Extracting prog: 3m13.599723365s Minimizing prog: 5m1.890247467s Simplifying prog options: 5m15.233553524s Extracting C: 1m54.849748888s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_clone detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r0}, 0x10) syz_clone(0x160480, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: possible deadlock in lapbeth_device_event single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=53.198893246s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r0}, 0x10) program did not crash testing program (duration=53.198893246s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_clone detailed listing: executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) syz_clone(0x160480, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: possible deadlock in lapbeth_device_event testing program (duration=53.198893246s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone detailed listing: executing program 0: syz_clone(0x160480, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: possible deadlock in lapbeth_device_event extracting C reproducer testing compiled C program (duration=53.198893246s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone program did not crash simplifying guilty program options testing program (duration=53.198893246s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone detailed listing: executing program 0: syz_clone(0x160480, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: possible deadlock in lapbeth_device_event extracting C reproducer testing compiled C program (duration=53.198893246s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone program did not crash testing program (duration=53.198893246s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone detailed listing: executing program 0: syz_clone(0x160480, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: possible deadlock in lapbeth_device_event extracting C reproducer testing compiled C program (duration=53.198893246s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone program did not crash reproducing took 14m36.503780492s repro crashed as (corrupted=false): ============================================ WARNING: possible recursive locking detected 6.14.0-syzkaller-g0c2623cef4f4 #0 Not tainted -------------------------------------------- dhcpcd/5505 is trying to acquire lock: ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2751 [inline] ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: netif_napi_add_weight include/linux/netdevice.h:2783 [inline] ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: lapbeth_new_device drivers/net/wan/lapbether.c:415 [inline] ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: lapbeth_device_event+0x766/0xa20 drivers/net/wan/lapbether.c:460 but task is already holding lock: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2751 [inline] ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270 net/core/dev_api.c:67 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&dev->lock); lock(&dev->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by dhcpcd/5505: #0: ffffffff900fbc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff900fbc48 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34e/0x1d80 net/ipv4/devinet.c:1121 #1: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2751 [inline] #1: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #1: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270 net/core/dev_api.c:67 stack backtrace: CPU: 1 UID: 0 PID: 5505 Comm: dhcpcd Not tainted 6.14.0-syzkaller-g0c2623cef4f4 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_deadlock_bug+0x2be/0x2d0 kernel/locking/lockdep.c:3042 check_deadlock kernel/locking/lockdep.c:3094 [inline] validate_chain+0x928/0x24e0 kernel/locking/lockdep.c:3896 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866 __mutex_lock_common kernel/locking/mutex.c:601 [inline] __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:746 netdev_lock include/linux/netdevice.h:2751 [inline] netif_napi_add_weight include/linux/netdevice.h:2783 [inline] lapbeth_new_device drivers/net/wan/lapbether.c:415 [inline] lapbeth_device_event+0x766/0xa20 drivers/net/wan/lapbether.c:460 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 __dev_notify_flags+0x209/0x410 net/core/dev.c:-1 netif_change_flags+0xf0/0x1a0 net/core/dev.c:9438 dev_change_flags+0x146/0x270 net/core/dev_api.c:68 devinet_ioctl+0xea4/0x1d80 net/ipv4/devinet.c:1200 inet_ioctl+0x3d9/0x4f0 net/ipv4/af_inet.c:1001 sock_do_ioctl+0x15a/0x490 net/socket.c:1190 sock_ioctl+0x644/0x900 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6c0c61dd49 Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8 RSP: 002b:00007fff9c0feb88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f6c0c54f6c0 RCX: 00007f6c0c61dd49 RDX: 00007fff9c10ed78 RSI: 0000000000008914 RDI: 000000000000000f RBP: 00007fff9c11ef38 R08: 00007fff9c10ed38 R09: 00007fff9c10ece8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff9c10ed78 R14: 0000000000000028 R15: 0000000000008914 final repro crashed as (corrupted=false): ============================================ WARNING: possible recursive locking detected 6.14.0-syzkaller-g0c2623cef4f4 #0 Not tainted -------------------------------------------- dhcpcd/5505 is trying to acquire lock: ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2751 [inline] ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: netif_napi_add_weight include/linux/netdevice.h:2783 [inline] ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: lapbeth_new_device drivers/net/wan/lapbether.c:415 [inline] ffff888012678d30 (&dev->lock){+.+.}-{4:4}, at: lapbeth_device_event+0x766/0xa20 drivers/net/wan/lapbether.c:460 but task is already holding lock: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2751 [inline] ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270 net/core/dev_api.c:67 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&dev->lock); lock(&dev->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by dhcpcd/5505: #0: ffffffff900fbc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff900fbc48 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34e/0x1d80 net/ipv4/devinet.c:1121 #1: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2751 [inline] #1: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #1: ffff888063508d30 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270 net/core/dev_api.c:67 stack backtrace: CPU: 1 UID: 0 PID: 5505 Comm: dhcpcd Not tainted 6.14.0-syzkaller-g0c2623cef4f4 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_deadlock_bug+0x2be/0x2d0 kernel/locking/lockdep.c:3042 check_deadlock kernel/locking/lockdep.c:3094 [inline] validate_chain+0x928/0x24e0 kernel/locking/lockdep.c:3896 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866 __mutex_lock_common kernel/locking/mutex.c:601 [inline] __mutex_lock+0x1a5/0x10c0 kernel/locking/mutex.c:746 netdev_lock include/linux/netdevice.h:2751 [inline] netif_napi_add_weight include/linux/netdevice.h:2783 [inline] lapbeth_new_device drivers/net/wan/lapbether.c:415 [inline] lapbeth_device_event+0x766/0xa20 drivers/net/wan/lapbether.c:460 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 __dev_notify_flags+0x209/0x410 net/core/dev.c:-1 netif_change_flags+0xf0/0x1a0 net/core/dev.c:9438 dev_change_flags+0x146/0x270 net/core/dev_api.c:68 devinet_ioctl+0xea4/0x1d80 net/ipv4/devinet.c:1200 inet_ioctl+0x3d9/0x4f0 net/ipv4/af_inet.c:1001 sock_do_ioctl+0x15a/0x490 net/socket.c:1190 sock_ioctl+0x644/0x900 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6c0c61dd49 Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8 RSP: 002b:00007fff9c0feb88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f6c0c54f6c0 RCX: 00007f6c0c61dd49 RDX: 00007fff9c10ed78 RSI: 0000000000008914 RDI: 000000000000000f RBP: 00007fff9c11ef38 R08: 00007fff9c10ed38 R09: 00007fff9c10ece8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff9c10ed78 R14: 0000000000000028 R15: 0000000000008914