======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc7-syzkaller-01160-g41c5d104f338 #0 Not tainted
------------------------------------------------------
syz.4.585/8226 is trying to acquire lock:
ffff888027c9e2d8 (kn->active#19){++++}-{0:0}, at: __kernfs_remove+0x400/0x870 fs/kernfs/dir.c:1486

but task is already holding lock:
ffff8880582b0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6034 [inline]
ffff8880582b0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2276

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&rdev->wiphy.mtx){+.+.}-{4:4}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __mutex_lock_common kernel/locking/mutex.c:585 [inline]
       __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
       class_wiphy_constructor include/net/cfg80211.h:6034 [inline]
       ieee80211_open+0xe9/0x1e0 net/mac80211/iface.c:445
       __dev_open+0x2d3/0x4a0 net/core/dev.c:1603
       dev_open+0xae/0x1b0 net/core/dev.c:1639
       team_port_add drivers/net/team/team_core.c:1229 [inline]
       team_add_slave+0x9af/0x2730 drivers/net/team/team_core.c:1988
       do_set_master net/core/rtnetlink.c:2926 [inline]
       do_setlink+0xe40/0x4210 net/core/rtnetlink.c:3125
       rtnl_changelink net/core/rtnetlink.c:3732 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3884 [inline]
       rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4021
       rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911
       netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
       netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
       netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1348
       netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1892
       sock_sendmsg_nosec net/socket.c:713 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:728
       ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2568
       ___sys_sendmsg net/socket.c:2622 [inline]
       __sys_sendmsg+0x269/0x350 net/socket.c:2654
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #2 (team->team_lock_key#3){+.+.}-{4:4}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       __mutex_lock_common kernel/locking/mutex.c:585 [inline]
       __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
       team_set_mac_address+0x122/0x280 drivers/net/team/team_core.c:1816
       dev_set_mac_address+0x327/0x510 net/core/dev.c:9426
       dev_set_mac_address_user+0x31/0x50 net/core/dev.c:9445
       do_setlink+0x74b/0x4210 net/core/rtnetlink.c:3073
       rtnl_changelink net/core/rtnetlink.c:3732 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3884 [inline]
       rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4021
       rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6911
       netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543
       netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
       netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1348
       netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1892
       sock_sendmsg_nosec net/socket.c:713 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:728
       __sys_sendto+0x363/0x4c0 net/socket.c:2182
       __do_sys_sendto net/socket.c:2189 [inline]
       __se_sys_sendto net/socket.c:2185 [inline]
       __x64_sys_sendto+0xde/0x100 net/socket.c:2185
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (dev_addr_sem){++++}-{4:4}:
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524
       address_show+0x25/0x250 net/core/net-sysfs.c:184
       dev_attr_show+0x55/0xc0 drivers/base/core.c:2423
       sysfs_kf_seq_show+0x331/0x4c0 fs/sysfs/file.c:59
       seq_read_iter+0x43f/0xd70 fs/seq_file.c:230
       new_sync_read fs/read_write.c:484 [inline]
       vfs_read+0x991/0xb70 fs/read_write.c:565
       ksys_read+0x18f/0x2b0 fs/read_write.c:708
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (kn->active#19){++++}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3161 [inline]
       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
       validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
       __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
       kernfs_drain+0x31c/0x6d0 fs/kernfs/dir.c:500
       __kernfs_remove+0x400/0x870 fs/kernfs/dir.c:1486
       kernfs_remove_by_name_ns+0xdc/0x160 fs/kernfs/dir.c:1694
       kernfs_remove_by_name include/linux/kernfs.h:625 [inline]
       remove_files fs/sysfs/group.c:28 [inline]
       sysfs_remove_group+0xfe/0x2c0 fs/sysfs/group.c:322
       sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:346
       device_remove_groups drivers/base/core.c:2819 [inline]
       device_remove_attrs+0x23a/0x290 drivers/base/core.c:2955
       device_del+0x572/0x9b0 drivers/base/core.c:3853
       unregister_netdevice_many_notify+0x19dc/0x2030 net/core/dev.c:11823
       unregister_netdevice_many net/core/dev.c:11853 [inline]
       unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11719
       unregister_netdevice include/linux/netdevice.h:3320 [inline]
       _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251
       ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2301
       ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1676
       mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664
       remove_user_radios drivers/net/wireless/virtual/mac80211_hwsim.c:6464 [inline]
       mac80211_hwsim_netlink_notify+0x5de/0x930 drivers/net/wireless/virtual/mac80211_hwsim.c:6478
       notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
       blocking_notifier_call_chain+0x69/0x90 kernel/notifier.c:380
       netlink_release+0x11a6/0x1bf0 net/netlink/af_netlink.c:764
       __sock_release net/socket.c:642 [inline]
       sock_close+0xbc/0x240 net/socket.c:1393
       __fput+0x23c/0xa50 fs/file_table.c:450
       task_work_run+0x24f/0x310 kernel/task_work.c:239
       get_signal+0x15f7/0x1750 kernel/signal.c:2790
       arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
       exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
       exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
       __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
       syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
       do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  kn->active#19 --> team->team_lock_key#3 --> &rdev->wiphy.mtx

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&rdev->wiphy.mtx);
                               lock(team->team_lock_key#3);
                               lock(&rdev->wiphy.mtx);
  lock(kn->active#19);

 *** DEADLOCK ***

4 locks held by syz.4.585/8226:
 #0: ffff88807b135608 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]
 #0: ffff88807b135608 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: __sock_release net/socket.c:641 [inline]
 #0: ffff88807b135608 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: sock_close+0x90/0x240 net/socket.c:1393
 #1: ffffffff8fd161d0 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x53/0x90 kernel/notifier.c:379
 #2: ffffffff8fcb4bc8 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 net/mac80211/main.c:1669
 #3: ffff8880582b0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6034 [inline]
 #3: ffff8880582b0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2276

stack backtrace:
CPU: 0 UID: 0 PID: 8226 Comm: syz.4.585 Not tainted 6.13.0-rc7-syzkaller-01160-g41c5d104f338 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
 check_prev_add kernel/locking/lockdep.c:3161 [inline]
 check_prevs_add kernel/locking/lockdep.c:3280 [inline]
 validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 kernfs_drain+0x31c/0x6d0 fs/kernfs/dir.c:500
 __kernfs_remove+0x400/0x870 fs/kernfs/dir.c:1486
 kernfs_remove_by_name_ns+0xdc/0x160 fs/kernfs/dir.c:1694
 kernfs_remove_by_name include/linux/kernfs.h:625 [inline]
 remove_files fs/sysfs/group.c:28 [inline]
 sysfs_remove_group+0xfe/0x2c0 fs/sysfs/group.c:322
 sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:346
 device_remove_groups drivers/base/core.c:2819 [inline]
 device_remove_attrs+0x23a/0x290 drivers/base/core.c:2955
 device_del+0x572/0x9b0 drivers/base/core.c:3853
 unregister_netdevice_many_notify+0x19dc/0x2030 net/core/dev.c:11823
 unregister_netdevice_many net/core/dev.c:11853 [inline]
 unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11719
 unregister_netdevice include/linux/netdevice.h:3320 [inline]
 _cfg80211_unregister_wdev+0x163/0x590 net/wireless/core.c:1251
 ieee80211_remove_interfaces+0x4ef/0x700 net/mac80211/iface.c:2301
 ieee80211_unregister_hw+0x5d/0x2c0 net/mac80211/main.c:1676
 mac80211_hwsim_del_radio+0x2c4/0x4c0 drivers/net/wireless/virtual/mac80211_hwsim.c:5664
 remove_user_radios drivers/net/wireless/virtual/mac80211_hwsim.c:6464 [inline]
 mac80211_hwsim_netlink_notify+0x5de/0x930 drivers/net/wireless/virtual/mac80211_hwsim.c:6478
 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
 blocking_notifier_call_chain+0x69/0x90 kernel/notifier.c:380
 netlink_release+0x11a6/0x1bf0 net/netlink/af_netlink.c:764
 __sock_release net/socket.c:642 [inline]
 sock_close+0xbc/0x240 net/socket.c:1393
 __fput+0x23c/0xa50 fs/file_table.c:450
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 get_signal+0x15f7/0x1750 kernel/signal.c:2790
 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2d22d87bbc
Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b
RSP: 002b:00007f2d207d1ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: 0000000000000020 RBX: 00007f2d207d1fc0 RCX: 00007f2d22d87bbc
RDX: 0000000000000020 RSI: 00007f2d207d2010 RDI: 000000000000000b
RBP: 0000000000000000 R08: 00007f2d207d1f14 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000000b
R13: 00007f2d207d1f68 R14: 00007f2d207d2010 R15: 0000000000000000
 </TASK>