./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3905215746 <...> Warning: Permanently added '10.128.10.22' (ED25519) to the list of known hosts. execve("./syz-executor3905215746", ["./syz-executor3905215746"], 0x7fff4a9b8e60 /* 10 vars */) = 0 brk(NULL) = 0x5555744e4000 brk(0x5555744e4d00) = 0x5555744e4d00 arch_prctl(ARCH_SET_FS, 0x5555744e4380) = 0 set_tid_address(0x5555744e4650) = 5828 set_robust_list(0x5555744e4660, 24) = 0 rseq(0x5555744e4ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3905215746", 4096) = 28 getrandom("\x0c\x6b\x30\xb9\xf1\x7c\xfa\xa0", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555744e4d00 brk(0x555574505d00) = 0x555574505d00 brk(0x555574506000) = 0x555574506000 mprotect(0x7fe40478d000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5829 attached , child_tidptr=0x5555744e4650) = 5829 [pid 5829] set_robust_list(0x5555744e4660, 24) = 0 [pid 5829] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5829] getppid() = 0 [pid 5829] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5829] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5829] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5829] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5829] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5829] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5829] unshare(CLONE_NEWNS) = 0 [pid 5829] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5829] unshare(CLONE_NEWIPC) = 0 [pid 5829] unshare(CLONE_NEWCGROUP) = 0 [pid 5829] unshare(CLONE_NEWUTS) = 0 [pid 5829] unshare(CLONE_SYSVSEM) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "16777216", 8) = 8 [pid 5829] close(3) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "536870912", 9) = 9 [pid 5829] close(3) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "1024", 4) = 4 [pid 5829] close(3) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "8192", 4) = 4 [pid 5829] close(3) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "1024", 4) = 4 [pid 5829] close(3) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "1024", 4) = 4 [pid 5829] close(3) = 0 [pid 5829] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5829] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5829] close(3) = 0 [pid 5829] getpid() = 1 [pid 5829] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<team_lock_key){+.+.}-{4:4}, at: team_device_event+0x544/0xa20 [ 88.256241][ T3018] [ 88.256241][ T3018] but task is already holding lock: [ 88.263697][ T3018] ffff888077f4cd30 (&dev_instance_lock_key#19){+.+.}-{4:4}, at: __linkwatch_run_queue+0x4a0/0x7e0 [ 88.274335][ T3018] [ 88.274335][ T3018] which lock already depends on the new lock. [ 88.274335][ T3018] [ 88.284726][ T3018] [ 88.284726][ T3018] the existing dependency chain (in reverse order) is: [ 88.293730][ T3018] [ 88.293730][ T3018] -> #1 (&dev_instance_lock_key#19){+.+.}-{4:4}: [ 88.302250][ T3018] lock_acquire+0x120/0x360 [ 88.307271][ T3018] __mutex_lock+0x182/0xe80 [ 88.312375][ T3018] dev_set_mtu+0x10e/0x260 [ 88.317314][ T3018] team_add_slave+0x8b8/0x2840 [ 88.322691][ T3018] do_set_master+0x530/0x6d0 [ 88.327814][ T3018] do_setlink+0xd47/0x40d0 [ 88.332739][ T3018] rtnl_newlink+0x160b/0x1c70 [ 88.337923][ T3018] rtnetlink_rcv_msg+0x7cc/0xb70 [ 88.343383][ T3018] netlink_rcv_skb+0x219/0x490 [ 88.348673][ T3018] netlink_unicast+0x758/0x8d0 [ 88.353967][ T3018] netlink_sendmsg+0x805/0xb30 [ 88.359255][ T3018] __sock_sendmsg+0x219/0x270 [ 88.364455][ T3018] ____sys_sendmsg+0x505/0x830 [ 88.369728][ T3018] ___sys_sendmsg+0x21f/0x2a0 [ 88.374915][ T3018] __x64_sys_sendmsg+0x19b/0x260 [ 88.380368][ T3018] do_syscall_64+0xf6/0x210 [ 88.385381][ T3018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.391785][ T3018] [ 88.391785][ T3018] -> #0 (team->team_lock_key){+.+.}-{4:4}: [ 88.399797][ T3018] validate_chain+0xb9b/0x2140 [ 88.405214][ T3018] __lock_acquire+0xaac/0xd20 [ 88.410406][ T3018] lock_acquire+0x120/0x360 [ 88.415438][ T3018] __mutex_lock+0x182/0xe80 [ 88.420484][ T3018] team_device_event+0x544/0xa20 [ 88.425956][ T3018] notifier_call_chain+0x1b3/0x3e0 [ 88.431586][ T3018] netif_state_change+0x284/0x3a0 [ 88.437125][ T3018] linkwatch_do_dev+0x117/0x170 [ 88.442502][ T3018] __linkwatch_run_queue+0x56d/0x7e0 [ 88.448298][ T3018] linkwatch_event+0x4c/0x60 [ 88.453483][ T3018] process_scheduled_works+0xadb/0x17a0 [ 88.459538][ T3018] worker_thread+0x8a0/0xda0 [ 88.464633][ T3018] kthread+0x70e/0x8a0 [ 88.469211][ T3018] ret_from_fork+0x4b/0x80 [ 88.474134][ T3018] ret_from_fork_asm+0x1a/0x30 [ 88.479405][ T3018] [ 88.479405][ T3018] other info that might help us debug this: [ 88.479405][ T3018] [ 88.489708][ T3018] Possible unsafe locking scenario: [ 88.489708][ T3018] [ 88.497153][ T3018] CPU0 CPU1 [ 88.502506][ T3018] ---- ---- [ 88.507859][ T3018] lock(&dev_instance_lock_key#19); [ 88.513143][ T3018] lock(team->team_lock_key); [ 88.520416][ T3018] lock(&dev_instance_lock_key#19); [ 88.531275][ T3018] lock(team->team_lock_key); [ 88.536568][ T3018] [ 88.536568][ T3018] *** DEADLOCK *** [ 88.536568][ T3018] [ 88.544702][ T3018] 4 locks held by kworker/u8:9/3018: [ 88.549972][ T3018] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 88.561641][ T3018] #1: ffffc9000b8efc60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 88.572615][ T3018] #2: ffffffff8f2f4288 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 88.581576][ T3018] #3: ffff888077f4cd30 (&dev_instance_lock_key#19){+.+.}-{4:4}, at: __linkwatch_run_queue+0x4a0/0x7e0 [ 88.592628][ T3018] [ 88.592628][ T3018] stack backtrace: [ 88.598520][ T3018] CPU: 0 UID: 0 PID: 3018 Comm: kworker/u8:9 Not tainted 6.15.0-rc4-syzkaller-gb4432656b36e #0 PREEMPT(full) [ 88.598548][ T3018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 88.598564][ T3018] Workqueue: events_unbound linkwatch_event [ 88.598590][ T3018] Call Trace: [ 88.598598][ T3018] [ 88.598604][ T3018] dump_stack_lvl+0x189/0x250 [ 88.598623][ T3018] ? __pfx_dump_stack_lvl+0x10/0x10 [ 88.598638][ T3018] ? __pfx__printk+0x10/0x10 [ 88.598651][ T3018] ? print_lock_name+0xde/0x100 [ 88.598669][ T3018] print_circular_bug+0x2ee/0x310 [ 88.598683][ T3018] check_noncircular+0x134/0x160 [ 88.598696][ T3018] validate_chain+0xb9b/0x2140 [ 88.598713][ T3018] __lock_acquire+0xaac/0xd20 [ 88.598730][ T3018] ? team_device_event+0x544/0xa20 [ 88.598741][ T3018] lock_acquire+0x120/0x360 [ 88.598756][ T3018] ? team_device_event+0x544/0xa20 [ 88.598768][ T3018] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 88.598782][ T3018] __mutex_lock+0x182/0xe80 [ 88.598795][ T3018] ? team_device_event+0x544/0xa20 [ 88.598806][ T3018] ? __asan_memset+0x22/0x50 [ 88.598818][ T3018] ? call_fib_nh_notifiers+0x33a/0x4e0 [ 88.598831][ T3018] ? __pfx_call_fib_nh_notifiers+0x10/0x10 [ 88.598842][ T3018] ? team_device_event+0x544/0xa20 [ 88.598854][ T3018] ? __pfx___mutex_lock+0x10/0x10 [ 88.598868][ T3018] ? fib_sync_down_dev+0x787/0x7b0 [ 88.598882][ T3018] team_device_event+0x544/0xa20 [ 88.598895][ T3018] notifier_call_chain+0x1b3/0x3e0 [ 88.598909][ T3018] netif_state_change+0x284/0x3a0 [ 88.598921][ T3018] ? __pfx_netif_state_change+0x10/0x10 [ 88.598932][ T3018] ? dev_deactivate+0x129/0x1b0 [ 88.598945][ T3018] ? nsim_get_iflink+0x20/0x280 [ 88.598962][ T3018] ? rfc2863_policy+0x1c6/0x3e0 [ 88.598976][ T3018] linkwatch_do_dev+0x117/0x170 [ 88.598991][ T3018] __linkwatch_run_queue+0x56d/0x7e0 [ 88.599007][ T3018] ? __pfx___linkwatch_run_queue+0x10/0x10 [ 88.599022][ T3018] ? _raw_spin_unlock_irq+0x23/0x50 [ 88.599032][ T3018] ? process_scheduled_works+0x9ec/0x17a0 [ 88.599049][ T3018] ? process_scheduled_works+0x9ec/0x17a0 [ 88.599066][ T3018] linkwatch_event+0x4c/0x60 [ 88.599079][ T3018] process_scheduled_works+0xadb/0x17a0 [ 88.599103][ T3018] ? __pfx_process_scheduled_works+0x10/0x10 [ 88.599124][ T3018] worker_thread+0x8a0/0xda0 [ 88.599136][ T3018] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 88.599150][ T3018] ? __kthread_parkme+0x7b/0x200 [ 88.599163][ T3018] kthread+0x70e/0x8a0 [pid 5829] exit_group(1) = ? [ 88.599182][ T3018] ? __pfx_worker_thread+0x10/0x10 [ 88.599193][ T3018] ? __pfx_kthread+0x10/0x10 [ 88.599205][ T3018] ? __pfx_kthread+0x10/0x10 [ 88.599217][ T3018] ? _raw_spin_unlock_irq+0x23/0x50 [ 88.599228][ T3018] ? lockdep_hardirqs_on+0x9c/0x150 [ 88.599240][ T3018] ? __pfx_kthread+0x10/0x10 [ 88.599252][ T3018] ret_from_fork+0x4b/0x80 [ 88.599276][ T3018] ? __pfx_kthread+0x10/0x10 [ 88.599297][ T3018] ret_from_fork_asm+0x1a/0x30 [ 88.599312][ T3018] [pid 5829] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5829, si_uid=0, si_status=1, si_utime=0, si_stime=118 /* 1.18 s */} --- exit_group(0) = ? +++ exited with 0 +++