====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u8:9/317 is trying to acquire lock: ffff8880680d4e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline] ffff8880680d4e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 but task is already holding lock: ffff8880271f48c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&port->pnodes_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] __dev_close_many+0xff/0x710 net/core/dev.c:1769 netif_close_many+0x243/0x810 net/core/dev.c:1824 netif_close_many_and_unlock+0x24/0x270 net/core/dev.c:12411 unregister_netdevice_many_notify+0x661/0x2150 net/core/dev.c:12481 unregister_netdevice_many net/core/dev.c:12589 [inline] unregister_netdevice_queue net/core/dev.c:12390 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12376 unregister_netdevice include/linux/netdevice.h:3487 [inline] nsim_destroy+0x23e/0x970 drivers/net/netdevsim/netdev.c:1198 __nsim_dev_port_del+0x194/0x2b0 drivers/net/netdevsim/dev.c:1472 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline] nsim_dev_reload_destroy+0x10a/0x490 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x66/0xd0 drivers/net/netdevsim/dev.c:963 devlink_reload+0x1ae/0x7a0 net/devlink/dev.c:462 devlink_pernet_pre_exit+0x247/0x370 net/devlink/core.c:578 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0xab0 net/core/net_namespace.c:235 cleanup_net+0x499/0x920 net/core/net_namespace.c:706 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #0 (&dev_instance_lock_key#23){+.+.}-{4:4}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12537 ipvlan_device_event+0xf01/0x11e0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12518 unregister_netdevice_many net/core/dev.c:12589 [inline] unregister_netdevice_queue net/core/dev.c:12390 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12376 unregister_netdevice include/linux/netdevice.h:3487 [inline] nsim_destroy+0x23e/0x970 drivers/net/netdevsim/netdev.c:1198 __nsim_dev_port_del+0x194/0x2b0 drivers/net/netdevsim/dev.c:1472 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline] nsim_dev_reload_destroy+0x10a/0x490 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x66/0xd0 drivers/net/netdevsim/dev.c:963 devlink_reload+0x1ae/0x7a0 net/devlink/dev.c:462 devlink_pernet_pre_exit+0x247/0x370 net/devlink/core.c:578 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0xab0 net/core/net_namespace.c:235 cleanup_net+0x499/0x920 net/core/net_namespace.c:706 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&port->pnodes_lock); lock(&dev_instance_lock_key#23); lock(&port->pnodes_lock); lock(&dev_instance_lock_key#23); *** DEADLOCK *** locks held by kworker/u8:9/317: 7, last CPU#0: #0: ffff88801d2d8940 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000321fd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cb6a48 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677 #3: ffff88807e545128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807e545128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff88807e545128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x19e/0x370 net/devlink/core.c:575 #4: ffff88807d463258 (&devlink->lock_key#7){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:308 [inline] #4: ffff88807d463258 (&devlink->lock_key#7){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff88807d463258 (&devlink->lock_key#7){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x1b4/0x370 net/devlink/core.c:575 #5: ffffffff90ccf540 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x1a6/0x970 drivers/net/netdevsim/netdev.c:1193 #6: ffff8880271f48c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x20f/0x11e0 drivers/net/ipvlan/ipvlan_main.c:810 stack backtrace: CPU: 0 UID: 0 PID: 317 Comm: kworker/u8:9 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 netdev_lock include/linux/netdevice.h:2861 [inline] ipvlan_uninit+0x16d/0x2f0 drivers/net/ipvlan/ipvlan_main.c:228 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12537 ipvlan_device_event+0xf01/0x11e0 drivers/net/ipvlan/ipvlan_main.c:851 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers net/core/dev.c:2327 [inline] unregister_netdevice_many_notify+0x1149/0x2150 net/core/dev.c:12518 unregister_netdevice_many net/core/dev.c:12589 [inline] unregister_netdevice_queue net/core/dev.c:12390 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12376 unregister_netdevice include/linux/netdevice.h:3487 [inline] nsim_destroy+0x23e/0x970 drivers/net/netdevsim/netdev.c:1198 __nsim_dev_port_del+0x194/0x2b0 drivers/net/netdevsim/dev.c:1472 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline] nsim_dev_reload_destroy+0x10a/0x490 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x66/0xd0 drivers/net/netdevsim/dev.c:963 devlink_reload+0x1ae/0x7a0 net/devlink/dev.c:462 devlink_pernet_pre_exit+0x247/0x370 net/devlink/core.c:578 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0xab0 net/core/net_namespace.c:235 cleanup_net+0x499/0x920 net/core/net_namespace.c:706 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state pim6reg: left allmulticast mode dvmrp6: left allmulticast mode bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond1 (unregistering): (slave veth3): Releasing active interface bond1 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state pim6reg: left allmulticast mode bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state pim6reg: left allmulticast mode bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves tipc: Left network mode hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed