./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor330085240 <...> Warning: Permanently added '10.128.1.42' (ED25519) to the list of known hosts. execve("./syz-executor330085240", ["./syz-executor330085240"], 0x7ffe0da81c40 /* 10 vars */) = 0 brk(NULL) = 0x55558b245000 brk(0x55558b245d00) = 0x55558b245d00 arch_prctl(ARCH_SET_FS, 0x55558b245380) = 0 set_tid_address(0x55558b245650) = 5837 set_robust_list(0x55558b245660, 24) = 0 rseq(0x55558b245ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor330085240", 4096) = 27 getrandom("\xa3\x53\x82\xfc\xd6\xaa\x93\xa9", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558b245d00 brk(0x55558b266d00) = 0x55558b266d00 brk(0x55558b267000) = 0x55558b267000 mprotect(0x7f76fec89000, 16384, PROT_READ) = 0 mmap(0x3ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ffffffff000 mmap(0x400000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400000000000 mmap(0x400001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5838 attached , child_tidptr=0x55558b245650) = 5838 [pid 5838] set_robust_list(0x55558b245660, 24) = 0 [pid 5838] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5838] getppid() = 0 [pid 5838] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5838] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5838] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5838] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5838] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5838] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5838] unshare(CLONE_NEWNS) = 0 [pid 5838] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5838] unshare(CLONE_NEWIPC) = 0 [pid 5838] unshare(CLONE_NEWCGROUP) = 0 [pid 5838] unshare(CLONE_NEWUTS) = 0 [pid 5838] unshare(CLONE_SYSVSEM) = 0 [pid 5838] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "16777216", 8) = 8 [pid 5838] close(3) = 0 [pid 5838] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "536870912", 9) = 9 [pid 5838] close(3) = 0 [pid 5838] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "1024", 4) = 4 [pid 5838] close(3) = 0 [pid 5838] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "8192", 4) = 4 [pid 5838] close(3) = 0 [pid 5838] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "1024", 4) = 4 [pid 5838] close(3) = 0 [pid 5838] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "1024", 4) = 4 [pid 5838] close(3) = 0 [pid 5838] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5838] close(3) = 0 [pid 5838] getpid() = 1 [pid 5838] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<wiphy.mtx){+.+.}-{4:4}, at: ieee80211_change_mac+0xc6/0x1160 [ 88.236397][ T5838] [ 88.236397][ T5838] but task is already holding lock: [ 88.243762][ T5838] ffff88807a458d28 (&dev->lock){+.+.}-{4:4}, at: dev_set_mac_address+0x2a/0x50 [ 88.252734][ T5838] [ 88.252734][ T5838] which lock already depends on the new lock. [ 88.252734][ T5838] [ 88.263134][ T5838] [ 88.263134][ T5838] the existing dependency chain (in reverse order) is: [ 88.272146][ T5838] [ 88.272146][ T5838] -> #1 (&dev->lock){+.+.}-{4:4}: [ 88.279373][ T5838] lock_acquire+0x1ed/0x550 [ 88.284403][ T5838] __mutex_lock+0x19c/0x1010 [ 88.289538][ T5838] register_netdevice+0x12d8/0x1b70 [ 88.295260][ T5838] cfg80211_register_netdevice+0x149/0x2f0 [ 88.301610][ T5838] ieee80211_if_add+0x119d/0x1780 [ 88.307168][ T5838] ieee80211_register_hw+0x3708/0x42e0 [ 88.313158][ T5838] mac80211_hwsim_new_radio+0x2a89/0x49f0 [ 88.319413][ T5838] init_mac80211_hwsim+0x87a/0xb00 [ 88.325049][ T5838] do_one_initcall+0x248/0x930 [ 88.330340][ T5838] do_initcall_level+0x157/0x210 [ 88.335798][ T5838] do_initcalls+0x71/0xd0 [ 88.340647][ T5838] kernel_init_freeable+0x435/0x5d0 [ 88.346374][ T5838] kernel_init+0x1d/0x2b0 [ 88.351236][ T5838] ret_from_fork+0x4b/0x80 [ 88.356179][ T5838] ret_from_fork_asm+0x1a/0x30 [ 88.361466][ T5838] [ 88.361466][ T5838] -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 88.369209][ T5838] validate_chain+0x18ef/0x5920 [ 88.374584][ T5838] __lock_acquire+0x1397/0x2100 [ 88.379962][ T5838] lock_acquire+0x1ed/0x550 [ 88.384996][ T5838] __mutex_lock+0x19c/0x1010 [ 88.390127][ T5838] ieee80211_change_mac+0xc6/0x1160 [ 88.395887][ T5838] netif_set_mac_address+0x327/0x510 [ 88.401697][ T5838] dev_set_mac_address+0x38/0x50 [ 88.407151][ T5838] bond_enslave+0xff3/0x3910 [ 88.412283][ T5838] do_set_master+0x579/0x730 [ 88.417401][ T5838] do_setlink+0xfee/0x40f0 [ 88.422344][ T5838] rtnl_newlink+0x15a6/0x1d90 [ 88.427546][ T5838] rtnetlink_rcv_msg+0x791/0xcf0 [ 88.433009][ T5838] netlink_rcv_skb+0x206/0x480 [ 88.438301][ T5838] netlink_unicast+0x7f6/0x990 [ 88.443597][ T5838] netlink_sendmsg+0x8de/0xcb0 [ 88.448890][ T5838] __sock_sendmsg+0x221/0x270 [ 88.454094][ T5838] ____sys_sendmsg+0x53a/0x860 [ 88.459382][ T5838] __sys_sendmsg+0x269/0x350 [ 88.464493][ T5838] do_syscall_64+0xf3/0x230 [ 88.469522][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.475945][ T5838] [ 88.475945][ T5838] other info that might help us debug this: [ 88.475945][ T5838] [ 88.486173][ T5838] Possible unsafe locking scenario: [ 88.486173][ T5838] [ 88.493621][ T5838] CPU0 CPU1 [ 88.498983][ T5838] ---- ---- [ 88.504346][ T5838] lock(&dev->lock); [ 88.508352][ T5838] lock(&rdev->wiphy.mtx); [ 88.515381][ T5838] lock(&dev->lock); [ 88.521886][ T5838] lock(&rdev->wiphy.mtx); [ 88.526394][ T5838] [ 88.526394][ T5838] *** DEADLOCK *** [ 88.526394][ T5838] [ 88.534536][ T5838] 2 locks held by syz-executor330/5838: [ 88.540163][ T5838] #0: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc4c/0x1d90 [ 88.549239][ T5838] #1: ffff88807a458d28 (&dev->lock){+.+.}-{4:4}, at: dev_set_mac_address+0x2a/0x50 [ 88.558646][ T5838] [ 88.558646][ T5838] stack backtrace: [ 88.564547][ T5838] CPU: 1 UID: 0 PID: 5838 Comm: syz-executor330 Not tainted 6.14.0-rc5-syzkaller-01215-g89d75c4c67ac #0 [ 88.564566][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 88.564580][ T5838] Call Trace: [ 88.564586][ T5838] [ 88.564594][ T5838] dump_stack_lvl+0x241/0x360 [ 88.564615][ T5838] ? __pfx_dump_stack_lvl+0x10/0x10 [ 88.564633][ T5838] ? __pfx__printk+0x10/0x10 [ 88.564652][ T5838] print_circular_bug+0x13a/0x1b0 [ 88.564673][ T5838] check_noncircular+0x36a/0x4a0 [ 88.564693][ T5838] ? __pfx_check_noncircular+0x10/0x10 [ 88.564711][ T5838] ? lockdep_lock+0x123/0x2b0 [ 88.564734][ T5838] ? validate_chain+0x11e/0x5920 [ 88.564754][ T5838] validate_chain+0x18ef/0x5920 [ 88.564780][ T5838] ? __pfx_validate_chain+0x10/0x10 [ 88.564799][ T5838] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 88.564818][ T5838] ? __pfx_validate_chain+0x10/0x10 [ 88.564836][ T5838] ? __pfx_validate_chain+0x10/0x10 [ 88.564853][ T5838] ? __pfx_validate_chain+0x10/0x10 [ 88.564871][ T5838] ? __pfx_validate_chain+0x10/0x10 [ 88.564890][ T5838] ? idr_get_free+0x91c/0xab0 [ 88.564907][ T5838] ? __pfx_validate_chain+0x10/0x10 [ 88.564925][ T5838] ? mark_lock+0x9a/0x360 [ 88.564948][ T5838] __lock_acquire+0x1397/0x2100 [ 88.564978][ T5838] lock_acquire+0x1ed/0x550 [ 88.565002][ T5838] ? ieee80211_change_mac+0xc6/0x1160 [ 88.565024][ T5838] ? __pfx_lock_acquire+0x10/0x10 [ 88.565049][ T5838] ? __pfx___might_resched+0x10/0x10 [ 88.565076][ T5838] __mutex_lock+0x19c/0x1010 [ 88.565095][ T5838] ? ieee80211_change_mac+0xc6/0x1160 [ 88.565115][ T5838] ? __pfx_lock_release+0x10/0x10 [ 88.565141][ T5838] ? ieee80211_change_mac+0xc6/0x1160 [ 88.565160][ T5838] ? __pfx___mutex_lock+0x10/0x10 [ 88.565182][ T5838] ? __pfx_vxlan_netdevice_event+0x10/0x10 [ 88.565209][ T5838] ? ib_device_get_by_netdev+0x85/0x5e0 [ 88.565233][ T5838] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 88.565255][ T5838] ? hsr_netdev_notify+0x295/0xb50 [ 88.565278][ T5838] ieee80211_change_mac+0xc6/0x1160 [ 88.565299][ T5838] ? ip6_route_dev_notify+0x99/0x600 [ 88.565316][ T5838] ? notifier_call_chain+0x15a/0x3f0 [ 88.565339][ T5838] ? notifier_call_chain+0x3cc/0x3f0 [ 88.565364][ T5838] netif_set_mac_address+0x327/0x510 [ 88.565383][ T5838] ? __pfx_netif_set_mac_address+0x10/0x10 [ 88.565405][ T5838] dev_set_mac_address+0x38/0x50 [ 88.565421][ T5838] bond_enslave+0xff3/0x3910 [ 88.565447][ T5838] ? __pfx_fib6_run_gc+0x10/0x10 [ 88.565472][ T5838] ? ip6_route_dev_notify+0x99/0x600 [ 88.565488][ T5838] ? notifier_call_chain+0x15a/0x3f0 [ 88.565513][ T5838] ? __pfx_bond_enslave+0x10/0x10 [ 88.565545][ T5838] ? __pfx___dev_change_flags+0x10/0x10 [ 88.565560][ T5838] ? validate_linkmsg+0x828/0xa40 [ 88.565580][ T5838] ? mutex_is_locked+0x17/0x50 [ 88.565597][ T5838] do_set_master+0x579/0x730 [ 88.565615][ T5838] do_setlink+0xfee/0x40f0 [ 88.565649][ T5838] ? __pfx_do_setlink+0x10/0x10 [ 88.565677][ T5838] ? __pfx___might_resched+0x10/0x10 [ 88.565699][ T5838] ? __pfx___mutex_trylock_common+0x10/0x10 [ 88.565719][ T5838] ? rcu_is_watching+0x15/0xb0 [ 88.565737][ T5838] ? trace_contention_end+0x3c/0x120 [ 88.565755][ T5838] ? __mutex_lock+0x397/0x1010 [ 88.565775][ T5838] ? __pfx_aa_get_newest_label+0x10/0x10 [ 88.565802][ T5838] ? rtnl_newlink+0xc4c/0x1d90 [ 88.565825][ T5838] ? __pfx___mutex_lock+0x10/0x10 [ 88.565847][ T5838] ? ns_capable+0x8a/0xf0 [ 88.565866][ T5838] ? rtnl_link_get_net_capable+0x168/0x340 [ 88.565892][ T5838] rtnl_newlink+0x15a6/0x1d90 [ 88.565915][ T5838] ? stack_depot_save_flags+0x7b4/0x940 [ 88.565950][ T5838] ? __pfx_rtnl_newlink+0x10/0x10 [ 88.565972][ T5838] ? __netlink_deliver_tap+0x561/0x7f0 [ 88.565996][ T5838] ? __pfx_validate_chain+0x10/0x10 [ 88.566013][ T5838] ? __sock_sendmsg+0x221/0x270 [ 88.566033][ T5838] ? ____sys_sendmsg+0x53a/0x860 [ 88.566049][ T5838] ? __sys_sendmsg+0x269/0x350 [ 88.566065][ T5838] ? do_syscall_64+0xf3/0x230 [ 88.566084][ T5838] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.566113][ T5838] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 88.566138][ T5838] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 88.566166][ T5838] ? mark_lock+0x9a/0x360 [ 88.566182][ T5838] ? __lock_acquire+0x1397/0x2100 [ 88.566218][ T5838] ? __pfx_lock_release+0x10/0x10 [ 88.566247][ T5838] ? __pfx_rtnl_newlink+0x10/0x10 [ 88.566271][ T5838] rtnetlink_rcv_msg+0x791/0xcf0 [ 88.566293][ T5838] ? rtnetlink_rcv_msg+0x1a7/0xcf0 [ 88.566317][ T5838] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 88.566342][ T5838] ? ref_tracker_free+0x643/0x7e0 [ 88.566359][ T5838] netlink_rcv_skb+0x206/0x480 [ 88.566382][ T5838] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 88.566405][ T5838] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 88.566435][ T5838] ? netlink_deliver_tap+0x2e/0x1b0 [ 88.566458][ T5838] netlink_unicast+0x7f6/0x990 [ 88.566480][ T5838] ? __pfx_netlink_unicast+0x10/0x10 [ 88.566499][ T5838] ? __virt_addr_valid+0x45f/0x530 [ 88.566515][ T5838] ? __phys_addr_symbol+0x2f/0x70 [ 88.566530][ T5838] ? __check_object_size+0x47a/0x730 [ 88.566552][ T5838] netlink_sendmsg+0x8de/0xcb0 [ 88.566579][ T5838] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.566603][ T5838] ? __lock_acquire+0x1397/0x2100 [ 88.566627][ T5838] ? aa_sock_msg_perm+0x91/0x160 [ 88.566652][ T5838] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.566674][ T5838] __sock_sendmsg+0x221/0x270 [ 88.566697][ T5838] ____sys_sendmsg+0x53a/0x860 [ 88.566717][ T5838] ? __pfx_____sys_sendmsg+0x10/0x10 [ 88.566735][ T5838] ? do_raw_spin_lock+0x14f/0x370 [ 88.566759][ T5838] __sys_sendmsg+0x269/0x350 [ 88.566777][ T5838] ? __pfx___sys_sendmsg+0x10/0x10 [ 88.566809][ T5838] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 88.566833][ T5838] ? exc_page_fault+0x590/0x8b0 [ 88.566854][ T5838] do_syscall_64+0xf3/0x230 [ 88.566873][ T5838] ? clear_bhb_loop+0x35/0x90 [ 88.566897][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.566923][ T5838] RIP: 0033:0x7f76fec11329 [ 88.566946][ T5838] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 88.566960][ T5838] RSP: 002b:00007fff4bb2f358 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 88.566976][ T5838] RAX: ffffffffffffffda RBX: 00007f76fec5e513 RCX: 00007f76fec11329 [pid 5838] sendmsg(3, {msg_name=NULL, msg_namelen=12, msg_iov=[{iov_base="\x2e\x00\x00\x00\x10\x00\x81\x88\xe6\xb6\x2a\xa7\x37\x72\xcc\x9f\x1b\xa1\xf8\x48\x48\x00\x00\x00\x5e\x14\x06\x02\x00\x00\x00\x00\x0e\x00\x0a\x00\x0f\x00\x00\x00\x02\x80\x00\x00\x12\x94", iov_len=46}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 46 [pid 5838] exit_group(1) = ? [ 88.566988][ T5838] RDX: 0000000000000000 RSI: 0000400000000600 RDI: 0000000000000003 [ 88.566998][ T5838] RBP: 00007f76fec5e4e3 R08: 0000000000000000 R09: 0000000000000000 [ 88.567008][ T5838] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f76fec5e44b [ 88.567018][ T5838] R13: 0000000000000048 R14: 0000000000050012 R15: 0000000000000003 [ 88.567034][ T5838] [ 89.207816][ T5838] bond0: (slave wlan1): Enslaving as an active interface with an up link [pid 5838] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5838, si_uid=0, si_status=1, si_utime=0, si_stime=115 /* 1.15 s */} --- exit_group(0) = ? +++ exited with 0 +++