bond3 (unregistering): Releasing active interface vlan4 bond0 (unregistering): Releasing backup interface bond3 bond3 (unregistering): Released all slaves bond2 (unregistering): Releasing active interface vlan3 ============================================ WARNING: possible recursive locking detected 4.14.226-syzkaller #0 Not tainted -------------------------------------------- kworker/u4:4/2875 is trying to acquire lock: (&(&bond->stats_lock)->rlock#4/3){+.+.}, at: [] bond_get_stats+0xb7/0x440 drivers/net/bonding/bond_main.c:3457 but task is already holding lock: (&(&bond->stats_lock)->rlock#4/3){+.+.}, at: [] bond_get_stats+0xb7/0x440 drivers/net/bonding/bond_main.c:3457 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&bond->stats_lock)->rlock#4/3); lock(&(&bond->stats_lock)->rlock#4/3); *** DEADLOCK *** May be due to missing lock nesting notation 6 locks held by kworker/u4:4/2875: #0: ("%s""netns"){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2087 #1: (net_cleanup_work){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2091 #2: (net_mutex){+.+.}, at: [] cleanup_net+0x110/0x840 net/core/net_namespace.c:450 #3: (rtnl_mutex){+.+.}, at: [] rtnl_lock_unregistering net/core/dev.c:8699 [inline] #3: (rtnl_mutex){+.+.}, at: [] default_device_exit_batch+0xd7/0x380 net/core/dev.c:8737 #4: (&(&bond->stats_lock)->rlock#4/3){+.+.}, at: [] bond_get_stats+0xb7/0x440 drivers/net/bonding/bond_main.c:3457 #5: (rcu_read_lock){....}, at: [] bond_get_nest_level drivers/net/bonding/bond_main.c:3446 [inline] #5: (rcu_read_lock){....}, at: [] bond_get_stats+0x9b/0x440 drivers/net/bonding/bond_main.c:3457 stack backtrace: CPU: 0 PID: 2875 Comm: kworker/u4:4 Not tainted 4.14.226-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_deadlock_bug kernel/locking/lockdep.c:1800 [inline] check_deadlock kernel/locking/lockdep.c:1847 [inline] validate_chain kernel/locking/lockdep.c:2448 [inline] __lock_acquire.cold+0x180/0x97c kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 _raw_spin_lock_nested+0x30/0x40 kernel/locking/spinlock.c:362 bond_get_stats+0xb7/0x440 drivers/net/bonding/bond_main.c:3457 dev_get_stats+0xa5/0x280 net/core/dev.c:8011 bond_get_stats+0x1da/0x440 drivers/net/bonding/bond_main.c:3463 __bond_release_one+0x3eb/0x14c0 drivers/net/bonding/bond_main.c:1894 bond_slave_netdev_event drivers/net/bonding/bond_main.c:3134 [inline] bond_netdev_event+0x9ee/0xbd0 drivers/net/bonding/bond_main.c:3232 notifier_call_chain+0x108/0x1a0 kernel/notifier.c:93 call_netdevice_notifiers_info net/core/dev.c:1667 [inline] call_netdevice_notifiers net/core/dev.c:1683 [inline] rollback_registered_many+0x765/0xba0 net/core/dev.c:7203 unregister_netdevice_many.part.0+0x18/0x2e0 net/core/dev.c:8285 unregister_netdevice_many net/core/dev.c:8284 [inline] default_device_exit_batch+0x2d8/0x380 net/core/dev.c:8746 ops_exit_list+0xf9/0x150 net/core/net_namespace.c:145 cleanup_net+0x3b3/0x840 net/core/net_namespace.c:484 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 bond0 (unregistering): Releasing backup interface bond2 bond2 (unregistering): Released all slaves bond1 (unregistering): Releasing active interface vlan2 bond0 (unregistering): Releasing backup interface bond1 bond1 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge3 left promiscuous mode device bridge2 left promiscuous mode device bridge1 left promiscuous mode device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode team0 (unregistering): Port device veth7 removed team0 (unregistering): Port device veth5 removed team0 (unregistering): Port device veth3 removed bond3 (unregistering): Releasing active interface vlan3 bond0 (unregistering): Releasing backup interface bond3 bond3 (unregistering): Released all slaves bond2 (unregistering): Releasing active interface vlan2 bond0 (unregistering): Releasing backup interface bond2 bond2 (unregistering): Released all slaves bond1 (unregistering): Releasing active interface vlan1 bond0 (unregistering): Releasing backup interface bond1 bond1 (unregistering): Released all slaves device hsr_slave_1 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves rxrpc: AF_RXRPC: Leaked local ffff888094874d80 {1} ------------[ cut here ]------------ kernel BUG at net/rxrpc/local_object.c:408! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 2875 Comm: kworker/u4:4 Not tainted 4.14.226-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net task: ffff8880ac0a8500 task.stack: ffff8880ac0b0000 RIP: 0010:rxrpc_destroy_all_locals+0xe6/0x100 net/rxrpc/local_object.c:408 RSP: 0018:ffff8880ac0b7c28 EFLAGS: 00010286 RAX: dffffc0000000000 RBX: ffff88805510a680 RCX: fffffbfff17d6ba8 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000286 RBP: ffff88805510a6a0 R08: ffff8880ac0a8500 R09: dffffc0000000000 R10: 0000000000000000 R11: ffff8880ac0a8500 R12: ffff88805510a6a0 R13: ffff88805510a6b0 R14: dffffc0000000000 R15: fffffbfff13c28bf FS: 0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff391d4e020 CR3: 00000000a145b000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxrpc_exit_net+0x158/0x260 net/rxrpc/net_ns.c:78 ops_exit_list+0xa5/0x150 net/core/net_namespace.c:142 cleanup_net+0x3b3/0x840 net/core/net_namespace.c:484 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Code: 00 00 00 00 00 fc ff df 48 83 eb 20 e8 24 b0 d8 fa 4c 8d 63 20 4c 39 e5 0f 85 11 45 a0 00 e8 12 b0 d8 fa 4c 89 ef e8 8a 0d a4 00 <0f> 0b 48 89 ef e8 90 38 02 fb eb c0 90 90 90 90 90 90 90 90 90 RIP: rxrpc_destroy_all_locals+0xe6/0x100 net/rxrpc/local_object.c:408 RSP: ffff8880ac0b7c28 ---[ end trace f2ed47490ca45c64 ]---