possible deadlock in ieee80211_remove_interfaces ====================================================== WARNING: possible circular locking dependency detected 6.13.0-syzkaller-07644-gc2da8b3f914f #0 Not tainted ------------------------------------------------------ kworker/u8:7/2923 is trying to acquire lock: ffffffff8fcb1548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] ffffffff8fcb1548 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 but task is already holding lock: ffff8880207e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline] ffff8880207e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 wiphy_lock include/net/cfg80211.h:6046 [inline] wiphy_register+0x1a49/0x27b0 net/wireless/core.c:1006 ieee80211_register_hw+0x354e/0x4240 net/mac80211/main.c:1587 mac80211_hwsim_new_radio+0x2a9f/0x4a90 drivers/net/wireless/virtual/mac80211_hwsim.c:5558 init_mac80211_hwsim+0x87a/0xb00 drivers/net/wireless/virtual/mac80211_hwsim.c:6910 do_one_initcall+0x248/0x870 init/main.c:1267 do_initcall_level+0x157/0x210 init/main.c:1329 do_initcalls+0x3f/0x80 init/main.c:1345 kernel_init_freeable+0x435/0x5d0 init/main.c:1578 kernel_init+0x1d/0x2b0 init/main.c:1467 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #0 (rtnl_mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 unregister_netdevice_many net/core/dev.c:11875 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741 unregister_netdevice include/linux/netdevice.h:3329 [inline] _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251 ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305 ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681 mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664 hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x812/0xd60 net/core/net_namespace.c:652 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rdev->wiphy.mtx); lock(rtnl_mutex); lock(&rdev->wiphy.mtx); lock(rtnl_mutex); *** DEADLOCK *** 4 locks held by kworker/u8:7/2923: #0: ffff88801baf3148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88801baf3148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc9000c027c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc9000c027c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fca4f90 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 net/core/net_namespace.c:606 #3: ffff8880207e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline] #3: ffff8880207e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280 stack backtrace: CPU: 1 UID: 0 PID: 2923 Comm: kworker/u8:7 Not tainted 6.13.0-syzkaller-07644-gc2da8b3f914f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208 check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline] unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792 unregister_netdevice_many net/core/dev.c:11875 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741 unregister_netdevice include/linux/netdevice.h:3329 [inline] _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251 ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305 ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681 mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664 hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x812/0xd60 net/core/net_namespace.c:652 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Warning: Permanently added '10.128.1.159' (ED25519) to the list of known hosts. 2025/01/26 21:08:27 ignoring optional flag "sandboxArg"="0" 2025/01/26 21:08:27 parsed 1 programs [ 62.925053][ T5818] cgroup: Unknown subsys name 'net' [ 63.052886][ T5818] cgroup: Unknown subsys name 'cpuset' [ 63.062062][ T5818] cgroup: Unknown subsys name 'rlimit' [ 64.346820][ T5818] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 66.945794][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 67.192242][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.202294][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.211154][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.223311][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.231154][ T54] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 67.238901][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.921680][ T5857] syz-executor (5857) used greatest stack depth: 19024 bytes left [ 67.983923][ T5862] chnl_net:caif_netlink_parms(): no params data found [ 68.047239][ T5862] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.055440][ T5862] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.063007][ T5862] bridge_slave_0: entered allmulticast mode [ 68.069841][ T5862] bridge_slave_0: entered promiscuous mode [ 68.078750][ T5862] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.086034][ T5862] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.093674][ T5862] bridge_slave_1: entered allmulticast mode [ 68.101190][ T5862] bridge_slave_1: entered promiscuous mode [ 68.127061][ T5862] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.138037][ T5862] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.163568][ T5862] team0: Port device team_slave_0 added [ 68.172360][ T5862] team0: Port device team_slave_1 added [ 68.215884][ T5862] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.223032][ T5862] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.249288][ T5862] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.262217][ T5862] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.269215][ T5862] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.295413][ T5862] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.333351][ T5862] hsr_slave_0: entered promiscuous mode [ 68.347485][ T5862] hsr_slave_1: entered promiscuous mode [ 68.469218][ T5862] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.479406][ T5862] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.488539][ T5862] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.498086][ T5862] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.523050][ T5862] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.530290][ T5862] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.538457][ T5862] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.545628][ T5862] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.595216][ T5862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.612603][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.622187][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.638755][ T5862] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.652551][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.659691][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.680890][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.688042][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.804810][ T5862] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.838775][ T5862] veth0_vlan: entered promiscuous mode [ 68.851264][ T5862] veth1_vlan: entered promiscuous mode [ 68.873859][ T5862] veth0_macvtap: entered promiscuous mode [ 68.883796][ T5862] veth1_macvtap: entered promiscuous mode [ 68.898798][ T5862] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.910820][ T5862] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.923172][ T5862] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.933155][ T5862] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.942197][ T5862] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.950990][ T5862] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.092963][ T2923] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.187059][ T2923] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.281732][ T2923] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.373425][ T2923] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.891047][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.899045][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.927032][ T965] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.935858][ T965] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/01/26 21:08:36 executed programs: 0 [ 70.089468][ T5134] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.099341][ T5134] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.107777][ T5134] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.117899][ T5134] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.125758][ T5134] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 70.134364][ T5134] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.241041][ T5907] chnl_net:caif_netlink_parms(): no params data found [ 70.284488][ T5907] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.292178][ T5907] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.299338][ T5907] bridge_slave_0: entered allmulticast mode [ 70.306474][ T5907] bridge_slave_0: entered promiscuous mode [ 70.314868][ T5907] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.322157][ T5907] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.330451][ T5907] bridge_slave_1: entered allmulticast mode [ 70.337484][ T5907] bridge_slave_1: entered promiscuous mode [ 70.363807][ T5907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.375166][ T5907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.406779][ T5907] team0: Port device team_slave_0 added [ 70.414661][ T5907] team0: Port device team_slave_1 added [ 70.435173][ T5907] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.442576][ T5907] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.469081][ T5907] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.483471][ T5907] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.490992][ T5907] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.517424][ T5907] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.549157][ T5907] hsr_slave_0: entered promiscuous mode [ 70.555734][ T5907] hsr_slave_1: entered promiscuous mode [ 70.562047][ T5907] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 70.570384][ T5907] Cannot create hsr debugfs directory [ 71.822411][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.828996][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.220940][ T5134] Bluetooth: hci0: command tx timeout [ 72.466228][ T2923] bridge_slave_1: left allmulticast mode [ 72.473963][ T2923] bridge_slave_1: left promiscuous mode [ 72.481446][ T2923] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.493497][ T2923] bridge_slave_0: left allmulticast mode [ 72.499178][ T2923] bridge_slave_0: left promiscuous mode [ 72.505502][ T2923] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.886212][ T2923] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 72.897730][ T2923] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 72.908101][ T2923] bond0 (unregistering): Released all slaves [ 73.008482][ T2923] hsr_slave_0: left promiscuous mode [ 73.016997][ T2923] hsr_slave_1: left promiscuous mode [ 73.023642][ T2923] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 73.033087][ T2923] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 73.041848][ T2923] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 73.049294][ T2923] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 73.070160][ T2923] veth1_macvtap: left promiscuous mode [ 73.076139][ T2923] veth0_macvtap: left promiscuous mode [ 73.083039][ T2923] veth1_vlan: left promiscuous mode [ 73.090301][ T2923] veth0_vlan: left promiscuous mode [ 73.502437][ T2923] team0 (unregistering): Port device team_slave_1 removed [ 73.533721][ T2923] team0 (unregistering): Port device team_slave_0 removed [ 73.859374][ T5907] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.873079][ T5907] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.889209][ T5907] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.908467][ T5907] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.037853][ T5907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.071800][ T5907] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.085859][ T965] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.093065][ T965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.112277][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.119413][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.300135][ T5134] Bluetooth: hci0: command tx timeout [ 74.611757][ T2923] [ 74.611955][ T5907] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.614118][ T2923] ====================================================== [ 74.627917][ T2923] WARNING: possible circular locking dependency detected [ 74.634946][ T2923] 6.13.0-syzkaller-07644-gc2da8b3f914f #0 Not tainted [ 74.641698][ T2923] ------------------------------------------------------ [ 74.648726][ T2923] kworker/u8:7/2923 is trying to acquire lock: [ 74.654912][ T2923] ffffffff8fcb1548 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 [ 74.665310][ T2923] [ 74.665310][ T2923] but task is already holding lock: [ 74.672671][ T2923] ffff8880207e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 [ 74.683045][ T2923] [ 74.683045][ T2923] which lock already depends on the new lock. [ 74.683045][ T2923] [ 74.693442][ T2923] [ 74.693442][ T2923] the existing dependency chain (in reverse order) is: [ 74.702446][ T2923] [ 74.702446][ T2923] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 74.710257][ T2923] lock_acquire+0x1ed/0x550 [ 74.715280][ T2923] __mutex_lock+0x19c/0x1010 [ 74.720382][ T2923] wiphy_register+0x1a49/0x27b0 [ 74.725761][ T2923] ieee80211_register_hw+0x354e/0x4240 [ 74.731787][ T2923] mac80211_hwsim_new_radio+0x2a9f/0x4a90 [ 74.738035][ T2923] init_mac80211_hwsim+0x87a/0xb00 [ 74.743663][ T2923] do_one_initcall+0x248/0x870 [ 74.748938][ T2923] do_initcall_level+0x157/0x210 [ 74.754389][ T2923] do_initcalls+0x3f/0x80 [ 74.759227][ T2923] kernel_init_freeable+0x435/0x5d0 [ 74.764937][ T2923] kernel_init+0x1d/0x2b0 [ 74.769820][ T2923] ret_from_fork+0x4b/0x80 [ 74.774761][ T2923] ret_from_fork_asm+0x1a/0x30 [ 74.780041][ T2923] [ 74.780041][ T2923] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 74.787270][ T2923] validate_chain+0x18ef/0x5920 [ 74.792649][ T2923] __lock_acquire+0x1397/0x2100 [ 74.798022][ T2923] lock_acquire+0x1ed/0x550 [ 74.803036][ T2923] __mutex_lock+0x19c/0x1010 [ 74.808137][ T2923] unregister_netdevice_many_notify+0xac2/0x2030 [ 74.814983][ T2923] unregister_netdevice_queue+0x303/0x370 [ 74.821214][ T2923] _cfg80211_unregister_wdev+0x163/0x590 [ 74.827473][ T2923] ieee80211_remove_interfaces+0x4ef/0x700 [ 74.833828][ T2923] ieee80211_unregister_hw+0x5d/0x2c0 [ 74.839729][ T2923] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 74.845790][ T2923] hwsim_exit_net+0x5c1/0x670 [ 74.850975][ T2923] cleanup_net+0x812/0xd60 [ 74.855910][ T2923] process_scheduled_works+0xa66/0x1840 [ 74.861966][ T2923] worker_thread+0x870/0xd30 [ 74.867094][ T2923] kthread+0x7a9/0x920 [ 74.871797][ T2923] ret_from_fork+0x4b/0x80 [ 74.876823][ T2923] ret_from_fork_asm+0x1a/0x30 [ 74.882122][ T2923] [ 74.882122][ T2923] other info that might help us debug this: [ 74.882122][ T2923] [ 74.892359][ T2923] Possible unsafe locking scenario: [ 74.892359][ T2923] [ 74.899815][ T2923] CPU0 CPU1 [ 74.905361][ T2923] ---- ---- [ 74.910712][ T2923] lock(&rdev->wiphy.mtx); [ 74.915210][ T2923] lock(rtnl_mutex); [ 74.921705][ T2923] lock(&rdev->wiphy.mtx); [ 74.928716][ T2923] lock(rtnl_mutex); [ 74.932695][ T2923] [ 74.932695][ T2923] *** DEADLOCK *** [ 74.932695][ T2923] [ 74.940822][ T2923] 4 locks held by kworker/u8:7/2923: [ 74.946091][ T2923] #0: ffff88801baf3148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 [ 74.956968][ T2923] #1: ffffc9000c027c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 [ 74.967484][ T2923] #2: ffffffff8fca4f90 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 [ 74.976884][ T2923] #3: ffff8880207e8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 [ 74.987753][ T2923] [ 74.987753][ T2923] stack backtrace: [ 74.993644][ T2923] CPU: 1 UID: 0 PID: 2923 Comm: kworker/u8:7 Not tainted 6.13.0-syzkaller-07644-gc2da8b3f914f #0 [ 74.993660][ T2923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 74.993670][ T2923] Workqueue: netns cleanup_net [ 74.993690][ T2923] Call Trace: [ 74.993696][ T2923] [ 74.993703][ T2923] dump_stack_lvl+0x241/0x360 [ 74.993723][ T2923] ? __pfx_dump_stack_lvl+0x10/0x10 [ 74.993741][ T2923] ? __pfx__printk+0x10/0x10 [ 74.993761][ T2923] print_circular_bug+0x13a/0x1b0 [ 74.993780][ T2923] check_noncircular+0x36a/0x4a0 [ 74.993799][ T2923] ? __pfx_check_noncircular+0x10/0x10 [ 74.993816][ T2923] ? lockdep_lock+0x123/0x2b0 [ 74.993831][ T2923] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 74.993847][ T2923] validate_chain+0x18ef/0x5920 [ 74.993868][ T2923] ? __schedule+0x1822/0x4b90 [ 74.993883][ T2923] ? __pfx_validate_chain+0x10/0x10 [ 74.993900][ T2923] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 74.993918][ T2923] ? __pfx___schedule+0x10/0x10 [ 74.993930][ T2923] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 74.993943][ T2923] ? do_raw_spin_unlock+0x13c/0x8b0 [ 74.993958][ T2923] ? try_to_wake_up+0x959/0x1470 [ 74.993975][ T2923] ? mark_lock+0x9a/0x360 [ 74.993991][ T2923] __lock_acquire+0x1397/0x2100 [ 74.994011][ T2923] lock_acquire+0x1ed/0x550 [ 74.994025][ T2923] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 74.994046][ T2923] ? __pfx_lock_acquire+0x10/0x10 [ 74.994061][ T2923] ? __pfx___might_resched+0x10/0x10 [ 74.994074][ T2923] ? finish_wait+0xd4/0x1e0 [ 74.994090][ T2923] __mutex_lock+0x19c/0x1010 [ 74.994104][ T2923] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 74.994125][ T2923] ? unregister_netdevice_many_notify+0xac2/0x2030 [ 74.994143][ T2923] ? __pfx___mutex_lock+0x10/0x10 [ 74.994162][ T2923] ? __pfx___might_resched+0x10/0x10 [ 74.994176][ T2923] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 74.994195][ T2923] ? unregister_netdevice_many_notify+0x9fa/0x2030 [ 74.994214][ T2923] unregister_netdevice_many_notify+0xac2/0x2030 [ 74.994233][ T2923] ? mark_lock+0x9a/0x360 [ 74.994251][ T2923] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 74.994269][ T2923] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 74.994285][ T2923] ? __pfx_lock_release+0x10/0x10 [ 74.994305][ T2923] unregister_netdevice_queue+0x303/0x370 [ 74.994322][ T2923] ? __pfx_up_write+0x10/0x10 [ 74.994333][ T2923] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 74.994352][ T2923] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 74.994367][ T2923] _cfg80211_unregister_wdev+0x163/0x590 [ 74.994383][ T2923] ieee80211_remove_interfaces+0x4ef/0x700 [ 74.994402][ T2923] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 74.994420][ T2923] ? rcu_is_watching+0x15/0xb0 [ 74.994439][ T2923] ieee80211_unregister_hw+0x5d/0x2c0 [ 74.994456][ T2923] mac80211_hwsim_del_radio+0x2c4/0x4c0 [ 74.994476][ T2923] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 74.994495][ T2923] hwsim_exit_net+0x5c1/0x670 [ 74.994512][ T2923] ? __pfx_hwsim_exit_net+0x10/0x10 [ 74.994527][ T2923] ? __ip_vs_dev_cleanup_batch+0x239/0x260 [ 74.994543][ T2923] cleanup_net+0x812/0xd60 [ 74.994558][ T2923] ? __pfx_cleanup_net+0x10/0x10 [ 74.994575][ T2923] ? process_scheduled_works+0x976/0x1840 [ 74.994588][ T2923] process_scheduled_works+0xa66/0x1840 [ 74.994608][ T2923] ? __pfx_process_scheduled_works+0x10/0x10 [ 74.994623][ T2923] ? assign_work+0x364/0x3d0 [ 74.994636][ T2923] worker_thread+0x870/0xd30 [ 74.994653][ T2923] ? __kthread_parkme+0x169/0x1d0 [ 74.994668][ T2923] ? __pfx_worker_thread+0x10/0x10 [ 74.994681][ T2923] kthread+0x7a9/0x920 [ 74.994695][ T2923] ? __pfx_kthread+0x10/0x10 [ 74.994710][ T2923] ? __pfx_worker_thread+0x10/0x10 [ 74.994723][ T2923] ? __pfx_kthread+0x10/0x10 [ 74.994737][ T2923] ? __pfx_kthread+0x10/0x10 [ 74.994752][ T2923] ? __pfx_kthread+0x10/0x10 [ 74.994765][ T2923] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.994777][ T2923] ? lockdep_hardirqs_on+0x99/0x150 [ 74.994790][ T2923] ? __pfx_kthread+0x10/0x10 [ 74.994804][ T2923] ret_from_fork+0x4b/0x80 [ 74.994819][ T2923] ? __pfx_kthread+0x10/0x10 [ 74.994833][ T2923] ret_from_fork_asm+0x1a/0x30 [ 74.994850][ T2923] [ 75.027130][ T5907] veth0_vlan: entered promiscuous mode [ 75.450932][ T5907] veth1_vlan: entered promiscuous mode [ 75.524168][ T5907] veth0_macvtap: entered promiscuous mode [ 75.536271][ T5907] veth1_macvtap: entered promiscuous mode [ 75.552158][ T5907] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.572089][ T5907] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.584287][ T5907] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.593808][ T5907] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.603714][ T5907] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.613009][ T5907] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.653364][ T5907] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht' [ 75.676367][ T5907] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht' [ 75.684547][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.693440][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.712355][ T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.721922][ T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 syzkaller build log: go env (err=) GO111MODULE='auto' GOARCH='amd64' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFLAGS='' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.22.7' GCCGO='gccgo' GOAMD64='v1' AR='ar' CC='gcc' CXX='g++' CGO_ENABLED='1' GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod' GOWORK='' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' PKG_CONFIG='pkg-config' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3215440905=/tmp/go-build -gno-record-gcc-switches' git status (err=) HEAD detached at 666f77ed02 nothing to commit, working tree clean tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen go fmt ./sys/... >/dev/null touch .descriptions GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=666f77ed02b98b834393ff84c646a8d611605f6f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20241016-170423'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog mkdir -p ./bin/linux_amd64 g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"666f77ed02b98b834393ff84c646a8d611605f6f\" /usr/bin/ld: /tmp/cc4Pfk52.o: in function `test_cover_filter()': executor.cc:(.text+0x1424b): warning: the use of `tempnam' is dangerous, better use `mkstemp' /usr/bin/ld: /tmp/cc4Pfk52.o: in function `Connection::Connect(char const*, char const*)': executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking