[syzbot] [bluetooth?] [wireless?] WARNING in free_netdev (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8d20dcda404d selftests: drv-net-hw: inject pp_alloc_fail e..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15ffc2b0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c30f048a4f12891
dashboard link: https://syzkaller.appspot.com/bug?extid=85ff1051228a04613a32
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ffc2b0580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5ce07c743ced/disk-8d20dcda.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/66f2a9a35d5e/vmlinux-8d20dcda.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4c790c086a46/bzImage-8d20dcda.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+85ff10...@syzkaller.appspotmail.com

------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 1 PID: 5961 at kernel/locking/mutex.c:564 __mutex_lock_common kernel/locking/mutex.c:564 [inline]
WARNING: CPU: 1 PID: 5961 at kernel/locking/mutex.c:564 __mutex_lock+0xdac/0xee0 kernel/locking/mutex.c:735
Modules linked in:
CPU: 1 UID: 0 PID: 5961 Comm: syz-executor Not tainted 6.13.0-rc7-syzkaller-01131-g8d20dcda404d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:564 [inline]
RIP: 0010:__mutex_lock+0xdac/0xee0 kernel/locking/mutex.c:735
Code: 0f b6 04 38 84 c0 0f 85 1a 01 00 00 83 3d 6f 40 4c 04 00 75 19 90 48 c7 c7 60 84 0a 8c 48 c7 c6 00 85 0a 8c e8 f5 dc 91 f5 90 <0f> 0b 90 90 90 e9 c7 f3 ff ff 90 0f 0b 90 e9 29 f8 ff ff 90 0f 0b
RSP: 0018:ffffc90003987580 EFLAGS: 00010246
RAX: ef7de89246652d00 RBX: ffff888029dc0cb0 RCX: ffff888025ad3c00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003987710 R08: ffffffff81602ac2 R09: 1ffff110170e519a
R10: dffffc0000000000 R11: ffffed10170e519b R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000730ec4 R15: dffffc0000000000
FS: 000055558b849500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffad944418 CR3: 00000000336ec000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
netdev_lock include/linux/netdevice.h:2691 [inline]
__netif_napi_del include/linux/netdevice.h:2829 [inline]
netif_napi_del include/linux/netdevice.h:2848 [inline]
free_netdev+0x2d9/0x610 net/core/dev.c:11621
netdev_run_todo+0xf21/0x10d0 net/core/dev.c:11189
nsim_destroy+0x3c3/0x620 drivers/net/netdevsim/netdev.c:1028
__nsim_dev_port_del+0x14b/0x1b0 drivers/net/netdevsim/dev.c:1428
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1440 [inline]
nsim_dev_reload_destroy+0x28a/0x490 drivers/net/netdevsim/dev.c:1661
nsim_drv_remove+0x58/0x160 drivers/net/netdevsim/dev.c:1676
device_remove drivers/base/dd.c:567 [inline]
__device_release_driver drivers/base/dd.c:1273 [inline]
device_release_driver_internal+0x4a9/0x7c0 drivers/base/dd.c:1296
bus_remove_device+0x34f/0x420 drivers/base/bus.c:576
device_del+0x57a/0x9b0 drivers/base/core.c:3854
device_unregister+0x20/0xc0 drivers/base/core.c:3895
nsim_bus_dev_del drivers/net/netdevsim/bus.c:462 [inline]
del_device_store+0x363/0x480 drivers/net/netdevsim/bus.c:226
kernfs_fop_write_iter+0x3a0/0x500 fs/kernfs/file.c:334
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0xaeb/0xd30 fs/read_write.c:679
ksys_write+0x18f/0x2b0 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f44ce1847df
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007ffde8b7b2a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f44ce1847df
RDX: 0000000000000001 RSI: 00007ffde8b7b2f0 RDI: 0000000000000005
RBP: 00007f44ce202d15 R08: 0000000000000000 R09: 00007ffde8b7b0f7
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 00007ffde8b7b2f0 R14: 00007f44ceea4620 R15: 0000000000000003
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hillf Danton]

On Fri, 17 Jan 2025 14:44:19 -0800

> syzbot found the following issue on:
>
> HEAD commit: 8d20dcda404d selftests: drv-net-hw: inject pp_alloc_fail e..
> git tree: net-next

> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ffc2b0580000

#syz test

--- x/net/core/dev.c
+++ y/net/core/dev.c
@@ -11606,8 +11606,6 @@ void free_netdev(struct net_device *dev)
return;
}

- mutex_destroy(&dev->lock);
-
kfree(dev->ethtool);
netif_free_tx_queues(dev);
netif_free_rx_queues(dev);
--

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

dge_slave_1) entered blocking state
[ 71.108569][ T5921] bridge0: port 2(bridge_slave_1) entered disabled state
[ 71.117387][ T5921] bridge_slave_1: entered allmulticast mode
[ 71.123910][ T5921] bridge_slave_1: entered promiscuous mode
[ 71.146979][ T5921] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 71.158781][ T5921] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 71.184379][ T5921] team0: Port device team_slave_0 added
[ 71.192152][ T5921] team0: Port device team_slave_1 added
[ 71.212442][ T5921] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 71.219636][ T5921] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 71.245715][ T5921] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 71.258513][ T5921] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 71.265647][ T5921] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 71.291996][ T5921] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 71.321987][ T5921] hsr_slave_0: entered promiscuous mode
[ 71.328221][ T5921] hsr_slave_1: entered promiscuous mode
[ 71.334223][ T5921] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 71.342456][ T5921] Cannot create hsr debugfs directory
[ 71.929099][ T52] bridge_slave_1: left allmulticast mode
[ 71.940906][ T52] bridge_slave_1: left promiscuous mode
[ 71.956079][ T52] bridge0: port 2(bridge_slave_1) entered disabled state
[ 71.979877][ T52] bridge_slave_0: left allmulticast mode
[ 71.994643][ T52] bridge_slave_0: left promiscuous mode
[ 72.001544][ T52] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.191789][ T1296] ieee802154 phy0 wpan0: encryption failed: -22
[ 72.202174][ T1296] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.356579][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 72.368682][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 72.378812][ T52] bond0 (unregistering): Released all slaves
[ 72.497588][ T52] hsr_slave_0: left promiscuous mode
[ 72.503680][ T52] hsr_slave_1: left promiscuous mode
[ 72.517610][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 72.525384][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 72.534301][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 72.543334][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 72.558287][ T52] veth1_macvtap: left promiscuous mode
[ 72.564051][ T52] veth0_macvtap: left promiscuous mode
[ 72.570624][ T52] veth1_vlan: left promiscuous mode
[ 72.576143][ T52] veth0_vlan: left promiscuous mode
[ 72.844032][ T52] team0 (unregistering): Port device team_slave_1 removed
[ 72.875447][ T52] team0 (unregistering): Port device team_slave_0 removed
[ 72.988099][ T5866] Bluetooth: hci0: command tx timeout
[ 73.179937][ T5921] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 73.205434][ T5921] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 73.217882][ T5921] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 73.236628][ T5921] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 73.342605][ T5921] 8021q: adding VLAN 0 to HW filter on device bond0
[ 73.370126][ T5921] 8021q: adding VLAN 0 to HW filter on device team0
[ 73.387661][ T1899] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.394773][ T1899] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 73.433491][ T1899] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.440768][ T1899] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 74.117012][ T52]
[ 74.119371][ T52] ======================================================
[ 74.126377][ T52] WARNING: possible circular locking dependency detected
[ 74.133548][ T52] 6.13.0-rc7-syzkaller-g41c5d104f338-dirty #0 Not tainted
[ 74.140756][ T52] ------------------------------------------------------
[ 74.147857][ T52] kworker/u8:3/52 is trying to acquire lock:
[ 74.153852][ T52] ffffffff8fcb4bc8 (rtnl_mutex){+.+.}-{4:4}
[ 74.153921][ T5921] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 74.153901][ T52] , at: unregister_netdevice_many_notify+0xac2/0x2030
[ 74.153942][ T52]
[ 74.153942][ T52] but task is already holding lock:
[ 74.180685][ T52] ffff888022680768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700
[ 74.183583][ T5921] veth0_vlan: entered promiscuous mode
[ 74.191061][ T52]
[ 74.191061][ T52] which lock already depends on the new lock.
[ 74.191061][ T52]
[ 74.191069][ T52]
[ 74.191069][ T52] the existing dependency chain (in reverse order) is:
[ 74.191075][ T52]
[ 74.191075][ T52] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}:
[ 74.191103][ T52] lock_acquire+0x1ed/0x550
[ 74.202674][ T5921] veth1_vlan: entered promiscuous mode
[ 74.206946][ T52] __mutex_lock+0x1ac/0xee0
[ 74.206974][ T52] wiphy_register+0x1a49/0x27b0
[ 74.206999][ T52] ieee80211_register_hw+0x30fb/0x3e10
[ 74.232754][ T5921] veth0_macvtap: entered promiscuous mode
[ 74.234151][ T52] mac80211_hwsim_new_radio+0x2a9f/0x4a90
[ 74.242216][ T5921] veth1_macvtap: entered promiscuous mode
[ 74.244595][ T52] init_mac80211_hwsim+0x87a/0xb00
[ 74.260771][ T5921] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 74.262564][ T52] do_one_initcall+0x248/0x870
[ 74.273588][ T5921] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 74.273873][ T52] do_initcall_level+0x157/0x210
[ 74.285635][ T5921] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.286402][ T52] do_initcalls+0x3f/0x80
[ 74.293737][ T5921] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.299019][ T52] kernel_init_freeable+0x435/0x5d0
[ 74.299045][ T52] kernel_init+0x1d/0x2b0
[ 74.299060][ T52] ret_from_fork+0x4b/0x80
[ 74.299077][ T52] ret_from_fork_asm+0x1a/0x30
[ 74.299092][ T52]
[ 74.299092][ T52] -> #0 (rtnl_mutex){+.+.}-{4:4}:
[ 74.299119][ T52] validate_chain+0x18ef/0x5920
[ 74.299140][ T52] __lock_acquire+0x1397/0x2100
[ 74.299157][ T52] lock_acquire+0x1ed/0x550
[ 74.299174][ T52] __mutex_lock+0x1ac/0xee0
[ 74.299194][ T52] unregister_netdevice_many_notify+0xac2/0x2030
[ 74.299215][ T52] unregister_netdevice_queue+0x303/0x370
[ 74.310452][ T5921] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.312695][ T52] _cfg80211_unregister_wdev+0x163/0x590
[ 74.321744][ T5921] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.327055][ T52] ieee80211_remove_interfaces+0x4ef/0x700
[ 74.327078][ T52] ieee80211_unregister_hw+0x5d/0x2c0
[ 74.327092][ T52] mac80211_hwsim_del_radio+0x2c4/0x4c0
[ 74.327113][ T52] hwsim_exit_net+0x5c1/0x670
[ 74.327131][ T52] cleanup_net+0x812/0xd60
[ 74.327147][ T52] process_scheduled_works+0xa66/0x1840
[ 74.327164][ T52] worker_thread+0x870/0xd30
[ 74.327179][ T52] kthread+0x2f0/0x390
[ 74.327197][ T52] ret_from_fork+0x4b/0x80
[ 74.327213][ T52] ret_from_fork_asm+0x1a/0x30
[ 74.461683][ T52]
[ 74.461683][ T52] other info that might help us debug this:
[ 74.461683][ T52]
[ 74.471904][ T52] Possible unsafe locking scenario:
[ 74.471904][ T52]
[ 74.479345][ T52] CPU0 CPU1
[ 74.484699][ T52] ---- ----
[ 74.490054][ T52] lock(&rdev->wiphy.mtx);
[ 74.494557][ T52] lock(rtnl_mutex);
[ 74.501049][ T52] lock(&rdev->wiphy.mtx);
[ 74.508240][ T52] lock(rtnl_mutex);
[ 74.512320][ T52]
[ 74.512320][ T52] *** DEADLOCK ***
[ 74.512320][ T52]
[ 74.520453][ T52] 4 locks held by kworker/u8:3/52:
[ 74.525551][ T52] #0: ffff88801baf5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840
[ 74.536426][ T52] #1: ffffc90000bc7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840
[ 74.546950][ T52] #2: ffffffff8fca8610 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60
[ 74.556428][ T52] #3: ffff888022680768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700
[ 74.567211][ T52]
[ 74.567211][ T52] stack backtrace:
[ 74.573099][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc7-syzkaller-g41c5d104f338-dirty #0
[ 74.583835][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 74.593989][ T52] Workqueue: netns cleanup_net
[ 74.598777][ T52] Call Trace:
[ 74.602139][ T52] <TASK>
[ 74.605061][ T52] dump_stack_lvl+0x241/0x360
[ 74.609741][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.615023][ T52] ? __pfx__printk+0x10/0x10
[ 74.619609][ T52] print_circular_bug+0x13a/0x1b0
[ 74.624632][ T52] check_noncircular+0x36a/0x4a0
[ 74.629567][ T52] ? __pfx_check_noncircular+0x10/0x10
[ 74.635022][ T52] ? lockdep_lock+0x123/0x2b0
[ 74.639697][ T52] ? mark_lock+0x9a/0x360
[ 74.644025][ T52] validate_chain+0x18ef/0x5920
[ 74.648869][ T52] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 74.655196][ T52] ? __pfx_validate_chain+0x10/0x10
[ 74.660392][ T52] ? __pfx___schedule+0x10/0x10
[ 74.665261][ T52] ? mark_lock+0x9a/0x360
[ 74.669612][ T52] __lock_acquire+0x1397/0x2100
[ 74.674480][ T52] lock_acquire+0x1ed/0x550
[ 74.679018][ T52] ? unregister_netdevice_many_notify+0xac2/0x2030
[ 74.685545][ T52] ? __pfx_lock_acquire+0x10/0x10
[ 74.690678][ T52] ? __pfx___might_resched+0x10/0x10
[ 74.695976][ T52] ? kthread_queue_work+0x110/0x180
[ 74.701181][ T52] __mutex_lock+0x1ac/0xee0
[ 74.705690][ T52] ? unregister_netdevice_many_notify+0xac2/0x2030
[ 74.712196][ T52] ? unregister_netdevice_many_notify+0xac2/0x2030
[ 74.718709][ T52] ? __pfx___mutex_lock+0x10/0x10
[ 74.723733][ T52] ? __pfx___might_resched+0x10/0x10
[ 74.729044][ T52] ? unregister_netdevice_many_notify+0x9fa/0x2030
[ 74.735549][ T52] ? unregister_netdevice_many_notify+0x9fa/0x2030
[ 74.742051][ T52] unregister_netdevice_many_notify+0xac2/0x2030
[ 74.748380][ T52] ? mark_lock+0x9a/0x360
[ 74.752709][ T52] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 74.759594][ T52] ? kernfs_remove_by_name_ns+0x11b/0x160
[ 74.765399][ T52] ? __pfx_lock_release+0x10/0x10
[ 74.770423][ T52] unregister_netdevice_queue+0x303/0x370
[ 74.776228][ T52] ? __pfx_up_write+0x10/0x10
[ 74.780907][ T52] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 74.787496][ T52] ? kernfs_remove_by_name_ns+0x11b/0x160
[ 74.793224][ T52] _cfg80211_unregister_wdev+0x163/0x590
[ 74.798866][ T52] ieee80211_remove_interfaces+0x4ef/0x700
[ 74.804670][ T52] ? __pfx_ieee80211_remove_interfaces+0x10/0x10
[ 74.811008][ T52] ? rcu_is_watching+0x15/0xb0
[ 74.815780][ T52] ieee80211_unregister_hw+0x5d/0x2c0
[ 74.821143][ T52] mac80211_hwsim_del_radio+0x2c4/0x4c0
[ 74.826690][ T52] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10
[ 74.832843][ T52] hwsim_exit_net+0x5c1/0x670
[ 74.837604][ T52] ? __pfx_hwsim_exit_net+0x10/0x10
[ 74.842805][ T52] ? __ip_vs_dev_cleanup_batch+0x239/0x260
[ 74.848606][ T52] cleanup_net+0x812/0xd60
[ 74.853017][ T52] ? __pfx_cleanup_net+0x10/0x10
[ 74.857953][ T52] ? process_scheduled_works+0x976/0x1840
[ 74.863675][ T52] process_scheduled_works+0xa66/0x1840
[ 74.869223][ T52] ? __pfx_process_scheduled_works+0x10/0x10
[ 74.875202][ T52] ? assign_work+0x364/0x3d0
[ 74.879783][ T52] worker_thread+0x870/0xd30
[ 74.884368][ T52] ? __kthread_parkme+0x169/0x1d0
[ 74.889647][ T52] ? __pfx_worker_thread+0x10/0x10
[ 74.894817][ T52] kthread+0x2f0/0x390
[ 74.898884][ T52] ? __pfx_worker_thread+0x10/0x10
[ 74.903996][ T52] ? __pfx_kthread+0x10/0x10
[ 74.908581][ T52] ret_from_fork+0x4b/0x80
[ 74.913082][ T52] ? __pfx_kthread+0x10/0x10
[ 74.917925][ T52] ret_from_fork_asm+0x1a/0x30
[ 74.922779][ T52] </TASK>
[ 74.941059][ T5921] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 75.065026][ T5866] Bluetooth: hci0: command tx timeout
[ 77.145065][ T5866] Bluetooth: hci0: command tx timeout
[ 79.225077][ T5866] Bluetooth: hci0: command tx timeout
[ 82.426508][ T911] cfg80211: failed to load regulatory.db


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.7'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1358422923=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at f2cb035c8f
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=f2cb035c8f931efff4a020b164e657f16f51934b -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250117-180932'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"f2cb035c8f931efff4a020b164e657f16f51934b\"
/usr/bin/ld: /tmp/ccnfUoRd.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=11d7e9df980000


Tested on:

commit: 41c5d104 net/mlx5: fix unintentional sign extension on..
git tree: net-next

kernel config: https://syzkaller.appspot.com/x/.config?x=c30f048a4f12891
dashboard link: https://syzkaller.appspot.com/bug?extid=85ff1051228a04613a32
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=17bbe9df980000

[Hillf Danton]

On Fri, 17 Jan 2025 14:44:19 -0800

> syzbot found the following issue on:
>
> HEAD commit: 8d20dcda404d selftests: drv-net-hw: inject pp_alloc_fail e..
> git tree: net-next

> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ffc2b0580000

#syz test

diff -pur p/include/linux/netdevice.h q/include/linux/netdevice.h
--- p/include/linux/netdevice.h 2025-01-19 14:23:21.962713400 +0800
+++ q/include/linux/netdevice.h 2025-01-19 14:44:32.303599900 +0800
@@ -2047,6 +2047,7 @@ enum netdev_reg_state {
* FIXME: cleanup struct net_device such that network protocol info
* moves out.
*/
+extern unsigned long extra_netdev_locks;

struct net_device {
/* Cacheline organization can be found documented in
diff -pur p/net/core/dev.c q/net/core/dev.c
--- p/net/core/dev.c 2025-01-19 14:26:04.863348200 +0800
+++ q/net/core/dev.c 2025-01-19 15:43:55.326734000 +0800
@@ -10269,14 +10269,19 @@ static bool from_cleanup_net(void)
#endif
}

+unsigned long extra_netdev_locks = 0;
static void rtnl_drop_if_cleanup_net(void)
{
+ if (extra_netdev_locks)
+ return;
if (from_cleanup_net())
__rtnl_unlock();
}

static void rtnl_acquire_if_cleanup_net(void)
{
+ if (extra_netdev_locks)
+ return;
if (from_cleanup_net())
rtnl_lock();
}
@@ -11606,8 +11611,6 @@ void free_netdev(struct net_device *dev)

return;
}

- mutex_destroy(&dev->lock);
-
kfree(dev->ethtool);
netif_free_tx_queues(dev);
netif_free_rx_queues(dev);

diff -pur p/net/wireless/core.c q/net/wireless/core.c
--- p/net/wireless/core.c 2025-01-19 14:29:30.497265000 +0800
+++ q/net/wireless/core.c 2025-01-19 14:40:07.687903000 +0800
@@ -1247,8 +1247,11 @@ static void _cfg80211_unregister_wdev(st

if (wdev->netdev) {
sysfs_remove_link(&wdev->netdev->dev.kobj, "phy80211");
- if (unregister_netdev)
+ if (unregister_netdev) {
+ extra_netdev_locks++;
unregister_netdevice(wdev->netdev);
+ extra_netdev_locks--;
+ }
}

list_del_rcu(&wdev->list);
--

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file include/linux/netdevice.h
checking file net/core/dev.c
Hunk #1 succeeded at 10256 (offset -13 lines).
Hunk #2 FAILED at 11611.
1 out of 2 hunks FAILED
checking file net/wireless/core.c



Tested on:

commit: 59372af6 Merge tag 'batadv-next-pullrequest-20250117' ..

git tree: net-next
kernel config: https://syzkaller.appspot.com/x/.config?x=c30f048a4f12891
dashboard link: https://syzkaller.appspot.com/bug?extid=85ff1051228a04613a32
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=14d80618580000