./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4195713003 <...> Warning: Permanently added '10.128.0.99' (ED25519) to the list of known hosts. execve("./syz-executor4195713003", ["./syz-executor4195713003"], 0x7ffe1b543270 /* 10 vars */) = 0 brk(NULL) = 0x55556004d000 brk(0x55556004dd00) = 0x55556004dd00 arch_prctl(ARCH_SET_FS, 0x55556004d380) = 0 set_tid_address(0x55556004d650) = 5073 set_robust_list(0x55556004d660, 24) = 0 rseq(0x55556004dca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4195713003", 4096) = 28 getrandom("\x49\xfb\x44\xb1\xff\x29\x6e\x9b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556004dd00 brk(0x55556006ed00) = 0x55556006ed00 brk(0x55556006f000) = 0x55556006f000 mprotect(0x7f963cc10000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5074 attached , child_tidptr=0x55556004d650) = 5074 [pid 5074] set_robust_list(0x55556004d660, 24) = 0 [pid 5074] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5074] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5074] setsid() = 1 [pid 5074] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5074] unshare(CLONE_NEWNS) = 0 [pid 5074] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5074] unshare(CLONE_NEWIPC) = 0 [pid 5074] unshare(CLONE_NEWCGROUP) = 0 [pid 5074] unshare(CLONE_NEWUTS) = 0 [pid 5074] unshare(CLONE_SYSVSEM) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "16777216", 8) = 8 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "536870912", 9) = 9 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "8192", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5074] close(3) = 0 [pid 5074] getpid() = 1 [pid 5074] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<team_lock_key){+.+.}-{3:3}, at: team_del_slave+0x32/0x1d0 [ 78.604927][ T5074] [ 78.604927][ T5074] but task is already holding lock: [ 78.612282][ T5074] ffff88802a210768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 78.622119][ T5074] [ 78.622119][ T5074] which lock already depends on the new lock. [ 78.622119][ T5074] [ 78.632515][ T5074] [ 78.632515][ T5074] the existing dependency chain (in reverse order) is: [ 78.641525][ T5074] [ 78.641525][ T5074] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 78.649264][ T5074] lock_acquire+0x1e4/0x530 [ 78.654314][ T5074] __mutex_lock+0x136/0xd70 [ 78.659352][ T5074] ieee80211_open+0xe7/0x200 [ 78.664484][ T5074] __dev_open+0x2d3/0x450 [ 78.669342][ T5074] dev_open+0xae/0x1b0 [ 78.673932][ T5074] team_add_slave+0x9b3/0x2750 [ 78.679213][ T5074] do_setlink+0xe70/0x41f0 [ 78.684151][ T5074] rtnl_setlink+0x40d/0x5a0 [ 78.689205][ T5074] rtnetlink_rcv_msg+0x89b/0x10d0 [ 78.694752][ T5074] netlink_rcv_skb+0x1e3/0x430 [ 78.700046][ T5074] netlink_unicast+0x7ea/0x980 [ 78.705342][ T5074] netlink_sendmsg+0x8e1/0xcb0 [ 78.710631][ T5074] __sock_sendmsg+0x221/0x270 [ 78.715833][ T5074] ____sys_sendmsg+0x525/0x7d0 [ 78.721126][ T5074] __sys_sendmsg+0x2b0/0x3a0 [ 78.726245][ T5074] do_syscall_64+0xfb/0x240 [ 78.731272][ T5074] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 78.737690][ T5074] [ 78.737690][ T5074] -> #0 (team->team_lock_key){+.+.}-{3:3}: [ 78.745687][ T5074] validate_chain+0x18cb/0x58e0 [ 78.751060][ T5074] __lock_acquire+0x1346/0x1fd0 [ 78.756434][ T5074] lock_acquire+0x1e4/0x530 [ 78.761459][ T5074] __mutex_lock+0x136/0xd70 [ 78.766482][ T5074] team_del_slave+0x32/0x1d0 [ 78.771592][ T5074] team_device_event+0x200/0x5b0 [ 78.777053][ T5074] notifier_call_chain+0x18f/0x3b0 [ 78.782687][ T5074] unregister_netdevice_many_notify+0xd96/0x16d0 [ 78.789557][ T5074] unregister_netdevice_queue+0x303/0x370 [ 78.795802][ T5074] _cfg80211_unregister_wdev+0x162/0x560 [ 78.801966][ T5074] ieee80211_if_remove+0x25d/0x3a0 [ 78.807602][ T5074] ieee80211_del_iface+0x19/0x30 [ 78.813059][ T5074] cfg80211_remove_virtual_intf+0x230/0x3f0 [ 78.819491][ T5074] genl_rcv_msg+0xb14/0xec0 [ 78.824511][ T5074] netlink_rcv_skb+0x1e3/0x430 [ 78.829804][ T5074] genl_rcv+0x28/0x40 [ 78.834304][ T5074] netlink_unicast+0x7ea/0x980 [ 78.839589][ T5074] netlink_sendmsg+0x8e1/0xcb0 [ 78.844876][ T5074] __sock_sendmsg+0x221/0x270 [ 78.850077][ T5074] ____sys_sendmsg+0x525/0x7d0 [ 78.855367][ T5074] __sys_sendmsg+0x2b0/0x3a0 [ 78.860487][ T5074] do_syscall_64+0xfb/0x240 [ 78.865515][ T5074] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 78.871928][ T5074] [ 78.871928][ T5074] other info that might help us debug this: [ 78.871928][ T5074] [ 78.882148][ T5074] Possible unsafe locking scenario: [ 78.882148][ T5074] [ 78.889599][ T5074] CPU0 CPU1 [ 78.894956][ T5074] ---- ---- [ 78.900319][ T5074] lock(&rdev->wiphy.mtx); [ 78.904825][ T5074] lock(team->team_lock_key); [ 78.912106][ T5074] lock(&rdev->wiphy.mtx); [ 78.919129][ T5074] lock(team->team_lock_key); [ 78.923894][ T5074] [ 78.923894][ T5074] *** DEADLOCK *** [ 78.923894][ T5074] [ 78.932030][ T5074] 3 locks held by syz-executor419/5074: [ 78.937568][ T5074] #0: ffffffff8f3f1a30 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 [ 78.945844][ T5074] #1: ffffffff8f38ce88 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 [ 78.955078][ T5074] #2: ffff88802a210768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_del_interface+0x11a/0x140 [ 78.965468][ T5074] [ 78.965468][ T5074] stack backtrace: [ 78.971352][ T5074] CPU: 1 PID: 5074 Comm: syz-executor419 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0 [ 78.981416][ T5074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 78.991472][ T5074] Call Trace: [ 78.994756][ T5074] [ 78.997688][ T5074] dump_stack_lvl+0x241/0x360 [ 79.002377][ T5074] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.007589][ T5074] ? print_circular_bug+0x130/0x1a0 [ 79.012796][ T5074] check_noncircular+0x36a/0x4a0 [ 79.017747][ T5074] ? __pfx_check_noncircular+0x10/0x10 [ 79.023218][ T5074] ? lockdep_lock+0x123/0x2b0 [ 79.027929][ T5074] ? lockdep_unlock+0x16a/0x300 [ 79.032795][ T5074] ? __pfx_lockdep_unlock+0x10/0x10 [ 79.038002][ T5074] ? _find_first_zero_bit+0xd4/0x100 [ 79.043293][ T5074] validate_chain+0x18cb/0x58e0 [ 79.048171][ T5074] ? __pfx_validate_chain+0x10/0x10 [ 79.053379][ T5074] ? __pfx_validate_chain+0x10/0x10 [ 79.058588][ T5074] ? stack_trace_save+0x118/0x1d0 [ 79.063624][ T5074] ? __pfx_stack_trace_save+0x10/0x10 [ 79.069010][ T5074] ? lockdep_unlock+0x16a/0x300 [ 79.073882][ T5074] ? mark_lock+0x9a/0x350 [ 79.078242][ T5074] __lock_acquire+0x1346/0x1fd0 [ 79.083118][ T5074] lock_acquire+0x1e4/0x530 [ 79.087635][ T5074] ? team_del_slave+0x32/0x1d0 [ 79.092415][ T5074] ? __pfx_lock_acquire+0x10/0x10 [ 79.097454][ T5074] ? __pfx___might_resched+0x10/0x10 [ 79.102759][ T5074] ? __pfx___might_resched+0x10/0x10 [ 79.108063][ T5074] ? xsk_notifier+0x218/0x230 [ 79.112779][ T5074] __mutex_lock+0x136/0xd70 [ 79.117376][ T5074] ? team_del_slave+0x32/0x1d0 [ 79.122144][ T5074] ? trace_contention_end+0x3c/0x100 [ 79.127441][ T5074] ? __mutex_lock+0x2ef/0xd70 [ 79.132121][ T5074] ? bond_netdev_event+0xdd/0xf20 [ 79.137178][ T5074] ? team_del_slave+0x32/0x1d0 [ 79.141954][ T5074] ? __pfx___mutex_lock+0x10/0x10 [ 79.146995][ T5074] ? __asan_memset+0x23/0x50 [ 79.151598][ T5074] team_del_slave+0x32/0x1d0 [ 79.156222][ T5074] team_device_event+0x200/0x5b0 [ 79.161166][ T5074] ? notifier_call_chain+0x166/0x3b0 [ 79.166460][ T5074] notifier_call_chain+0x18f/0x3b0 [ 79.171597][ T5074] unregister_netdevice_many_notify+0xd96/0x16d0 [ 79.177949][ T5074] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 79.183686][ T5074] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 79.190467][ T5074] ? kasan_quarantine_put+0xdc/0x230 [ 79.195769][ T5074] unregister_netdevice_queue+0x303/0x370 [ 79.201510][ T5074] ? __pfx_up_write+0x10/0x10 [ 79.206203][ T5074] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 79.212468][ T5074] ? kernfs_remove_by_name_ns+0x11b/0x160 [ 79.218203][ T5074] _cfg80211_unregister_wdev+0x162/0x560 [ 79.223849][ T5074] ieee80211_if_remove+0x25d/0x3a0 [ 79.228974][ T5074] ieee80211_del_iface+0x19/0x30 [ 79.233925][ T5074] cfg80211_remove_virtual_intf+0x230/0x3f0 [ 79.239839][ T5074] genl_rcv_msg+0xb14/0xec0 [ 79.244349][ T5074] ? mark_lock+0x9a/0x350 [ 79.248691][ T5074] ? __pfx_genl_rcv_msg+0x10/0x10 [ 79.253734][ T5074] ? __pfx_lock_acquire+0x10/0x10 [ 79.258762][ T5074] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 79.264146][ T5074] ? __pfx_nl80211_del_interface+0x10/0x10 [ 79.269973][ T5074] ? __pfx_nl80211_post_doit+0x10/0x10 [ 79.275473][ T5074] ? __pfx___might_resched+0x10/0x10 [ 79.280775][ T5074] netlink_rcv_skb+0x1e3/0x430 [ 79.285554][ T5074] ? __pfx_genl_rcv_msg+0x10/0x10 [ 79.290593][ T5074] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 79.295895][ T5074] ? __pfx_lock_release+0x10/0x10 [ 79.300923][ T5074] ? __netlink_deliver_tap+0x77e/0x7c0 [ 79.306417][ T5074] genl_rcv+0x28/0x40 [ 79.310406][ T5074] netlink_unicast+0x7ea/0x980 [ 79.315180][ T5074] ? __pfx_netlink_unicast+0x10/0x10 [ 79.320467][ T5074] ? __virt_addr_valid+0x44e/0x520 [ 79.325606][ T5074] ? __phys_addr_symbol+0x2f/0x70 [ 79.330634][ T5074] ? __check_object_size+0x4bc/0xa00 [ 79.335921][ T5074] ? bpf_lsm_netlink_send+0x9/0x10 [ 79.341049][ T5074] netlink_sendmsg+0x8e1/0xcb0 [ 79.345857][ T5074] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.351154][ T5074] ? __import_iovec+0x536/0x820 [ 79.356016][ T5074] ? aa_sock_msg_perm+0x91/0x160 [ 79.360960][ T5074] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 79.366282][ T5074] ? security_socket_sendmsg+0x87/0xb0 [ 79.371759][ T5074] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.377063][ T5074] __sock_sendmsg+0x221/0x270 [ 79.381746][ T5074] ____sys_sendmsg+0x525/0x7d0 [ 79.386530][ T5074] ? __pfx_____sys_sendmsg+0x10/0x10 [ 79.391823][ T5074] ? do_raw_spin_lock+0x14f/0x370 [ 79.396877][ T5074] __sys_sendmsg+0x2b0/0x3a0 [ 79.401494][ T5074] ? __pfx___sys_sendmsg+0x10/0x10 [ 79.406616][ T5074] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 79.412947][ T5074] ? _raw_spin_unlock_irq+0x2e/0x50 [ 79.418238][ T5074] ? ptrace_notify+0x279/0x380 [ 79.423024][ T5074] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 79.429351][ T5074] ? do_syscall_64+0x10a/0x240 [ 79.434126][ T5074] ? syscall_trace_enter+0x5f/0x150 [ 79.439335][ T5074] do_syscall_64+0xfb/0x240 [ 79.443850][ T5074] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 79.449750][ T5074] RIP: 0033:0x7f963cb981a9 [ 79.454196][ T5074] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 79.473899][ T5074] RSP: 002b:00007ffdde1419a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.482327][ T5074] RAX: ffffffffffffffda RBX: 00007f963cbe53f6 RCX: 00007f963cb981a9 [ 79.490308][ T5074] RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000004 [ 79.498311][ T5074] RBP: 00007f963cc17440 R08: 0000000000000000 R09: 0000000000000000 [ 79.506284][ T5074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000031 [ 79.514251][ T5074] R13: 0000000000000003 R14: 0000000000050012 R15: 00007ffdde141a02 [ 79.522229][ T5074] [ 79.531252][ T5074] team0: Port device wlan0 removed [pid 5074] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x1c\x00\x00\x00\x23\x00\x37\x95\x00\x00\x9f\x83\x3d\x32\x34\xd3\x08\xf8\x00\x00\x08\x00\x03\x00\x47\x00\x00\x00", iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5074] exit_group(1) = ? [pid 5074] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5074, si_uid=0, si_status=1, si_utime=0, si_stime=142 /* 1.42 s */} --- exit_group(0) = ? +++ exited with 0 +++