======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G S L
------------------------------------------------------
kworker/u8:5/101 is trying to acquire lock:
ffff88801eab6e70 (&netdev_virt_instance_lock_key){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2859 [inline]
ffff88801eab6e70 (&netdev_virt_instance_lock_key){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
ffff88801eab6e70 (&netdev_virt_instance_lock_key){+.+.}-{4:4}, at: call_netdevice_unregister_notifiers net/core/dev.c:1973 [inline]
ffff88801eab6e70 (&netdev_virt_instance_lock_key){+.+.}-{4:4}, at: call_netdevice_unregister_net_notifiers+0x1e0/0x4c0 net/core/dev.c:2009
but task is already holding lock:
ffffffff90676ba0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
ffffffff90676ba0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 net/core/dev.c:2223
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #6 (rtnl_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
cgrp_css_online+0x91/0x300 net/core/netprio_cgroup.c:157
online_css+0xbd/0x2e0 kernel/cgroup/cgroup.c:5889
css_create kernel/cgroup/cgroup.c:5967 [inline]
cgroup_apply_control_enable+0x9ed/0xda0 kernel/cgroup/cgroup.c:3478
cgroup_mkdir+0xe66/0x10f0 kernel/cgroup/cgroup.c:6168
kernfs_iop_mkdir+0x213/0x360 fs/kernfs/dir.c:1304
vfs_mkdir+0x40e/0x630 fs/namei.c:5423
filename_mkdirat+0x285/0x510 fs/namei.c:5456
__do_sys_mkdirat fs/namei.c:5477 [inline]
__se_sys_mkdirat+0x35/0x150 fs/namei.c:5474
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #5 (cgroup_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
cgroup_lock include/linux/cgroup.h:485 [inline]
cgroup_kn_lock_live+0x14f/0x260 kernel/cgroup/cgroup.c:1729
cgroup_rmdir+0x23/0x2b0 kernel/cgroup/cgroup.c:6420
kernfs_iop_rmdir+0x1f2/0x330 fs/kernfs/dir.c:1322
vfs_rmdir+0x3e6/0x6a0 fs/namei.c:5528
filename_rmdir+0x292/0x520 fs/namei.c:5585
__do_sys_rmdir fs/namei.c:5608 [inline]
__se_sys_rmdir+0x2e/0x140 fs/namei.c:5605
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #4 (&type->i_mutex_dir_key#6){++++}-{4:4}:
down_read+0x45/0x320 kernel/locking/rwsem.c:1574
inode_lock_shared include/linux/fs.h:1039 [inline]
lookup_slow+0x46/0x80 fs/namei.c:1935
ovl_lookup_positive_unlocked fs/overlayfs/namei.c:216 [inline]
ovl_lookup_single+0x323/0xe90 fs/overlayfs/namei.c:260
ovl_lookup_layer+0x377/0x440 fs/overlayfs/namei.c:365
ovl_lookup_layers fs/overlayfs/namei.c:1168 [inline]
ovl_lookup+0x9ae/0x1c80 fs/overlayfs/namei.c:1403
lookup_open+0x94b/0x1970 fs/namei.c:4530
open_last_lookups fs/namei.c:4769 [inline]
path_openat+0x673/0x1da0 fs/namei.c:5008
do_file_open+0x23e/0x4a0 fs/namei.c:5040
do_sys_openat2+0x115/0x200 fs/open.c:1442
do_sys_open fs/open.c:1448 [inline]
__do_sys_openat fs/open.c:1464 [inline]
__se_sys_openat fs/open.c:1459 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1459
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}:
d_wait_lookup fs/dcache.c:2838 [inline]
__d_alloc_parallel+0xc32/0x1700 fs/dcache.c:2942
__lookup_slow+0x82/0x2f0 fs/namei.c:1904
lookup_slow+0x59/0x80 fs/namei.c:1936
walk_component fs/namei.c:2282 [inline]
link_path_walk+0xd22/0x1910 fs/namei.c:2656
path_parentat fs/namei.c:2860 [inline]
__filename_parentat+0x287/0x6f0 fs/namei.c:2884
filename_parentat fs/namei.c:2902 [inline]
filename_unlinkat+0x104/0x610 fs/namei.c:5701
__do_sys_unlink fs/namei.c:5767 [inline]
__se_sys_unlink+0x2e/0x140 fs/namei.c:5764
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&type->i_mutex_dir_key#5){++++}-{4:4}:
down_read+0x45/0x320 kernel/locking/rwsem.c:1574
inode_lock_shared include/linux/fs.h:1039 [inline]
lookup_slow+0x46/0x80 fs/namei.c:1935
walk_component fs/namei.c:2282 [inline]
lookup_last fs/namei.c:2789 [inline]
path_lookupat+0x3f5/0x8c0 fs/namei.c:2813
filename_lookup+0x265/0x5d0 fs/namei.c:2842
kern_path+0x3d/0x150 fs/namei.c:3036
bpf_prog_get_type_path+0xa3/0x270 kernel/bpf/inode.c:642
__bpf_mt_check_path net/netfilter/xt_bpf.c:60 [inline]
bpf_mt_check_v1+0x156/0x360 net/netfilter/xt_bpf.c:84
xt_checkentry_match net/netfilter/x_tables.c:543 [inline]
xt_check_match+0x602/0xce0 net/netfilter/x_tables.c:576
__nft_match_init+0x66b/0x8c0 net/netfilter/nft_compat.c:546
nft_match_large_init+0xc0/0x150 net/netfilter/nft_compat.c:568
nf_tables_newexpr net/netfilter/nf_tables_api.c:3647 [inline]
nf_tables_newrule+0x179e/0x28a0 net/netfilter/nf_tables_api.c:4465
nfnetlink_rcv_batch net/netfilter/nfnetlink.c:524 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]
nfnetlink_rcv+0x1288/0x28c0 net/netfilter/nfnetlink.c:665
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x7c3/0xae0 net/netlink/af_netlink.c:1916
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
__sock_sendmsg net/socket.c:815 [inline]
____sys_sendmsg+0x54e/0x850 net/socket.c:2712
___sys_sendmsg+0x2a5/0x360 net/socket.c:2766
__sys_sendmsg net/socket.c:2798 [inline]
__do_sys_sendmsg net/socket.c:2803 [inline]
__se_sys_sendmsg net/socket.c:2801 [inline]
__x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2801
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&nft_net->commit_mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
nf_tables_netdev_event+0xad/0x160 net/netfilter/nft_chain_filter.c:416
call_netdevice_notifier net/core/dev.c:1949 [inline]
call_netdevice_register_notifiers net/core/dev.c:1957 [inline]
call_netdevice_register_net_notifiers+0x133/0x750 net/core/dev.c:1990
register_netdevice_notifier+0x96/0x160 net/core/dev.c:2046
nft_chain_filter_netdev_init net/netfilter/nft_chain_filter.c:442 [inline]
nft_chain_filter_init+0x1d/0x80 net/netfilter/nft_chain_filter.c:468
nf_tables_module_init+0x25/0xd0 net/netfilter/nf_tables_api.c:12251
do_one_initcall+0x250/0x870 init/main.c:1360
do_initcall_level+0x10a/0x1a0 init/main.c:1422
do_initcalls+0x59/0xa0 init/main.c:1438
kernel_init_freeable+0x29d/0x3e0 init/main.c:1673
kernel_init+0x22/0x1d0 init/main.c:1563
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #0 (&netdev_virt_instance_lock_key){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
netdev_lock include/linux/netdevice.h:2859 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
call_netdevice_unregister_notifiers net/core/dev.c:1973 [inline]
call_netdevice_unregister_net_notifiers+0x1e0/0x4c0 net/core/dev.c:2009
__unregister_netdevice_notifier_net net/core/dev.c:2140 [inline]
unregister_netdevice_notifier_dev_net+0x159/0x1a0 net/core/dev.c:2270
nsim_destroy+0x105/0x800 drivers/net/netdevsim/netdev.c:1195
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1472
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1710
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:963
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8f0 net/core/net_namespace.c:235
cleanup_net+0x572/0x810 net/core/net_namespace.c:706
process_one_work kernel/workqueue.c:3495 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
other info that might help us debug this:
Chain exists of:
&netdev_virt_instance_lock_key --> cgroup_mutex --> rtnl_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(rtnl_mutex);
lock(cgroup_mutex);
lock(rtnl_mutex);
lock(&netdev_virt_instance_lock_key);
*** DEADLOCK ***
locks held by kworker/u8:5/101: 6, last CPU#0:
#0: ffff88801c286148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88801c286148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88801c286148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
#0: ffff88801c286148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
#1: ffffc90002597c40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90002597c40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90002597c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
#1: ffffc90002597c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
#2: ffffffff906682a8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677
#3: ffff88802aff2128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff88802aff2128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline]
#3: ffff88802aff2128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 net/devlink/core.c:575
#4: ffff88802aff1258 (&devlink->lock_key#14){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:308 [inline]
#4: ffff88802aff1258 (&devlink->lock_key#14){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline]
#4: ffff88802aff1258 (&devlink->lock_key#14){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 net/devlink/core.c:575
#5: ffffffff90676ba0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
#5: ffffffff90676ba0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 net/core/dev.c:2223
stack backtrace:
CPU: 0 UID: 0 PID: 101 Comm: kworker/u8:5 Tainted: G S L syzkaller #0 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: netns cleanup_net
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821
netdev_lock include/linux/netdevice.h:2859 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
call_netdevice_unregister_notifiers net/core/dev.c:1973 [inline]
call_netdevice_unregister_net_notifiers+0x1e0/0x4c0 net/core/dev.c:2009
__unregister_netdevice_notifier_net net/core/dev.c:2140 [inline]
unregister_netdevice_notifier_dev_net+0x159/0x1a0 net/core/dev.c:2270
nsim_destroy+0x105/0x800 drivers/net/netdevsim/netdev.c:1195
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1472
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1710
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:963
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8f0 net/core/net_namespace.c:235
cleanup_net+0x572/0x810 net/core/net_namespace.c:706
process_one_work kernel/workqueue.c:3495 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
IPVS: stop unused estimator thread 0...
netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim10 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
erspan0: left allmulticast mode
erspan0: left promiscuous mode
bridge0: port 3(erspan0) entered disabled state
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
tipc: Disabling bearer
tipc: Left network mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
IPVS: stop unused estimator thread 0...