gretap0 (unregistering): left promiscuous mode ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u8:40/16578 is trying to acquire lock: ffff888058f50e70 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline] ffff888058f50e70 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 but task is already holding lock: ffff88802b7568c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&port->pnodes_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers+0x7c/0xb0 net/core/dev.c:2327 xdp_set_features_flag_locked net/core/xdp.c:1009 [inline] xdp_set_features_flag_locked+0x16e/0x220 net/core/xdp.c:999 xdp_set_features_flag+0x2d/0x40 net/core/xdp.c:1016 bond_xdp_set_features+0x20d/0x350 drivers/net/bonding/bond_main.c:1884 bond_enslave+0x57ed/0x5cb0 drivers/net/bonding/bond_main.c:2340 do_set_master+0x40f/0x730 net/core/rtnetlink.c:3071 do_setlink.isra.0+0xb2b/0x3e60 net/core/rtnetlink.c:3273 rtnl_changelink net/core/rtnetlink.c:3905 [inline] __rtnl_newlink net/core/rtnetlink.c:4076 [inline] rtnl_newlink+0x13c1/0x2620 net/core/rtnetlink.c:4215 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&dev_instance_lock_key#2){+.+.}-{4:4}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12537 ipvlan_device_event+0xf01/0x11e0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12518 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline] ops_undo_list+0x8ff/0xab0 net/core/net_namespace.c:249 cleanup_net+0x499/0x920 net/core/net_namespace.c:706 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); *** DEADLOCK *** locks held by kworker/u8:40/16578: 5, last CPU#0: #0: ffff88801d2d8940 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90004987d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cb6a48 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677 #3: ffffffff90ccf540 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline] #3: ffffffff90ccf540 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:249 #4: ffff88802b7568c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 stack backtrace: CPU: 0 UID: 0 PID: 16578 Comm: kworker/u8:40 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12537 ipvlan_device_event+0xf01/0x11e0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12518 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline] ops_undo_list+0x8ff/0xab0 net/core/net_namespace.c:249 cleanup_net+0x499/0x920 net/core/net_namespace.c:706 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves bond2 (unregistering): Released all slaves tipc: Left network mode dummy0: left promiscuous mode hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth0_vlan: left promiscuous mode wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50