bond0: left allmulticast mode
batman_adv: batadv0: Removing interface: ip6gretap1
ip6gretap0 (unregistering): left allmulticast mode
bond0 (unregistering): Released all slaves
======================================================
WARNING: possible circular locking dependency detected
6.14.0-rc6-syzkaller-01241-g702e3fa16cd4 #0 Not tainted
------------------------------------------------------
kworker/u8:8/3363 is trying to acquire lock:
ffff888029e40768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6063 [inline]
ffff888029e40768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_change_mac+0xc6/0x1160 net/mac80211/iface.c:307
but task is already holding lock:
ffff88807dad4d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2731 [inline]
ffff88807dad4d28 (&dev->lock){+.+.}-{4:4}, at: dev_set_mac_address+0x2a/0x50 net/core/dev_api.c:302
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&dev->lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
netdev_lock include/linux/netdevice.h:2731 [inline]
register_netdevice+0x12d8/0x1b70 net/core/dev.c:10994
cfg80211_register_netdevice+0x149/0x2f0 net/wireless/core.c:1489
ieee80211_if_add+0x119d/0x1780 net/mac80211/iface.c:2225
ieee80211_register_hw+0x3708/0x42e0 net/mac80211/main.c:1604
mac80211_hwsim_new_radio+0x2a89/0x49f0 drivers/net/wireless/virtual/mac80211_hwsim.c:5559
init_mac80211_hwsim+0x87a/0xb00 drivers/net/wireless/virtual/mac80211_hwsim.c:6911
do_one_initcall+0x248/0x930 init/main.c:1257
do_initcall_level+0x157/0x210 init/main.c:1319
do_initcalls+0x71/0xd0 init/main.c:1335
kernel_init_freeable+0x435/0x5d0 init/main.c:1568
kernel_init+0x1d/0x2b0 init/main.c:1457
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
class_wiphy_constructor include/net/cfg80211.h:6063 [inline]
ieee80211_change_mac+0xc6/0x1160 net/mac80211/iface.c:307
netif_set_mac_address+0x327/0x510 net/core/dev.c:9590
dev_set_mac_address+0x38/0x50 net/core/dev_api.c:303
bond_set_mac_address+0x28e/0x830 drivers/net/bonding/bond_main.c:4903
netif_set_mac_address+0x327/0x510 net/core/dev.c:9590
dev_set_mac_address+0x38/0x50 net/core/dev_api.c:303
__set_port_dev_addr drivers/net/team/team_core.c:58 [inline]
team_port_set_orig_dev_addr drivers/net/team/team_core.c:63 [inline]
team_port_del+0xb0d/0xce0 drivers/net/team/team_core.c:1381
team_del_slave+0x3d/0x1d0 drivers/net/team/team_core.c:2004
team_device_event+0x200/0x5b0 drivers/net/team/team_core.c:3000
notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2226 [inline]
call_netdevice_notifiers net/core/dev.c:2240 [inline]
unregister_netdevice_many_notify+0x156b/0x24f0 net/core/dev.c:11954
cleanup_net+0x76d/0xd60 net/core/net_namespace.c:647
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd30 kernel/workqueue.c:3400
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->lock);
lock(&rdev->wiphy.mtx);
lock(&dev->lock);
lock(&rdev->wiphy.mtx);
*** DEADLOCK ***
7 locks held by kworker/u8:8/3363:
#0: ffff88801bef6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
#0: ffff88801bef6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319
#1: ffffc9000caf7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc9000caf7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319
#2: ffffffff8feca250 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 net/core/net_namespace.c:606
#3: ffffffff8fed6cc8 (rtnl_mutex){+.+.}-{4:4}, at: cleanup_net+0x6bf/0xd60 net/core/net_namespace.c:642
#4: ffff888033f8ce00 (team->team_lock_key#3){+.+.}-{4:4}, at: team_del_slave+0x32/0x1d0 drivers/net/team/team_core.c:2003
#5: ffff88807dbc4d28 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2731 [inline]
#5: ffff88807dbc4d28 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: dev_set_mac_address+0x2a/0x50 net/core/dev_api.c:302
#6: ffff88807dad4d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2731 [inline]
#6: ffff88807dad4d28 (&dev->lock){+.+.}-{4:4}, at: dev_set_mac_address+0x2a/0x50 net/core/dev_api.c:302
stack backtrace:
CPU: 1 UID: 0 PID: 3363 Comm: kworker/u8:8 Not tainted 6.14.0-rc6-syzkaller-01241-g702e3fa16cd4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
class_wiphy_constructor include/net/cfg80211.h:6063 [inline]
ieee80211_change_mac+0xc6/0x1160 net/mac80211/iface.c:307
netif_set_mac_address+0x327/0x510 net/core/dev.c:9590
dev_set_mac_address+0x38/0x50 net/core/dev_api.c:303
bond_set_mac_address+0x28e/0x830 drivers/net/bonding/bond_main.c:4903
netif_set_mac_address+0x327/0x510 net/core/dev.c:9590
dev_set_mac_address+0x38/0x50 net/core/dev_api.c:303
__set_port_dev_addr drivers/net/team/team_core.c:58 [inline]
team_port_set_orig_dev_addr drivers/net/team/team_core.c:63 [inline]
team_port_del+0xb0d/0xce0 drivers/net/team/team_core.c:1381
team_del_slave+0x3d/0x1d0 drivers/net/team/team_core.c:2004
team_device_event+0x200/0x5b0 drivers/net/team/team_core.c:3000
notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2226 [inline]
call_netdevice_notifiers net/core/dev.c:2240 [inline]
unregister_netdevice_many_notify+0x156b/0x24f0 net/core/dev.c:11954
cleanup_net+0x76d/0xd60 net/core/net_namespace.c:647
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd30 kernel/workqueue.c:3400
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
team0: Port device bond0 removed
bond0 (unregistering): (slave wlan1): Releasing backup interface
bond0 (unregistering): Released all slaves
bond1 (unregistering): Released all slaves
bond2 (unregistering): Released all slaves
bond3 (unregistering): Released all slaves
bond0 (unregistering): Released all slaves
bond1 (unregistering): Released all slaves
bond2 (unregistering): Released all slaves
bond3 (unregistering): Released all slaves
: left promiscuous mode
tipc: Disabling bearer
tipc: Left network mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
pimreg (unregistering): left allmulticast mode
pim6reg9 (unregistering): left allmulticast mode
pim6reg9 (unregistering): left allmulticast mode
IPVS: stop unused estimator thread 0...