Warning: Permanently added '10.128.1.53' (ED25519) to the list of known hosts. 2025/12/28 09:32:07 parsed 1 programs [ 92.208452][ T5769] cgroup: Unknown subsys name 'net' [ 92.375817][ T5769] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 94.350587][ T5769] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.624936][ T5800] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.635519][ T5800] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.643426][ T5800] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.652144][ T5800] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.661220][ T5800] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 96.669052][ T5800] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.262411][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.270540][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.321356][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.330516][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.629828][ T5818] chnl_net:caif_netlink_parms(): no params data found [ 97.723513][ T5818] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.731886][ T5818] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.739737][ T5818] bridge_slave_0: entered allmulticast mode [ 97.748709][ T5818] bridge_slave_0: entered promiscuous mode [ 97.760376][ T5818] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.767943][ T5818] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.775114][ T5818] bridge_slave_1: entered allmulticast mode [ 97.782433][ T5818] bridge_slave_1: entered promiscuous mode [ 97.811507][ T9] cfg80211: failed to load regulatory.db [ 97.846184][ T5818] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.862750][ T5818] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.912708][ T5818] team0: Port device team_slave_0 added [ 97.921859][ T5818] team0: Port device team_slave_1 added [ 97.954955][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.962339][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.989052][ T5818] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.003272][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.010396][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.036610][ T5818] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.090356][ T5818] hsr_slave_0: entered promiscuous mode [ 98.099273][ T5818] hsr_slave_1: entered promiscuous mode [ 98.288519][ T5818] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.309053][ T5818] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.329172][ T5818] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.339842][ T5818] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.426441][ T5818] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.460573][ T5818] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.483225][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.490657][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.506262][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.514004][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.747906][ T5818] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.799511][ T5818] veth0_vlan: entered promiscuous mode [ 98.814575][ T5818] veth1_vlan: entered promiscuous mode [ 98.878281][ T5818] veth0_macvtap: entered promiscuous mode [ 98.889102][ T5818] veth1_macvtap: entered promiscuous mode [ 98.938949][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.956008][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.973660][ T5818] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.983284][ T5818] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.992563][ T5818] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.001698][ T5818] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.230590][ T59] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.795580][ T59] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/12/28 09:32:20 executed programs: 0 [ 101.952900][ T5800] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 101.961827][ T5800] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 101.971035][ T5800] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 101.980071][ T5800] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 101.988899][ T5800] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 101.996382][ T5800] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.163611][ T5880] chnl_net:caif_netlink_parms(): no params data found [ 102.238525][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.245734][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.253068][ T5880] bridge_slave_0: entered allmulticast mode [ 102.260812][ T5880] bridge_slave_0: entered promiscuous mode [ 102.269763][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.277049][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.284221][ T5880] bridge_slave_1: entered allmulticast mode [ 102.292554][ T5880] bridge_slave_1: entered promiscuous mode [ 102.324649][ T5880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.336985][ T5880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.375232][ T5880] team0: Port device team_slave_0 added [ 102.383384][ T5880] team0: Port device team_slave_1 added [ 102.413289][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.420988][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.446953][ T5880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.459986][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.467060][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.493064][ T5880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.540788][ T5880] hsr_slave_0: entered promiscuous mode [ 102.548051][ T5880] hsr_slave_1: entered promiscuous mode [ 102.554437][ T5880] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 102.562364][ T5880] Cannot create hsr debugfs directory [ 104.048174][ T5800] Bluetooth: hci0: command tx timeout [ 104.409604][ T59] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.462540][ T59] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 105.425965][ T59] hsr_slave_0: left promiscuous mode [ 105.433071][ T59] hsr_slave_1: left promiscuous mode [ 105.442776][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 105.451615][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 105.462595][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 105.470200][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 105.480701][ T59] bridge_slave_1: left allmulticast mode [ 105.486420][ T59] bridge_slave_1: left promiscuous mode [ 105.493162][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.510815][ T59] bridge_slave_0: left allmulticast mode [ 105.519156][ T59] bridge_slave_0: left promiscuous mode [ 105.525494][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.560101][ T59] veth1_macvtap: left promiscuous mode [ 105.566088][ T59] veth0_macvtap: left promiscuous mode [ 105.575072][ T59] veth1_vlan: left promiscuous mode [ 105.583264][ T59] veth0_vlan: left promiscuous mode [ 106.001351][ T59] team0 (unregistering): Port device team_slave_1 removed [ 106.040030][ T59] team0 (unregistering): Port device team_slave_0 removed [ 106.075633][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 106.120146][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 106.136720][ T5800] Bluetooth: hci0: command tx timeout [ 106.446878][ T59] bond0 (unregistering): Released all slaves [ 106.538626][ T5880] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.549202][ T5880] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.560207][ T5880] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.570269][ T5880] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.684705][ T5880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.709775][ T5880] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.730352][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.738367][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.758731][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.765929][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.042799][ T5880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.123105][ T5880] veth0_vlan: entered promiscuous mode [ 107.145765][ T5880] veth1_vlan: entered promiscuous mode [ 107.182202][ T5880] veth0_macvtap: entered promiscuous mode [ 107.192401][ T5880] veth1_macvtap: entered promiscuous mode [ 107.213076][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.227161][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.240012][ T5880] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.249724][ T5880] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.258574][ T5880] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.267546][ T5880] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.334021][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.346066][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.403188][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.414469][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/28 09:32:25 executed programs: 2 [ 107.498695][ T5925] netlink: 'syz.0.17': attribute type 10 has an invalid length. [ 107.531686][ T5925] team0: Port device wlan1 added [ 107.599008][ T5926] netlink: 'syz.0.18': attribute type 10 has an invalid length. [ 107.671746][ T5927] netlink: 'syz.0.19': attribute type 10 has an invalid length. [ 107.710853][ T5928] netlink: 'syz.0.20': attribute type 10 has an invalid length. [ 107.774475][ T5929] netlink: 'syz.0.21': attribute type 10 has an invalid length. [ 107.801468][ T5930] netlink: 'syz.0.22': attribute type 10 has an invalid length. [ 107.852132][ T5931] netlink: 'syz.0.23': attribute type 10 has an invalid length. [ 107.875121][ T5932] netlink: 'syz.0.24': attribute type 10 has an invalid length. [ 107.924785][ T5933] netlink: 'syz.0.25': attribute type 10 has an invalid length. [ 107.980399][ T5934] netlink: 'syz.0.26': attribute type 10 has an invalid length. [ 108.210829][ T5800] Bluetooth: hci0: command tx timeout [ 110.286801][ T5800] Bluetooth: hci0: command tx timeout 2025/12/28 09:32:30 executed programs: 224 [ 112.514256][ T6151] validate_nla: 216 callbacks suppressed [ 112.514270][ T6151] netlink: 'syz.0.243': attribute type 10 has an invalid length. [ 112.549692][ T6152] netlink: 'syz.0.244': attribute type 10 has an invalid length. [ 112.572633][ T6153] netlink: 'syz.0.245': attribute type 10 has an invalid length. [ 112.595781][ T6154] netlink: 'syz.0.246': attribute type 10 has an invalid length. [ 112.621909][ T6155] netlink: 'syz.0.247': attribute type 10 has an invalid length. [ 112.646014][ T6156] netlink: 'syz.0.248': attribute type 10 has an invalid length. [ 112.669752][ T6157] netlink: 'syz.0.249': attribute type 10 has an invalid length. [ 112.691883][ T6158] netlink: 'syz.0.250': attribute type 10 has an invalid length. [ 112.716011][ T6159] netlink: 'syz.0.251': attribute type 10 has an invalid length. [ 112.740554][ T6160] netlink: 'syz.0.252': attribute type 10 has an invalid length. 2025/12/28 09:32:35 executed programs: 470 [ 117.517344][ T6397] validate_nla: 234 callbacks suppressed [ 117.517378][ T6397] netlink: 'syz.0.487': attribute type 10 has an invalid length. [ 117.548681][ T6398] netlink: 'syz.0.488': attribute type 10 has an invalid length. [ 117.572531][ T6399] netlink: 'syz.0.489': attribute type 10 has an invalid length. [ 117.595726][ T6400] netlink: 'syz.0.490': attribute type 10 has an invalid length. [ 117.619930][ T6401] netlink: 'syz.0.491': attribute type 10 has an invalid length. [ 117.642015][ T6402] netlink: 'syz.0.492': attribute type 10 has an invalid length. [ 117.668683][ T6403] netlink: 'syz.0.493': attribute type 10 has an invalid length. [ 117.692082][ T6404] netlink: 'syz.0.494': attribute type 10 has an invalid length. [ 117.714873][ T6405] netlink: 'syz.0.495': attribute type 10 has an invalid length. [ 117.740396][ T6406] netlink: 'syz.0.496': attribute type 10 has an invalid length. [ 120.264131][ T5080] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 120.283097][ T5080] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 120.292385][ T5080] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 120.301012][ T5080] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 120.311451][ T5080] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 120.319166][ T5080] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 120.423929][ T59] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.506749][ T59] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.556017][ T6528] chnl_net:caif_netlink_parms(): no params data found [ 120.582172][ T59] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.644522][ T59] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.684181][ T6528] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.691718][ T6528] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.699004][ T6528] bridge_slave_0: entered allmulticast mode [ 120.706208][ T6528] bridge_slave_0: entered promiscuous mode [ 120.715328][ T6528] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.722646][ T6528] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.730455][ T6528] bridge_slave_1: entered allmulticast mode [ 120.738589][ T6528] bridge_slave_1: entered promiscuous mode [ 120.775200][ T6528] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 120.788119][ T6528] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 120.867614][ T6528] team0: Port device team_slave_0 added [ 120.884085][ T6528] team0: Port device team_slave_1 added [ 120.932768][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 120.940729][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 120.967527][ T6528] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 121.004403][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 121.011487][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 121.038001][ T6528] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 121.095923][ T6528] hsr_slave_0: entered promiscuous mode [ 121.102876][ T6528] hsr_slave_1: entered promiscuous mode [ 121.784022][ T59] [ 121.786426][ T59] ====================================================== [ 121.793469][ T59] WARNING: possible circular locking dependency detected [ 121.800519][ T59] syzkaller #0 Not tainted [ 121.804963][ T59] ------------------------------------------------------ [ 121.812011][ T59] kworker/u4:4/59 is trying to acquire lock: [ 121.818014][ T59] ffff888024fa0d00 (team->team_lock_key#2){+.+.}-{3:3}, at: team_del_slave+0x32/0x1c0 [ 121.827668][ T59] [ 121.827668][ T59] but task is already holding lock: [ 121.835065][ T59] ffff88807adf0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x292/0x680 [ 121.845472][ T59] [ 121.845472][ T59] which lock already depends on the new lock. [ 121.845472][ T59] [ 121.855907][ T59] [ 121.855907][ T59] the existing dependency chain (in reverse order) is: [ 121.866699][ T59] [ 121.866699][ T59] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 121.874482][ T59] __mutex_lock+0x129/0xcc0 [ 121.879550][ T59] ieee80211_open+0x144/0x200 [ 121.884786][ T59] __dev_open+0x2bc/0x430 [ 121.889667][ T59] dev_open+0xab/0x170 [ 121.894286][ T59] team_add_slave+0xae7/0x2660 [ 121.899590][ T59] do_setlink+0xe14/0x3fb0 [ 121.904550][ T59] rtnl_newlink+0x175b/0x2020 [ 121.909761][ T59] rtnetlink_rcv_msg+0x7c7/0xf10 [ 121.915249][ T59] netlink_rcv_skb+0x216/0x480 [ 121.920561][ T59] netlink_unicast+0x751/0x8d0 [ 121.925883][ T59] netlink_sendmsg+0x8c1/0xbe0 [ 121.931191][ T59] ____sys_sendmsg+0x5bf/0x950 [ 121.936503][ T59] ___sys_sendmsg+0x220/0x290 [ 121.941735][ T59] __se_sys_sendmsg+0x1a5/0x270 [ 121.947132][ T59] do_syscall_64+0x55/0xb0 [ 121.952094][ T59] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 121.958535][ T59] [ 121.958535][ T59] -> #0 (team->team_lock_key#2){+.+.}-{3:3}: [ 121.966730][ T59] __lock_acquire+0x2ddb/0x7c80 [ 121.972123][ T59] lock_acquire+0x197/0x410 [ 121.977163][ T59] __mutex_lock+0x129/0xcc0 [ 121.982206][ T59] team_del_slave+0x32/0x1c0 [ 121.987338][ T59] team_device_event+0x28d/0xa20 [ 121.992819][ T59] notifier_call_chain+0x197/0x390 [ 121.998471][ T59] unregister_netdevice_many_notify+0xf36/0x1810 [ 122.005337][ T59] unregister_netdevice_queue+0x324/0x360 [ 122.011597][ T59] _cfg80211_unregister_wdev+0x16b/0x580 [ 122.017771][ T59] ieee80211_remove_interfaces+0x496/0x680 [ 122.024116][ T59] ieee80211_unregister_hw+0x5d/0x2a0 [ 122.030030][ T59] mac80211_hwsim_del_radio+0x274/0x450 [ 122.036128][ T59] hwsim_exit_net+0x585/0x640 [ 122.041347][ T59] cleanup_net+0x6f4/0xb90 [ 122.046313][ T59] process_scheduled_works+0xa45/0x15b0 [ 122.052403][ T59] worker_thread+0xa55/0xfc0 [ 122.057531][ T59] kthread+0x2fa/0x390 [ 122.062140][ T59] ret_from_fork+0x48/0x80 [ 122.067099][ T59] ret_from_fork_asm+0x11/0x20 [ 122.072402][ T59] [ 122.072402][ T59] other info that might help us debug this: [ 122.072402][ T59] [ 122.082644][ T59] Possible unsafe locking scenario: [ 122.082644][ T59] [ 122.090104][ T59] CPU0 CPU1 [ 122.095484][ T59] ---- ---- [ 122.101032][ T59] lock(&rdev->wiphy.mtx); [ 122.105558][ T59] lock(team->team_lock_key#2); [ 122.113042][ T59] lock(&rdev->wiphy.mtx); [ 122.120082][ T59] lock(team->team_lock_key#2); [ 122.125044][ T59] [ 122.125044][ T59] *** DEADLOCK *** [ 122.125044][ T59] [ 122.133198][ T59] 5 locks held by kworker/u4:4/59: [ 122.138356][ T59] #0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 [ 122.149280][ T59] #1: ffffc900015a7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 [ 122.159837][ T59] #2: ffffffff8dfa8610 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x136/0xb90 [ 122.169252][ T59] #3: ffffffff8dfb5448 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_unregister_hw+0x55/0x2a0 [ 122.179113][ T59] #4: ffff88807adf0768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x292/0x680 [ 122.189927][ T59] [ 122.189927][ T59] stack backtrace: [ 122.195892][ T59] CPU: 0 PID: 59 Comm: kworker/u4:4 Not tainted syzkaller #0 [ 122.203293][ T59] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 122.213365][ T59] Workqueue: netns cleanup_net [ 122.218163][ T59] Call Trace: [ 122.221460][ T59] [ 122.224411][ T59] dump_stack_lvl+0x16c/0x230 [ 122.229122][ T59] ? load_image+0x3b0/0x3b0 [ 122.233652][ T59] ? show_regs_print_info+0x20/0x20 [ 122.238879][ T59] ? print_circular_bug+0x12b/0x1a0 [ 122.244099][ T59] check_noncircular+0x2bd/0x3c0 [ 122.249057][ T59] ? print_deadlock_bug+0x5d0/0x5d0 [ 122.254273][ T59] ? lockdep_lock+0xe0/0x220 [ 122.258888][ T59] ? _find_first_zero_bit+0xd3/0x100 [ 122.264206][ T59] __lock_acquire+0x2ddb/0x7c80 [ 122.269116][ T59] ? verify_lock_unused+0x140/0x140 [ 122.274337][ T59] ? verify_lock_unused+0x140/0x140 [ 122.279583][ T59] lock_acquire+0x197/0x410 [ 122.284108][ T59] ? team_del_slave+0x32/0x1c0 [ 122.288897][ T59] ? __might_sleep+0xe0/0xe0 [ 122.293685][ T59] ? read_lock_is_recursive+0x20/0x20 [ 122.299091][ T59] __mutex_lock+0x129/0xcc0 [ 122.303620][ T59] ? team_del_slave+0x32/0x1c0 [ 122.308410][ T59] ? __lock_acquire+0x7c80/0x7c80 [ 122.313457][ T59] ? rcu_is_watching+0x15/0xb0 [ 122.318253][ T59] ? trace_contention_end+0x39/0xe0 [ 122.323483][ T59] ? __mutex_lock+0x304/0xcc0 [ 122.328196][ T59] ? team_del_slave+0x32/0x1c0 [ 122.332982][ T59] ? mutex_lock_nested+0x20/0x20 [ 122.337942][ T59] ? bond_netdev_event+0xe1/0xef0 [ 122.342988][ T59] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 122.348636][ T59] ? bond_ipsec_offload_ok+0x410/0x410 [ 122.354133][ T59] team_del_slave+0x32/0x1c0 [ 122.358746][ T59] team_device_event+0x28d/0xa20 [ 122.363707][ T59] notifier_call_chain+0x197/0x390 [ 122.368859][ T59] unregister_netdevice_many_notify+0xf36/0x1810 [ 122.375207][ T59] ? lock_chain_count+0x20/0x20 [ 122.380084][ T59] ? unregister_netdevice_many+0x20/0x20 [ 122.385747][ T59] ? kernfs_remove_by_name_ns+0x117/0x150 [ 122.391491][ T59] ? __lock_acquire+0x7c80/0x7c80 [ 122.396537][ T59] unregister_netdevice_queue+0x324/0x360 [ 122.402282][ T59] ? list_netdevice+0x730/0x730 [ 122.407151][ T59] ? kernfs_remove_by_name_ns+0x117/0x150 [ 122.412901][ T59] _cfg80211_unregister_wdev+0x16b/0x580 [ 122.418562][ T59] ieee80211_remove_interfaces+0x496/0x680 [ 122.424394][ T59] ? ieee80211_do_stop+0x1db0/0x1db0 [ 122.429702][ T59] ? rcu_is_watching+0x15/0xb0 [ 122.434491][ T59] ieee80211_unregister_hw+0x5d/0x2a0 [ 122.439895][ T59] mac80211_hwsim_del_radio+0x274/0x450 [ 122.445462][ T59] ? rhashtable_remove_fast+0xbf0/0xbf0 [ 122.451032][ T59] hwsim_exit_net+0x585/0x640 [ 122.455737][ T59] ? hwsim_init_net+0x90/0x90 [ 122.460435][ T59] ? __ip_vs_dev_cleanup_batch+0x238/0x250 [ 122.466264][ T59] cleanup_net+0x6f4/0xb90 [ 122.470708][ T59] ? ops_free_list+0x3b0/0x3b0 [ 122.475503][ T59] ? _raw_spin_unlock_irq+0x23/0x50 [ 122.480729][ T59] ? process_scheduled_works+0x957/0x15b0 [ 122.486482][ T59] ? process_scheduled_works+0x957/0x15b0 [ 122.492222][ T59] process_scheduled_works+0xa45/0x15b0 [ 122.497796][ T59] ? assign_work+0x400/0x400 [ 122.502412][ T59] ? assign_work+0x39e/0x400 [ 122.507035][ T59] worker_thread+0xa55/0xfc0 [ 122.511665][ T59] kthread+0x2fa/0x390 [ 122.515758][ T59] ? pr_cont_work+0x560/0x560 [ 122.520459][ T59] ? kthread_blkcg+0xd0/0xd0 [ 122.525067][ T59] ret_from_fork+0x48/0x80 [ 122.529530][ T59] ? kthread_blkcg+0xd0/0xd0 [ 122.534137][ T59] ret_from_fork_asm+0x11/0x20 [ 122.538931][ T59] [ 122.543728][ T5080] Bluetooth: hci0: command tx timeout [ 122.552314][ T59] team0: Port device wlan1 removed [ 122.572861][ T6528] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 122.595471][ T6528] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 122.606230][ T6528] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 122.619327][ T6528] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 122.724829][ T59] hsr_slave_0: left promiscuous mode [ 122.735053][ T59] hsr_slave_1: left promiscuous mode [ 122.741461][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 122.751037][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 122.759108][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 122.766940][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 122.774648][ T59] bridge_slave_1: left allmulticast mode [ 122.783515][ T59] bridge_slave_1: left promiscuous mode [ 122.789635][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.799466][ T59] bridge_slave_0: left allmulticast mode [ 122.805252][ T59] bridge_slave_0: left promiscuous mode [ 122.812101][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.825654][ T59] veth1_macvtap: left promiscuous mode [ 122.832136][ T59] veth0_macvtap: left promiscuous mode [ 122.838596][ T59] veth1_vlan: left promiscuous mode [ 122.843936][ T59] veth0_vlan: left promiscuous mode [ 123.060919][ T59] team0 (unregistering): Port device team_slave_1 removed [ 123.084467][ T59] team0 (unregistering): Port device team_slave_0 removed [ 123.110871][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 123.135109][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 123.245342][ T59] bond0 (unregistering): Released all slaves [ 123.318196][ T6528] 8021q: adding VLAN 0 to HW filter on device bond0 [ 123.335087][ T6528] 8021q: adding VLAN 0 to HW filter on device team0 [ 123.348946][ T1081] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.356147][ T1081] bridge0: port 1(bridge_slave_0) entered forwarding state [ 123.372860][ T1081] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.380024][ T1081] bridge0: port 2(bridge_slave_1) entered forwarding state [ 123.572910][ T6528] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 123.615136][ T6528] veth0_vlan: entered promiscuous mode [ 123.626090][ T6528] veth1_vlan: entered promiscuous mode [ 123.654416][ T6528] veth0_macvtap: entered promiscuous mode [ 123.664708][ T6528] veth1_macvtap: entered promiscuous mode [ 123.682212][ T6528] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 123.695107][ T6528] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 123.705785][ T6528] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.715648][ T6528] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.724870][ T6528] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.733767][ T6528] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.763506][ T6528] ieee80211 phy7: Selected rate control algorithm 'minstrel_ht' [ 123.787588][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.792561][ T6528] ieee80211 phy8: Selected rate control algorithm 'minstrel_ht' [ 123.795525][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/28 09:32:42 executed programs: 602 [ 123.830623][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.838970][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.872570][ T6576] validate_nla: 120 callbacks suppressed [ 123.872583][ T6576] netlink: 'syz.0.617': attribute type 10 has an invalid length. [ 123.898164][ T6576] team0: Port device wlan1 added [ 123.918354][ T6577] netlink: 'syz.0.618': attribute type 10 has an invalid length. [ 123.944644][ T6578] netlink: 'syz.0.619': attribute type 10 has an invalid length. [ 123.968780][ T6579] netlink: 'syz.0.620': attribute type 10 has an invalid length. [ 123.988444][ T6580] netlink: 'syz.0.621': attribute type 10 has an invalid length. [ 124.013591][ T6581] netlink: 'syz.0.622': attribute type 10 has an invalid length. [ 124.033414][ T6582] netlink: 'syz.0.623': attribute type 10 has an invalid length. [ 124.054897][ T6583] netlink: 'syz.0.624': attribute type 10 has an invalid length. [ 124.077134][ T6584] netlink: 'syz.0.625': attribute type 10 has an invalid length. [ 124.096031][ T6585] netlink: 'syz.0.626': attribute type 10 has an invalid length. [ 124.606684][ T5080] Bluetooth: hci0: command tx timeout [ 126.686705][ T5080] Bluetooth: hci0: command tx timeout [ 128.767290][ T5080] Bluetooth: hci0: command tx timeout 2025/12/28 09:32:47 executed programs: 890 [ 128.883080][ T6872] validate_nla: 280 callbacks suppressed [ 128.883093][ T6872] netlink: 'syz.0.907': attribute type 10 has an invalid length. [ 128.907893][ T6873] netlink: 'syz.0.908': attribute type 10 has an invalid length. [ 128.925550][ T6874] netlink: 'syz.0.909': attribute type 10 has an invalid length. [ 128.952240][ T6875] netlink: 'syz.0.910': attribute type 10 has an invalid length. [ 128.972290][ T6876] netlink: 'syz.0.911': attribute type 10 has an invalid length. [ 128.990572][ T6877] netlink: 'syz.0.912': attribute type 10 has an invalid length. [ 129.012545][ T6878] netlink: 'syz.0.913': attribute type 10 has an invalid length. [ 129.032405][ T6879] netlink: 'syz.0.914': attribute type 10 has an invalid length. [ 129.051540][ T6880] netlink: 'syz.0.915': attribute type 10 has an invalid length. [ 129.072640][ T6881] netlink: 'syz.0.916': attribute type 10 has an invalid length.