netlink: 4 bytes leftover after parsing attributes in process `syz.4.1288'. ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ syz.4.1288/9934 is trying to acquire lock: ffff0000f1f12e78 (&dev_instance_lock_key#17){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline] ffff0000f1f12e78 (&dev_instance_lock_key#17){+.+.}-{4:4}, at: ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 but task is already holding lock: ffff0000f22108c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&port->pnodes_lock){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers+0x88/0xd0 net/core/dev.c:2327 xdp_set_features_flag_locked+0x14c/0x218 net/core/xdp.c:1009 xdp_features_set_redirect_target_locked net/core/xdp.c:1028 [inline] xdp_features_set_redirect_target+0x60/0x94 net/core/xdp.c:1035 veth_xdp_set drivers/net/veth.c:1627 [inline] veth_xdp+0x4d4/0x624 drivers/net/veth.c:1660 dev_xdp_install+0x388/0x7c8 net/core/dev.c:10442 dev_xdp_attach+0x694/0x798 net/core/dev.c:10570 dev_xdp_attach_link net/core/dev.c:10589 [inline] bpf_xdp_link_attach+0x3cc/0x9b0 net/core/dev.c:10765 link_create+0x278/0x614 kernel/bpf/syscall.c:5862 __sys_bpf+0x770/0x82c kernel/bpf/syscall.c:6442 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 -> #0 (&dev_instance_lock_key#17){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 rtnl_delete_link+0x11c/0x184 net/core/rtnetlink.c:3652 rtnl_dellink+0x35c/0x4c8 net/core/rtnetlink.c:3694 rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7132 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7159 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg+0xc8/0x17c net/socket.c:815 ____sys_sendmsg+0x3d0/0x6c8 net/socket.c:2713 ___sys_sendmsg+0x198/0x224 net/socket.c:2767 __sys_sendmsg+0x158/0x204 net/socket.c:2799 __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __arm64_sys_sendmsg+0x88/0x9c net/socket.c:2802 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->pnodes_lock); lock(&dev_instance_lock_key#17); lock(&port->pnodes_lock); lock(&dev_instance_lock_key#17); *** DEADLOCK *** locks held by syz.4.1288/9934: 2, last CPU#0: #0: ffff800089ee9d40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffff800089ee9d40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffff800089ee9d40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dellink+0x2dc/0x4c8 net/core/rtnetlink.c:3686 #1: ffff0000f22108c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x434/0xcc0 drivers/net/ipvlan/ipvlan_main.c:810 stack backtrace: CPU: 0 UID: 0 PID: 9934 Comm: syz.4.1288 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x328/0x330 kernel/locking/lockdep.c:2059 check_noncircular+0x158/0x174 kernel/locking/lockdep.c:2191 check_prev_add kernel/locking/lockdep.c:3181 [inline] check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1600/0x2a6c kernel/locking/lockdep.c:5254 lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x164/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x128/0x28c drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1188/0x1760 net/core/dev.c:12537 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12589 ipvlan_device_event+0xbe4/0xcc0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0xf24/0x1760 net/core/dev.c:12518 rtnl_delete_link+0x11c/0x184 net/core/rtnetlink.c:3652 rtnl_dellink+0x35c/0x4c8 net/core/rtnetlink.c:3694 rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7132 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7159 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg+0xc8/0x17c net/socket.c:815 ____sys_sendmsg+0x3d0/0x6c8 net/socket.c:2713 ___sys_sendmsg+0x198/0x224 net/socket.c:2767 __sys_sendmsg+0x158/0x204 net/socket.c:2799 __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __arm64_sys_sendmsg+0x88/0x9c net/socket.c:2802 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590