bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave geneve1): Releasing backup interface ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u8:17/8440 is trying to acquire lock: ffff0000c8d74e78 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline] ffff0000c8d74e78 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 but task is already holding lock: ffff0000ccfbe8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&port->pnodes_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers+0x88/0xd0 net/core/dev.c:2327 xdp_set_features_flag_locked+0x14c/0x218 net/core/xdp.c:1009 xdp_set_features_flag+0x34/0x4c net/core/xdp.c:1016 bond_xdp_set_features+0x230/0x308 drivers/net/bonding/bond_main.c:-1 bond_enslave+0x20f0/0x2d30 drivers/net/bonding/bond_main.c:2340 do_set_master+0x400/0x56c net/core/rtnetlink.c:3071 do_setlink+0xca8/0x31e8 net/core/rtnetlink.c:3273 rtnl_changelink net/core/rtnetlink.c:3905 [inline] __rtnl_newlink net/core/rtnetlink.c:4076 [inline] rtnl_newlink+0xf44/0x138c net/core/rtnetlink.c:4215 rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7132 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7159 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg+0xc8/0x17c net/socket.c:815 ____sys_sendmsg+0x3d0/0x6c8 net/socket.c:2713 ___sys_sendmsg+0x198/0x224 net/socket.c:2767 __sys_sendmsg+0x158/0x204 net/socket.c:2799 __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __arm64_sys_sendmsg+0x88/0x9c net/socket.c:2802 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 -> #0 (&dev_instance_lock_key#2){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline] ops_undo_list+0x32c/0x81c net/core/net_namespace.c:249 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); lock(&port->pnodes_lock); lock(&dev_instance_lock_key#2); *** DEADLOCK *** locks held by kworker/u8:17/8440: 5, last CPU#0: #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3362 [inline] #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3470 #1: ffff800093287c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3362 [inline] #1: ffff800093287c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3470 #2: ffff800089edcd08 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x104/0x6c4 net/core/net_namespace.c:677 #3: ffff800089ee9d40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 #4: ffff0000ccfbe8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 stack backtrace: CPU: 0 UID: 0 PID: 8440 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: netns cleanup_net Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x328/0x330 kernel/locking/lockdep.c:2059 check_noncircular+0x158/0x174 kernel/locking/lockdep.c:2191 check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline] ops_undo_list+0x32c/0x81c net/core/net_namespace.c:249 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): Released all slaves batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_1 team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed