Warning: Permanently added '10.128.0.32' (ED25519) to the list of known hosts. 2026/07/04 04:20:39 parsed 1 programs 2026/07/04 04:20:39 serving rpc on tcp://36781 [ 81.758774][ T5792] cgroup: Unknown subsys name 'net' [ 81.895792][ T5792] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.383582][ T5792] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.596730][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.605567][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.637878][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.646777][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.676697][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.684878][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.692643][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.703422][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.712622][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 86.721520][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.965968][ T9] cfg80211: failed to load regulatory.db [ 87.737909][ T5868] chnl_net:caif_netlink_parms(): no params data found [ 87.817917][ T5868] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.825777][ T5868] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.832923][ T5868] bridge_slave_0: entered allmulticast mode [ 87.839899][ T5868] bridge_slave_0: entered promiscuous mode [ 87.862129][ T5868] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.869834][ T5868] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.877846][ T5868] bridge_slave_1: entered allmulticast mode [ 87.886197][ T5868] bridge_slave_1: entered promiscuous mode [ 87.909411][ T5868] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.924686][ T5868] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.964829][ T5868] team0: Port device team_slave_0 added [ 87.972313][ T5868] team0: Port device team_slave_1 added [ 87.992553][ T5868] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.999605][ T5868] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.025565][ T5868] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.039183][ T5868] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.046200][ T5868] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.072111][ T5868] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.122912][ T5868] hsr_slave_0: entered promiscuous mode [ 88.129231][ T5868] hsr_slave_1: entered promiscuous mode [ 88.308061][ T5868] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.319761][ T5868] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.329963][ T5868] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.339786][ T5868] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.377365][ T5868] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.384904][ T5868] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.393222][ T5868] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.400436][ T5868] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.470475][ T5868] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.490601][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.500388][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.515782][ T5868] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.528448][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.535625][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.553025][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.560216][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.762223][ T5868] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.821037][ T5868] veth0_vlan: entered promiscuous mode [ 88.831262][ T5868] veth1_vlan: entered promiscuous mode [ 88.856248][ T5868] veth0_macvtap: entered promiscuous mode [ 88.866133][ T5868] veth1_macvtap: entered promiscuous mode [ 88.890251][ T5868] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.904700][ T5868] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.918437][ T5868] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.928030][ T5868] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.936757][ T5868] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.945578][ T5868] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.075938][ T5868] syz-executor (5868) used greatest stack depth: 20728 bytes left [ 89.440052][ T141] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/07/04 04:20:49 executed programs: 0 [ 89.873090][ T5087] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 89.884302][ T5087] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 89.892192][ T5087] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 89.901692][ T5087] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 89.909519][ T5087] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 89.918771][ T5087] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.034982][ T5891] chnl_net:caif_netlink_parms(): no params data found [ 90.091219][ T5891] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.098446][ T5891] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.105693][ T5891] bridge_slave_0: entered allmulticast mode [ 90.112686][ T5891] bridge_slave_0: entered promiscuous mode [ 90.120462][ T5891] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.128205][ T5891] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.135487][ T5891] bridge_slave_1: entered allmulticast mode [ 90.142140][ T5891] bridge_slave_1: entered promiscuous mode [ 90.176711][ T5891] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.188036][ T5891] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.213966][ T5891] team0: Port device team_slave_0 added [ 90.223939][ T5891] team0: Port device team_slave_1 added [ 90.250002][ T5891] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.257307][ T5891] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.283359][ T5891] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.297271][ T5891] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.304317][ T5891] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.330944][ T5891] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.375347][ T5891] hsr_slave_0: entered promiscuous mode [ 90.381654][ T5891] hsr_slave_1: entered promiscuous mode [ 90.388319][ T5891] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.397424][ T5891] Cannot create hsr debugfs directory [ 91.815952][ T141] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.995216][ T5087] Bluetooth: hci0: command tx timeout [ 94.074301][ T5087] Bluetooth: hci0: command tx timeout [ 94.404757][ T141] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.468894][ T141] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 95.331957][ T141] hsr_slave_0: left promiscuous mode [ 95.338154][ T141] hsr_slave_1: left promiscuous mode [ 95.345717][ T141] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 95.353163][ T141] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.361670][ T141] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.369649][ T141] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.377407][ T141] bridge_slave_1: left allmulticast mode [ 95.383046][ T141] bridge_slave_1: left promiscuous mode [ 95.389470][ T141] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.400150][ T141] bridge_slave_0: left allmulticast mode [ 95.406799][ T141] bridge_slave_0: left promiscuous mode [ 95.412482][ T141] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.431612][ T141] veth1_macvtap: left promiscuous mode [ 95.437914][ T141] veth0_macvtap: left promiscuous mode [ 95.443466][ T141] veth1_vlan: left promiscuous mode [ 95.449118][ T141] veth0_vlan: left promiscuous mode [ 95.830718][ T141] team0 (unregistering): Port device team_slave_1 removed [ 95.862362][ T141] team0 (unregistering): Port device team_slave_0 removed [ 95.890682][ T141] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 95.922836][ T141] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 96.126230][ T141] bond0 (unregistering): Released all slaves [ 96.154316][ T5087] Bluetooth: hci0: command tx timeout [ 96.232343][ T5891] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.242391][ T5891] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.253638][ T5891] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.264313][ T5891] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.359502][ T5891] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.378052][ T5891] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.389392][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.396575][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.412157][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.419339][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.607847][ T5891] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.652490][ T5891] veth0_vlan: entered promiscuous mode [ 96.666651][ T5891] veth1_vlan: entered promiscuous mode [ 96.698953][ T5891] veth0_macvtap: entered promiscuous mode [ 96.708489][ T5891] veth1_macvtap: entered promiscuous mode [ 96.726255][ T5891] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.751089][ T5891] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.761847][ T5891] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.772170][ T5891] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.781503][ T5891] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.790279][ T5891] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.852341][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.862027][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/07/04 04:20:56 executed programs: 2 [ 96.896391][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.904606][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.949145][ T5935] netlink: 'syz.0.17': attribute type 10 has an invalid length. [ 96.970037][ T5935] team0: Port device wlan1 added [ 96.996641][ T5936] netlink: 'syz.0.18': attribute type 10 has an invalid length. [ 97.026126][ T5937] netlink: 'syz.0.19': attribute type 10 has an invalid length. [ 97.051736][ T5938] netlink: 'syz.0.20': attribute type 10 has an invalid length. [ 97.071787][ T5939] netlink: 'syz.0.21': attribute type 10 has an invalid length. [ 97.099446][ T5940] netlink: 'syz.0.22': attribute type 10 has an invalid length. [ 97.127554][ T5941] netlink: 'syz.0.23': attribute type 10 has an invalid length. [ 97.152967][ T5942] netlink: 'syz.0.24': attribute type 10 has an invalid length. [ 97.175287][ T5943] netlink: 'syz.0.25': attribute type 10 has an invalid length. [ 97.193712][ T5944] netlink: 'syz.0.26': attribute type 10 has an invalid length. [ 98.244613][ T5087] Bluetooth: hci0: command tx timeout 2026/07/04 04:21:01 executed programs: 270 [ 101.958386][ T6203] validate_nla: 258 callbacks suppressed [ 101.958399][ T6203] netlink: 'syz.0.285': attribute type 10 has an invalid length. [ 101.983840][ T6204] netlink: 'syz.0.286': attribute type 10 has an invalid length. [ 102.003934][ T6205] netlink: 'syz.0.287': attribute type 10 has an invalid length. [ 102.022753][ T6206] netlink: 'syz.0.288': attribute type 10 has an invalid length. [ 102.051190][ T6207] netlink: 'syz.0.289': attribute type 10 has an invalid length. [ 102.070580][ T6208] netlink: 'syz.0.290': attribute type 10 has an invalid length. [ 102.093239][ T6209] netlink: 'syz.0.291': attribute type 10 has an invalid length. [ 102.112954][ T6210] netlink: 'syz.0.292': attribute type 10 has an invalid length. [ 102.132227][ T6211] netlink: 'syz.0.293': attribute type 10 has an invalid length. [ 102.151155][ T6212] netlink: 'syz.0.294': attribute type 10 has an invalid length. 2026/07/04 04:21:06 executed programs: 541 [ 106.972109][ T6476] validate_nla: 261 callbacks suppressed [ 106.972121][ T6476] netlink: 'syz.0.556': attribute type 10 has an invalid length. [ 106.998890][ T6477] netlink: 'syz.0.557': attribute type 10 has an invalid length. [ 107.020520][ T6478] netlink: 'syz.0.558': attribute type 10 has an invalid length. [ 107.039743][ T6479] netlink: 'syz.0.559': attribute type 10 has an invalid length. [ 107.060198][ T6480] netlink: 'syz.0.560': attribute type 10 has an invalid length. [ 107.080472][ T6481] netlink: 'syz.0.561': attribute type 10 has an invalid length. [ 107.100550][ T6482] netlink: 'syz.0.562': attribute type 10 has an invalid length. [ 107.119204][ T6483] netlink: 'syz.0.563': attribute type 10 has an invalid length. [ 107.140239][ T6484] netlink: 'syz.0.564': attribute type 10 has an invalid length. [ 107.158976][ T6485] netlink: 'syz.0.565': attribute type 10 has an invalid length. [ 108.178237][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 108.187350][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 108.197923][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 108.206900][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 108.214892][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 108.222222][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 108.327901][ T6539] chnl_net:caif_netlink_parms(): no params data found [ 108.384355][ T6539] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.391880][ T6539] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.399185][ T6539] bridge_slave_0: entered allmulticast mode [ 108.406725][ T6539] bridge_slave_0: entered promiscuous mode [ 108.414307][ T6539] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.421396][ T6539] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.429024][ T6539] bridge_slave_1: entered allmulticast mode [ 108.435957][ T6539] bridge_slave_1: entered promiscuous mode [ 108.453825][ T42] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.483286][ T6539] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.494957][ T6539] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.520013][ T6539] team0: Port device team_slave_0 added [ 108.528061][ T6539] team0: Port device team_slave_1 added [ 108.548290][ T6539] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 108.561555][ T6539] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 108.587558][ T6539] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 108.609669][ T42] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.622794][ T6539] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 108.630052][ T6539] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 108.656585][ T6539] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 108.690079][ T6539] hsr_slave_0: entered promiscuous mode [ 108.696509][ T6539] hsr_slave_1: entered promiscuous mode [ 108.723106][ T42] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.808300][ T42] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.651103][ T42] [ 109.653458][ T42] ====================================================== [ 109.660456][ T42] WARNING: possible circular locking dependency detected [ 109.667469][ T42] syzkaller #0 Not tainted [ 109.671864][ T42] ------------------------------------------------------ [ 109.678865][ T42] kworker/u4:2/42 is trying to acquire lock: [ 109.684824][ T42] ffff888075268d80 (team->team_lock_key#2){+.+.}-{3:3}, at: team_del_slave+0x31/0x1b0 [ 109.694396][ T42] [ 109.694396][ T42] but task is already holding lock: [ 109.701739][ T42] ffff88802cdc0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x2bd/0x690 [ 109.712071][ T42] [ 109.712071][ T42] which lock already depends on the new lock. [ 109.712071][ T42] [ 109.722457][ T42] [ 109.722457][ T42] the existing dependency chain (in reverse order) is: [ 109.731455][ T42] [ 109.731455][ T42] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 109.739167][ T42] __mutex_lock+0x135/0xc80 [ 109.744187][ T42] ieee80211_open+0x144/0x200 [ 109.749382][ T42] __dev_open+0x2cb/0x430 [ 109.754226][ T42] dev_open+0xab/0x190 [ 109.758812][ T42] team_add_slave+0x709/0x2880 [ 109.764085][ T42] do_setlink+0xcde/0x3f40 [ 109.769014][ T42] rtnl_newlink+0x1848/0x2170 [ 109.774204][ T42] rtnetlink_rcv_msg+0x843/0xf90 [ 109.779645][ T42] netlink_rcv_skb+0x235/0x4c0 [ 109.784912][ T42] netlink_unicast+0x7b1/0x930 [ 109.790177][ T42] netlink_sendmsg+0x8d0/0xbf0 [ 109.795448][ T42] ____sys_sendmsg+0x61b/0x980 [ 109.800718][ T42] ___sys_sendmsg+0x2a6/0x360 [ 109.805899][ T42] __se_sys_sendmsg+0x1d0/0x2c0 [ 109.811255][ T42] do_syscall_64+0x55/0xb0 [ 109.816181][ T42] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 109.822581][ T42] [ 109.822581][ T42] -> #0 (team->team_lock_key#2){+.+.}-{3:3}: [ 109.830729][ T42] __lock_acquire+0x37ef/0x7d80 [ 109.836085][ T42] lock_acquire+0x19e/0x420 [ 109.841092][ T42] __mutex_lock+0x135/0xc80 [ 109.846131][ T42] team_del_slave+0x31/0x1b0 [ 109.851226][ T42] team_device_event+0x297/0xa30 [ 109.856670][ T42] notifier_call_chain+0x18f/0x380 [ 109.862285][ T42] unregister_netdevice_many_notify+0x1037/0x1910 [ 109.869211][ T42] unregister_netdevice_queue+0x2e9/0x330 [ 109.875440][ T42] _cfg80211_unregister_wdev+0x16d/0x580 [ 109.881578][ T42] ieee80211_remove_interfaces+0x4b3/0x690 [ 109.887889][ T42] ieee80211_unregister_hw+0x5d/0x2a0 [ 109.893769][ T42] mac80211_hwsim_del_radio+0x289/0x480 [ 109.899821][ T42] hwsim_exit_net+0x58d/0x650 [ 109.905004][ T42] cleanup_net+0x707/0xbb0 [ 109.909924][ T42] process_scheduled_works+0xa60/0x1600 [ 109.915976][ T42] worker_thread+0xa5e/0xfe0 [ 109.921066][ T42] kthread+0x2fa/0x390 [ 109.925638][ T42] ret_from_fork+0x48/0x80 [ 109.930559][ T42] ret_from_fork_asm+0x11/0x20 [ 109.935829][ T42] [ 109.935829][ T42] other info that might help us debug this: [ 109.935829][ T42] [ 109.946043][ T42] Possible unsafe locking scenario: [ 109.946043][ T42] [ 109.953475][ T42] CPU0 CPU1 [ 109.958822][ T42] ---- ---- [ 109.964173][ T42] lock(&rdev->wiphy.mtx); [ 109.968674][ T42] lock(team->team_lock_key#2); [ 109.976122][ T42] lock(&rdev->wiphy.mtx); [ 109.983131][ T42] lock(team->team_lock_key#2); [ 109.988056][ T42] [ 109.988056][ T42] *** DEADLOCK *** [ 109.988056][ T42] [ 109.996189][ T42] 5 locks held by kworker/u4:2/42: [ 110.001281][ T42] #0: ffff88801a25c938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 110.012572][ T42] #1: ffffc90000b2fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 110.023078][ T42] #2: ffffffff8e3c8f90 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 [ 110.032461][ T42] #3: ffffffff8e3d5f88 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_unregister_hw+0x55/0x2a0 [ 110.042275][ T42] #4: ffff88802cdc0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x2bd/0x690 [ 110.053039][ T42] [ 110.053039][ T42] stack backtrace: [ 110.058924][ T42] CPU: 0 PID: 42 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 110.066278][ T42] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 110.076321][ T42] Workqueue: netns cleanup_net [ 110.081096][ T42] Call Trace: [ 110.084373][ T42] [ 110.087307][ T42] dump_stack_lvl+0x18c/0x250 [ 110.091972][ T42] ? load_image+0x420/0x420 [ 110.096461][ T42] ? show_regs_print_info+0x20/0x20 [ 110.101679][ T42] ? print_circular_bug+0x12b/0x1a0 [ 110.106878][ T42] check_noncircular+0x2fc/0x400 [ 110.111821][ T42] ? print_deadlock_bug+0x5d0/0x5d0 [ 110.117011][ T42] ? lockdep_lock+0xf5/0x230 [ 110.121589][ T42] ? _find_first_zero_bit+0xd6/0x100 [ 110.126864][ T42] __lock_acquire+0x37ef/0x7d80 [ 110.131708][ T42] ? verify_lock_unused+0x140/0x140 [ 110.136896][ T42] ? verify_lock_unused+0x140/0x140 [ 110.142082][ T42] ? __up_read+0x2b8/0x6b0 [ 110.146484][ T42] lock_acquire+0x19e/0x420 [ 110.150974][ T42] ? team_del_slave+0x31/0x1b0 [ 110.155728][ T42] ? __might_sleep+0xe0/0xe0 [ 110.160303][ T42] ? read_lock_is_recursive+0x20/0x20 [ 110.165663][ T42] __mutex_lock+0x135/0xc80 [ 110.170149][ T42] ? team_del_slave+0x31/0x1b0 [ 110.174900][ T42] ? __mutex_lock+0x30d/0xc80 [ 110.179558][ T42] ? team_del_slave+0x31/0x1b0 [ 110.184328][ T42] ? mutex_lock_nested+0x20/0x20 [ 110.189276][ T42] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 110.194900][ T42] team_del_slave+0x31/0x1b0 [ 110.199481][ T42] team_device_event+0x297/0xa30 [ 110.204417][ T42] notifier_call_chain+0x18f/0x380 [ 110.209532][ T42] unregister_netdevice_many_notify+0x1037/0x1910 [ 110.215935][ T42] ? unregister_netdevice_many+0x20/0x20 [ 110.221560][ T42] ? kernfs_remove_by_name_ns+0x117/0x150 [ 110.227269][ T42] ? __lock_acquire+0x7d80/0x7d80 [ 110.232278][ T42] unregister_netdevice_queue+0x2e9/0x330 [ 110.237984][ T42] ? list_netdevice+0x730/0x730 [ 110.242818][ T42] ? kernfs_remove_by_name_ns+0x117/0x150 [ 110.248524][ T42] _cfg80211_unregister_wdev+0x16d/0x580 [ 110.254146][ T42] ieee80211_remove_interfaces+0x4b3/0x690 [ 110.259941][ T42] ? ieee80211_do_stop+0x1df0/0x1df0 [ 110.265211][ T42] ? rcu_is_watching+0x15/0xb0 [ 110.269960][ T42] ieee80211_unregister_hw+0x5d/0x2a0 [ 110.275321][ T42] mac80211_hwsim_del_radio+0x289/0x480 [ 110.280856][ T42] ? rhashtable_remove_fast+0xc00/0xc00 [ 110.286393][ T42] hwsim_exit_net+0x58d/0x650 [ 110.291053][ T42] ? hwsim_init_net+0x90/0x90 [ 110.295714][ T42] ? __ip_vs_dev_cleanup_batch+0x238/0x250 [ 110.301504][ T42] cleanup_net+0x707/0xbb0 [ 110.305909][ T42] ? ops_free_list+0x3b0/0x3b0 [ 110.310656][ T42] ? _raw_spin_unlock_irq+0x23/0x50 [ 110.315838][ T42] ? process_scheduled_works+0x975/0x1600 [ 110.321539][ T42] ? process_scheduled_works+0x975/0x1600 [ 110.327241][ T42] process_scheduled_works+0xa60/0x1600 [ 110.332773][ T42] ? worker_attach_to_pool+0x370/0x370 [ 110.338215][ T42] ? assign_work+0x3cc/0x5d0 [ 110.342787][ T42] worker_thread+0xa5e/0xfe0 [ 110.347376][ T42] ? _raw_spin_unlock+0x40/0x40 [ 110.352224][ T42] ? __kthread_parkme+0x71/0x1c0 [ 110.357157][ T42] kthread+0x2fa/0x390 [ 110.361224][ T42] ? pr_cont_work+0x550/0x550 [ 110.365887][ T42] ? kthread_blkcg+0xd0/0xd0 [ 110.370474][ T42] ret_from_fork+0x48/0x80 [ 110.374886][ T42] ? kthread_blkcg+0xd0/0xd0 [ 110.379466][ T42] ret_from_fork_asm+0x11/0x20 [ 110.384226][ T42] [ 110.389628][ T5087] Bluetooth: hci0: command tx timeout [ 110.396771][ T42] team0: Port device wlan1 removed [ 110.432541][ T6539] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.441245][ T6539] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.455342][ T6539] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.463995][ T6539] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.521848][ T6539] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.540045][ T6539] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.556449][ T42] hsr_slave_0: left promiscuous mode [ 110.562097][ T42] hsr_slave_1: left promiscuous mode [ 110.568667][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 110.577368][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 110.585351][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 110.592741][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 110.600821][ T42] bridge_slave_1: left allmulticast mode [ 110.606511][ T42] bridge_slave_1: left promiscuous mode [ 110.612235][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.620401][ T42] bridge_slave_0: left allmulticast mode [ 110.626239][ T42] bridge_slave_0: left promiscuous mode [ 110.631880][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.643845][ T42] veth1_macvtap: left promiscuous mode [ 110.649423][ T42] veth0_macvtap: left promiscuous mode [ 110.655677][ T42] veth1_vlan: left promiscuous mode [ 110.660940][ T42] veth0_vlan: left promiscuous mode [ 110.811871][ T42] team0 (unregistering): Port device team_slave_1 removed [ 110.833294][ T42] team0 (unregistering): Port device team_slave_0 removed [ 110.856179][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 110.878332][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 110.970387][ T42] bond0 (unregistering): Released all slaves [ 111.053026][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.060180][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.072143][ T141] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.079291][ T141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.110800][ T6539] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 111.231119][ T6539] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.261509][ T6539] veth0_vlan: entered promiscuous mode [ 111.270341][ T6539] veth1_vlan: entered promiscuous mode [ 111.290688][ T6539] veth0_macvtap: entered promiscuous mode [ 111.300702][ T6539] veth1_macvtap: entered promiscuous mode [ 111.321975][ T6539] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.335212][ T6539] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.346443][ T6539] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.355261][ T6539] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.363952][ T6539] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.372681][ T6539] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.400812][ T6539] ieee80211 phy7: Selected rate control algorithm 'minstrel_ht' [ 111.420673][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.422249][ T6539] ieee80211 phy8: Selected rate control algorithm 'minstrel_ht' [ 111.434839][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.453051][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.460996][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.493213][ T6580] team0: Port device wlan1 added 2026/07/04 04:21:11 executed programs: 633 [ 112.008867][ T6611] validate_nla: 81 callbacks suppressed [ 112.008877][ T6611] netlink: 'syz.0.647': attribute type 10 has an invalid length. [ 112.030593][ T6612] netlink: 'syz.0.648': attribute type 10 has an invalid length. [ 112.045383][ T6613] netlink: 'syz.0.649': attribute type 10 has an invalid length. [ 112.080579][ T6614] netlink: 'syz.0.650': attribute type 10 has an invalid length. [ 112.097353][ T6615] netlink: 'syz.0.651': attribute type 10 has an invalid length. [ 112.111887][ T6616] netlink: 'syz.0.652': attribute type 10 has an invalid length. [ 112.138110][ T6617] netlink: 'syz.0.653': attribute type 10 has an invalid length. [ 112.152916][ T6618] netlink: 'syz.0.654': attribute type 10 has an invalid length. [ 112.170498][ T6619] netlink: 'syz.0.655': attribute type 10 has an invalid length. [ 112.198820][ T6621] netlink: 'syz.0.656': attribute type 10 has an invalid length. [ 112.474548][ T5087] Bluetooth: hci0: command tx timeout [ 114.554618][ T5087] Bluetooth: hci0: command tx timeout [ 116.634343][ T5087] Bluetooth: hci0: command tx timeout 2026/07/04 04:21:16 executed programs: 930 [ 117.066157][ T6913] validate_nla: 287 callbacks suppressed [ 117.066177][ T6913] netlink: 'syz.0.944': attribute type 10 has an invalid length. [ 117.089951][ T6914] netlink: 'syz.0.945': attribute type 10 has an invalid length. [ 117.105180][ T6915] netlink: 'syz.0.946': attribute type 10 has an invalid length. [ 117.128329][ T6916] netlink: 'syz.0.947': attribute type 10 has an invalid length. [ 117.143568][ T6917] netlink: 'syz.0.948': attribute type 10 has an invalid length. [ 117.159014][ T6918] netlink: 'syz.0.949': attribute type 10 has an invalid length. [ 117.188779][ T6919] netlink: 'syz.0.950': attribute type 10 has an invalid length. [ 117.207680][ T6920] netlink: 'syz.0.951': attribute type 10 has an invalid length. [ 117.222341][ T6921] netlink: 'syz.0.952': attribute type 10 has an invalid length. [ 117.248072][ T6922] netlink: 'syz.0.953': attribute type 10 has an invalid length.