possible deadlock in ieee80211_remove_interfaces ====================================================== WARNING: possible circular locking dependency detected 6.13.0-syzkaller-04046-g0ad9617c78ac #0 Not tainted ------------------------------------------------------ kworker/u8:2/35 is trying to acquire lock: ffffffff8fcc5a88 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] ffffffff8fcc5a88 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 but task is already holding lock: ffff88805f2f8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline] ffff88805f2f8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 wiphy_lock include/net/cfg80211.h:6046 [inline] wiphy_register+0x1a49/0x27b0 net/wireless/core.c:1006 ieee80211_register_hw+0x354e/0x4240 net/mac80211/main.c:1587 mac80211_hwsim_new_radio+0x2a9f/0x4a90 drivers/net/wireless/virtual/mac80211_hwsim.c:5558 init_mac80211_hwsim+0x87a/0xb00 drivers/net/wireless/virtual/mac80211_hwsim.c:6910 do_one_initcall+0x248/0x870 init/main.c:1267 do_initcall_level+0x157/0x210 init/main.c:1329 do_initcalls+0x3f/0x80 init/main.c:1345 kernel_init_freeable+0x435/0x5d0 init/main.c:1578 kernel_init+0x1d/0x2b0 init/main.c:1467 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #0 (rtnl_mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 unregister_netdevice_many net/core/dev.c:11875 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741 unregister_netdevice include/linux/netdevice.h:3329 [inline] _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251 ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305 ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681 mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664 hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x812/0xd60 net/core/net_namespace.c:652 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rdev->wiphy.mtx); lock(rtnl_mutex); lock(&rdev->wiphy.mtx); lock(rtnl_mutex); *** DEADLOCK *** 4 locks held by kworker/u8:2/35: #0: ffff88801baf5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88801baf5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc90000ab7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc90000ab7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fcb94d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 net/core/net_namespace.c:606 #3: ffff88805f2f8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline] #3: ffff88805f2f8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280 stack backtrace: CPU: 0 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted 6.13.0-syzkaller-04046-g0ad9617c78ac #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208 check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 unregister_netdevice_many net/core/dev.c:11875 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741 unregister_netdevice include/linux/netdevice.h:3329 [inline] _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251 ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305 ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681 mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664 hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x812/0xd60 net/core/net_namespace.c:652 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Warning: Permanently added '10.128.0.20' (ED25519) to the list of known hosts. 2025/01/25 01:29:44 ignoring optional flag "sandboxArg"="0" 2025/01/25 01:29:45 parsed 1 programs [ 170.271461][ T5848] cgroup: Unknown subsys name 'net' [ 170.378014][ T5848] cgroup: Unknown subsys name 'cpuset' [ 170.386768][ T5848] cgroup: Unknown subsys name 'rlimit' [ 171.810663][ T5848] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 174.220873][ T5857] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 174.583413][ T5865] chnl_net:caif_netlink_parms(): no params data found [ 174.668394][ T5865] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.675761][ T5865] bridge0: port 1(bridge_slave_0) entered disabled state [ 174.683090][ T5865] bridge_slave_0: entered allmulticast mode [ 174.690939][ T5865] bridge_slave_0: entered promiscuous mode [ 174.701694][ T5865] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.709702][ T5865] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.716951][ T5865] bridge_slave_1: entered allmulticast mode [ 174.723570][ T5865] bridge_slave_1: entered promiscuous mode [ 174.748100][ T5865] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.758892][ T5865] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.781025][ T5865] team0: Port device team_slave_0 added [ 174.808993][ T5865] team0: Port device team_slave_1 added [ 174.828029][ T5865] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.835161][ T5865] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.866138][ T5865] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.885096][ T5865] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.892098][ T5865] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.918273][ T5865] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 174.952955][ T5865] hsr_slave_0: entered promiscuous mode [ 174.959441][ T5865] hsr_slave_1: entered promiscuous mode [ 175.061887][ T5865] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 175.073174][ T5865] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 175.083395][ T5865] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 175.092119][ T5865] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 175.113371][ T5865] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.120714][ T5865] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.128813][ T5865] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.135943][ T5865] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.182653][ T5865] 8021q: adding VLAN 0 to HW filter on device bond0 [ 175.201263][ T226] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.210725][ T226] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.226391][ T5865] 8021q: adding VLAN 0 to HW filter on device team0 [ 175.241497][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.248665][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.261276][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.268397][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.385604][ T5865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.418544][ T5865] veth0_vlan: entered promiscuous mode [ 175.429815][ T5865] veth1_vlan: entered promiscuous mode [ 175.450571][ T5865] veth0_macvtap: entered promiscuous mode [ 175.460066][ T5865] veth1_macvtap: entered promiscuous mode [ 175.475290][ T5865] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 175.490123][ T5865] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 175.500275][ T5865] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.510112][ T5865] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.519130][ T5865] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.528218][ T5865] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.629441][ T5865] syz-executor (5865) used greatest stack depth: 17616 bytes left [ 175.669808][ T35] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.772951][ T35] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.849144][ T35] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.928080][ T35] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.680359][ T5907] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 176.689800][ T5907] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 176.699670][ T5907] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 176.708734][ T5907] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 176.720460][ T5907] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 176.728205][ T5907] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 177.439841][ T226] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.448072][ T226] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.477594][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.486786][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/01/25 01:29:55 executed programs: 0 [ 178.124411][ T5907] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 178.132981][ T5907] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 178.142118][ T5907] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 178.152482][ T5907] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 178.161219][ T5907] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 178.169318][ T5907] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 178.264513][ T5943] chnl_net:caif_netlink_parms(): no params data found [ 178.311147][ T5943] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.318638][ T5943] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.326723][ T5943] bridge_slave_0: entered allmulticast mode [ 178.333335][ T5943] bridge_slave_0: entered promiscuous mode [ 178.340861][ T5943] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.348043][ T5943] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.355292][ T5943] bridge_slave_1: entered allmulticast mode [ 178.361842][ T5943] bridge_slave_1: entered promiscuous mode [ 178.380745][ T5943] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 178.392830][ T5943] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 178.430570][ T5943] team0: Port device team_slave_0 added [ 178.448750][ T5943] team0: Port device team_slave_1 added [ 178.482981][ T5943] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 178.490354][ T5943] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.518133][ T5943] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 178.539307][ T5943] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 178.546974][ T5943] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.573856][ T5943] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 178.590933][ T35] bridge_slave_1: left allmulticast mode [ 178.597200][ T35] bridge_slave_1: left promiscuous mode [ 178.603793][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.616984][ T35] bridge_slave_0: left allmulticast mode [ 178.622641][ T35] bridge_slave_0: left promiscuous mode [ 178.629001][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.858384][ T35] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 178.869458][ T35] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 178.879738][ T35] bond0 (unregistering): Released all slaves [ 178.908622][ T5943] hsr_slave_0: entered promiscuous mode [ 178.917640][ T5943] hsr_slave_1: entered promiscuous mode [ 178.925522][ T5943] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 178.933864][ T5943] Cannot create hsr debugfs directory [ 178.996712][ T35] hsr_slave_0: left promiscuous mode [ 179.003692][ T35] hsr_slave_1: left promiscuous mode [ 179.010658][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.018379][ T35] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 179.030854][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 179.040151][ T35] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 179.061293][ T35] veth1_macvtap: left promiscuous mode [ 179.069553][ T35] veth0_macvtap: left promiscuous mode [ 179.076785][ T35] veth1_vlan: left promiscuous mode [ 179.082325][ T35] veth0_vlan: left promiscuous mode [ 179.456981][ T35] team0 (unregistering): Port device team_slave_1 removed [ 179.487887][ T35] team0 (unregistering): Port device team_slave_0 removed [ 180.235445][ T5145] Bluetooth: hci0: command tx timeout [ 180.504039][ T5943] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 180.517380][ T5943] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 180.542409][ T5943] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 180.570678][ T5943] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 180.655550][ T35] [ 180.657922][ T35] ====================================================== [ 180.664954][ T35] WARNING: possible circular locking dependency detected [ 180.671996][ T35] 6.13.0-syzkaller-04046-g0ad9617c78ac #0 Not tainted [ 180.678772][ T35] ------------------------------------------------------ [ 180.685801][ T35] kworker/u8:2/35 is trying to acquire lock: [ 180.691875][ T35] ffffffff8fcc5a88 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 [ 180.702281][ T35] [ 180.702281][ T35] but task is already holding lock: [ 180.709668][ T35] ffff88805f2f8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 [ 180.720140][ T35] [ 180.720140][ T35] which lock already depends on the new lock. [ 180.720140][ T35] [ 180.730814][ T35] [ 180.730814][ T35] the existing dependency chain (in reverse order) is: [ 180.739994][ T35] [ 180.739994][ T35] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 180.747721][ T35] lock_acquire+0x1ed/0x550 [ 180.752742][ T35] __mutex_lock+0x19c/0x1010 [ 180.757844][ T35] wiphy_register+0x1a49/0x27b0 [ 180.763293][ T35] ieee80211_register_hw+0x354e/0x4240 [ 180.769266][ T35] mac80211_hwsim_new_radio+0x2a9f/0x4a90 [ 180.775495][ T35] init_mac80211_hwsim+0x87a/0xb00 [ 180.781200][ T35] do_one_initcall+0x248/0x870 [ 180.786484][ T35] do_initcall_level+0x157/0x210 [ 180.792039][ T35] do_initcalls+0x3f/0x80 [ 180.796969][ T35] kernel_init_freeable+0x435/0x5d0 [ 180.802690][ T35] kernel_init+0x1d/0x2b0 [ 180.807616][ T35] ret_from_fork+0x4b/0x80 [ 180.812716][ T35] ret_from_fork_asm+0x1a/0x30 [ 180.817988][ T35] [ 180.817988][ T35] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 180.825224][ T35] validate_chain+0x18ef/0x5920 [ 180.830603][ T35] __lock_acquire+0x1397/0x2100 [ 180.836068][ T35] lock_acquire+0x1ed/0x550 [ 180.841085][ T35] __mutex_lock+0x19c/0x1010 [ 180.846325][ T35] unregister_netdevice_many_notify+0xac2/0x2030 [ 180.853250][ T35] unregister_netdevice_queue+0x303/0x370 [ 180.859477][ T35] _cfg80211_unregister_wdev+0x163/0x590 [ 180.865618][ T35] ieee80211_remove_interfaces+0x4ef/0x700 [ 180.871930][ T35] ieee80211_unregister_hw+0x5d/0x2c0 [ 180.877809][ T35] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 180.883863][ T35] hwsim_exit_net+0x5c1/0x670 [ 180.889044][ T35] cleanup_net+0x812/0xd60 [ 180.893967][ T35] process_scheduled_works+0xa66/0x1840 [ 180.900018][ T35] worker_thread+0x870/0xd30 [ 180.905111][ T35] kthread+0x7a9/0x920 [ 180.909684][ T35] ret_from_fork+0x4b/0x80 [ 180.914606][ T35] ret_from_fork_asm+0x1a/0x30 [ 180.919877][ T35] [ 180.919877][ T35] other info that might help us debug this: [ 180.919877][ T35] [ 180.930090][ T35] Possible unsafe locking scenario: [ 180.930090][ T35] [ 180.937611][ T35] CPU0 CPU1 [ 180.942959][ T35] ---- ---- [ 180.948395][ T35] lock(&rdev->wiphy.mtx); [ 180.952893][ T35] lock(rtnl_mutex); [ 180.959386][ T35] lock(&rdev->wiphy.mtx); [ 180.966838][ T35] lock(rtnl_mutex); [ 180.970808][ T35] [ 180.970808][ T35] *** DEADLOCK *** [ 180.970808][ T35] [ 180.978934][ T35] 4 locks held by kworker/u8:2/35: [ 180.984025][ T35] #0: ffff88801baf5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 [ 180.994997][ T35] #1: ffffc90000ab7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 [ 181.005524][ T35] #2: ffffffff8fcb94d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 [ 181.015002][ T35] #3: ffff88805f2f8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 [ 181.025803][ T35] [ 181.025803][ T35] stack backtrace: [ 181.031780][ T35] CPU: 0 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted 6.13.0-syzkaller-04046-g0ad9617c78ac #0 [ 181.031794][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 181.031803][ T35] Workqueue: netns cleanup_net [ 181.031821][ T35] Call Trace: [ 181.031826][ T35] [ 181.031833][ T35] dump_stack_lvl+0x241/0x360 [ 181.031852][ T35] ? __pfx_dump_stack_lvl+0x10/0x10 [ 181.031868][ T35] ? __pfx__printk+0x10/0x10 [ 181.031886][ T35] print_circular_bug+0x13a/0x1b0 [ 181.031905][ T35] check_noncircular+0x36a/0x4a0 [ 181.031922][ T35] ? __pfx_check_noncircular+0x10/0x10 [ 181.031939][ T35] ? lockdep_lock+0x123/0x2b0 [ 181.031956][ T35] validate_chain+0x18ef/0x5920 [ 181.031979][ T35] ? __pfx_validate_chain+0x10/0x10 [ 181.031997][ T35] ? mark_lock+0x9a/0x360 [ 181.032013][ T35] ? __lock_acquire+0x1397/0x2100 [ 181.032032][ T35] ? mark_lock+0x9a/0x360 [ 181.032047][ T35] __lock_acquire+0x1397/0x2100 [ 181.032066][ T35] lock_acquire+0x1ed/0x550 [ 181.032079][ T35] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 181.032097][ T35] ? __pfx_lock_acquire+0x10/0x10 [ 181.032111][ T35] ? __pfx___might_resched+0x10/0x10 [ 181.032125][ T35] ? finish_wait+0xd4/0x1e0 [ 181.032141][ T35] __mutex_lock+0x19c/0x1010 [ 181.032158][ T35] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 181.032176][ T35] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 181.032196][ T35] ? __pfx___mutex_lock+0x10/0x10 [ 181.032213][ T35] ? __pfx___might_resched+0x10/0x10 [ 181.032226][ T35] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 181.032242][ T35] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 181.032257][ T35] unregister_netdevice_many_notify+0xac2/0x2030 [ 181.032272][ T35] ? mark_lock+0x9a/0x360 [ 181.032290][ T35] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 181.032305][ T35] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 181.032322][ T35] ? __pfx_lock_release+0x10/0x10 [ 181.032342][ T35] unregister_netdevice_queue+0x303/0x370 [ 181.032356][ T35] ? __pfx_up_write+0x10/0x10 [ 181.032367][ T35] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 181.032382][ T35] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 181.032399][ T35] _cfg80211_unregister_wdev+0x163/0x590 [ 181.032418][ T35] ieee80211_remove_interfaces+0x4ef/0x700 [ 181.032435][ T35] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 181.032449][ T35] ? rcu_is_watching+0x15/0xb0 [ 181.032468][ T35] ieee80211_unregister_hw+0x5d/0x2c0 [ 181.032481][ T35] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 181.032498][ T35] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 181.032515][ T35] hwsim_exit_net+0x5c1/0x670 [ 181.032529][ T35] ? __pfx_hwsim_exit_net+0x10/0x10 [ 181.032542][ T35] ? __ip_vs_dev_cleanup_batch+0x239/0x260 [ 181.032560][ T35] cleanup_net+0x812/0xd60 [ 181.032573][ T35] ? __pfx_cleanup_net+0x10/0x10 [ 181.032587][ T35] ? process_scheduled_works+0x976/0x1840 [ 181.032600][ T35] process_scheduled_works+0xa66/0x1840 [ 181.032619][ T35] ? __pfx_process_scheduled_works+0x10/0x10 [ 181.032634][ T35] ? assign_work+0x364/0x3d0 [ 181.032647][ T35] worker_thread+0x870/0xd30 [ 181.032662][ T35] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 181.032679][ T35] ? __kthread_parkme+0x169/0x1d0 [ 181.032694][ T35] ? __pfx_worker_thread+0x10/0x10 [ 181.032706][ T35] kthread+0x7a9/0x920 [ 181.032720][ T35] ? __pfx_kthread+0x10/0x10 [ 181.032734][ T35] ? __pfx_worker_thread+0x10/0x10 [ 181.032747][ T35] ? __pfx_kthread+0x10/0x10 [ 181.032761][ T35] ? __pfx_kthread+0x10/0x10 [ 181.032776][ T35] ? __pfx_kthread+0x10/0x10 [ 181.032789][ T35] ? _raw_spin_unlock_irq+0x23/0x50 [ 181.032804][ T35] ? lockdep_hardirqs_on+0x99/0x150 [ 181.032819][ T35] ? __pfx_kthread+0x10/0x10 [ 181.032834][ T35] ret_from_fork+0x4b/0x80 [ 181.032846][ T35] ? __pfx_kthread+0x10/0x10 [ 181.032860][ T35] ret_from_fork_asm+0x1a/0x30 [ 181.032876][ T35] [ 181.496210][ T5943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 181.522187][ T5943] 8021q: adding VLAN 0 to HW filter on device team0 [ 181.551590][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.558748][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 181.599689][ T3541] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.606850][ T3541] bridge0: port 2(bridge_slave_1) entered forwarding state [ 181.834874][ T5943] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 181.860346][ T5943] veth0_vlan: entered promiscuous mode [ 181.875856][ T5943] veth1_vlan: entered promiscuous mode [ 181.898550][ T5943] veth0_macvtap: entered promiscuous mode [ 181.907889][ T5943] veth1_macvtap: entered promiscuous mode [ 181.923242][ T5943] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 181.936709][ T5943] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 181.947029][ T5943] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.960386][ T5943] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.969828][ T5943] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.978867][ T5943] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.007459][ T5943] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht' [ 182.029275][ T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 182.036226][ T5943] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht' [ 182.045668][ T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 182.060406][ T3541] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 182.069110][ T3541] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 syzkaller build log: go env (err=) GO111MODULE='auto' GOARCH='amd64' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFLAGS='' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs-2/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.22.7' GCCGO='gccgo' GOAMD64='v1' AR='ar' CC='gcc' CXX='g++' CGO_ENABLED='1' GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod' GOWORK='' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' PKG_CONFIG='pkg-config' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build537466918=/tmp/go-build -gno-record-gcc-switches' git status (err=) HEAD detached at 67d7ec0a69 nothing to commit, working tree clean tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen go fmt ./sys/... >/dev/null touch .descriptions GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=67d7ec0a69193b2acbb8cdb5109d5505a9128ac5 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250109-184308'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog mkdir -p ./bin/linux_amd64 g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"67d7ec0a69193b2acbb8cdb5109d5505a9128ac5\" /usr/bin/ld: /tmp/ccyKhZYp.o: in function `Connection::Connect(char const*, char const*)': executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking