team0: Port device bridge5 removed
team0: Port device bridge6 removed
team0: Port device bridge7 removed
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G             L     
------------------------------------------------------
kworker/u8:6/1676 is trying to acquire lock:
ffff888056108e70 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline]
ffff888056108e70 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: ipvlan_uninit+0x147/0x290 drivers/net/ipvlan/ipvlan_main.c:228

but task is already holding lock:
ffff888021b908c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x489/0xfb0 drivers/net/ipvlan/ipvlan_main.c:810

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&port->pnodes_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       ipvlan_device_event+0x489/0xfb0 drivers/net/ipvlan/ipvlan_main.c:810
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
       call_netdevice_notifiers+0x90/0xd0 net/core/dev.c:2327
       xdp_set_features_flag_locked net/core/xdp.c:1009 [inline]
       xdp_set_features_flag+0x1a0/0x2a0 net/core/xdp.c:1016
       bond_xdp_set_features+0x277/0x320 drivers/net/bonding/bond_main.c:1884
       __bond_release_one+0xeb3/0x11c0 drivers/net/bonding/bond_main.c:2599
       bond_slave_netdev_event drivers/net/bonding/bond_main.c:3972 [inline]
       bond_netdev_event+0x54a/0xf80 drivers/net/bonding/bond_main.c:4090
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
       call_netdevice_notifiers net/core/dev.c:2327 [inline]
       unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
       unregister_netdevice_many net/core/dev.c:12589 [inline]
       unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12390
       unregister_netdevice include/linux/netdevice.h:3487 [inline]
       nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
       __nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1472
       nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline]
       nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1710
       nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1725
       device_remove drivers/base/dd.c:616 [inline]
       __device_release_driver drivers/base/dd.c:1349 [inline]
       device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
       bus_remove_device+0x444/0x560 drivers/base/bus.c:664
       device_del+0x524/0x8f0 drivers/base/core.c:3965
       device_unregister+0x21/0xf0 drivers/base/core.c:4006
       nsim_bus_dev_del drivers/net/netdevsim/bus.c:488 [inline]
       del_device_store+0x2b5/0x370 drivers/net/netdevsim/bus.c:244
       kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
       new_sync_write fs/read_write.c:595 [inline]
       vfs_write+0x612/0xba0 fs/read_write.c:687
       ksys_write+0x150/0x270 fs/read_write.c:739
       do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
       do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166
       asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598

-> #0 (&dev_instance_lock_key#2){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3181 [inline]
       check_prevs_add kernel/locking/lockdep.c:3300 [inline]
       validate_chain kernel/locking/lockdep.c:3924 [inline]
       __lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5253
       lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       netdev_lock include/linux/netdevice.h:2861 [inline]
       ipvlan_uninit+0x147/0x290 drivers/net/ipvlan/ipvlan_main.c:228
       unregister_netdevice_many_notify+0x1acd/0x2140 net/core/dev.c:12537
       ipvlan_device_event+0xf1f/0xfb0 drivers/net/ipvlan/ipvlan_main.c:851
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
       call_netdevice_notifiers net/core/dev.c:2327 [inline]
       unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
       ops_exit_rtnl_list net/core/net_namespace.c:188 [inline]
       ops_undo_list+0x391/0x8d0 net/core/net_namespace.c:249
       cleanup_net+0x572/0x810 net/core/net_namespace.c:706
       process_one_work kernel/workqueue.c:3387 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&port->pnodes_lock);
                               lock(&dev_instance_lock_key#2);
                               lock(&port->pnodes_lock);
  lock(&dev_instance_lock_key#2);

 *** DEADLOCK ***

locks held by kworker/u8:6/1676: 5, last CPU#0:
 #0: ffff88801c2d6140 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801c2d6140 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801c2d6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
 #0: ffff88801c2d6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
 #1: ffffc9000fdcfc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000fdcfc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000fdcfc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
 #1: ffffc9000fdcfc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
 #2: ffffffff9023e628 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677
 #3: ffffffff9024ce80 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
 #3: ffffffff9024ce80 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x28e/0x8d0 net/core/net_namespace.c:249
 #4: ffff888021b908c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x489/0xfb0 drivers/net/ipvlan/ipvlan_main.c:810

stack backtrace:
CPU: 0 UID: 0 PID: 1676 Comm: kworker/u8:6 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2059
 check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2191
 check_prev_add kernel/locking/lockdep.c:3181 [inline]
 check_prevs_add kernel/locking/lockdep.c:3300 [inline]
 validate_chain kernel/locking/lockdep.c:3924 [inline]
 __lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5253
 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
 __mutex_lock_common kernel/locking/mutex.c:646 [inline]
 __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
 netdev_lock include/linux/netdevice.h:2861 [inline]
 ipvlan_uninit+0x147/0x290 drivers/net/ipvlan/ipvlan_main.c:228
 unregister_netdevice_many_notify+0x1acd/0x2140 net/core/dev.c:12537
 ipvlan_device_event+0xf1f/0xfb0 drivers/net/ipvlan/ipvlan_main.c:851
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline]
 ops_undo_list+0x391/0x8d0 net/core/net_namespace.c:249
 cleanup_net+0x572/0x810 net/core/net_namespace.c:706
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
tipc: Left network mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_1
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed