====================================================== WARNING: possible circular locking dependency detected 4.14.298-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.5/8002 is trying to acquire lock: (rtnl_mutex){+.+.}, at: [] unregister_netdevice_notifier+0x5e/0x2b0 net/core/dev.c:1630 but task is already holding lock: (&xt[i].mutex){+.+.}, at: [] xt_find_table_lock+0x38/0x3d0 net/netfilter/x_tables.c:1088 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&xt[i].mutex){+.+.}: __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893 xt_find_target+0x3e/0x1e0 net/netfilter/x_tables.c:232 xt_request_find_target net/netfilter/x_tables.c:261 [inline] xt_request_find_target+0x72/0xe0 net/netfilter/x_tables.c:254 ipt_init_target+0xb9/0x250 net/sched/act_ipt.c:45 __tcf_ipt_init+0x48d/0xc00 net/sched/act_ipt.c:168 tcf_xt_init+0x43/0x50 net/sched/act_ipt.c:210 tcf_action_init_1+0x51a/0x9e0 net/sched/act_api.c:691 tcf_action_init+0x26d/0x400 net/sched/act_api.c:760 tcf_action_add net/sched/act_api.c:1088 [inline] tc_ctl_action+0x2e3/0x510 net/sched/act_api.c:1140 rtnetlink_rcv_msg+0x3be/0xb10 net/core/rtnetlink.c:4322 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2454 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 sock_no_sendpage+0xe2/0x110 net/core/sock.c:2610 kernel_sendpage net/socket.c:3407 [inline] sock_sendpage+0xdf/0x140 net/socket.c:871 pipe_to_sendpage+0x226/0x2d0 fs/splice.c:451 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x326/0x7a0 fs/splice.c:626 splice_from_pipe fs/splice.c:661 [inline] generic_splice_sendpage+0xc1/0x110 fs/splice.c:832 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0xd59/0x1380 fs/splice.c:1382 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 -> #0 (rtnl_mutex){+.+.}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893 unregister_netdevice_notifier+0x5e/0x2b0 net/core/dev.c:1630 tee_tg_destroy+0x5c/0xb0 net/netfilter/xt_TEE.c:123 cleanup_entry+0x232/0x310 net/ipv6/netfilter/ip6_tables.c:685 __do_replace+0x38d/0x580 net/ipv4/netfilter/arp_tables.c:930 do_replace net/ipv6/netfilter/ip6_tables.c:1162 [inline] do_ip6t_set_ctl+0x256/0x3b0 net/ipv6/netfilter/ip6_tables.c:1688 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x5f/0xb0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0xc0/0x120 net/ipv6/ipv6_sockglue.c:937 tcp_setsockopt+0x7b/0xc0 net/ipv4/tcp.c:2831 SYSC_setsockopt net/socket.c:1865 [inline] SyS_setsockopt+0x110/0x1e0 net/socket.c:1844 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&xt[i].mutex); lock(rtnl_mutex); lock(&xt[i].mutex); lock(rtnl_mutex); *** DEADLOCK *** 1 lock held by syz-executor.5/8002: #0: (&xt[i].mutex){+.+.}, at: [] xt_find_table_lock+0x38/0x3d0 net/netfilter/x_tables.c:1088 stack backtrace: CPU: 0 PID: 8002 Comm: syz-executor.5 Not tainted 4.14.298-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893 unregister_netdevice_notifier+0x5e/0x2b0 net/core/dev.c:1630 tee_tg_destroy+0x5c/0xb0 net/netfilter/xt_TEE.c:123 cleanup_entry+0x232/0x310 net/ipv6/netfilter/ip6_tables.c:685 __do_replace+0x38d/0x580 net/ipv4/netfilter/arp_tables.c:930 do_replace net/ipv6/netfilter/ip6_tables.c:1162 [inline] do_ip6t_set_ctl+0x256/0x3b0 net/ipv6/netfilter/ip6_tables.c:1688 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x5f/0xb0 net/netfilter/nf_sockopt.c:115 ipv6_setsockopt+0xc0/0x120 net/ipv6/ipv6_sockglue.c:937 tcp_setsockopt+0x7b/0xc0 net/ipv4/tcp.c:2831 SYSC_setsockopt net/socket.c:1865 [inline] SyS_setsockopt+0x110/0x1e0 net/socket.c:1844 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table IPVS: ftp: loaded support on port[0] = 21 netlink: 284 bytes leftover after parsing attributes in process `syz-executor.0'. 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link netlink: 284 bytes leftover after parsing attributes in process `syz-executor.0'. bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link netlink: 284 bytes leftover after parsing attributes in process `syz-executor.0'. bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode bond0: Releasing backup interface team0 syz-executor.5 (13223) used greatest stack depth: 23952 bytes left bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 bond0: Enslaving team0 as an active interface with an up link netlink: 284 bytes leftover after parsing attributes in process `syz-executor.0'. bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode netlink: 284 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 284 bytes leftover after parsing attributes in process `syz-executor.4'. device team0 left promiscuous mode device team_slave_0 left promiscuous mode new mount options do not match the existing superblock, will be ignored device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 new mount options do not match the existing superblock, will be ignored bond0: Enslaving team0 as an active interface with an up link bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode netlink: 284 bytes leftover after parsing attributes in process `syz-executor.2'. new mount options do not match the existing superblock, will be ignored device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 new mount options do not match the existing superblock, will be ignored bond0: Enslaving team0 as an active interface with an up link netlink: 284 bytes leftover after parsing attributes in process `syz-executor.4'. bond0: Releasing backup interface team0 bridge0: port 3(team0) entered blocking state new mount options do not match the existing superblock, will be ignored bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode netlink: 284 bytes leftover after parsing attributes in process `syz-executor.2'. new mount options do not match the existing superblock, will be ignored device team0 left promiscuous mode new mount options do not match the existing superblock, will be ignored device team_slave_0 left promiscuous mode new mount options do not match the existing superblock, will be ignored device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 new mount options do not match the existing superblock, will be ignored bond0: Enslaving team0 as an active interface with an up link new mount options do not match the existing superblock, will be ignored bond0: Releasing backup interface team0 new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state new mount options do not match the existing superblock, will be ignored device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode new mount options do not match the existing superblock, will be ignored netlink: 284 bytes leftover after parsing attributes in process `syz-executor.4'. new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored