netlink: 14 bytes leftover after parsing attributes in process `syz.7.7045'. ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ syz.7.7045/27904 is trying to acquire lock: ffff888037fa8e70 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline] ffff888037fa8e70 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 but task is already holding lock: ffff88803672e8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&port->pnodes_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821 ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers+0x7c/0xb0 net/core/dev.c:2327 xdp_set_features_flag_locked net/core/xdp.c:1009 [inline] xdp_set_features_flag_locked+0x16e/0x220 net/core/xdp.c:999 xdp_set_features_flag+0x2d/0x40 net/core/xdp.c:1016 bond_xdp_set_features+0x20d/0x350 drivers/net/bonding/bond_main.c:1884 bond_enslave+0x57ed/0x5cb0 drivers/net/bonding/bond_main.c:2340 do_set_master+0x40f/0x730 net/core/rtnetlink.c:3071 do_setlink.isra.0+0xb2b/0x3e60 net/core/rtnetlink.c:3273 rtnl_changelink net/core/rtnetlink.c:3905 [inline] __rtnl_newlink net/core/rtnetlink.c:4076 [inline] rtnl_newlink+0x13c1/0x2620 net/core/rtnetlink.c:4215 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&dev_instance_lock_key#2){+.+.}-{4:4}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12537 ipvlan_device_event+0xf01/0x11e0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12518 rtnl_delete_link net/core/rtnetlink.c:3652 [inline] rtnl_dellink+0x472/0xb40 net/core/rtnetlink.c:3694 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); *** DEADLOCK *** locks held by syz.7.7045/27904: 2, last CPU#0: #0: ffffffff90cd01c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff90cd01c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff90cd01c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dellink+0x307/0xb40 net/core/rtnetlink.c:3686 #1: ffff88803672e8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 stack backtrace: CPU: 0 UID: 0 PID: 27904 Comm: syz.7.7045 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bc0 kernel/locking/mutex.c:821 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12537 ipvlan_device_event+0xf01/0x11e0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12518 rtnl_delete_link net/core/rtnetlink.c:3652 [inline] rtnl_dellink+0x472/0xb40 net/core/rtnetlink.c:3694 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f960519e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f96060c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9605425fa0 RCX: 00007f960519e159 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 RBP: 00007f9605235024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9605426038 R14: 00007f9605425fa0 R15: 00007fff741cd868 bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves