netlink: 'syz-executor.3': attribute type 11 has an invalid length. ============================================ WARNING: possible recursive locking detected 5.11.0-rc5-syzkaller #0 Not tainted -------------------------------------------- syz-executor.3/750 is trying to acquire lock: ffff88811f6085e8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5267 [inline] ffff88811f6085e8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_netdev_notifier_call+0x28a/0x5b0 net/wireless/core.c:1407 but task is already holding lock: ffff88811f6085e8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5267 [inline] ffff88811f6085e8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_pre_doit+0xc1/0x160 net/wireless/nl80211.c:14837 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rdev->wiphy.mtx); lock(&rdev->wiphy.mtx); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by syz-executor.3/750: #0: ffffffff852a2eb0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x10/0x30 net/netlink/genetlink.c:810 #1: ffffffff85288d48 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x13/0x160 net/wireless/nl80211.c:14793 #2: ffff88811f6085e8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5267 [inline] #2: ffff88811f6085e8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_pre_doit+0xc1/0x160 net/wireless/nl80211.c:14837 stack backtrace: CPU: 0 PID: 750 Comm: syz-executor.3 Not tainted 5.11.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x77/0x97 lib/dump_stack.c:120 print_deadlock_bug kernel/locking/lockdep.c:2829 [inline] check_deadlock kernel/locking/lockdep.c:2872 [inline] validate_chain kernel/locking/lockdep.c:3661 [inline] __lock_acquire.cold.75+0x165/0x2be kernel/locking/lockdep.c:4899 lock_acquire+0xd0/0x3e0 kernel/locking/lockdep.c:5509 __mutex_lock_common kernel/locking/mutex.c:956 [inline] __mutex_lock+0x94/0xa00 kernel/locking/mutex.c:1103 wiphy_lock include/net/cfg80211.h:5267 [inline] cfg80211_netdev_notifier_call+0x28a/0x5b0 net/wireless/core.c:1407 notifier_call_chain+0x2f/0x90 kernel/notifier.c:83 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] unregister_netdevice_many+0x11d/0x6d0 net/core/dev.c:10704 unregister_netdevice_queue+0xc6/0x100 net/core/dev.c:10638 register_netdevice+0x55a/0x630 net/core/dev.c:10013 cfg80211_register_netdevice+0x4f/0x110 net/wireless/core.c:1349 ieee80211_if_add+0x571/0x9e0 net/mac80211/iface.c:1990 ieee80211_add_iface+0x38/0x90 net/mac80211/cfg.c:125 rdev_add_virtual_intf net/wireless/rdev-ops.h:45 [inline] nl80211_new_interface+0x1b4/0x540 net/wireless/nl80211.c:3977 genl_family_rcv_msg_doit.isra.17+0x102/0x140 net/netlink/genetlink.c:739 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0xd8/0x1e0 net/netlink/genetlink.c:800 netlink_rcv_skb+0x49/0xf0 net/netlink/af_netlink.c:2494 genl_rcv+0x1f/0x30 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] netlink_unicast+0x19a/0x270 net/netlink/af_netlink.c:1330 netlink_sendmsg+0x248/0x480 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0x2b/0x40 net/socket.c:674 ____sys_sendmsg+0x1ed/0x230 net/socket.c:2350 ___sys_sendmsg+0x77/0xb0 net/socket.c:2404 __sys_sendmsg+0x52/0xa0 net/socket.c:2437 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e219 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fdfbd3afc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219 RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000004 RBP: 000000000119c110 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119c0dc R13: 00007ffd1315af0f R14: 00007fdfbd3b09c0 R15: 000000000119c0dc