possible deadlock in ieee80211_remove_interfaces ====================================================== WARNING: possible circular locking dependency detected 6.13.0-syzkaller-gaa22f4da2a46 #0 Not tainted ------------------------------------------------------ kworker/u4:8/1041 is trying to acquire lock: ffffffff8fcc38c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] ffffffff8fcc38c8 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 but task is already holding lock: ffff88801fdd8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline] ffff88801fdd8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 wiphy_lock include/net/cfg80211.h:6046 [inline] wiphy_register+0x1a49/0x27b0 net/wireless/core.c:1006 ieee80211_register_hw+0x354e/0x4240 net/mac80211/main.c:1587 mac80211_hwsim_new_radio+0x2a9f/0x4a90 drivers/net/wireless/virtual/mac80211_hwsim.c:5558 init_mac80211_hwsim+0x87a/0xb00 drivers/net/wireless/virtual/mac80211_hwsim.c:6910 do_one_initcall+0x248/0x870 init/main.c:1267 do_initcall_level+0x157/0x210 init/main.c:1329 do_initcalls+0x3f/0x80 init/main.c:1345 kernel_init_freeable+0x435/0x5d0 init/main.c:1578 kernel_init+0x1d/0x2b0 init/main.c:1467 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #0 (rtnl_mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 unregister_netdevice_many net/core/dev.c:11875 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741 unregister_netdevice include/linux/netdevice.h:3329 [inline] _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251 ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305 ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681 mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664 hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x812/0xd60 net/core/net_namespace.c:652 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rdev->wiphy.mtx); lock(rtnl_mutex); lock(&rdev->wiphy.mtx); lock(rtnl_mutex); *** DEADLOCK *** 4 locks held by kworker/u4:8/1041: #0: ffff88801baef148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88801baef148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc900026c7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc900026c7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fcb7310 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 net/core/net_namespace.c:606 #3: ffff88801fdd8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline] #3: ffff88801fdd8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280 stack backtrace: CPU: 0 UID: 0 PID: 1041 Comm: kworker/u4:8 Not tainted 6.13.0-syzkaller-gaa22f4da2a46 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208 check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 unregister_netdevice_many net/core/dev.c:11875 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741 unregister_netdevice include/linux/netdevice.h:3329 [inline] _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251 ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305 ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681 mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664 hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x812/0xd60 net/core/net_namespace.c:652 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 Warning: Permanently added '[localhost]:61309' (ED25519) to the list of known hosts. 2025/01/26 16:15:14 ignoring optional flag "sandboxArg"="0" 2025/01/26 16:15:15 parsed 1 programs [ 72.075961][ T5311] cgroup: Unknown subsys name 'net' [ 72.163570][ T5311] cgroup: Unknown subsys name 'cpuset' [ 72.167899][ T5311] cgroup: Unknown subsys name 'rlimit' [ 73.659069][ T5311] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.352858][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.355458][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 77.429272][ T5321] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 78.718785][ T5342] chnl_net:caif_netlink_parms(): no params data found [ 78.813684][ T5342] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.817353][ T5342] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.820113][ T5342] bridge_slave_0: entered allmulticast mode [ 78.832466][ T5342] bridge_slave_0: entered promiscuous mode [ 78.837526][ T5342] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.840322][ T5342] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.850706][ T5342] bridge_slave_1: entered allmulticast mode [ 78.853889][ T5342] bridge_slave_1: entered promiscuous mode [ 78.892513][ T5342] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.897818][ T5342] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.943432][ T5342] team0: Port device team_slave_0 added [ 78.951120][ T5342] team0: Port device team_slave_1 added [ 78.982515][ T5342] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.985290][ T5342] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.012658][ T5342] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.021131][ T5342] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.023885][ T5342] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.051624][ T5342] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.101722][ T5342] hsr_slave_0: entered promiscuous mode [ 79.111834][ T5342] hsr_slave_1: entered promiscuous mode [ 79.323244][ T5342] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.343636][ T5342] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.348785][ T5342] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.363893][ T5342] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.496615][ T5342] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.524232][ T5342] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.550644][ T1082] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.553727][ T1082] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.563035][ T1082] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.565837][ T1082] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.625379][ T5342] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.831502][ T5342] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.876253][ T5342] veth0_vlan: entered promiscuous mode [ 79.892846][ T5342] veth1_vlan: entered promiscuous mode [ 79.926969][ T5342] veth0_macvtap: entered promiscuous mode [ 79.944595][ T5342] veth1_macvtap: entered promiscuous mode [ 79.968586][ T5342] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.985521][ T5342] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.995309][ T5342] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.012129][ T5342] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.015508][ T5342] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.018735][ T5342] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.218337][ T1041] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.303658][ T1041] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.362472][ T1041] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.464056][ T1041] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.835787][ T5363] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.839516][ T5363] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.843670][ T5363] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.846809][ T5363] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.849808][ T5363] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.853820][ T5363] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.324612][ T1142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.327563][ T1142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.379545][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.383470][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.847568][ T1041] bridge_slave_1: left allmulticast mode [ 82.850042][ T1041] bridge_slave_1: left promiscuous mode [ 82.872805][ T1041] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.893144][ T1041] bridge_slave_0: left allmulticast mode [ 82.895375][ T1041] bridge_slave_0: left promiscuous mode [ 82.897616][ T1041] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.417328][ T1041] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 83.423157][ T1041] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 83.427715][ T1041] bond0 (unregistering): Released all slaves [ 83.513594][ T1041] hsr_slave_0: left promiscuous mode [ 83.529773][ T1041] hsr_slave_1: left promiscuous mode [ 83.533753][ T1041] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 83.536480][ T1041] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 83.547965][ T1041] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 83.552824][ T1041] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 83.588670][ T1041] veth1_macvtap: left promiscuous mode [ 83.621546][ T1041] veth0_macvtap: left promiscuous mode [ 83.624521][ T1041] veth1_vlan: left promiscuous mode [ 83.627310][ T1041] veth0_vlan: left promiscuous mode [ 84.283574][ T1041] team0 (unregistering): Port device team_slave_1 removed [ 84.299448][ T1041] team0 (unregistering): Port device team_slave_0 removed 2025/01/26 16:15:30 executed programs: 0 [ 84.808107][ T4662] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.813460][ T4662] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.816396][ T4662] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.828065][ T4662] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.849412][ T4662] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 84.857850][ T4662] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.413648][ T1041] [ 85.414912][ T1041] ====================================================== [ 85.418230][ T1041] WARNING: possible circular locking dependency detected [ 85.421601][ T1041] 6.13.0-syzkaller-gaa22f4da2a46 #0 Not tainted [ 85.425778][ T1041] ------------------------------------------------------ [ 85.428977][ T1041] kworker/u4:8/1041 is trying to acquire lock: [ 85.431666][ T1041] ffffffff8fcc38c8 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 [ 85.436236][ T1041] [ 85.436236][ T1041] but task is already holding lock: [ 85.439047][ T1041] ffff88801fdd8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 [ 85.442853][ T1041] [ 85.442853][ T1041] which lock already depends on the new lock. [ 85.442853][ T1041] [ 85.446909][ T1041] [ 85.446909][ T1041] the existing dependency chain (in reverse order) is: [ 85.450246][ T1041] [ 85.450246][ T1041] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 85.453137][ T1041] lock_acquire+0x1ed/0x550 [ 85.455040][ T1041] __mutex_lock+0x19c/0x1010 [ 85.457268][ T1041] wiphy_register+0x1a49/0x27b0 [ 85.459163][ T1041] ieee80211_register_hw+0x354e/0x4240 [ 85.461430][ T1041] mac80211_hwsim_new_radio+0x2a9f/0x4a90 [ 85.463574][ T1041] init_mac80211_hwsim+0x87a/0xb00 [ 85.465588][ T1041] do_one_initcall+0x248/0x870 [ 85.467560][ T1041] do_initcall_level+0x157/0x210 [ 85.469544][ T1041] do_initcalls+0x3f/0x80 [ 85.471407][ T1041] kernel_init_freeable+0x435/0x5d0 [ 85.473728][ T1041] kernel_init+0x1d/0x2b0 [ 85.475626][ T1041] ret_from_fork+0x4b/0x80 [ 85.477506][ T1041] ret_from_fork_asm+0x1a/0x30 [ 85.479539][ T1041] [ 85.479539][ T1041] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 85.482379][ T1041] validate_chain+0x18ef/0x5920 [ 85.484341][ T1041] __lock_acquire+0x1397/0x2100 [ 85.486235][ T1041] lock_acquire+0x1ed/0x550 [ 85.487790][ T1041] __mutex_lock+0x19c/0x1010 [ 85.489660][ T1041] unregister_netdevice_many_notify+0xac2/0x2030 [ 85.492262][ T1041] unregister_netdevice_queue+0x303/0x370 [ 85.494728][ T1041] _cfg80211_unregister_wdev+0x163/0x590 [ 85.497013][ T1041] ieee80211_remove_interfaces+0x4ef/0x700 [ 85.499285][ T1041] ieee80211_unregister_hw+0x5d/0x2c0 [ 85.501525][ T1041] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 85.503784][ T1041] hwsim_exit_net+0x5c1/0x670 [ 85.505792][ T1041] cleanup_net+0x812/0xd60 [ 85.507643][ T1041] process_scheduled_works+0xa66/0x1840 [ 85.509987][ T1041] worker_thread+0x870/0xd30 [ 85.511971][ T1041] kthread+0x7a9/0x920 [ 85.513746][ T1041] ret_from_fork+0x4b/0x80 [ 85.515601][ T1041] ret_from_fork_asm+0x1a/0x30 [ 85.517599][ T1041] [ 85.517599][ T1041] other info that might help us debug this: [ 85.517599][ T1041] [ 85.521739][ T1041] Possible unsafe locking scenario: [ 85.521739][ T1041] [ 85.524521][ T1041] CPU0 CPU1 [ 85.526378][ T1041] ---- ---- [ 85.528347][ T1041] lock(&rdev->wiphy.mtx); [ 85.530042][ T1041] lock(rtnl_mutex); [ 85.532443][ T1041] lock(&rdev->wiphy.mtx); [ 85.535013][ T1041] lock(rtnl_mutex); [ 85.536514][ T1041] [ 85.536514][ T1041] *** DEADLOCK *** [ 85.536514][ T1041] [ 85.539505][ T1041] 4 locks held by kworker/u4:8/1041: [ 85.541482][ T1041] #0: ffff88801baef148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 [ 85.545504][ T1041] #1: ffffc900026c7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 [ 85.549433][ T1041] #2: ffffffff8fcb7310 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 [ 85.552888][ T1041] #3: ffff88801fdd8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 [ 85.557108][ T1041] [ 85.557108][ T1041] stack backtrace: [ 85.559372][ T1041] CPU: 0 UID: 0 PID: 1041 Comm: kworker/u4:8 Not tainted 6.13.0-syzkaller-gaa22f4da2a46 #0 [ 85.559385][ T1041] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.559394][ T1041] Workqueue: netns cleanup_net [ 85.559413][ T1041] Call Trace: [ 85.559420][ T1041] [ 85.559425][ T1041] dump_stack_lvl+0x241/0x360 [ 85.559438][ T1041] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.559449][ T1041] ? __pfx__printk+0x10/0x10 [ 85.559466][ T1041] print_circular_bug+0x13a/0x1b0 [ 85.559478][ T1041] check_noncircular+0x36a/0x4a0 [ 85.559490][ T1041] ? __pfx_check_noncircular+0x10/0x10 [ 85.559498][ T1041] ? lockdep_lock+0x123/0x2b0 [ 85.559505][ T1041] ? kvm_sched_clock_read+0x11/0x20 [ 85.559513][ T1041] ? psi_task_change+0xed/0x270 [ 85.559519][ T1041] ? sched_clock_cpu+0x76/0x490 [ 85.559525][ T1041] validate_chain+0x18ef/0x5920 [ 85.559539][ T1041] ? __pfx_validate_chain+0x10/0x10 [ 85.559548][ T1041] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 85.559561][ T1041] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 85.559571][ T1041] ? lockdep_hardirqs_on+0x99/0x150 [ 85.559582][ T1041] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 85.559592][ T1041] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 85.559602][ T1041] ? do_raw_spin_unlock+0x58/0x8b0 [ 85.559615][ T1041] ? try_to_wake_up+0x959/0x1470 [ 85.559631][ T1041] ? mark_lock+0x9a/0x360 [ 85.559644][ T1041] ? __pfx_try_to_wake_up+0x10/0x10 [ 85.559658][ T1041] __lock_acquire+0x1397/0x2100 [ 85.559675][ T1041] lock_acquire+0x1ed/0x550 [ 85.559687][ T1041] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 85.559704][ T1041] ? __pfx_lock_acquire+0x10/0x10 [ 85.559718][ T1041] ? __pfx___might_resched+0x10/0x10 [ 85.559730][ T1041] ? kthread_queue_work+0x110/0x180 [ 85.559746][ T1041] __mutex_lock+0x19c/0x1010 [ 85.559757][ T1041] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 85.559767][ T1041] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 85.559775][ T1041] ? __pfx___mutex_lock+0x10/0x10 [ 85.559782][ T1041] ? __pfx___might_resched+0x10/0x10 [ 85.559789][ T1041] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 85.559798][ T1041] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 85.559812][ T1041] unregister_netdevice_many_notify+0xac2/0x2030 [ 85.559826][ T1041] ? mark_lock+0x9a/0x360 [ 85.559842][ T1041] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 85.559857][ T1041] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 85.559869][ T1041] ? __pfx_lock_release+0x10/0x10 [ 85.559887][ T1041] unregister_netdevice_queue+0x303/0x370 [ 85.559901][ T1041] ? __pfx_up_write+0x10/0x10 [ 85.559912][ T1041] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 85.559926][ T1041] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 85.559937][ T1041] _cfg80211_unregister_wdev+0x163/0x590 [ 85.559949][ T1041] ieee80211_remove_interfaces+0x4ef/0x700 [ 85.559965][ T1041] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 85.559979][ T1041] ? rcu_is_watching+0x15/0xb0 [ 85.559990][ T1041] ieee80211_unregister_hw+0x5d/0x2c0 [ 85.560002][ T1041] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 85.560019][ T1041] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 85.560036][ T1041] hwsim_exit_net+0x5c1/0x670 [ 85.560049][ T1041] ? __pfx_hwsim_exit_net+0x10/0x10 [ 85.560061][ T1041] ? __ip_vs_dev_cleanup_batch+0x239/0x260 [ 85.560075][ T1041] cleanup_net+0x812/0xd60 [ 85.560089][ T1041] ? __pfx_cleanup_net+0x10/0x10 [ 85.560103][ T1041] ? process_scheduled_works+0x976/0x1840 [ 85.560115][ T1041] process_scheduled_works+0xa66/0x1840 [ 85.560131][ T1041] ? __pfx_process_scheduled_works+0x10/0x10 [ 85.560139][ T1041] ? assign_work+0x364/0x3d0 [ 85.560145][ T1041] worker_thread+0x870/0xd30 [ 85.560158][ T1041] ? __kthread_parkme+0x169/0x1d0 [ 85.560170][ T1041] ? __pfx_worker_thread+0x10/0x10 [ 85.560181][ T1041] kthread+0x7a9/0x920 [ 85.560195][ T1041] ? __pfx_kthread+0x10/0x10 [ 85.560208][ T1041] ? __pfx_worker_thread+0x10/0x10 [ 85.560220][ T1041] ? __pfx_kthread+0x10/0x10 [ 85.560232][ T1041] ? __pfx_kthread+0x10/0x10 [ 85.560246][ T1041] ? __pfx_kthread+0x10/0x10 [ 85.560258][ T1041] ? _raw_spin_unlock_irq+0x23/0x50 [ 85.560268][ T1041] ? lockdep_hardirqs_on+0x99/0x150 [ 85.560279][ T1041] ? __pfx_kthread+0x10/0x10 [ 85.560293][ T1041] ret_from_fork+0x4b/0x80 [ 85.560302][ T1041] ? __pfx_kthread+0x10/0x10 [ 85.560310][ T1041] ret_from_fork_asm+0x1a/0x30 [ 85.560320][ T1041] [ 85.798475][ T5419] chnl_net:caif_netlink_parms(): no params data found [ 85.885871][ T5419] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.888797][ T5419] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.896587][ T5419] bridge_slave_0: entered allmulticast mode [ 85.899208][ T5419] bridge_slave_0: entered promiscuous mode [ 85.906780][ T5419] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.909397][ T5419] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.920483][ T5419] bridge_slave_1: entered allmulticast mode [ 85.926570][ T5419] bridge_slave_1: entered promiscuous mode [ 85.991433][ T5419] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.011698][ T5419] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.088868][ T5419] team0: Port device team_slave_0 added [ 86.106478][ T5419] team0: Port device team_slave_1 added [ 86.151638][ T5419] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.154471][ T5419] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.198430][ T5419] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.204231][ T5419] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.206988][ T5419] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.243796][ T5419] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.280235][ T5419] hsr_slave_0: entered promiscuous mode [ 86.291997][ T5419] hsr_slave_1: entered promiscuous mode [ 86.593533][ T8] cfg80211: failed to load regulatory.db [ 86.611020][ T5419] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.621372][ T5419] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.632058][ T5419] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.639785][ T5419] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.660108][ T5419] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.662973][ T5419] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.665573][ T5419] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.668237][ T5419] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.744278][ T5419] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.751750][ T1082] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.754817][ T1082] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.772949][ T5419] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.785234][ T1082] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.788149][ T1082] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.799512][ T1082] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.802139][ T1082] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.912559][ T4662] Bluetooth: hci0: command tx timeout [ 86.951817][ T5419] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.987578][ T5419] veth0_vlan: entered promiscuous mode [ 87.009158][ T5419] veth1_vlan: entered promiscuous mode [ 87.042775][ T5419] veth0_macvtap: entered promiscuous mode [ 87.051619][ T5419] veth1_macvtap: entered promiscuous mode [ 87.066975][ T5419] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.083303][ T5419] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.092081][ T5419] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.095502][ T5419] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.098752][ T5419] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.113591][ T5419] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.146035][ T5419] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht' [ 87.181836][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.184661][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.188969][ T5419] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht' [ 87.211608][ T1142] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.221882][ T1142] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.128153][ T1142] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.622628][ T1142] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.653415][ T1142] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.684391][ T1142] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.761572][ T1142] bridge_slave_1: left allmulticast mode [ 90.764290][ T1142] bridge_slave_1: left promiscuous mode [ 90.767018][ T1142] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.773875][ T1142] bridge_slave_0: left allmulticast mode [ 90.776475][ T1142] bridge_slave_0: left promiscuous mode [ 90.779150][ T1142] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.893824][ T1142] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 90.898126][ T1142] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 90.913096][ T1142] bond0 (unregistering): Released all slaves [ 91.025855][ T1142] hsr_slave_0: left promiscuous mode [ 91.028773][ T1142] hsr_slave_1: left promiscuous mode [ 91.042143][ T1142] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 91.045199][ T1142] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 91.051919][ T1142] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 91.054740][ T1142] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 91.074067][ T1142] veth1_macvtap: left promiscuous mode [ 91.076206][ T1142] veth0_macvtap: left promiscuous mode [ 91.078223][ T1142] veth1_vlan: left promiscuous mode [ 91.080300][ T1142] veth0_vlan: left promiscuous mode [ 91.177874][ T1142] team0 (unregistering): Port device team_slave_1 removed [ 91.185589][ T1142] team0 (unregistering): Port device team_slave_0 removed VM DIAGNOSIS: 16:15:31 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000073 RBX=ffffffff9a746940 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc900026c64b0 R8 =ffffffff8576423b R9 =1ffff11006687046 R10=dffffc0000000000 R11=ffffffff857641f0 R12=dffffc0000000000 R13=ffffffff9a440f3f R14=0000000000000073 R15=00000000000003f8 RIP=ffffffff8576426e RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88801fc00000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffdff050fa8 CR3=00000000006c0000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000c0fff800 Opmask01=000000000000001c Opmask02=000000000000001f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 93a8b8efc2f13712 fe490c34b882f152 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0812589bd5bfedb0 22520931d7d7e77d ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ccc8a80a2fbd4dd6 dc5d92cd0a1d1614 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 425afed90a4a58c0 227c69a1d402349c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000001fc0 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000397a090000 0000016b00395d72 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000003991050000 66b0fbb190ce0000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 877d125000395d55 a8fef0ae5c7e71b1 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0039605aba0f5166 239c00005894b1a2 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 200b67274002ff43 4f3ce154e2eec129 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6db221917626f08a 5930fb678c2c51a6 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3d3d3d3d3d3d3d3d 3d3d3d3d3d3d3d3d 3d3d3d3d3d3d3d3d 3d3d3d3d3d3d3d3d ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f73657201828800 000000843d736563 61667265746e6900 883d656d616e6669 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 524e584f01828800 00000084004e585e 5c5b4f5849535400 880058505c535b54 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 syzkaller build log: go env (err=) GO111MODULE='auto' GOARCH='amd64' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFLAGS='' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.22.7' GCCGO='gccgo' GOAMD64='v1' AR='ar' CC='gcc' CXX='g++' CGO_ENABLED='1' GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod' GOWORK='' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' PKG_CONFIG='pkg-config' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4199170335=/tmp/go-build -gno-record-gcc-switches' git status (err=) HEAD detached at 75bb1b32609 nothing to commit, working tree clean tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen go fmt ./sys/... >/dev/null touch .descriptions GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=75bb1b32609dc8e20e442a992f648e465c66cdf3 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20241111-155241'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog mkdir -p ./bin/linux_amd64 g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"75bb1b32609dc8e20e442a992f648e465c66cdf3\" /usr/bin/ld: /tmp/ccCkqcsO.o: in function `test_cover_filter()': executor.cc:(.text+0x1426b): warning: the use of `tempnam' is dangerous, better use `mkstemp' /usr/bin/ld: /tmp/ccCkqcsO.o: in function `Connection::Connect(char const*, char const*)': executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking