possible deadlock in ieee80211_uninit netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 ============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- kworker/u32:2/5754 is trying to acquire lock: ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: wiphy_lock include/net/cfg80211.h:6890 [inline] ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_uninit+0x104/0x2e0 net/mac80211/iface.c:957 but task is already holding lock: ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf0/0x6e0 net/mac80211/iface.c:2511 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rdev->wiphy.mtx); lock(&rdev->wiphy.mtx); *** DEADLOCK *** May be due to missing lock nesting notation locks held by kworker/u32:2/5754: 5, last CPU#3: #0: ffff88801d6a7140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90003e3fd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cbbfa8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677 #3: ffffffff90cd4b00 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x4d/0x360 net/mac80211/main.c:1714 #4: ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] #4: ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf0/0x6e0 net/mac80211/iface.c:2511 stack backtrace: CPU: 3 UID: 0 PID: 5754 Comm: kworker/u32:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_deadlock_bug.cold+0xbd/0xca kernel/locking/lockdep.c:3085 check_deadlock kernel/locking/lockdep.c:3137 [inline] validate_chain kernel/locking/lockdep.c:3939 [inline] __lock_acquire+0x13f4/0x1f40 kernel/locking/lockdep.c:5288 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 wiphy_lock include/net/cfg80211.h:6890 [inline] ieee80211_uninit+0x104/0x2e0 net/mac80211/iface.c:957 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12580 unregister_netdevice_many net/core/dev.c:12632 [inline] unregister_netdevice_queue net/core/dev.c:12433 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12419 unregister_netdevice include/linux/netdevice.h:3490 [inline] _cfg80211_unregister_wdev+0x66e/0x830 net/wireless/core.c:1451 ieee80211_remove_interfaces+0x34e/0x6e0 net/mac80211/iface.c:2536 ieee80211_unregister_hw+0x55/0x360 net/mac80211/main.c:1721 mac80211_hwsim_del_radio drivers/net/wireless/virtual/mac80211_hwsim_main.c:6256 [inline] hwsim_exit_net+0x891/0x1500 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7269 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2ee/0xab0 net/core/net_namespace.c:253 cleanup_net+0x499/0x920 net/core/net_namespace.c:706 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Warning: Permanently added '[localhost]:3021' (ED25519) to the list of known hosts. [ 51.520000][ T43] kauditd_printk_skb: 17 callbacks suppressed [ 51.520014][ T43] audit: type=1400 audit(1791023277.948:138): avc: denied { execute } for pid=5727 comm="sh" name="syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 51.520308][ T43] audit: type=1400 audit(1791023277.948:139): avc: denied { execute_no_trans } for pid=5727 comm="sh" path="/syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 2026/10/03 10:27:59 parsed 1 programs 2026/10/03 10:27:59 serving rpc on tcp://37171 [ 52.857933][ T43] audit: type=1400 audit(1791023279.278:140): avc: denied { node_bind } for pid=5727 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 52.861685][ T43] audit: type=1400 audit(1791023279.288:141): avc: denied { node_bind } for pid=5727 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 55.972647][ T43] audit: type=1400 audit(1791023282.398:142): avc: denied { mounton } for pid=5736 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 55.975690][ T43] audit: type=1400 audit(1791023282.398:143): avc: denied { mount } for pid=5736 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 55.979766][ T5736] cgroup: Unknown subsys name 'net' [ 55.982024][ T43] audit: type=1400 audit(1791023282.408:144): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 56.153866][ T5736] cgroup: Unknown subsys name 'cpuset' [ 56.157732][ T5736] cgroup: Unknown subsys name 'rlimit' [ 56.300812][ T43] audit: type=1400 audit(1791023282.728:145): avc: denied { setattr } for pid=5736 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 56.301254][ T43] audit: type=1400 audit(1791023282.728:146): avc: denied { create } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 56.301552][ T43] audit: type=1400 audit(1791023282.728:147): avc: denied { write } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 56.359977][ T5739] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 57.319932][ T5736] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 59.402243][ T43] kauditd_printk_skb: 11 callbacks suppressed [ 59.402257][ T43] audit: type=1400 audit(1791023285.828:159): avc: denied { execmem } for pid=5744 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 59.407732][ T43] audit: type=1400 audit(1791023285.828:160): avc: denied { read } for pid=5748 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 59.407854][ T43] audit: type=1400 audit(1791023285.828:161): avc: denied { open } for pid=5748 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 59.408732][ T43] audit: type=1400 audit(1791023285.828:162): avc: denied { mounton } for pid=5748 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 59.415196][ T43] audit: type=1400 audit(1791023285.838:163): avc: denied { mounton } for pid=5747 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 59.416357][ T43] audit: type=1400 audit(1791023285.838:164): avc: denied { mount } for pid=5747 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 59.539982][ T43] audit: type=1400 audit(1791023285.968:165): avc: denied { mount } for pid=5748 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 59.541092][ T43] audit: type=1400 audit(1791023285.968:166): avc: denied { mounton } for pid=5748 comm="syz-executor" path="/syzkaller.9VQWV5/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 59.542485][ T43] audit: type=1400 audit(1791023285.968:167): avc: denied { mount } for pid=5748 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 59.544889][ T43] audit: type=1400 audit(1791023285.968:168): avc: denied { mounton } for pid=5748 comm="syz-executor" path="/syzkaller.9VQWV5/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 59.594204][ T5748] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 59.943129][ T5779] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 59.946364][ T5779] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 59.950526][ T5779] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 59.960117][ T5779] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 59.963921][ T5779] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 61.124827][ T5764] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.125481][ T5764] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.125543][ T5764] bridge_slave_0: entered allmulticast mode [ 61.126359][ T5764] bridge_slave_0: entered promiscuous mode [ 61.138559][ T5764] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.138632][ T5764] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.138701][ T5764] bridge_slave_1: entered allmulticast mode [ 61.139833][ T5764] bridge_slave_1: entered promiscuous mode [ 61.174937][ T5764] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.178356][ T5764] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.225672][ T5764] team0: Port device team_slave_0 added [ 61.227620][ T5764] team0: Port device team_slave_1 added [ 61.276342][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.276356][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.303023][ T5764] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.303040][ T5764] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.303062][ T5764] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.313153][ T5764] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.313169][ T5764] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.313191][ T5764] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 61.428130][ T5764] hsr_slave_0: entered promiscuous mode [ 61.429908][ T5764] hsr_slave_1: entered promiscuous mode [ 61.432769][ T123] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.432782][ T123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.640812][ T5764] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 61.647900][ T5764] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 61.649575][ T5764] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 61.656445][ T5764] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 61.657482][ T5764] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 61.660780][ T5764] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 61.661377][ T5764] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 61.665359][ T5764] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 61.742268][ T5764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.757393][ T5764] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.763588][ T123] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.763715][ T123] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.770216][ T123] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.770315][ T123] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.069435][ T5764] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.118372][ T5764] veth0_vlan: entered promiscuous mode [ 62.130265][ T5764] veth1_vlan: entered promiscuous mode [ 62.157940][ T5764] veth0_macvtap: entered promiscuous mode [ 62.163521][ T5764] veth1_macvtap: entered promiscuous mode [ 62.176072][ T5764] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 62.182160][ T5764] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 62.222339][ T5837] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.222369][ T5837] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.222388][ T5837] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.222406][ T5837] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/10/03 10:28:08 executed programs: 0 [ 62.306702][ T67] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 62.307358][ T67] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 62.307672][ T5837] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.307844][ T67] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 62.308651][ T67] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 62.310251][ T67] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 62.385919][ T5837] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.458551][ T5837] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.555997][ T5837] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.733665][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.733751][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.733807][ T5864] bridge_slave_0: entered allmulticast mode [ 62.734597][ T5864] bridge_slave_0: entered promiscuous mode [ 62.736150][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.736191][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.736246][ T5864] bridge_slave_1: entered allmulticast mode [ 62.736966][ T5864] bridge_slave_1: entered promiscuous mode [ 62.756877][ T5864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.758628][ T5864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.776522][ T5864] team0: Port device team_slave_0 added [ 62.777943][ T5864] team0: Port device team_slave_1 added [ 62.790941][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.790957][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.790977][ T5864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.793067][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.793081][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.793102][ T5864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.814915][ T5864] hsr_slave_0: entered promiscuous mode [ 62.815489][ T5864] hsr_slave_1: entered promiscuous mode [ 62.815842][ T5864] debugfs: 'hsr0' already exists in 'hsr' [ 62.815935][ T5864] Cannot create hsr debugfs directory [ 64.359905][ T67] Bluetooth: hci0: command tx timeout [ 65.513797][ T5837] bridge_slave_1: left allmulticast mode [ 65.513852][ T5837] bridge_slave_1: left promiscuous mode [ 65.515345][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.527936][ T5837] bridge_slave_0: left allmulticast mode [ 65.527953][ T5837] bridge_slave_0: left promiscuous mode [ 65.528170][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.590137][ T43] kauditd_printk_skb: 20 callbacks suppressed [ 65.590156][ T43] audit: type=1400 audit(1791023292.018:189): avc: denied { write } for pid=5883 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 65.590377][ T43] audit: type=1400 audit(1791023292.018:190): avc: denied { create } for pid=5883 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.590877][ T43] audit: type=1400 audit(1791023292.018:191): avc: denied { write } for pid=5883 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth2.link" dev="tmpfs" ino=2013 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.591303][ T43] audit: type=1400 audit(1791023292.018:192): avc: denied { append } for pid=5883 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" dev="tmpfs" ino=2013 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.649792][ T43] audit: type=1400 audit(1791023292.078:193): avc: denied { write } for pid=5886 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 65.649931][ T43] audit: type=1400 audit(1791023292.078:194): avc: denied { unlink } for pid=5886 comm="rm" name="resolv.conf.eth2.link" dev="tmpfs" ino=2013 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.662713][ T5837] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 65.685485][ T5837] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 65.686538][ T5837] bond0 (unregistering): Released all slaves [ 65.733369][ T5441] 8021q: adding VLAN 0 to HW filter on device eth2 [ 65.763611][ T5837] hsr_slave_0: left promiscuous mode [ 65.764176][ T5837] hsr_slave_1: left promiscuous mode [ 65.764872][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.764895][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 65.765793][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.765807][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 65.776211][ T5837] veth1_macvtap: left promiscuous mode [ 65.776258][ T5837] veth0_macvtap: left promiscuous mode [ 65.776383][ T5837] veth1_vlan: left promiscuous mode [ 65.776449][ T5837] veth0_vlan: left promiscuous mode [ 65.995161][ T5837] team0 (unregistering): Port device team_slave_1 removed [ 66.010657][ T5837] team0 (unregistering): Port device team_slave_0 removed [ 66.242707][ T43] audit: type=1400 audit(1791023292.668:195): avc: denied { write } for pid=5889 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.318339][ T43] audit: type=1400 audit(1791023292.738:196): avc: denied { write } for pid=5892 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.439075][ T67] Bluetooth: hci0: command tx timeout [ 66.439466][ T5864] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.442488][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 66.443164][ T5864] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.444629][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 66.445152][ T5864] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.447862][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 66.448537][ T5864] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.455828][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 66.458030][ T43] audit: type=1400 audit(1791023292.878:197): avc: denied { write } for pid=5895 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.525202][ T43] audit: type=1400 audit(1791023292.948:198): avc: denied { write } for pid=5905 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.543482][ T5864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.563932][ T5864] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.570011][ T209] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.570091][ T209] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.579873][ T209] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.579960][ T209] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.879344][ T5864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.922063][ T5864] veth0_vlan: entered promiscuous mode [ 66.928641][ T5864] veth1_vlan: entered promiscuous mode [ 66.962353][ T5864] veth0_macvtap: entered promiscuous mode [ 66.964951][ T5864] veth1_macvtap: entered promiscuous mode [ 66.973999][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.978182][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.009928][ T5754] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.043791][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.043805][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.049131][ T5837] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.072199][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.072217][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.079714][ T5837] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.090038][ T5754] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.666773][ T5754] [ 67.667906][ T5754] ============================================ [ 67.670864][ T5754] WARNING: possible recursive locking detected [ 67.673721][ T5754] syzkaller #0 Not tainted [ 67.675241][ T5754] -------------------------------------------- [ 67.677627][ T5754] kworker/u32:2/5754 is trying to acquire lock: [ 67.680230][ T5754] ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_uninit+0x104/0x2e0 [ 67.684005][ T5754] [ 67.684005][ T5754] but task is already holding lock: [ 67.687170][ T5754] ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf0/0x6e0 [ 67.691869][ T5754] [ 67.691869][ T5754] other info that might help us debug this: [ 67.695164][ T5754] Possible unsafe locking scenario: [ 67.695164][ T5754] [ 67.698279][ T5754] CPU0 [ 67.699702][ T5754] ---- [ 67.701072][ T5754] lock(&rdev->wiphy.mtx); [ 67.702958][ T5754] lock(&rdev->wiphy.mtx); [ 67.704806][ T5754] [ 67.704806][ T5754] *** DEADLOCK *** [ 67.704806][ T5754] [ 67.708010][ T5754] May be due to missing lock nesting notation [ 67.708010][ T5754] [ 67.710898][ T5754] locks held by kworker/u32:2/5754: 5, last CPU#3: [ 67.713491][ T5754] #0: ffff88801d6a7140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 67.717245][ T5754] #1: ffffc90003e3fd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 67.721603][ T5754] #2: ffffffff90cbbfa8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 [ 67.727220][ T5754] #3: ffffffff90cd4b00 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x4d/0x360 [ 67.731071][ T5754] #4: ffff8880539b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf0/0x6e0 [ 67.734602][ T5754] [ 67.734602][ T5754] stack backtrace: [ 67.736954][ T5754] CPU: 3 UID: 0 PID: 5754 Comm: kworker/u32:2 Not tainted syzkaller #0 PREEMPT(full) [ 67.740313][ T5754] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.744149][ T5754] Workqueue: netns cleanup_net [ 67.745929][ T5754] Call Trace: [ 67.747399][ T5754] [ 67.748493][ T5754] dump_stack_lvl+0x100/0x190 [ 67.750079][ T5754] print_deadlock_bug.cold+0xbd/0xca [ 67.751840][ T5754] __lock_acquire+0x13f4/0x1f40 [ 67.753682][ T5754] lock_acquire+0x1d1/0x380 [ 67.755394][ T5754] ? ieee80211_uninit+0x104/0x2e0 [ 67.757427][ T5754] ? __pfx___might_resched+0x10/0x10 [ 67.759654][ T5754] __mutex_lock+0x1a4/0x1bd0 [ 67.761548][ T5754] ? ieee80211_uninit+0x104/0x2e0 [ 67.763313][ T5754] ? ieee80211_uninit+0x104/0x2e0 [ 67.765265][ T5754] ? ib_device_get_by_netdev+0x1a8/0x530 [ 67.767507][ T5754] ? __pfx___mutex_lock+0x10/0x10 [ 67.769502][ T5754] ? vxlan_netdevice_event+0x11f/0x370 [ 67.771717][ T5754] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 67.774156][ T5754] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 67.776825][ T5754] ? __pfx_vxlan_netdevice_event+0x10/0x10 [ 67.779316][ T5754] ? ip6_route_dev_notify+0xe4/0x750 [ 67.782010][ T5754] ? ndisc_netdev_event+0xa1/0x560 [ 67.784532][ T5754] ? ieee80211_uninit+0x104/0x2e0 [ 67.787098][ T5754] ? rtnl_is_locked+0x15/0x20 [ 67.789325][ T5754] ieee80211_uninit+0x104/0x2e0 [ 67.791104][ T5754] ? __pfx_ieee80211_uninit+0x10/0x10 [ 67.792953][ T5754] unregister_netdevice_many_notify+0x1407/0x2150 [ 67.794957][ T5754] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 67.797525][ T5754] ? rcu_is_watching+0x13/0xc0 [ 67.799462][ T5754] unregister_netdevice_queue+0x30b/0x3c0 [ 67.801666][ T5754] ? kernfs_remove_by_name_ns+0x103/0x120 [ 67.803902][ T5754] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 67.806383][ T5754] _cfg80211_unregister_wdev+0x66e/0x830 [ 67.808647][ T5754] ieee80211_remove_interfaces+0x34e/0x6e0 [ 67.811148][ T5754] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 67.813691][ T5754] ieee80211_unregister_hw+0x55/0x360 [ 67.815846][ T5754] hwsim_exit_net+0x891/0x1500 [ 67.818006][ T5754] ? __pfx_hwsim_exit_net+0x10/0x10 [ 67.821567][ T5754] ? __pfx___might_resched+0x10/0x10 [ 67.823580][ T5754] ? ip_vs_sync_net_cleanup+0x84/0x90 [ 67.825315][ T5754] ? __ip_vs_dev_cleanup_batch+0x21e/0x2a0 [ 67.827144][ T5754] ? __pfx_hwsim_exit_net+0x10/0x10 [ 67.828885][ T5754] ops_undo_list+0x2ee/0xab0 [ 67.830799][ T5754] ? __pfx_ops_undo_list+0x10/0x10 [ 67.832972][ T5754] ? cleanup_net+0x332/0x920 [ 67.834812][ T5754] ? idr_destroy+0x62/0x2e0 [ 67.836747][ T5754] cleanup_net+0x499/0x920 [ 67.838833][ T5754] ? __pfx_cleanup_net+0x10/0x10 [ 67.840948][ T5754] ? process_one_work+0xa2c/0x1b10 [ 67.843529][ T5754] ? process_one_work+0x906/0x1b10 [ 67.846421][ T5754] process_one_work+0xac7/0x1b10 [ 67.849247][ T5754] ? __pfx_process_one_work+0x10/0x10 [ 67.851637][ T5754] ? lock_acquire+0x1d1/0x380 [ 67.853690][ T5754] ? __pfx_cleanup_net+0x10/0x10 [ 67.856016][ T5754] worker_thread+0x5ef/0xe50 [ 67.858043][ T5754] ? kthread+0x13a/0x450 [ 67.859721][ T5754] ? __pfx_worker_thread+0x10/0x10 [ 67.861571][ T5754] kthread+0x373/0x450 [ 67.862940][ T5754] ? __pfx_kthread+0x10/0x10 [ 67.864501][ T5754] ret_from_fork+0x730/0xd60 [ 67.866036][ T5754] ? __pfx_ret_from_fork+0x10/0x10 [ 67.867762][ T5754] ? __switch_to+0x800/0x10f0 [ 67.869425][ T5754] ? __pfx_kthread+0x10/0x10 [ 67.871349][ T5754] ret_from_fork_asm+0x1a/0x30 [ 67.873464][ T5754] [ 71.389794][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.389822][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.509494][ T10] cfg80211: failed to load regulatory.db syzkaller build log: go env (err=) AR='ar' CC='gcc' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_ENABLED='1' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' CXX='g++' GCCGO='gccgo' GO111MODULE='auto' GOAMD64='v1' GOARCH='amd64' GOAUTH='netrc' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOCACHEPROG='' GODEBUG='' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFIPS140='off' GOFLAGS='' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1444367985=/tmp/go-build -gno-record-gcc-switches' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod' GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTELEMETRY='local' GOTELEMETRYDIR='/syzkaller/.config/go/telemetry' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.26.0' GOWORK='' PKG_CONFIG='pkg-config' git status (err=) HEAD detached at 1e72964b011 nothing to commit, working tree clean tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e72964b0111319984575e60f266d1fa0a98abb5 -X github.com/google/syzkaller/prog.gitRevisionDate=20260817-123423" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e72964b0111319984575e60f266d1fa0a98abb5 -X github.com/google/syzkaller/prog.gitRevisionDate=20260817-123423" ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen touch .descriptions GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e72964b0111319984575e60f266d1fa0a98abb5 -X github.com/google/syzkaller/prog.gitRevisionDate=20260817-123423" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog mkdir -p ./bin/linux_amd64 g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"1e72964b0111319984575e60f266d1fa0a98abb5\" /usr/bin/ld: /tmp/ccQDOckT.o: in function `Connection::Connect(char const*, char const*)': executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking ./tools/check-syzos.sh 2>/dev/null