bond5 (unregistering): Released all slaves
======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 Not tainted
------------------------------------------------------
kworker/u32:2/22754 is trying to acquire lock:
ffff88806cc5ce00 (team->team_lock_key#12){+.+.}-{4:4}, at: team_del_slave+0x31/0x1b0 drivers/net/team/team_core.c:2003

but task is already holding lock:
ffff888072bc0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6062 [inline]
ffff888072bc0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf0/0x720 net/mac80211/iface.c:2337

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:602 [inline]
       __mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
       class_wiphy_constructor include/net/cfg80211.h:6062 [inline]
       ieee80211_open+0x132/0x210 net/mac80211/iface.c:445
       __dev_open+0x2e7/0x7d0 net/core/dev.c:1683
       netif_open+0xf2/0x160 net/core/dev.c:1706
       dev_open+0xb2/0x260 net/core/dev_api.c:201
       team_port_add drivers/net/team/team_core.c:1230 [inline]
       team_add_slave+0xaf0/0x21a0 drivers/net/team/team_core.c:1989
       do_set_master+0x40c/0x730 net/core/rtnetlink.c:2946
       do_setlink.constprop.0+0xbd8/0x4380 net/core/rtnetlink.c:3148
       rtnl_changelink net/core/rtnetlink.c:3759 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3918 [inline]
       rtnl_newlink+0x1446/0x2000 net/core/rtnetlink.c:4055
       rtnetlink_rcv_msg+0x95b/0xe90 net/core/rtnetlink.c:6944
       netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552
       netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
       netlink_unicast+0x58a/0x850 net/netlink/af_netlink.c:1346
       netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896
       sock_sendmsg_nosec net/socket.c:712 [inline]
       __sock_sendmsg net/socket.c:727 [inline]
       ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
       ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
       __sys_sendmsg+0x16d/0x220 net/socket.c:2652
       do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
       __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306
       do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
       entry_SYSENTER_compat_after_hwframe+0x84/0x8e

-> #0 (team->team_lock_key#12){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3168 [inline]
       check_prevs_add kernel/locking/lockdep.c:3287 [inline]
       validate_chain kernel/locking/lockdep.c:3911 [inline]
       __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
       lock_acquire kernel/locking/lockdep.c:5871 [inline]
       lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
       __mutex_lock_common kernel/locking/mutex.c:602 [inline]
       __mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
       team_del_slave+0x31/0x1b0 drivers/net/team/team_core.c:2003
       team_device_event+0xd0/0x770 drivers/net/team/team_core.c:3000
       notifier_call_chain+0xb9/0x410 kernel/notifier.c:85
       call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230
       call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
       call_netdevice_notifiers net/core/dev.c:2282 [inline]
       unregister_netdevice_many_notify+0xf9d/0x2700 net/core/dev.c:12077
       unregister_netdevice_many net/core/dev.c:12140 [inline]
       unregister_netdevice_queue+0x305/0x3f0 net/core/dev.c:11984
       unregister_netdevice include/linux/netdevice.h:3379 [inline]
       _cfg80211_unregister_wdev+0x64b/0x830 net/wireless/core.c:1256
       ieee80211_remove_interfaces+0x34e/0x720 net/mac80211/iface.c:2362
       ieee80211_unregister_hw+0x55/0x3a0 net/mac80211/main.c:1683
       mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim.c:5671 [inline]
       hwsim_exit_net+0x3ac/0x7d0 drivers/net/wireless/virtual/mac80211_hwsim.c:6551
       ops_exit_list net/core/net_namespace.c:200 [inline]
       ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253
       cleanup_net+0x408/0x890 net/core/net_namespace.c:686
       process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
       process_scheduled_works kernel/workqueue.c:3321 [inline]
       worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
       kthread+0x3c5/0x780 kernel/kthread.c:464
       ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&rdev->wiphy.mtx);
                               lock(team->team_lock_key#12);
                               lock(&rdev->wiphy.mtx);
  lock(team->team_lock_key#12);

 *** DEADLOCK ***

5 locks held by kworker/u32:2/22754:
 #0: ffff88801ca8f948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
 #1: ffffc9000349fd10 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
 #2: ffffffff90349f90 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x890 net/core/net_namespace.c:662
 #3: ffffffff9035ffe8 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x4d/0x3a0 net/mac80211/main.c:1676
 #4: ffff888072bc0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6062 [inline]
 #4: ffff888072bc0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf0/0x720 net/mac80211/iface.c:2337

stack backtrace:
CPU: 3 UID: 0 PID: 22754 Comm: kworker/u32:2 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_circular_bug+0x275/0x350 kernel/locking/lockdep.c:2046
 check_noncircular+0x14c/0x170 kernel/locking/lockdep.c:2178
 check_prev_add kernel/locking/lockdep.c:3168 [inline]
 check_prevs_add kernel/locking/lockdep.c:3287 [inline]
 validate_chain kernel/locking/lockdep.c:3911 [inline]
 __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
 lock_acquire kernel/locking/lockdep.c:5871 [inline]
 lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
 __mutex_lock_common kernel/locking/mutex.c:602 [inline]
 __mutex_lock+0x199/0xb90 kernel/locking/mutex.c:747
 team_del_slave+0x31/0x1b0 drivers/net/team/team_core.c:2003
 team_device_event+0xd0/0x770 drivers/net/team/team_core.c:3000
 notifier_call_chain+0xb9/0x410 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230
 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
 call_netdevice_notifiers net/core/dev.c:2282 [inline]
 unregister_netdevice_many_notify+0xf9d/0x2700 net/core/dev.c:12077
 unregister_netdevice_many net/core/dev.c:12140 [inline]
 unregister_netdevice_queue+0x305/0x3f0 net/core/dev.c:11984
 unregister_netdevice include/linux/netdevice.h:3379 [inline]
 _cfg80211_unregister_wdev+0x64b/0x830 net/wireless/core.c:1256
 ieee80211_remove_interfaces+0x34e/0x720 net/mac80211/iface.c:2362
 ieee80211_unregister_hw+0x55/0x3a0 net/mac80211/main.c:1683
 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim.c:5671 [inline]
 hwsim_exit_net+0x3ac/0x7d0 drivers/net/wireless/virtual/mac80211_hwsim.c:6551
 ops_exit_list net/core/net_namespace.c:200 [inline]
 ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253
 cleanup_net+0x408/0x890 net/core/net_namespace.c:686
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
team0: Port device wlan1 removed
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
IPVS: stop unused estimator thread 0...
------------[ cut here ]------------
WARNING: CPU: 1 PID: 22754 at net/xfrm/xfrm_state.c:3284 xfrm_state_fini+0x28c/0x320 net/xfrm/xfrm_state.c:3284
Modules linked in:
CPU: 1 UID: 0 PID: 22754 Comm: kworker/u32:2 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:xfrm_state_fini+0x28c/0x320 net/xfrm/xfrm_state.c:3284
Code: 99 f7 90 0f 0b 90 e9 e7 fe ff ff e8 1e 64 99 f7 90 0f 0b 90 e9 39 ff ff ff e8 10 64 99 f7 90 0f 0b 90 eb 8a e8 05 64 99 f7 90 <0f> 0b 90 e9 d5 fd ff ff e8 d7 be fd f7 e9 f8 fd ff ff e8 fd be fd
RSP: 0000:ffffc9000349faa0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88806fb68000 RCX: fffff52000693f25
RDX: ffff888025e90000 RSI: ffffffff8a21f0eb RDI: ffff888025e90444
RBP: ffff88806fb694c0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000002c00 R12: ffffc9000349fbe8
R13: dffffc0000000000 R14: fffffbfff20a4788 R15: ffffffff90523c20
FS:  0000000000000000(0000) GS:ffff88809762d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000008004b000 CR3: 000000000e382000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 xfrm_net_exit+0x2d/0x70 net/xfrm/xfrm_policy.c:4348
 ops_exit_list net/core/net_namespace.c:200 [inline]
 ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253
 cleanup_net+0x408/0x890 net/core/net_namespace.c:686
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>