bridge0: port 1(bridge_slave_0) entered disabled state bond1 (unregistering): (slave bridge2): Releasing active interface ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u8:28/9623 is trying to acquire lock: ffff0000d3564e78 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline] ffff0000d3564e78 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 but task is already holding lock: ffff0000ceaf68c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&port->pnodes_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers+0x88/0xd0 net/core/dev.c:2327 xdp_set_features_flag_locked+0x14c/0x218 net/core/xdp.c:1009 xdp_set_features_flag+0x34/0x4c net/core/xdp.c:1016 bond_xdp_set_features+0x230/0x308 drivers/net/bonding/bond_main.c:-1 __bond_release_one+0xb9c/0xe38 drivers/net/bonding/bond_main.c:2599 bond_slave_netdev_event drivers/net/bonding/bond_main.c:3972 [inline] bond_netdev_event+0x3e0/0xaf0 drivers/net/bonding/bond_main.c:4090 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 unregister_netdevice_many net/core/dev.c:12589 [inline] unregister_netdevice_queue+0x274/0x30c net/core/dev.c:12390 unregister_netdevice include/linux/netdevice.h:3487 [inline] nsim_destroy+0x248/0x5f8 drivers/net/netdevsim/netdev.c:1198 __nsim_dev_port_del+0x13c/0x1ec drivers/net/netdevsim/dev.c:1472 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline] nsim_dev_reload_destroy+0x13c/0x210 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x9c/0xd0 drivers/net/netdevsim/dev.c:963 devlink_reload+0x19c/0x64c net/devlink/dev.c:462 devlink_pernet_pre_exit+0x1ac/0x30c net/devlink/core.c:578 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x158/0x81c net/core/net_namespace.c:235 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 -> #0 (&dev_instance_lock_key#2){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline] ops_undo_list+0x32c/0x81c net/core/net_namespace.c:249 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); *** DEADLOCK *** locks held by kworker/u8:28/9623: 5, last CPU#1: #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3362 [inline] #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3470 #1: ffff80009b197c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3362 [inline] #1: ffff80009b197c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3470 #2: ffff800089edcd08 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x104/0x6c4 net/core/net_namespace.c:677 #3: ffff800089ee9d40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 #4: ffff0000ceaf68c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 stack backtrace: CPU: 1 UID: 0 PID: 9623 Comm: kworker/u8:28 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: netns cleanup_net Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x328/0x330 kernel/locking/lockdep.c:2059 check_noncircular+0x158/0x174 kernel/locking/lockdep.c:2191 check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline] ops_undo_list+0x32c/0x81c net/core/net_namespace.c:249 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves tipc: Left network mode hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed IPVS: stop unused estimator thread 0... netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state lo: left allmulticast mode bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state batman_adv: batadv0: Interface deactivated: gretap1 batman_adv: batadv0: Removing interface: gretap1 bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves IPVS: stopping master sync thread 8355 ... hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_1 team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed