====================================================== WARNING: possible circular locking dependency detected 6.8.0-rc7-syzkaller-g707081b61156 #0 Not tainted ------------------------------------------------------ kworker/u4:6/645 is trying to acquire lock: ffff0000db044d20 (team->team_lock_key){+.+.}-{3:3}, at: team_del_slave+0x38/0x1a4 drivers/net/team/team.c:1989 but task is already holding lock: ffff0000e2058768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5932 [inline] ffff0000e2058768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x12c/0x5dc net/mac80211/iface.c:2261 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: __mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:608 __mutex_lock kernel/locking/mutex.c:752 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:804 wiphy_lock include/net/cfg80211.h:5932 [inline] ieee80211_open+0xe4/0x1e4 net/mac80211/iface.c:449 __dev_open+0x32c/0x500 net/core/dev.c:1446 dev_open+0xa8/0x248 net/core/dev.c:1482 team_port_add drivers/net/team/team.c:1215 [inline] team_add_slave+0x7b0/0x2368 drivers/net/team/team.c:1975 do_set_master net/core/rtnetlink.c:2707 [inline] do_setlink+0xc30/0x3794 net/core/rtnetlink.c:2913 __rtnl_newlink net/core/rtnetlink.c:3704 [inline] rtnl_newlink+0x14c0/0x1bcc net/core/rtnetlink.c:3751 rtnetlink_rcv_msg+0x748/0xdbc net/core/rtnetlink.c:6617 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6635 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x65c/0x898 net/netlink/af_netlink.c:1367 netlink_sendmsg+0x83c/0xb20 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x56c/0x840 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x26c/0x33c net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2674 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 -> #0 (team->team_lock_key){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x3384/0x763c kernel/locking/lockdep.c:5137 lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5754 __mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:608 __mutex_lock kernel/locking/mutex.c:752 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:804 team_del_slave+0x38/0x1a4 drivers/net/team/team.c:1989 team_device_event+0x25c/0x4cc drivers/net/team/team.c:3031 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1966 [inline] call_netdevice_notifiers_extack net/core/dev.c:2004 [inline] call_netdevice_notifiers net/core/dev.c:2018 [inline] unregister_netdevice_many_notify+0xd4c/0x17b8 net/core/dev.c:11083 unregister_netdevice_many net/core/dev.c:11139 [inline] unregister_netdevice_queue+0x2d8/0x324 net/core/dev.c:11019 unregister_netdevice include/linux/netdevice.h:3195 [inline] _cfg80211_unregister_wdev+0x164/0x6c4 net/wireless/core.c:1206 cfg80211_unregister_wdev+0x24/0x34 net/wireless/core.c:1261 ieee80211_remove_interfaces+0x418/0x5dc net/mac80211/iface.c:2286 ieee80211_unregister_hw+0x60/0x29c net/mac80211/main.c:1495 mac80211_hwsim_del_radio+0x21c/0x3e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5435 hwsim_exit_net+0x51c/0x5e4 drivers/net/wireless/virtual/mac80211_hwsim.c:6312 ops_exit_list net/core/net_namespace.c:170 [inline] cleanup_net+0x564/0x8d0 net/core/net_namespace.c:618 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rdev->wiphy.mtx); lock(team->team_lock_key); lock(&rdev->wiphy.mtx); lock(team->team_lock_key); *** DEADLOCK *** 5 locks held by kworker/u4:6/645: #0: ffff0000c0023d38 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x560/0x1204 kernel/workqueue.c:2606 #1: ffff800098957c20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x5a0/0x1204 kernel/workqueue.c:2608 #2: ffff800091943350 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf4/0x8d0 net/core/net_namespace.c:580 #3: ffff80009194f2e8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:79 #4: ffff0000e2058768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5932 [inline] #4: ffff0000e2058768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x12c/0x5dc net/mac80211/iface.c:2261 stack backtrace: CPU: 0 PID: 645 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: netns cleanup_net Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 dump_stack+0x1c/0x28 lib/dump_stack.c:113 print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2060 check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x3384/0x763c kernel/locking/lockdep.c:5137 lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5754 __mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:608 __mutex_lock kernel/locking/mutex.c:752 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:804 team_del_slave+0x38/0x1a4 drivers/net/team/team.c:1989 team_device_event+0x25c/0x4cc drivers/net/team/team.c:3031 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1966 [inline] call_netdevice_notifiers_extack net/core/dev.c:2004 [inline] call_netdevice_notifiers net/core/dev.c:2018 [inline] unregister_netdevice_many_notify+0xd4c/0x17b8 net/core/dev.c:11083 unregister_netdevice_many net/core/dev.c:11139 [inline] unregister_netdevice_queue+0x2d8/0x324 net/core/dev.c:11019 unregister_netdevice include/linux/netdevice.h:3195 [inline] _cfg80211_unregister_wdev+0x164/0x6c4 net/wireless/core.c:1206 cfg80211_unregister_wdev+0x24/0x34 net/wireless/core.c:1261 ieee80211_remove_interfaces+0x418/0x5dc net/mac80211/iface.c:2286 ieee80211_unregister_hw+0x60/0x29c net/mac80211/main.c:1495 mac80211_hwsim_del_radio+0x21c/0x3e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5435 hwsim_exit_net+0x51c/0x5e4 drivers/net/wireless/virtual/mac80211_hwsim.c:6312 ops_exit_list net/core/net_namespace.c:170 [inline] cleanup_net+0x564/0x8d0 net/core/net_namespace.c:618 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 team0: Port device wlan1 removed hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): Released all slaves team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): Released all slaves netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 team0: Port device wlan1 removed hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): Released all slaves netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 team0: Port device wlan1 removed hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): Released all slaves