Debian GNU/Linux 11 syzkaller ttyS0 Warning: Permanently added '[localhost]:1569' (ECDSA) to the list of known hosts. 2025/01/23 16:06:25 fuzzer started 2025/01/23 16:06:26 dialing manager at localhost:45511 2025/01/23 16:06:26 checking machine... 2025/01/23 16:06:26 checking revisions... syzkaller login: [ 68.932698] kmemleak: Automatic memory scanning thread ended 2025/01/23 16:06:26 testing simple program... [ 69.097644] cgroup: Unknown subsys name 'net' [ 69.204705] cgroup: Unknown subsys name 'cpuset' [ 69.237182] cgroup: Unknown subsys name 'rlimit' executing program executing program [ 75.402403] kmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak) executing program executing program executing program executing program [ 86.756119] kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) [ 87.430661] audit: type=1400 audit(1737648405.242:7): avc: denied { execmem } for pid=271 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 88.599180] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.602071] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.606950] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.616321] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.622717] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 88.625361] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 90.682446] Bluetooth: hci0: command tx timeout executing program [ 92.729693] Bluetooth: hci0: command tx timeout [ 94.777818] Bluetooth: hci0: command tx timeout executing program [ 96.825705] Bluetooth: hci0: command tx timeout executing program executing program executing program executing program executing program executing program [ 115.645853] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.647305] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.741438] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.742656] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/01/23 16:07:14 building call list... executing program [ 116.700088] syz-executor.0 (272) used greatest stack depth: 23296 bytes left [ 116.729442] [ 116.729794] ====================================================== [ 116.730793] WARNING: possible circular locking dependency detected [ 116.731809] 6.13.0-next-20250123 #1 Not tainted [ 116.732830] ------------------------------------------------------ [ 116.734836] kworker/u8:2/726 is trying to acquire lock: [ 116.735816] ffffffff8621d8e8 (rtnl_mutex){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1612/0x1c80 [ 116.737707] [ 116.737707] but task is already holding lock: [ 116.738899] ffff888014cb0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 116.744448] [ 116.744448] which lock already depends on the new lock. [ 116.744448] [ 116.745880] [ 116.745880] the existing dependency chain (in reverse order) is: [ 116.747175] [ 116.747175] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 116.748436] __mutex_lock+0x13d/0xb50 [ 116.749313] wiphy_register+0x1b2e/0x25d0 [ 116.750254] ieee80211_register_hw+0x23a4/0x3d60 [ 116.751256] mac80211_hwsim_new_radio+0x2759/0x4d60 [ 116.752357] init_mac80211_hwsim+0x389/0x870 [ 116.753266] do_one_initcall+0xf9/0x640 [ 116.754049] kernel_init_freeable+0x53d/0x7a0 [ 116.755037] kernel_init+0x1e/0x2d0 [ 116.755854] ret_from_fork+0x48/0x80 [ 116.756680] ret_from_fork_asm+0x1a/0x30 [ 116.757607] [ 116.757607] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 116.758829] __lock_acquire+0x29fd/0x4580 [ 116.759808] lock_acquire+0x19b/0x520 [ 116.760709] __mutex_lock+0x13d/0xb50 [ 116.761629] unregister_netdevice_many_notify+0x1612/0x1c80 [ 116.762851] unregister_netdevice_queue+0x224/0x2e0 [ 116.763979] _cfg80211_unregister_wdev+0x57b/0x700 [ 116.765106] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 116.766205] ieee80211_unregister_hw+0x55/0x3a0 [ 116.767304] hwsim_exit_net+0x3a0/0x730 [ 116.768251] ops_exit_list+0xb3/0x180 [ 116.769157] cleanup_net+0x546/0xad0 [ 116.770058] process_one_work+0x8ee/0x1a10 [ 116.771107] worker_thread+0x674/0xe70 [ 116.772100] kthread+0x3ab/0x720 [ 116.772969] ret_from_fork+0x48/0x80 [ 116.773875] ret_from_fork_asm+0x1a/0x30 [ 116.774897] [ 116.774897] other info that might help us debug this: [ 116.774897] [ 116.776420] Possible unsafe locking scenario: [ 116.776420] [ 116.777571] CPU0 CPU1 [ 116.778458] ---- ---- [ 116.779369] lock(&rdev->wiphy.mtx); [ 116.780177] lock(rtnl_mutex); [ 116.781337] lock(&rdev->wiphy.mtx); [ 116.782589] lock(rtnl_mutex); [ 116.783360] [ 116.783360] *** DEADLOCK *** [ 116.783360] [ 116.784503] 4 locks held by kworker/u8:2/726: [ 116.785414] #0: ffff888008fdb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12b6/0x1a10 [ 116.787491] #1: ffff88801eef7d30 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x861/0x1a10 [ 116.789423] #2: ffffffff86211910 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xca/0xad0 [ 116.791241] #3: ffff888014cb0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0xf2/0x6b0 [ 116.793261] [ 116.793261] stack backtrace: [ 116.794129] CPU: 0 UID: 0 PID: 726 Comm: kworker/u8:2 Not tainted 6.13.0-next-20250123 #1 [ 116.794218] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 116.794270] Workqueue: netns cleanup_net [ 116.794368] Call Trace: [ 116.794391] [ 116.794418] dump_stack_lvl+0xca/0x120 [ 116.794554] print_circular_bug+0x47b/0x750 [ 116.794665] check_noncircular+0x2e9/0x3c0 [ 116.794766] ? __pfx_check_noncircular+0x10/0x10 [ 116.794868] ? hlock_class+0x4e/0x130 [ 116.794939] ? srso_return_thunk+0x5/0x5f [ 116.795074] ? mark_lock+0xac/0xed0 [ 116.795191] ? lockdep_lock+0xba/0x1b0 [ 116.795327] ? __pfx_lockdep_lock+0x10/0x10 [ 116.795479] __lock_acquire+0x29fd/0x4580 [ 116.795611] ? __pfx___lock_acquire+0x10/0x10 [ 116.795715] ? lock_release+0x20f/0x6f0 [ 116.795821] ? __pfx_lock_release+0x10/0x10 [ 116.795925] ? srso_return_thunk+0x5/0x5f [ 116.796071] lock_acquire+0x19b/0x520 [ 116.796175] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 116.796296] ? __pfx_lock_acquire+0x10/0x10 [ 116.796404] ? __pfx_lock_release+0x10/0x10 [ 116.796509] ? __pfx_try_to_wake_up+0x10/0x10 [ 116.796614] ? srso_return_thunk+0x5/0x5f [ 116.796750] ? lock_is_held_type+0x9e/0x120 [ 116.796886] ? srso_return_thunk+0x5/0x5f [ 116.797031] __mutex_lock+0x13d/0xb50 [ 116.797159] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 116.797270] ? unregister_netdevice_many_notify+0x1612/0x1c80 [ 116.797384] ? srso_return_thunk+0x5/0x5f [ 116.797518] ? synchronize_rcu_expedited+0x38a/0x420 [ 116.797622] ? __pfx___mutex_lock+0x10/0x10 [ 116.797755] ? srso_return_thunk+0x5/0x5f [ 116.797901] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 116.797998] unregister_netdevice_many_notify+0x1612/0x1c80 [ 116.798112] ? __virt_addr_valid+0x2e8/0x5d0 [ 116.798238] ? __pfx_lock_release+0x10/0x10 [ 116.798346] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 116.798459] ? find_held_lock+0x2c/0x110 [ 116.798597] ? srso_return_thunk+0x5/0x5f [ 116.798738] ? kernfs_remove_by_name_ns+0xc7/0x130 [ 116.798883] ? srso_return_thunk+0x5/0x5f [ 116.799018] ? lock_release+0x20f/0x6f0 [ 116.799142] ? __pfx_lock_release+0x10/0x10 [ 116.799246] ? srso_return_thunk+0x5/0x5f [ 116.799381] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 116.799500] ? srso_return_thunk+0x5/0x5f [ 116.799648] unregister_netdevice_queue+0x224/0x2e0 [ 116.799756] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 116.799863] ? up_write+0x195/0x520 [ 116.799997] _cfg80211_unregister_wdev+0x57b/0x700 [ 116.800125] ? srso_return_thunk+0x5/0x5f [ 116.800269] ieee80211_remove_interfaces+0x2f2/0x6b0 [ 116.800365] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 116.800460] ? srso_return_thunk+0x5/0x5f [ 116.800594] ? srso_return_thunk+0x5/0x5f [ 116.800729] ? synchronize_rcu+0x1ff/0x260 [ 116.800832] ieee80211_unregister_hw+0x55/0x3a0 [ 116.800942] hwsim_exit_net+0x3a0/0x730 [ 116.801047] ? __pfx_hwsim_exit_net+0x10/0x10 [ 116.801147] ? srso_return_thunk+0x5/0x5f [ 116.801281] ? netdev_run_todo+0x788/0x1040 [ 116.801403] ? __pfx_hwsim_exit_net+0x10/0x10 [ 116.801508] ops_exit_list+0xb3/0x180 [ 116.801613] cleanup_net+0x546/0xad0 [ 116.801723] ? __pfx_cleanup_net+0x10/0x10 [ 116.801855] process_one_work+0x8ee/0x1a10 [ 116.802012] ? __pfx_lock_acquire+0x10/0x10 [ 116.802120] ? __pfx_process_one_work+0x10/0x10 [ 116.802260] ? srso_return_thunk+0x5/0x5f [ 116.802394] ? move_linked_works+0x172/0x270 [ 116.802505] ? srso_return_thunk+0x5/0x5f [ 116.802640] ? assign_work+0x196/0x240 [ 116.802778] worker_thread+0x674/0xe70 [ 116.802917] ? lockdep_hardirqs_on_prepare+0x262/0x3f0 [ 116.803042] ? srso_return_thunk+0x5/0x5f [ 116.803189] ? __pfx_worker_thread+0x10/0x10 [ 116.803309] kthread+0x3ab/0x720 [ 116.803412] ? __pfx_kthread+0x10/0x10 [ 116.803516] ? srso_return_thunk+0x5/0x5f [ 116.803628] ? finish_task_switch.isra.0+0x206/0x840 [ 116.803728] ? __pfx_kthread+0x10/0x10 [ 116.803836] ret_from_fork+0x48/0x80 [ 116.803898] ? __pfx_kthread+0x10/0x10 [ 116.804004] ret_from_fork_asm+0x1a/0x30 [ 116.804136] executing program [ 120.798566] audit: type=1400 audit(1737648438.610:8): avc: denied { create } for pid=250 comm="syz-fuzzer" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 [ 121.729021] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list executing program [ 122.823862] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list VM DIAGNOSIS: 16:07:14 Registers: info registers vcpu 0 RAX=0000000000000038 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff8283eaa5 RDI=ffffffff886970a0 RBP=ffffffff88697060 RSP=ffff88801eef6c90 R8 =0000000000000000 R9 =ffffed1001d96046 R10=0000000000000038 R11=3038383866666666 R12=0000000000000038 R13=0000000000000010 R14=ffffffff88697060 R15=ffffffff8283ea90 RIP=ffffffff8283eafd RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f3925c79550 CR3=000000000c566000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 XMM02=0000000000000000bfe62e42fefa39ef XMM03=0000ff00000000000000000000000000 XMM04=732f6c61636f6c2f7273752f3d485441 XMM05=622f6c61636f6c2f7273752f3a6e6962 XMM06=73752f3a6e6962732f7273752f3a6e69 XMM07=6e69622f3a6e6962732f3a6e69622f72 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000001 RBX=0000000000000159 RCX=0000000000000003 RDX=0000000000000000 RSI=ffffffff8166a989 RDI=ffffffff8558b938 RBP=0000000000000159 RSP=ffff88800f4d7a48 R8 =0000000000000001 R9 =ffffed1003e1699f R10=000000000000000e R11=0000000000000000 R12=0000000000000001 R13=ffff88800ead082f R14=00000000000001fe R15=dffffc0000000000 RIP=ffffffff8166a9e8 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000001f21870 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000c00083b000 CR3=000000000c566000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=776f68735f65646f6d5f69736d207420 XMM02=79735f69736d5f7866705f5f20742030 XMM03=30386234363531386666666666666666 XMM04=30303030303030303030303030303030 XMM05=30386234363531386666666666666666 XMM06=6d65725f73667379735f69736d207420 XMM07=666666666666660a637365645f65766f XMM08=66705f5f207420303364343635313866 XMM09=0a637365645f646e69665f69736d5f78 XMM10=30346434363531386666666666666666 XMM11=637365645f646e69665f69736d207420 XMM12=6565343635313866666666666666660a XMM13=00000000008a4dee00000000008a69cf XMM14=000000000089d9b900000000008a4694 XMM15=00000000004643c100000000004360f2