964590][ T61] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.379919][ T5081] Bluetooth: hci0: command tx timeout [ 101.211012][ T61] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.266815][ T61] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.133167][ T61] hsr_slave_0: left promiscuous mode [ 102.139822][ T61] hsr_slave_1: left promiscuous mode [ 102.146346][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 102.157523][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 102.166678][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 102.176901][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 102.185501][ T61] bridge_slave_1: left allmulticast mode [ 102.193842][ T61] bridge_slave_1: left promiscuous mode [ 102.201112][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.216996][ T61] bridge_slave_0: left allmulticast mode [ 102.224640][ T61] bridge_slave_0: left promiscuous mode [ 102.231280][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.264060][ T61] veth1_macvtap: left promiscuous mode [ 102.272781][ T61] veth0_macvtap: left promiscuous mode [ 102.278506][ T61] veth1_vlan: left promiscuous mode [ 102.284667][ T61] veth0_vlan: left promiscuous mode [ 102.460838][ T5081] Bluetooth: hci0: command tx timeout [ 102.824195][ T61] team0 (unregistering): Port device team_slave_1 removed [ 102.860728][ T61] team0 (unregistering): Port device team_slave_0 removed [ 102.896786][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 102.939632][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 103.175677][ T61] bond0 (unregistering): Released all slaves [ 103.280391][ T5875] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.290687][ T5875] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.302615][ T5875] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.317445][ T5875] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.408399][ T5875] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.440117][ T5875] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.458201][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.465431][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.481693][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.488928][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.728403][ T5875] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.802848][ T5875] veth0_vlan: entered promiscuous mode [ 103.818554][ T5875] veth1_vlan: entered promiscuous mode [ 103.863697][ T5875] veth0_macvtap: entered promiscuous mode [ 103.887672][ T5875] veth1_macvtap: entered promiscuous mode [ 103.920743][ T5875] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.942491][ T5875] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.961617][ T5875] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.971048][ T5875] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.986424][ T5875] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.995383][ T5875] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.065216][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.083158][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.116610][ T1335] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.126466][ T1335] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/03/27 19:57:59 executed programs: 2 [ 104.267126][ T5915] netlink: 'syz.0.17': attribute type 10 has an invalid length. [ 104.305416][ T5915] team0: Port device wlan1 added [ 104.388698][ T5916] netlink: 'syz.0.18': attribute type 10 has an invalid length. [ 104.498868][ T5917] netlink: 'syz.0.19': attribute type 10 has an invalid length. [ 104.539445][ T5081] Bluetooth: hci0: command tx timeout [ 104.633375][ T5918] netlink: 'syz.0.20': attribute type 10 has an invalid length. [ 104.677596][ T5919] netlink: 'syz.0.21': attribute type 10 has an invalid length. [ 104.725497][ T5920] netlink: 'syz.0.22': attribute type 10 has an invalid length. [ 104.760363][ T5921] netlink: 'syz.0.23': attribute type 10 has an invalid length. [ 104.815426][ T5922] netlink: 'syz.0.24': attribute type 10 has an invalid length. [ 104.876029][ T5923] netlink: 'syz.0.25': attribute type 10 has an invalid length. [ 104.932359][ T5924] netlink: 'syz.0.26': attribute type 10 has an invalid length. [ 106.618959][ T5081] Bluetooth: hci0: command tx timeout 2026/03/27 19:58:04 executed programs: 178 [ 109.273476][ T6095] validate_nla: 170 callbacks suppressed [ 109.273492][ T6095] netlink: 'syz.0.197': attribute type 10 has an invalid length. [ 109.313100][ T6096] netlink: 'syz.0.198': attribute type 10 has an invalid length. [ 109.341512][ T6097] netlink: 'syz.0.199': attribute type 10 has an invalid length. [ 109.381683][ T6098] netlink: 'syz.0.200': attribute type 10 has an invalid length. [ 109.407794][ T6099] netlink: 'syz.0.201': attribute type 10 has an invalid length. [ 109.442662][ T6100] netlink: 'syz.0.202': attribute type 10 has an invalid length. [ 109.472706][ T6101] netlink: 'syz.0.203': attribute type 10 has an invalid length. [ 109.514665][ T6102] netlink: 'syz.0.204': attribute type 10 has an invalid length. [ 109.542055][ T6103] netlink: 'syz.0.205': attribute type 10 has an invalid length. [ 109.572839][ T6104] netlink: 'syz.0.206': attribute type 10 has an invalid length. 2026/03/27 19:58:09 executed programs: 387 [ 114.300873][ T6305] validate_nla: 200 callbacks suppressed [ 114.300890][ T6305] netlink: 'syz.0.407': attribute type 10 has an invalid length. [ 114.340525][ T6306] netlink: 'syz.0.408': attribute type 10 has an invalid length. [ 114.369911][ T6307] netlink: 'syz.0.409': attribute type 10 has an invalid length. [ 114.412142][ T6308] netlink: 'syz.0.410': attribute type 10 has an invalid length. [ 114.441139][ T6309] netlink: 'syz.0.411': attribute type 10 has an invalid length. [ 114.471045][ T6310] netlink: 'syz.0.412': attribute type 10 has an invalid length. [ 114.509460][ T6311] netlink: 'syz.0.413': attribute type 10 has an invalid length. [ 114.537790][ T6312] netlink: 'syz.0.414': attribute type 10 has an invalid length. [ 114.567437][ T6313] netlink: 'syz.0.415': attribute type 10 has an invalid length. [ 114.600973][ T6314] netlink: 'syz.0.416': attribute type 10 has an invalid length. 2026/03/27 19:58:14 executed programs: 596 [ 119.320709][ T6514] validate_nla: 199 callbacks suppressed [ 119.320724][ T6514] netlink: 'syz.0.616': attribute type 10 has an invalid length. [ 119.411524][ T5813] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 119.434934][ T5813] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 119.443047][ T5813] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 119.451860][ T5813] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 119.460846][ T5813] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 119.468552][ T5813] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 119.643578][ T157] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.666233][ T6516] chnl_net:caif_netlink_parms(): no params data found [ 119.743846][ T157] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.759849][ T6516] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.766975][ T6516] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.774649][ T6516] bridge_slave_0: entered allmulticast mode [ 119.782291][ T6516] bridge_slave_0: entered promiscuous mode [ 119.792113][ T6516] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.799389][ T6516] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.806614][ T6516] bridge_slave_1: entered allmulticast mode [ 119.813967][ T6516] bridge_slave_1: entered promiscuous mode [ 119.830580][ T157] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.865718][ T6516] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 119.877730][ T6516] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 119.910093][ T157] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.942536][ T6516] team0: Port device team_slave_0 added [ 119.952722][ T6516] team0: Port device team_slave_1 added [ 119.980057][ T6516] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 119.987135][ T6516] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 120.013258][ T6516] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 120.026086][ T6516] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 120.033262][ T6516] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 120.059460][ T6516] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 120.107684][ T6516] hsr_slave_0: entered promiscuous mode [ 120.114427][ T6516] hsr_slave_1: entered promiscuous mode [ 120.966958][ T6516] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 120.977907][ T6516] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 120.990149][ T6516] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 121.002561][ T6516] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 121.082651][ T157] [ 121.085045][ T157] ====================================================== [ 121.092188][ T157] WARNING: possible circular locking dependency detected [ 121.099259][ T157] syzkaller #0 Not tainted [ 121.103716][ T157] ------------------------------------------------------ [ 121.110768][ T157] kworker/u4:6/157 is trying to acquire lock: [ 121.116867][ T157] ffff8880228b8d00 (team->team_lock_key#2){+.+.}-{3:3}, at: team_del_slave+0x32/0x1c0 [ 121.126534][ T157] [ 121.126534][ T157] but task is already holding lock: [ 121.133931][ T157] ffff88802bd70768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x29a/0x690 [ 121.144336][ T157] [ 121.144336][ T157] which lock already depends on the new lock. [ 121.144336][ T157] [ 121.154754][ T157] [ 121.154754][ T157] the existing dependency chain (in reverse order) is: [ 121.163778][ T157] [ 121.163778][ T157] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 121.171529][ T157] __mutex_lock+0x136/0xcc0 [ 121.176574][ T157] ieee80211_open+0x144/0x200 [ 121.181797][ T157] __dev_open+0x2cb/0x430 [ 121.186664][ T157] dev_open+0xab/0x190 [ 121.191274][ T157] team_add_slave+0x75f/0x29a0 [ 121.196586][ T157] do_setlink+0xdfe/0x4130 [ 121.201550][ T157] rtnl_newlink+0x17da/0x20a0 [ 121.206776][ T157] rtnetlink_rcv_msg+0x869/0xfa0 [ 121.212249][ T157] netlink_rcv_skb+0x241/0x4d0 [ 121.217561][ T157] netlink_unicast+0x751/0x8d0 [ 121.223127][ T157] netlink_sendmsg+0x8d0/0xbf0 [ 121.228436][ T157] ____sys_sendmsg+0x5ba/0x960 [ 121.233740][ T157] ___sys_sendmsg+0x2a6/0x360 [ 121.238954][ T157] __se_sys_sendmsg+0x1c2/0x2b0 [ 121.244345][ T157] do_syscall_64+0x55/0xa0 [ 121.249309][ T157] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 121.255752][ T157] [ 121.255752][ T157] -> #0 (team->team_lock_key#2){+.+.}-{3:3}: [ 121.263939][ T157] __lock_acquire+0x2df1/0x7d40 [ 121.269328][ T157] lock_acquire+0x19e/0x420 [ 121.274368][ T157] __mutex_lock+0x136/0xcc0 [ 121.279405][ T157] team_del_slave+0x32/0x1c0 [ 121.284539][ T157] team_device_event+0x28d/0xa20 [ 121.290020][ T157] notifier_call_chain+0x197/0x380 [ 121.295673][ T157] unregister_netdevice_many_notify+0x100d/0x1900 [ 121.302623][ T157] unregister_netdevice_queue+0x32c/0x370 [ 121.308878][ T157] _cfg80211_unregister_wdev+0x16b/0x580 [ 121.315047][ T157] ieee80211_remove_interfaces+0x49e/0x690 [ 121.321405][ T157] ieee80211_unregister_hw+0x5d/0x2a0 [ 121.327307][ T157] mac80211_hwsim_del_radio+0x289/0x480 [ 121.333389][ T157] hwsim_exit_net+0x58d/0x650 [ 121.338607][ T157] cleanup_net+0x70a/0xbb0 [ 121.343569][ T157] process_scheduled_works+0xa5d/0x15d0 [ 121.349652][ T157] worker_thread+0xa55/0xfc0 [ 121.354778][ T157] kthread+0x2fa/0x390 [ 121.359384][ T157] ret_from_fork+0x48/0x80 [ 121.364339][ T157] ret_from_fork_asm+0x11/0x20 [ 121.369640][ T157] [ 121.369640][ T157] other info that might help us debug this: [ 121.369640][ T157] [ 121.379875][ T157] Possible unsafe locking scenario: [ 121.379875][ T157] [ 121.387334][ T157] CPU0 CPU1 [ 121.392708][ T157] ---- ---- [ 121.398082][ T157] lock(&rdev->wiphy.mtx); [ 121.402607][ T157] lock(team->team_lock_key#2); [ 121.410085][ T157] lock(&rdev->wiphy.mtx); [ 121.417161][ T157] lock(team->team_lock_key#2); [ 121.422116][ T157] [ 121.422116][ T157] *** DEADLOCK *** [ 121.422116][ T157] [ 121.430295][ T157] 5 locks held by kworker/u4:6/157: [ 121.435509][ T157] #0: ffff88801a254938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 121.446408][ T157] #1: ffffc90002d67d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 121.456973][ T157] #2: ffffffff8e3b4950 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 [ 121.466433][ T157] #3: ffffffff8e3c1988 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_unregister_hw+0x55/0x2a0 [ 121.476326][ T157] #4: ffff88802bd70768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x29a/0x690 [ 121.487336][ T157] [ 121.487336][ T157] stack backtrace: [ 121.493266][ T157] CPU: 0 PID: 157 Comm: kworker/u4:6 Not tainted syzkaller #0 [ 121.500844][ T157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 121.511013][ T157] Workqueue: netns cleanup_net [ 121.515841][ T157] Call Trace: [ 121.519142][ T157] [ 121.522099][ T157] dump_stack_lvl+0x18c/0x250 [ 121.526931][ T157] ? load_image+0x400/0x400 [ 121.531478][ T157] ? show_regs_print_info+0x20/0x20 [ 121.536737][ T157] ? print_circular_bug+0x12b/0x1a0 [ 121.541977][ T157] check_noncircular+0x2fc/0x400 [ 121.546966][ T157] ? print_deadlock_bug+0x5d0/0x5d0 [ 121.552196][ T157] ? lockdep_lock+0xf5/0x230 [ 121.556808][ T157] ? __lock_acquire+0x1273/0x7d40 [ 121.561861][ T157] ? _find_first_zero_bit+0xd3/0x100 [ 121.567170][ T157] __lock_acquire+0x2df1/0x7d40 [ 121.572054][ T157] ? verify_lock_unused+0x140/0x140 [ 121.577278][ T157] ? verify_lock_unused+0x140/0x140 [ 121.582503][ T157] lock_acquire+0x19e/0x420 [ 121.587021][ T157] ? team_del_slave+0x32/0x1c0 [ 121.591814][ T157] ? __might_sleep+0xe0/0xe0 [ 121.596424][ T157] ? read_lock_is_recursive+0x20/0x20 [ 121.601822][ T157] __mutex_lock+0x136/0xcc0 [ 121.606345][ T157] ? team_del_slave+0x32/0x1c0 [ 121.611131][ T157] ? __lock_acquire+0x7d40/0x7d40 [ 121.616171][ T157] ? rcu_is_watching+0x15/0xb0 [ 121.620960][ T157] ? trace_contention_end+0x39/0xe0 [ 121.626185][ T157] ? __mutex_lock+0x315/0xcc0 [ 121.630881][ T157] ? team_del_slave+0x32/0x1c0 [ 121.635667][ T157] ? mutex_lock_nested+0x20/0x20 [ 121.640620][ T157] ? bond_netdev_event+0xeb/0xf20 [ 121.645668][ T157] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 121.651324][ T157] team_del_slave+0x32/0x1c0 [ 121.655943][ T157] team_device_event+0x28d/0xa20 [ 121.660911][ T157] notifier_call_chain+0x197/0x380 [ 121.666047][ T157] unregister_netdevice_many_notify+0x100d/0x1900 [ 121.672653][ T157] ? lock_chain_count+0x20/0x20 [ 121.677529][ T157] ? unregister_netdevice_many+0x20/0x20 [ 121.683179][ T157] ? kernfs_remove_by_name_ns+0x117/0x150 [ 121.688947][ T157] ? __lock_acquire+0x7d40/0x7d40 [ 121.694023][ T157] unregister_netdevice_queue+0x32c/0x370 [ 121.699760][ T157] ? list_netdevice+0x730/0x730 [ 121.704643][ T157] ? kernfs_remove_by_name_ns+0x117/0x150 [ 121.710396][ T157] _cfg80211_unregister_wdev+0x16b/0x580 [ 121.716051][ T157] ieee80211_remove_interfaces+0x49e/0x690 [ 121.721890][ T157] ? ieee80211_do_stop+0x1e20/0x1e20 [ 121.727214][ T157] ? rcu_is_watching+0x15/0xb0 [ 121.732028][ T157] ieee80211_unregister_hw+0x5d/0x2a0 [ 121.737436][ T157] mac80211_hwsim_del_radio+0x289/0x480 [ 121.743014][ T157] ? rhashtable_remove_fast+0xc00/0xc00 [ 121.748589][ T157] hwsim_exit_net+0x58d/0x650 [ 121.753288][ T157] ? hwsim_init_net+0x90/0x90 [ 121.757989][ T157] ? __ip_vs_dev_cleanup_batch+0x238/0x250 [ 121.763821][ T157] cleanup_net+0x70a/0xbb0 [ 121.768264][ T157] ? ops_free_list+0x3b0/0x3b0 [ 121.773081][ T157] ? _raw_spin_unlock_irq+0x23/0x50 [ 121.778313][ T157] ? process_scheduled_works+0x96f/0x15d0 [ 121.784054][ T157] ? process_scheduled_works+0x96f/0x15d0 [ 121.789792][ T157] process_scheduled_works+0xa5d/0x15d0 [ 121.795365][ T157] ? worker_attach_to_pool+0x380/0x380 [ 121.800847][ T157] ? assign_work+0x3d2/0x5d0 [ 121.805462][ T157] worker_thread+0xa55/0xfc0 [ 121.810079][ T157] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 121.816021][ T157] ? _raw_spin_unlock+0x40/0x40 [ 121.820889][ T157] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 121.826816][ T157] kthread+0x2fa/0x390 [ 121.830899][ T157] ? pr_cont_work+0x560/0x560 [ 121.835596][ T157] ? kthread_blkcg+0xd0/0xd0 [ 121.840217][ T157] ret_from_fork+0x48/0x80 [ 121.844667][ T157] ? kthread_blkcg+0xd0/0xd0 [ 121.849274][ T157] ret_from_fork_asm+0x11/0x20 [ 121.854062][ T157] [ 121.862180][ T5081] Bluetooth: hci1: command tx timeout [ 121.880227][ T157] team0: Port device wlan1 removed [ 121.934109][ T6516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 121.990005][ T6516] 8021q: adding VLAN 0 to HW filter on device team0 [ 122.008421][ T1335] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.015641][ T1335] bridge0: port 1(bridge_slave_0) entered forwarding state [ 122.034450][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.041642][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 122.062687][ T157] hsr_slave_0: left promiscuous mode [ 122.068594][ T157] hsr_slave_1: left promiscuous mode [ 122.075435][ T157] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 122.083449][ T157] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 122.091514][ T157] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 122.099860][ T157] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 122.107586][ T157] bridge_slave_1: left allmulticast mode [ 122.114420][ T157] bridge_slave_1: left promiscuous mode [ 122.120511][ T157] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.130306][ T157] bridge_slave_0: left allmulticast mode [ 122.136010][ T157] bridge_slave_0: left promiscuous mode [ 122.142154][ T157] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.155404][ T157] veth1_macvtap: left promiscuous mode [ 122.162759][ T157] veth0_macvtap: left promiscuous mode [ 122.168409][ T157] veth1_vlan: left promiscuous mode [ 122.175038][ T157] veth0_vlan: left promiscuous mode [ 122.391864][ T157] team0 (unregistering): Port device team_slave_1 removed [ 122.416404][ T157] team0 (unregistering): Port device team_slave_0 removed [ 122.439074][ T157] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 122.461563][ T157] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 122.576576][ T157] bond0 (unregistering): Released all slaves [ 122.843584][ T6516] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.878480][ T6516] veth0_vlan: entered promiscuous mode [ 122.889333][ T6516] veth1_vlan: entered promiscuous mode [ 122.930624][ T6516] veth0_macvtap: entered promiscuous mode [ 122.941894][ T6516] veth1_macvtap: entered promiscuous mode [ 122.962890][ T6516] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.977554][ T6516] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.990156][ T6516] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.999743][ T6516] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.008498][ T6516] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.017283][ T6516] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.048145][ T6516] ieee80211 phy7: Selected rate control algorithm 'minstrel_ht' [ 123.070286][ T157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.078892][ T157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.086819][ T6516] ieee80211 phy8: Selected rate control algorithm 'minstrel_ht' [ 123.111409][ T1335] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.119957][ T1335] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.151429][ T6562] netlink: 'syz.0.617': attribute type 10 has an invalid length. [ 123.180371][ T6562] team0: Port device wlan1 added [ 123.202900][ T6563] netlink: 'syz.0.618': attribute type 10 has an invalid length. [ 123.232550][ T6564] netlink: 'syz.0.619': attribute type 10 has an invalid length. [ 123.258604][ T6565] netlink: 'syz.0.620': attribute type 10 has an invalid length. [ 123.281257][ T6566] netlink: 'syz.0.621': attribute type 10 has an invalid length. [ 123.310848][ T6567] netlink: 'syz.0.622': attribute type 10 has an invalid length. [ 123.335613][ T6568] netlink: 'syz.0.623': attribute type 10 has an invalid length. [ 123.363456][ T6569] netlink: 'syz.0.624': attribute type 10 has an invalid length. [ 123.384948][ T6570] netlink: 'syz.0.625': attribute type 10 has an invalid length. [ 123.899122][ T5081] Bluetooth: hci1: command tx timeout 2026/03/27 19:58:19 executed programs: 655 [ 124.331625][ T6621] validate_nla: 50 callbacks suppressed [ 124.331640][ T6621] netlink: 'syz.0.676': attribute type 10 has an invalid length. [ 124.361579][ T6622] netlink: 'syz.0.677': attribute type 10 has an invalid length. [ 124.384151][ T6623] netlink: 'syz.0.678': attribute type 10 has an invalid length. [ 124.408231][ T6624] netlink: 'syz.0.679': attribute type 10 has an invalid length. [ 124.436289][ T6625] netlink: 'syz.0.680': attribute type 10 has an invalid length. [ 124.461233][ T6626] netlink: 'syz.0.681': attribute type 10 has an invalid length. [ 124.486052][ T6627] netlink: 'syz.0.682': attribute type 10 has an invalid length. [ 124.513529][ T6628] netlink: 'syz.0.683': attribute type 10 has an invalid length. [ 124.534899][ T6629] netlink: 'syz.0.684': attribute type 10 has an invalid length. [ 124.560463][ T6630] netlink: 'syz.0.685': attribute type 10 has an invalid length. [ 125.980753][ T5081] Bluetooth: hci1: command tx timeout [ 128.060298][ T5081] Bluetooth: hci1: command tx timeout 2026/03/27 19:58:24 executed programs: 928 [ 129.344742][ T6893] validate_nla: 262 callbacks suppressed [ 129.344754][ T6893] netlink: 'syz.0.948': attribute type 10 has an invalid length. [ 129.369917][ T6894] netlink: 'syz.0.949': attribute type 10 has an invalid length. [ 129.387989][ T6895] netlink: 'syz.0.950': attribute type 10 has an invalid length. [ 129.414972][ T6896] netlink: 'syz.0.951': attribute type 10 has an invalid length. [ 129.433924][ T6897] netlink: 'syz.0.952': attribute type 10 has an invalid length. [ 129.452341][ T6898] netlink: 'syz.0.953': attribute type 10 has an invalid length. [ 129.474431][ T6899] netlink: 'syz.0.954': attribute type 10 has an invalid length. [ 129.492990][ T6900] netlink: 'syz.0.955': attribute type 10 has an invalid length. [ 129.511426][ T6901] netlink: 'syz.0.956': attribute type 10 has an invalid length. [ 129.534389][ T6902] netlink: 'syz.0.957': attribute type 10 has an invalid length.