possible deadlock in ieee80211_remove_interfaces
======================================================
WARNING: possible circular locking dependency detected
6.13.0-syzkaller-g805ba04cb7cc #0 Not tainted
------------------------------------------------------
kworker/u4:6/1036 is trying to acquire lock:
ffffffff8fcc3b08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline]
ffffffff8fcc3b08 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792
but task is already holding lock:
ffff888012748768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline]
ffff888012748768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
wiphy_lock include/net/cfg80211.h:6046 [inline]
wiphy_register+0x1a49/0x27b0 net/wireless/core.c:1006
ieee80211_register_hw+0x354e/0x4240 net/mac80211/main.c:1587
mac80211_hwsim_new_radio+0x2a9f/0x4a90 drivers/net/wireless/virtual/mac80211_hwsim.c:5558
init_mac80211_hwsim+0x87a/0xb00 drivers/net/wireless/virtual/mac80211_hwsim.c:6910
do_one_initcall+0x248/0x870 init/main.c:1257
do_initcall_level+0x157/0x210 init/main.c:1319
do_initcalls+0x3f/0x80 init/main.c:1335
kernel_init_freeable+0x435/0x5d0 init/main.c:1568
kernel_init+0x1d/0x2b0 init/main.c:1457
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 (rtnl_mutex){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline]
unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792
unregister_netdevice_many net/core/dev.c:11875 [inline]
unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741
unregister_netdevice include/linux/netdevice.h:3329 [inline]
_cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251
ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305
ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681
mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664
hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544
ops_exit_list net/core/net_namespace.c:172 [inline]
cleanup_net+0x812/0xd60 net/core/net_namespace.c:652
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rdev->wiphy.mtx);
lock(rtnl_mutex);
lock(&rdev->wiphy.mtx);
lock(rtnl_mutex);
*** DEADLOCK ***
4 locks held by kworker/u4:6/1036:
#0: ffff888030423148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888030423148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc9000250fc60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc9000250fc60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2: ffffffff8fcb7550 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 net/core/net_namespace.c:606
#3: ffff888012748768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline]
#3: ffff888012748768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2280
stack backtrace:
CPU: 0 UID: 0 PID: 1036 Comm: kworker/u4:6 Not tainted 6.13.0-syzkaller-g805ba04cb7cc #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
rtnl_acquire_if_cleanup_net net/core/dev.c:10272 [inline]
unregister_netdevice_many_notify+0xac2/0x2030 net/core/dev.c:11792
unregister_netdevice_many net/core/dev.c:11875 [inline]
unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11741
unregister_netdevice include/linux/netdevice.h:3329 [inline]
_cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251
ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2305
ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1681
mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664
hwsim_exit_net+0x5c1/0x670 drivers/net/wireless/virtual/mac80211_hwsim.c:6544
ops_exit_list net/core/net_namespace.c:172 [inline]
cleanup_net+0x812/0xd60 net/core/net_namespace.c:652
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
Warning: Permanently added '[localhost]:40430' (ED25519) to the list of known hosts.
2025/01/27 22:10:28 ignoring optional flag "sandboxArg"="0"
2025/01/27 22:10:29 parsed 1 programs
[ 72.632103][ T5308] cgroup: Unknown subsys name 'net'
[ 72.721936][ T5308] cgroup: Unknown subsys name 'cpuset'
[ 72.726052][ T5308] cgroup: Unknown subsys name 'rlimit'
[ 74.207970][ T5308] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 76.364387][ T1309] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.367021][ T1309] ieee802154 phy1 wpan1: encryption failed: -22
[ 79.216272][ T5317] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 80.278932][ T5334] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 80.282788][ T5334] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 80.285892][ T5334] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 80.289903][ T5334] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 80.303480][ T5334] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 80.306419][ T5334] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 82.505223][ T5356] chnl_net:caif_netlink_parms(): no params data found
[ 82.594915][ T5356] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.603246][ T5356] bridge0: port 1(bridge_slave_0) entered disabled state
[ 82.606025][ T5356] bridge_slave_0: entered allmulticast mode
[ 82.620121][ T5356] bridge_slave_0: entered promiscuous mode
[ 82.625275][ T5356] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.628051][ T5356] bridge0: port 2(bridge_slave_1) entered disabled state
[ 82.639755][ T5356] bridge_slave_1: entered allmulticast mode
[ 82.648525][ T5356] bridge_slave_1: entered promiscuous mode
[ 82.682350][ T5356] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 82.687403][ T5356] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 82.731465][ T5356] team0: Port device team_slave_0 added
[ 82.739196][ T5356] team0: Port device team_slave_1 added
[ 82.771339][ T5356] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 82.773983][ T5356] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.799272][ T5356] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 82.819419][ T5356] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 82.822209][ T5356] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 82.848471][ T5356] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 82.893957][ T5356] hsr_slave_0: entered promiscuous mode
[ 82.899749][ T5356] hsr_slave_1: entered promiscuous mode
[ 83.116517][ T5356] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 83.133623][ T5356] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 83.150581][ T5356] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 83.155569][ T5356] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 83.202955][ T5356] bridge0: port 2(bridge_slave_1) entered blocking state
[ 83.205885][ T5356] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 83.209523][ T5356] bridge0: port 1(bridge_slave_0) entered blocking state
[ 83.212361][ T5356] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 83.312634][ T5356] 8021q: adding VLAN 0 to HW filter on device bond0
[ 83.334058][ T5356] 8021q: adding VLAN 0 to HW filter on device team0
[ 83.344472][ T1088] bridge0: port 1(bridge_slave_0) entered disabled state
[ 83.351160][ T1088] bridge0: port 2(bridge_slave_1) entered disabled state
[ 83.377105][ T1088] bridge0: port 1(bridge_slave_0) entered blocking state
[ 83.379954][ T1088] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 83.405437][ T1088] bridge0: port 2(bridge_slave_1) entered blocking state
[ 83.408764][ T1088] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 83.656490][ T5356] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 83.707255][ T5356] veth0_vlan: entered promiscuous mode
[ 83.726130][ T5356] veth1_vlan: entered promiscuous mode
[ 83.763067][ T5356] veth0_macvtap: entered promiscuous mode
[ 83.772314][ T5356] veth1_macvtap: entered promiscuous mode
[ 83.795059][ T5356] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.811994][ T5356] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.830023][ T5356] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.833574][ T5356] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.837459][ T5356] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.859744][ T5356] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.129600][ T1036] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.231076][ T1036] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.314874][ T1036] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.433782][ T1036] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.505347][ T4579] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.517253][ T4579] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.543942][ T55] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.546865][ T55] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/01/27 22:10:44 executed programs: 0
[ 85.974360][ T5334] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 85.979446][ T5334] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 85.982873][ T5334] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 85.999018][ T5334] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 86.002519][ T5334] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 86.005355][ T5334] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 86.336208][ T5398] chnl_net:caif_netlink_parms(): no params data found
[ 86.471917][ T5398] bridge0: port 1(bridge_slave_0) entered blocking state
[ 86.479849][ T5398] bridge0: port 1(bridge_slave_0) entered disabled state
[ 86.482513][ T5398] bridge_slave_0: entered allmulticast mode
[ 86.489942][ T5398] bridge_slave_0: entered promiscuous mode
[ 86.501228][ T5398] bridge0: port 2(bridge_slave_1) entered blocking state
[ 86.503885][ T5398] bridge0: port 2(bridge_slave_1) entered disabled state
[ 86.506669][ T5398] bridge_slave_1: entered allmulticast mode
[ 86.539963][ T5398] bridge_slave_1: entered promiscuous mode
[ 86.619188][ T57] cfg80211: failed to load regulatory.db
[ 86.640145][ T5398] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 86.686527][ T5398] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 86.767232][ T5398] team0: Port device team_slave_0 added
[ 86.780124][ T5398] team0: Port device team_slave_1 added
[ 86.782626][ T1036] bridge_slave_1: left allmulticast mode
[ 86.785216][ T1036] bridge_slave_1: left promiscuous mode
[ 86.809643][ T1036] bridge0: port 2(bridge_slave_1) entered disabled state
[ 86.817065][ T1036] bridge_slave_0: left allmulticast mode
[ 86.828704][ T1036] bridge_slave_0: left promiscuous mode
[ 86.830975][ T1036] bridge0: port 1(bridge_slave_0) entered disabled state
[ 87.234760][ T1036] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 87.242012][ T1036] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 87.246224][ T1036] bond0 (unregistering): Released all slaves
[ 87.252762][ T5398] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 87.255975][ T5398] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 87.270602][ T5398] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 87.303921][ T5398] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 87.306664][ T5398] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 87.322957][ T5398] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 87.404451][ T1036] hsr_slave_0: left promiscuous mode
[ 87.412717][ T1036] hsr_slave_1: left promiscuous mode
[ 87.420580][ T1036] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 87.423473][ T1036] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 87.439479][ T1036] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 87.442306][ T1036] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 87.464103][ T1036] veth1_macvtap: left promiscuous mode
[ 87.466565][ T1036] veth0_macvtap: left promiscuous mode
[ 87.469221][ T1036] veth1_vlan: left promiscuous mode
[ 87.471489][ T1036] veth0_vlan: left promiscuous mode
[ 87.952497][ T1036] team0 (unregistering): Port device team_slave_1 removed
[ 87.971841][ T1036] team0 (unregistering): Port device team_slave_0 removed
[ 88.039698][ T5334] Bluetooth: hci0: command tx timeout
[ 88.211899][ T5398] hsr_slave_0: entered promiscuous mode
[ 88.214671][ T5398] hsr_slave_1: entered promiscuous mode
[ 88.916709][ T1036]
[ 88.917701][ T1036] ======================================================
[ 88.920308][ T1036] WARNING: possible circular locking dependency detected
[ 88.922889][ T1036] 6.13.0-syzkaller-g805ba04cb7cc #0 Not tainted
[ 88.926239][ T1036] ------------------------------------------------------
[ 88.928900][ T1036] kworker/u4:6/1036 is trying to acquire lock:
[ 88.931254][ T1036] ffffffff8fcc3b08 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0xac2/0x2030
[ 88.935275][ T1036]
[ 88.935275][ T1036] but task is already holding lock:
[ 88.938093][ T1036] ffff888012748768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700
[ 88.942215][ T1036]
[ 88.942215][ T1036] which lock already depends on the new lock.
[ 88.942215][ T1036]
[ 88.946249][ T1036]
[ 88.946249][ T1036] the existing dependency chain (in reverse order) is:
[ 88.949882][ T1036]
[ 88.949882][ T1036] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
[ 88.952921][ T1036] lock_acquire+0x1ed/0x550
[ 88.954865][ T1036] __mutex_lock+0x19c/0x1010
[ 88.956876][ T1036] wiphy_register+0x1a49/0x27b0
[ 88.959040][ T1036] ieee80211_register_hw+0x354e/0x4240
[ 88.961468][ T1036] mac80211_hwsim_new_radio+0x2a9f/0x4a90
[ 88.963893][ T1036] init_mac80211_hwsim+0x87a/0xb00
[ 88.966104][ T1036] do_one_initcall+0x248/0x870
[ 88.968168][ T1036] do_initcall_level+0x157/0x210
[ 88.970333][ T1036] do_initcalls+0x3f/0x80
[ 88.972138][ T1036] kernel_init_freeable+0x435/0x5d0
[ 88.974288][ T1036] kernel_init+0x1d/0x2b0
[ 88.976160][ T1036] ret_from_fork+0x4b/0x80
[ 88.978032][ T1036] ret_from_fork_asm+0x1a/0x30
[ 88.980101][ T1036]
[ 88.980101][ T1036] -> #0 (rtnl_mutex){+.+.}-{4:4}:
[ 88.983291][ T1036] validate_chain+0x18ef/0x5920
[ 88.985229][ T1036] __lock_acquire+0x1397/0x2100
[ 88.987251][ T1036] lock_acquire+0x1ed/0x550
[ 88.989238][ T1036] __mutex_lock+0x19c/0x1010
[ 88.991188][ T1036] unregister_netdevice_many_notify+0xac2/0x2030
[ 88.993836][ T1036] unregister_netdevice_queue+0x303/0x370
[ 88.996330][ T1036] _cfg80211_unregister_wdev+0x163/0x590
[ 88.998955][ T1036] ieee80211_remove_interfaces+0x4ef/0x700
[ 89.001325][ T1036] ieee80211_unregister_hw+0x5d/0x2c0
[ 89.003726][ T1036] mac80211_hwsim_del_radio+0x2c4/0x4c0
[ 89.006359][ T1036] hwsim_exit_net+0x5c1/0x670
[ 89.008377][ T1036] cleanup_net+0x812/0xd60
[ 89.010249][ T1036] process_scheduled_works+0xa66/0x1840
[ 89.012562][ T1036] worker_thread+0x870/0xd30
[ 89.014759][ T1036] kthread+0x7a9/0x920
[ 89.016560][ T1036] ret_from_fork+0x4b/0x80
[ 89.018546][ T1036] ret_from_fork_asm+0x1a/0x30
[ 89.020728][ T1036]
[ 89.020728][ T1036] other info that might help us debug this:
[ 89.020728][ T1036]
[ 89.024975][ T1036] Possible unsafe locking scenario:
[ 89.024975][ T1036]
[ 89.027901][ T1036] CPU0 CPU1
[ 89.029992][ T1036] ---- ----
[ 89.032202][ T1036] lock(&rdev->wiphy.mtx);
[ 89.033929][ T1036] lock(rtnl_mutex);
[ 89.036429][ T1036] lock(&rdev->wiphy.mtx);
[ 89.039138][ T1036] lock(rtnl_mutex);
[ 89.040749][ T1036]
[ 89.040749][ T1036] *** DEADLOCK ***
[ 89.040749][ T1036]
[ 89.043836][ T1036] 4 locks held by kworker/u4:6/1036:
[ 89.045859][ T1036] #0: ffff888030423148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840
[ 89.050158][ T1036] #1: ffffc9000250fc60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840
[ 89.054139][ T1036] #2: ffffffff8fcb7550 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60
[ 89.057931][ T1036] #3: ffff888012748768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700
[ 89.061991][ T1036]
[ 89.061991][ T1036] stack backtrace:
[ 89.064235][ T1036] CPU: 0 UID: 0 PID: 1036 Comm: kworker/u4:6 Not tainted 6.13.0-syzkaller-g805ba04cb7cc #0
[ 89.064248][ T1036] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 89.064257][ T1036] Workqueue: netns cleanup_net
[ 89.064276][ T1036] Call Trace:
[ 89.064283][ T1036]
[ 89.064289][ T1036] dump_stack_lvl+0x241/0x360
[ 89.064302][ T1036] ? __pfx_dump_stack_lvl+0x10/0x10
[ 89.064313][ T1036] ? __pfx__printk+0x10/0x10
[ 89.064330][ T1036] print_circular_bug+0x13a/0x1b0
[ 89.064343][ T1036] check_noncircular+0x36a/0x4a0
[ 89.064354][ T1036] ? __pfx_check_noncircular+0x10/0x10
[ 89.064364][ T1036] ? lockdep_lock+0x123/0x2b0
[ 89.064378][ T1036] validate_chain+0x18ef/0x5920
[ 89.064393][ T1036] ? __pfx_validate_chain+0x10/0x10
[ 89.064405][ T1036] ? mark_lock+0x9a/0x360
[ 89.064419][ T1036] ? __lock_acquire+0x1397/0x2100
[ 89.064435][ T1036] ? mark_lock+0x9a/0x360
[ 89.064451][ T1036] __lock_acquire+0x1397/0x2100
[ 89.064473][ T1036] lock_acquire+0x1ed/0x550
[ 89.064485][ T1036] ? unregister_netdevice_many_notify+0xac2/0x2030
[ 89.064497][ T1036] ? __pfx_lock_acquire+0x10/0x10
[ 89.064511][ T1036] ? __pfx___might_resched+0x10/0x10
[ 89.064523][ T1036] ? finish_wait+0xd4/0x1e0
[ 89.064537][ T1036] __mutex_lock+0x19c/0x1010
[ 89.064550][ T1036] ? unregister_netdevice_many_notify+0xac2/0x2030
[ 89.064560][ T1036] ? unregister_netdevice_many_notify+0xac2/0x2030
[ 89.064570][ T1036] ? __pfx___mutex_lock+0x10/0x10
[ 89.064582][ T1036] ? __pfx___might_resched+0x10/0x10
[ 89.064593][ T1036] ? unregister_netdevice_many_notify+0x9fa/0x2030
[ 89.064602][ T1036] ? unregister_netdevice_many_notify+0x9fa/0x2030
[ 89.064613][ T1036] unregister_netdevice_many_notify+0xac2/0x2030
[ 89.064623][ T1036] ? mark_lock+0x9a/0x360
[ 89.064639][ T1036] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 89.064649][ T1036] ? kernfs_remove_by_name_ns+0x11b/0x160
[ 89.064661][ T1036] ? __pfx_lock_release+0x10/0x10
[ 89.064677][ T1036] unregister_netdevice_queue+0x303/0x370
[ 89.064693][ T1036] ? __pfx_up_write+0x10/0x10
[ 89.064703][ T1036] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 89.064718][ T1036] ? kernfs_remove_by_name_ns+0x11b/0x160
[ 89.064729][ T1036] _cfg80211_unregister_wdev+0x163/0x590
[ 89.064743][ T1036] ieee80211_remove_interfaces+0x4ef/0x700
[ 89.064760][ T1036] ? __pfx_ieee80211_remove_interfaces+0x10/0x10
[ 89.064774][ T1036] ? rcu_is_watching+0x15/0xb0
[ 89.064787][ T1036] ieee80211_unregister_hw+0x5d/0x2c0
[ 89.064801][ T1036] mac80211_hwsim_del_radio+0x2c4/0x4c0
[ 89.064818][ T1036] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10
[ 89.064834][ T1036] hwsim_exit_net+0x5c1/0x670
[ 89.064848][ T1036] ? __pfx_hwsim_exit_net+0x10/0x10
[ 89.064860][ T1036] ? __ip_vs_dev_cleanup_batch+0x239/0x260
[ 89.064875][ T1036] cleanup_net+0x812/0xd60
[ 89.064888][ T1036] ? __pfx_cleanup_net+0x10/0x10
[ 89.064902][ T1036] ? process_scheduled_works+0x976/0x1840
[ 89.064914][ T1036] process_scheduled_works+0xa66/0x1840
[ 89.064931][ T1036] ? __pfx_process_scheduled_works+0x10/0x10
[ 89.064944][ T1036] ? assign_work+0x364/0x3d0
[ 89.064955][ T1036] worker_thread+0x870/0xd30
[ 89.064968][ T1036] ? __kthread_parkme+0x169/0x1d0
[ 89.064980][ T1036] ? __pfx_worker_thread+0x10/0x10
[ 89.064991][ T1036] kthread+0x7a9/0x920
[ 89.065005][ T1036] ? __pfx_kthread+0x10/0x10
[ 89.065018][ T1036] ? __pfx_worker_thread+0x10/0x10
[ 89.065029][ T1036] ? __pfx_kthread+0x10/0x10
[ 89.065040][ T1036] ? __pfx_kthread+0x10/0x10
[ 89.065053][ T1036] ? __pfx_kthread+0x10/0x10
[ 89.065065][ T1036] ? _raw_spin_unlock_irq+0x23/0x50
[ 89.065075][ T1036] ? lockdep_hardirqs_on+0x99/0x150
[ 89.065087][ T1036] ? __pfx_kthread+0x10/0x10
[ 89.065101][ T1036] ret_from_fork+0x4b/0x80
[ 89.065114][ T1036] ? __pfx_kthread+0x10/0x10
[ 89.065126][ T1036] ret_from_fork_asm+0x1a/0x30
[ 89.065141][ T1036]
[ 89.296504][ T5398] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 89.310971][ T5398] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 89.329020][ T5398] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 89.339676][ T5398] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 89.442292][ T5398] 8021q: adding VLAN 0 to HW filter on device bond0
[ 89.472463][ T5398] 8021q: adding VLAN 0 to HW filter on device team0
[ 89.493955][ T55] bridge0: port 1(bridge_slave_0) entered blocking state
[ 89.496746][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 89.524707][ T4579] bridge0: port 2(bridge_slave_1) entered blocking state
[ 89.527511][ T4579] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 89.699061][ T5398] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 89.739458][ T5398] veth0_vlan: entered promiscuous mode
[ 89.770476][ T5398] veth1_vlan: entered promiscuous mode
[ 89.802039][ T5398] veth0_macvtap: entered promiscuous mode
[ 89.805680][ T5398] veth1_macvtap: entered promiscuous mode
[ 89.826699][ T5398] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 89.841723][ T5398] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 89.845621][ T5398] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.859538][ T5398] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.863440][ T5398] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.866830][ T5398] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.913127][ T5398] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 89.925463][ T55] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.929313][ T55] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 89.936861][ T5398] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[ 89.949485][ T1036] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.952571][ T1036] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 91.676146][ T4579] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.191771][ T4579] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.221664][ T4579] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.252415][ T4579] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.332431][ T4579] bridge_slave_1: left allmulticast mode
[ 93.334603][ T4579] bridge_slave_1: left promiscuous mode
[ 93.336900][ T4579] bridge0: port 2(bridge_slave_1) entered disabled state
[ 93.355501][ T4579] bridge_slave_0: left allmulticast mode
[ 93.357753][ T4579] bridge_slave_0: left promiscuous mode
[ 93.360594][ T4579] bridge0: port 1(bridge_slave_0) entered disabled state
[ 93.463445][ T4579] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 93.473054][ T4579] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 93.492426][ T4579] bond0 (unregistering): Released all slaves
[ 93.634108][ T4579] hsr_slave_0: left promiscuous mode
[ 93.640717][ T4579] hsr_slave_1: left promiscuous mode
[ 93.650551][ T4579] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 93.653423][ T4579] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 93.668679][ T4579] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 93.671526][ T4579] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 93.680956][ T4579] veth1_macvtap: left promiscuous mode
[ 93.683099][ T4579] veth0_macvtap: left promiscuous mode
[ 93.685351][ T4579] veth1_vlan: left promiscuous mode
[ 93.687324][ T4579] veth0_vlan: left promiscuous mode
[ 93.860208][ T4579] team0 (unregistering): Port device team_slave_1 removed
[ 93.872506][ T4579] team0 (unregistering): Port device team_slave_0 removed
VM DIAGNOSIS:
22:10:48 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000061 RBX=ffffffff9a748100 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc9000250e4b0
R8 =ffffffff857645fb R9 =1ffff11003d7d046 R10=dffffc0000000000 R11=ffffffff857645b0
R12=dffffc0000000000 R13=ffffffff9a442f43 R14=0000000000000061 R15=00000000000003f8
RIP=ffffffff8576462e RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88801fc00000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f54c6894cda CR3=0000000011e34000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000002088000 Opmask01=0000000000020000 Opmask02=0000000000000000 Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd67edf2b0 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6565656565656565 6565656565656565
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ff00ff0000000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffff0000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ff00ff0000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4f6e3a6d5e007325 2e73250064252e73 2500656c6f736e6f 632f7665642f000a
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4f4b1f485e005600 0b56000041000b56 000040494a564b4a 460a5340410a000a
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 616d6e612020296f 2074616c2067000a 6572696563282031 5f65206163615f72
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
syzkaller build log:
go env (err=)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2501399437=/tmp/go-build -gno-record-gcc-switches'
git status (err=)
HEAD detached at 29f61fceff5
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=29f61fceff5d68b408b9086bff96ca036b503584 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20241205-000301'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"29f61fceff5d68b408b9086bff96ca036b503584\"
/usr/bin/ld: /tmp/cclpXplW.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking