====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u8:19/12780 is trying to acquire lock: ffff0000ffc20e78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline] ffff0000ffc20e78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 but task is already holding lock: ffff0000d46ec8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&port->pnodes_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] __dev_close_many+0xf8/0x648 net/core/dev.c:1769 netif_close_many+0x1d8/0x51c net/core/dev.c:1824 netif_close_many_and_unlock+0x38/0x15c net/core/dev.c:12411 unregister_netdevice_many_notify+0x5a4/0x1760 net/core/dev.c:12481 unregister_netdevice_many net/core/dev.c:12589 [inline] unregister_netdevice_queue+0x274/0x30c net/core/dev.c:12390 unregister_netdevice include/linux/netdevice.h:3487 [inline] nsim_destroy+0x248/0x5f8 drivers/net/netdevsim/netdev.c:1198 __nsim_dev_port_del+0x13c/0x1ec drivers/net/netdevsim/dev.c:1472 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline] nsim_dev_reload_destroy+0x13c/0x210 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x9c/0xd0 drivers/net/netdevsim/dev.c:963 devlink_reload+0x19c/0x64c net/devlink/dev.c:462 devlink_pernet_pre_exit+0x1ac/0x30c net/devlink/core.c:578 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x158/0x81c net/core/net_namespace.c:235 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 -> #0 (&dev_instance_lock_key#23){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 unregister_netdevice_many net/core/dev.c:12589 [inline] unregister_netdevice_queue+0x274/0x30c net/core/dev.c:12390 unregister_netdevice include/linux/netdevice.h:3487 [inline] nsim_destroy+0x248/0x5f8 drivers/net/netdevsim/netdev.c:1198 __nsim_dev_port_del+0x13c/0x1ec drivers/net/netdevsim/dev.c:1472 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline] nsim_dev_reload_destroy+0x13c/0x210 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x9c/0xd0 drivers/net/netdevsim/dev.c:963 devlink_reload+0x19c/0x64c net/devlink/dev.c:462 devlink_pernet_pre_exit+0x1ac/0x30c net/devlink/core.c:578 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x158/0x81c net/core/net_namespace.c:235 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->pnodes_lock); lock(&dev_instance_lock_key#23); lock(&port->pnodes_lock); lock(&dev_instance_lock_key#23); *** DEADLOCK *** locks held by kworker/u8:19/12780: 7, last CPU#0: #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3362 [inline] #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3470 #1: ffff8000952d7c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3362 [inline] #1: ffff8000952d7c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3470 #2: ffff800089edcd08 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x104/0x6c4 net/core/net_namespace.c:677 #3: ffff0000d7fd7128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff0000d7fd7128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff0000d7fd7128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x108/0x30c net/devlink/core.c:575 #4: ffff0000d7fd5258 (&devlink->lock_key#8){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:308 [inline] #4: ffff0000d7fd5258 (&devlink->lock_key#8){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff0000d7fd5258 (&devlink->lock_key#8){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x11c/0x30c net/devlink/core.c:575 #5: ffff800089ee9d40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 #6: ffff0000d46ec8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 stack backtrace: CPU: 0 UID: 0 PID: 12780 Comm: kworker/u8:19 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: netns cleanup_net Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x328/0x330 kernel/locking/lockdep.c:2059 check_noncircular+0x158/0x174 kernel/locking/lockdep.c:2191 check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 unregister_netdevice_many net/core/dev.c:12589 [inline] unregister_netdevice_queue+0x274/0x30c net/core/dev.c:12390 unregister_netdevice include/linux/netdevice.h:3487 [inline] nsim_destroy+0x248/0x5f8 drivers/net/netdevsim/netdev.c:1198 __nsim_dev_port_del+0x13c/0x1ec drivers/net/netdevsim/dev.c:1472 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline] nsim_dev_reload_destroy+0x13c/0x210 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x9c/0xd0 drivers/net/netdevsim/dev.c:963 devlink_reload+0x19c/0x64c net/devlink/dev.c:462 devlink_pernet_pre_exit+0x1ac/0x30c net/devlink/core.c:578 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x158/0x81c net/core/net_namespace.c:235 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 43831 - 0 netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 43831 - 0 netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 43831 - 0 netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 43831 - 0 bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state veth5: left allmulticast mode veth5: left promiscuous mode bridge1: port 3(veth5) entered disabled state veth0_to_bond: left allmulticast mode veth0_to_bond: left promiscuous mode bridge1: port 2(veth0_to_bond) entered disabled state veth3: left allmulticast mode veth3: left promiscuous mode bridge1: port 1(veth3) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves tipc: Disabling bearer tipc: Left network mode hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode IPVS: stop unused estimator thread 0... netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): (slave wlan0): Releasing backup interface bond1 (unregistering): Released all slaves bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves bond2 (unregistering): Released all slaves bond3 (unregistering): Released all slaves bond4 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves |2ö;: left promiscuous mode tipc: Left network mode tipc: Disabling bearer tipc: Left network mode IPVS: stopping backup sync thread 10748 ... IPVS: stopping backup sync thread 10418 ... hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left allmulticast mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed IPVS: stop unused estimator thread 0... IPVS: stop unused estimator thread 0... IPVS: stop unused estimator thread 0...