[syzbot] [wireless?] possible deadlock in ieee80211_change_mac (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 89d75c4c67ac Merge branch 'mlx5-next' of git://git.kernel...
git tree: net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15941698580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ca99d9d1f4a8ecfa
dashboard link: https://syzkaller.appspot.com/bug?extid=30de9d963fdd95d745f8
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12ebddb0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=115beff8580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/42d0e44c785b/disk-89d75c4c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a15a82bda0f1/vmlinux-89d75c4c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/51341d6e7b24/bzImage-89d75c4c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+30de9d...@syzkaller.appspotmail.com

netlink: 'syz-executor330': attribute type 10 has an invalid length.
======================================================
WARNING: possible circular locking dependency detected
6.14.0-rc5-syzkaller-01215-g89d75c4c67ac #0 Not tainted
------------------------------------------------------
syz-executor330/5838 is trying to acquire lock:
ffff888021b08768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6063 [inline]
ffff888021b08768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_change_mac+0xc6/0x1160 net/mac80211/iface.c:307

but task is already holding lock:
ffff88807a458d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2731 [inline]
ffff88807a458d28 (&dev->lock){+.+.}-{4:4}, at: dev_set_mac_address+0x2a/0x50 net/core/dev_api.c:302

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&dev->lock){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
netdev_lock include/linux/netdevice.h:2731 [inline]
register_netdevice+0x12d8/0x1b70 net/core/dev.c:10991
cfg80211_register_netdevice+0x149/0x2f0 net/wireless/core.c:1482
ieee80211_if_add+0x119d/0x1780 net/mac80211/iface.c:2225
ieee80211_register_hw+0x3708/0x42e0 net/mac80211/main.c:1604
mac80211_hwsim_new_radio+0x2a89/0x49f0 drivers/net/wireless/virtual/mac80211_hwsim.c:5559
init_mac80211_hwsim+0x87a/0xb00 drivers/net/wireless/virtual/mac80211_hwsim.c:6911
do_one_initcall+0x248/0x930 init/main.c:1257
do_initcall_level+0x157/0x210 init/main.c:1319
do_initcalls+0x71/0xd0 init/main.c:1335
kernel_init_freeable+0x435/0x5d0 init/main.c:1568
kernel_init+0x1d/0x2b0 init/main.c:1457
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
class_wiphy_constructor include/net/cfg80211.h:6063 [inline]
ieee80211_change_mac+0xc6/0x1160 net/mac80211/iface.c:307
netif_set_mac_address+0x327/0x510 net/core/dev.c:9587
dev_set_mac_address+0x38/0x50 net/core/dev_api.c:303
bond_enslave+0xff3/0x3910 drivers/net/bonding/bond_main.c:2123
do_set_master+0x579/0x730 net/core/rtnetlink.c:2943
do_setlink+0xfee/0x40f0 net/core/rtnetlink.c:3149
rtnl_changelink net/core/rtnetlink.c:3759 [inline]
__rtnl_newlink net/core/rtnetlink.c:3918 [inline]
rtnl_newlink+0x15a6/0x1d90 net/core/rtnetlink.c:4055
rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6945
netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:709 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:724
____sys_sendmsg+0x53a/0x860 net/socket.c:2564
___sys_sendmsg net/socket.c:2618 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2650
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&dev->lock);
lock(&rdev->wiphy.mtx);
lock(&dev->lock);
lock(&rdev->wiphy.mtx);

*** DEADLOCK ***

2 locks held by syz-executor330/5838:
#0: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#0: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#0: ffffffff8fed6908 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc4c/0x1d90 net/core/rtnetlink.c:4054
#1: ffff88807a458d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2731 [inline]
#1: ffff88807a458d28 (&dev->lock){+.+.}-{4:4}, at: dev_set_mac_address+0x2a/0x50 net/core/dev_api.c:302

stack backtrace:
CPU: 1 UID: 0 PID: 5838 Comm: syz-executor330 Not tainted 6.14.0-rc5-syzkaller-01215-g89d75c4c67ac #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208
check_prev_add kernel/locking/lockdep.c:3163 [inline]
check_prevs_add kernel/locking/lockdep.c:3282 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
class_wiphy_constructor include/net/cfg80211.h:6063 [inline]
ieee80211_change_mac+0xc6/0x1160 net/mac80211/iface.c:307
netif_set_mac_address+0x327/0x510 net/core/dev.c:9587
dev_set_mac_address+0x38/0x50 net/core/dev_api.c:303
bond_enslave+0xff3/0x3910 drivers/net/bonding/bond_main.c:2123
do_set_master+0x579/0x730 net/core/rtnetlink.c:2943
do_setlink+0xfee/0x40f0 net/core/rtnetlink.c:3149
rtnl_changelink net/core/rtnetlink.c:3759 [inline]
__rtnl_newlink net/core/rtnetlink.c:3918 [inline]
rtnl_newlink+0x15a6/0x1d90 net/core/rtnetlink.c:4055
rtnetlink_rcv_msg+0x791/0xcf0 net/core/rtnetlink.c:6945
netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:709 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:724
____sys_sendmsg+0x53a/0x860 net/socket.c:2564
___sys_sendmsg net/socket.c:2618 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2650
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f76fec11329
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff4bb2f358 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f76fec5e513 RCX: 00007f76fec11329
RDX: 0000000000000000 RSI: 0000400000000600 RDI: 0000000000000003
RBP: 00007f76fec5e4e3 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f76fec5e44b
R13: 0000000000000048 R14: 0000000000050012 R15: 0000000000000003
</TASK>
bond0: (slave wlan1): Enslaving as an active interface with an up link


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Hillf Danton]

On Fri, 14 Mar 2025 10:19:26 -0700

Given fresh new hw allocated [1], no one could have taken the wiphy lock, so this
report is false positive.

[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/drivers/net/wireless/virtual/mac80211_hwsim.c#n5185

Given rtnl_mutex also taken [2], this report is incorrect from the POV of lockdep.

[2] https://web.git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/net/mac80211/main.c#n1596

[Edward Adam Davis]

#syz test

diff --git a/net/wireless/core.c b/net/wireless/core.c
index 12b780de8779..a271bea5699e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1477,12 +1477,12 @@ int cfg80211_register_netdevice(struct net_device *dev)
lockdep_assert_held(&rdev->wiphy.mtx);

/* we'll take care of this */
- wdev->registered = true;
wdev->registering = true;
ret = register_netdevice(dev);
if (ret)
goto out;

+ wdev->registered = true;
cfg80211_register_wdev(rdev, wdev);
ret = 0;
out:

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

08][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.036708][ T1] ret_from_fork_asm+0x1a/0x30
[ 8.036708][ T1] </TASK>
[ 8.134385][ C0] vkms_vblank_simulate: vblank timer overrun
[ 8.221915][ T36] sd 0:0:1:0: Attached scsi generic sg0 type 0
[ 8.221924][ T73] sd 0:0:1:0: [sda] 4194304 512-byte logical blocks: (2.15 GB/2.00 GiB)
[ 8.221951][ T73] sd 0:0:1:0: [sda] 4096-byte physical blocks
[ 8.225939][ T73] sd 0:0:1:0: [sda] Write Protect is off
[ 8.227274][ T73] sd 0:0:1:0: [sda] Mode Sense: 1f 00 00 08
[ 8.228765][ T73] sd 0:0:1:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 8.268565][ T73] sda: sda1
[ 8.269923][ T73] sd 0:0:1:0: [sda] Attached SCSI disk
[ 286.896359][ T31] INFO: task swapper/0:1 blocked for more than 143 seconds.
[ 286.898632][ T31] Not tainted 6.14.0-rc6-syzkaller-gbfc6c67ec2d6-dirty #0
[ 286.900152][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 286.902226][ T31] task:swapper/0 state:D stack:17232 pid:1 tgid:1 ppid:0 task_flags:0x0140 flags:0x00004002
[ 286.904319][ T31] Call Trace:
[ 286.905255][ T31] <TASK>
[ 286.906061][ T31] __schedule+0x190e/0x4c90
[ 286.907166][ T31] ? rcu_is_watching+0x15/0xb0
[ 286.908672][ T31] ? schedule+0x90/0x320
[ 286.909576][ T31] ? lock_release+0xbf/0xa30
[ 286.910712][ T31] ? __pfx___schedule+0x10/0x10
[ 286.912865][ T31] ? __pfx_lock_release+0x10/0x10
[ 286.913717][ T31] ? rcu_is_watching+0x15/0xb0
[ 286.914523][ T31] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 286.915779][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 286.918633][ T31] ? schedule+0x90/0x320
[ 286.922896][ T31] schedule+0x14b/0x320
[ 286.927117][ T31] schedule_preempt_disabled+0x13/0x30
[ 286.932667][ T31] __mutex_lock+0x817/0x1010
[ 286.937764][ T31] ? __mutex_lock+0x602/0x1010
[ 286.942558][ T31] ? cfg80211_netdev_notifier_call+0x71e/0x1490
[ 286.949056][ T31] ? __pfx___mutex_lock+0x10/0x10
[ 286.954109][ T31] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 286.960296][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 286.966969][ T31] cfg80211_netdev_notifier_call+0x71e/0x1490
[ 286.973158][ T31] ? __asan_memset+0x23/0x50
[ 286.977945][ T31] ? __pfx_cfg80211_netdev_notifier_call+0x10/0x10
[ 286.984555][ T31] ? __asan_memset+0x23/0x50
[ 286.989221][ T31] ? lockdep_init_map_type+0xa1/0x910
[ 286.994812][ T31] ? __pfx_lockdep_init_map_type+0x10/0x10
[ 287.001153][ T31] ? __pfx_igmp_ifc_timer_expire+0x10/0x10
[ 287.007380][ T31] ? init_timer_key+0x197/0x320
[ 287.012266][ T31] ? __raw_spin_lock_init+0x45/0x100
[ 287.017927][ T31] ? inetdev_init+0x39d/0x4e0
[ 287.022631][ T31] ? inetdev_event+0x398/0x1620
[ 287.027555][ T31] ? igmp_netdev_event+0x7c/0x770
[ 287.032601][ T31] notifier_call_chain+0x1a5/0x3f0
[ 287.038157][ T31] register_netdevice+0x16c5/0x1b70
[ 287.043551][ T31] ? __pfx_register_netdevice+0x10/0x10
[ 287.049369][ T31] ? ieee80211_debugfs_recreate_netdev+0x104b/0x14d0
[ 287.056080][ T31] cfg80211_register_netdevice+0x129/0x2d0
[ 287.062180][ T31] ieee80211_if_add+0x119d/0x1780
[ 287.067240][ T31] ieee80211_register_hw+0x3708/0x42e0
[ 287.072718][ T31] ? ieee80211_register_hw+0x1601/0x42e0
[ 287.078518][ T31] ? __pfx_ieee80211_register_hw+0x10/0x10
[ 287.084343][ T31] ? __asan_memset+0x23/0x50
[ 287.089050][ T31] ? __hrtimer_init+0x170/0x250
[ 287.094023][ T31] mac80211_hwsim_new_radio+0x2a89/0x49f0
[ 287.099859][ T31] ? kasan_quarantine_put+0xdc/0x230
[ 287.105426][ T31] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[ 287.111612][ T31] ? sysfs_create_groups+0x9b/0x120
[ 287.116835][ T31] ? class_register+0x302/0x380
[ 287.121675][ T31] init_mac80211_hwsim+0x87a/0xb00
[ 287.127111][ T31] ? __pfx_init_mac80211_hwsim+0x10/0x10
[ 287.132757][ T31] ? usb_register_driver+0x2e2/0x380
[ 287.138309][ T31] ? __pfx_init_mac80211_hwsim+0x10/0x10
[ 287.143994][ T31] do_one_initcall+0x248/0x930
[ 287.148836][ T31] ? __pfx_init_mac80211_hwsim+0x10/0x10
[ 287.154490][ T31] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 287.160903][ T31] ? __pfx_do_one_initcall+0x10/0x10
[ 287.166282][ T31] ? __pfx_parse_args+0x10/0x10
[ 287.171134][ T31] ? rcu_is_watching+0x15/0xb0
[ 287.176393][ T31] do_initcall_level+0x157/0x210
[ 287.181652][ T31] do_initcalls+0x71/0xd0
[ 287.185982][ T31] kernel_init_freeable+0x435/0x5d0
[ 287.191255][ T31] ? __pfx_kernel_init_freeable+0x10/0x10
[ 287.197321][ T31] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 287.203746][ T31] ? __pfx_kernel_init+0x10/0x10
[ 287.208961][ T31] ? __pfx_kernel_init+0x10/0x10
[ 287.214115][ T31] ? __pfx_kernel_init+0x10/0x10
[ 287.219424][ T31] kernel_init+0x1d/0x2b0
[ 287.223762][ T31] ret_from_fork+0x4b/0x80
[ 287.228231][ T31] ? __pfx_kernel_init+0x10/0x10
[ 287.233343][ T31] ret_from_fork_asm+0x1a/0x30
[ 287.238220][ T31] </TASK>
[ 287.241494][ T31] INFO: task kworker/u8:5:222 blocked for more than 143 seconds.
[ 287.249373][ T31] Not tainted 6.14.0-rc6-syzkaller-gbfc6c67ec2d6-dirty #0
[ 287.257124][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 287.265793][ T31] task:kworker/u8:5 state:D stack:23952 pid:222 tgid:222 ppid:2 task_flags:0x4208060 flags:0x00004000
[ 287.278105][ T31] Workqueue: events_unbound linkwatch_event
[ 287.284753][ T31] Call Trace:
[ 287.288096][ T31] <TASK>
[ 287.291045][ T31] __schedule+0x190e/0x4c90
[ 287.295605][ T31] ? rcu_is_watching+0x15/0xb0
[ 287.300391][ T31] ? schedule+0x90/0x320
[ 287.304619][ T31] ? lock_release+0xbf/0xa30
[ 287.309226][ T31] ? __pfx___schedule+0x10/0x10
[ 287.314070][ T31] ? __pfx_lock_release+0x10/0x10
[ 287.319165][ T31] ? rcu_is_watching+0x15/0xb0
[ 287.323955][ T31] ? kthread_data+0x52/0xd0
[ 287.328675][ T31] ? schedule+0x90/0x320
[ 287.333173][ T31] ? wq_worker_sleeping+0x66/0x240
[ 287.338509][ T31] ? schedule+0x90/0x320
[ 287.342779][ T31] schedule+0x14b/0x320
[ 287.347003][ T31] schedule_preempt_disabled+0x13/0x30
[ 287.352459][ T31] __mutex_lock+0x817/0x1010
[ 287.357333][ T31] ? __mutex_lock+0x602/0x1010
[ 287.362101][ T31] ? linkwatch_event+0xe/0x60
[ 287.367185][ T31] ? __pfx___mutex_lock+0x10/0x10
[ 287.372266][ T31] ? __pfx_debug_object_deactivate+0x10/0x10
[ 287.378693][ T31] ? rcu_is_watching+0x15/0xb0
[ 287.383653][ T31] ? process_scheduled_works+0x9c6/0x18e0
[ 287.389423][ T31] linkwatch_event+0xe/0x60
[ 287.394020][ T31] process_scheduled_works+0xabe/0x18e0
[ 287.399648][ T31] ? __pfx_process_scheduled_works+0x10/0x10
[ 287.405648][ T31] ? __pfx__raw_spin_lock_irq+0x10/0x10
[ 287.411257][ T31] ? assign_work+0x364/0x3d0
[ 287.415874][ T31] worker_thread+0x870/0xd30
[ 287.420596][ T31] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 287.426679][ T31] ? __kthread_parkme+0x169/0x1d0
[ 287.431809][ T31] ? __pfx_worker_thread+0x10/0x10
[ 287.436977][ T31] kthread+0x7a9/0x920
[ 287.441160][ T31] ? __pfx_kthread+0x10/0x10
[ 287.445738][ T31] ? __pfx_worker_thread+0x10/0x10
[ 287.451040][ T31] ? __pfx_kthread+0x10/0x10
[ 287.455720][ T31] ? __pfx_kthread+0x10/0x10
[ 287.460356][ T31] ? __pfx_kthread+0x10/0x10
[ 287.464943][ T31] ? _raw_spin_unlock_irq+0x23/0x50
[ 287.470301][ T31] ? lockdep_hardirqs_on+0x99/0x150
[ 287.475688][ T31] ? __pfx_kthread+0x10/0x10
[ 287.480418][ T31] ret_from_fork+0x4b/0x80
[ 287.484977][ T31] ? __pfx_kthread+0x10/0x10
[ 287.489904][ T31] ret_from_fork_asm+0x1a/0x30
[ 287.494692][ T31] </TASK>
[ 287.498653][ T31] INFO: task kworker/1:2:976 blocked for more than 143 seconds.
[ 287.506556][ T31] Not tainted 6.14.0-rc6-syzkaller-gbfc6c67ec2d6-dirty #0
[ 287.514318][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 287.523264][ T31] task:kworker/1:2 state:D stack:26680 pid:976 tgid:976 ppid:2 task_flags:0x4208060 flags:0x00004000
[ 287.535539][ T31] Workqueue: events_power_efficient reg_check_chans_work
[ 287.542680][ T31] Call Trace:
[ 287.546032][ T31] <TASK>
[ 287.549043][ T31] __schedule+0x190e/0x4c90
[ 287.553747][ T31] ? do_raw_spin_lock+0x14f/0x370
[ 287.558882][ T31] ? schedule+0x90/0x320
[ 287.563160][ T31] ? schedule+0x90/0x320
[ 287.567703][ T31] ? lock_release+0xbf/0xa30
[ 287.572411][ T31] ? __pfx___schedule+0x10/0x10
[ 287.577351][ T31] ? _raw_spin_lock_irq+0xdf/0x120
[ 287.582452][ T31] ? __pfx_lock_release+0x10/0x10
[ 287.587679][ T31] ? kick_pool+0x1bd/0x620
[ 287.592411][ T31] ? schedule+0x90/0x320
[ 287.596792][ T31] ? rcu_is_watching+0x15/0xb0
[ 287.601681][ T31] ? schedule+0x90/0x320
[ 287.605958][ T31] schedule+0x14b/0x320
[ 287.610173][ T31] schedule_preempt_disabled+0x13/0x30
[ 287.615794][ T31] __mutex_lock+0x817/0x1010
[ 287.620589][ T31] ? __mutex_lock+0x602/0x1010
[ 287.625344][ T31] ? reg_check_chans_work+0x99/0xfb0
[ 287.630639][ T31] ? __pfx___mutex_lock+0x10/0x10
[ 287.635660][ T31] ? do_raw_spin_unlock+0x13c/0x8b0
[ 287.640904][ T31] ? rcu_is_watching+0x15/0xb0
[ 287.645692][ T31] ? process_scheduled_works+0x9c6/0x18e0
[ 287.651535][ T31] reg_check_chans_work+0x99/0xfb0
[ 287.656703][ T31] ? process_scheduled_works+0x9c6/0x18e0
[ 287.662621][ T31] ? lock_acquire+0xe3/0x550
[ 287.667297][ T31] ? __pfx_lock_acquire+0x10/0x10
[ 287.672336][ T31] ? debug_object_deactivate+0x2d5/0x390
[ 287.678057][ T31] ? __pfx_lock_release+0x10/0x10
[ 287.683094][ T31] ? __pfx_reg_check_chans_work+0x10/0x10
[ 287.689044][ T31] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 287.695474][ T31] ? rcu_is_watching+0x15/0xb0
[ 287.700564][ T31] ? process_scheduled_works+0x9c6/0x18e0
[ 287.706359][ T31] process_scheduled_works+0xabe/0x18e0
[ 287.712027][ T31] ? __pfx_process_scheduled_works+0x10/0x10
[ 287.718078][ T31] ? __pfx__raw_spin_lock_irq+0x10/0x10
[ 287.724200][ T31] ? assign_work+0x364/0x3d0
[ 287.729082][ T31] worker_thread+0x870/0xd30
[ 287.733860][ T31] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 287.740034][ T31] ? __kthread_parkme+0x169/0x1d0
[ 287.745113][ T31] ? __pfx_worker_thread+0x10/0x10
[ 287.750290][ T31] kthread+0x7a9/0x920
[ 287.754445][ T31] ? __pfx_kthread+0x10/0x10
[ 287.759346][ T31] ? __pfx_worker_thread+0x10/0x10
[ 287.764565][ T31] ? __pfx_kthread+0x10/0x10
[ 287.769211][ T31] ? __pfx_kthread+0x10/0x10
[ 287.774224][ T31] ? __pfx_kthread+0x10/0x10
[ 287.778935][ T31] ? _raw_spin_unlock_irq+0x23/0x50
[ 287.784151][ T31] ? lockdep_hardirqs_on+0x99/0x150
[ 287.789546][ T31] ? __pfx_kthread+0x10/0x10
[ 287.794422][ T31] ret_from_fork+0x4b/0x80
[ 287.798905][ T31] ? __pfx_kthread+0x10/0x10
[ 287.803525][ T31] ret_from_fork_asm+0x1a/0x30
[ 287.808466][ T31] </TASK>
[ 287.811849][ T31] INFO: lockdep is turned off.
[ 287.816688][ T31] Kernel panic - not syncing: hung_task: blocked tasks
[ 287.823719][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-rc6-syzkaller-gbfc6c67ec2d6-dirty #0
[ 287.826639][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 287.826639][ T31] Call Trace:
[ 287.826639][ T31] <TASK>
[ 287.826639][ T31] dump_stack_lvl+0x241/0x360
[ 287.826639][ T31] ? __pfx_dump_stack_lvl+0x10/0x10
[ 287.826639][ T31] ? __pfx__printk+0x10/0x10
[ 287.826639][ T31] ? show_trace_log_lvl+0x3b2/0x410
[ 287.826639][ T31] ? vscnprintf+0x5d/0x90
[ 287.826639][ T31] panic+0x349/0x880
[ 287.826639][ T31] ? __wake_up_klogd+0xcc/0x110
[ 287.826639][ T31] ? __pfx_panic+0x10/0x10
[ 287.826639][ T31] ? watchdog+0x100f/0x10a0
[ 287.826639][ T31] watchdog+0x1097/0x10a0
[ 287.826639][ T31] ? watchdog+0x1ea/0x10a0
[ 287.826639][ T31] ? __pfx_watchdog+0x10/0x10
[ 287.826639][ T31] kthread+0x7a9/0x920
[ 287.826639][ T31] ? __pfx_kthread+0x10/0x10
[ 287.826639][ T31] ? __pfx_watchdog+0x10/0x10
[ 287.826639][ T31] ? __pfx_kthread+0x10/0x10
[ 287.826639][ T31] ? __pfx_kthread+0x10/0x10
[ 287.826639][ T31] ? __pfx_kthread+0x10/0x10
[ 287.826639][ T31] ? _raw_spin_unlock_irq+0x23/0x50
[ 287.826639][ T31] ? lockdep_hardirqs_on+0x99/0x150
[ 287.826639][ T31] ? __pfx_kthread+0x10/0x10
[ 287.826639][ T31] ret_from_fork+0x4b/0x80
[ 287.826639][ T31] ? __pfx_kthread+0x10/0x10
[ 287.826639][ T31] ret_from_fork_asm+0x1a/0x30
[ 287.826639][ T31] </TASK>
[ 287.826639][ T31] Kernel Offset: disabled
[ 287.826639][ T31] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/tool...@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2577400997=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at e28266709d
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e28266709dd2a1d1452d4a5bbf271700e10335c6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250313-150626'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"e28266709dd2a1d1452d4a5bbf271700e10335c6\"
go: downloading golang.org/x/net v0.36.0
go: downloading golang.org/x/crypto v0.35.0
/usr/bin/ld: /tmp/cctp6ird.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=11e4ae54580000


Tested on:

commit: bfc6c67e net/smc: use the correct ndev to find pnetid ..
git tree: net-next
kernel config: https://syzkaller.appspot.com/x/.config?x=aeeec842a6bdc8b9

dashboard link: https://syzkaller.appspot.com/bug?extid=30de9d963fdd95d745f8
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11fb8fa8580000

[Edward Adam Davis]

#syz test

diff --git a/net/wireless/core.c b/net/wireless/core.c

index 12b780de8779..eed4c06cd40b 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1477,12 +1477,13 @@ int cfg80211_register_netdevice(struct net_device *dev)

lockdep_assert_held(&rdev->wiphy.mtx);

/* we'll take care of this */
- wdev->registered = true;
wdev->registering = true;

+ wiphy_unlock(&rdev->wiphy);

ret = register_netdevice(dev);
if (ret)
goto out;

+ wiphy_lock(&rdev->wiphy);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

[ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 6.315586][ T1] ACPI: button: Power Button [PWRF]
[ 6.317572][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 6.319522][ T1] ACPI: button: Sleep Button [SLPF]
[ 6.322849][ T160] kworker/u8:2 (160) used greatest stack depth: 25040 bytes left
[ 6.339104][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 6.357629][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 6.358659][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 6.376651][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 6.377767][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 6.396682][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 6.397793][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 6.410957][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 6.765156][ T1] N_HDLC line discipline registered with maxframe=4096
[ 6.766554][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 6.771823][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 6.782377][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 6.793730][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 6.802882][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 6.817467][ T1] Non-volatile memory driver v1.3
[ 6.833852][ T1] Linux agpgart interface v0.103
[ 6.838660][ T1] usbcore: registered new interface driver xillyusb
[ 6.842888][ T1] ACPI: bus type drm_connector registered
[ 6.848740][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 6.856871][ T1] [drm] Initialized vkms 1.0.0 for vkms on minor 1
[ 6.920872][ T1] Console: switching to colour frame buffer device 128x48
[ 6.939174][ T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 6.940974][ T1] usbcore: registered new interface driver udl
[ 6.943622][ T1] usbcore: registered new interface driver gm12u320
[ 6.945937][ T1] usbcore: registered new interface driver gud
[ 6.996845][ T1] brd: module loaded
[ 7.125659][ T1] loop: module loaded
[ 7.222154][ T1] zram: Added device: zram0
[ 7.231576][ T1] null_blk: disk nullb0 created
[ 7.232720][ T1] null_blk: module loaded
[ 7.234877][ T1] Guest personality initialized and is inactive
[ 7.236894][ T1] VMCI host device registered (name=vmci, major=10, minor=118)
[ 7.237964][ T1] Initialized host personality
[ 7.238752][ T1] usbcore: registered new interface driver rtsx_usb
[ 7.241700][ T1] usbcore: registered new interface driver viperboard
[ 7.243324][ T1] usbcore: registered new interface driver dln2
[ 7.244938][ T1] usbcore: registered new interface driver pn533_usb
[ 7.250291][ T1] nfcsim 0.2 initialized
[ 7.251327][ T1] usbcore: registered new interface driver port100
[ 7.253031][ T1] usbcore: registered new interface driver nfcmrvl
[ 7.260121][ T1] Loading iSCSI transport class v2.0-870.
[ 7.273577][ T1] virtio_scsi virtio0: 1/0/0 default/read/poll queues
[ 7.290506][ T1] scsi host0: Virtio SCSI HBA
[ 7.346832][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 7.356167][ T67] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 7.398007][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 7.401815][ T1] db_root: cannot open: /etc/target
[ 7.405313][ T1] slram: not enough parameters.
[ 7.418587][ T1] ftl_cs: FTL header not found.
[ 7.489656][ T1] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[ 7.491468][ T1] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Ja...@zx2c4.com>. All Rights Reserved.
[ 7.493205][ T1] eql: Equalizer2002: Simon Janes (si...@ncm.com) and David S. Miller (da...@redhat.com)
[ 7.505905][ T1] MACsec IEEE 802.1AE
[ 7.520864][ T1] usbcore: registered new interface driver mvusb_mdio
[ 7.522652][ T1] tun: Universal TUN/TAP device driver, 1.6
[ 7.610482][ T1] vcan: Virtual CAN interface driver
[ 7.611463][ T1] vxcan: Virtual CAN Tunnel driver
[ 7.612662][ T1] slcan: serial line CAN interface driver
[ 7.613594][ T1] CAN device driver interface
[ 7.615490][ T1] usbcore: registered new interface driver usb_8dev
[ 7.617483][ T1] usbcore: registered new interface driver ems_usb
[ 7.619366][ T1] usbcore: registered new interface driver esd_usb
[ 7.621425][ T1] usbcore: registered new interface driver etas_es58x
[ 7.622931][ T1] usbcore: registered new interface driver f81604
[ 7.625832][ T1] usbcore: registered new interface driver gs_usb
[ 7.627854][ T1] usbcore: registered new interface driver kvaser_usb
[ 7.629164][ T1] usbcore: registered new interface driver mcba_usb
[ 7.630506][ T1] usbcore: registered new interface driver peak_usb
[ 7.632412][ T1] usbcore: registered new interface driver ucan
[ 7.634580][ T1] e100: Intel(R) PRO/100 Network Driver
[ 7.635683][ T1] e100: Copyright(c) 1999-2006 Intel Corporation
[ 7.637454][ T1] e1000: Intel(R) PRO/1000 Network Driver
[ 7.638344][ T1] e1000: Copyright (c) 1999-2006 Intel Corporation.
[ 7.639758][ T1] e1000e: Intel(R) PRO/1000 Network Driver
[ 7.640954][ T1] e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
[ 7.643738][ T1] mkiss: AX.25 Multikiss, Hans Albas PE1AYX
[ 7.644897][ T1] AX.25: bpqether driver version 004
[ 7.647261][ T1] PPP generic driver version 2.4.2
[ 7.649746][ T1] PPP BSD Compression module registered
[ 7.650859][ T1] PPP Deflate Compression module registered
[ 7.651804][ T1] PPP MPPE Compression module registered
[ 7.653073][ T1] NET: Registered PF_PPPOX protocol family
[ 7.654416][ T1] PPTP driver version 0.8.5
[ 7.658831][ T1] SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256) (6 bit encapsulation enabled).
[ 7.661202][ T1] CSLIP: code copyright 1989 Regents of the University of California.
[ 7.662988][ T1] SLIP linefill/keepalive option.
[ 7.664045][ T1] hdlc: HDLC support module revision 1.22
[ 7.665756][ T1] LAPB Ethernet driver version 0.02
[ 7.668387][ T1] usbcore: registered new interface driver ath9k_htc
[ 7.670120][ T1] usbcore: registered new interface driver carl9170
[ 7.671501][ T1] usbcore: registered new interface driver ath6kl_usb
[ 7.673063][ T1] usbcore: registered new interface driver ar5523
[ 7.674505][ T1] usbcore: registered new interface driver ath10k_usb
[ 7.676436][ T1] usbcore: registered new interface driver plfxlc
[ 7.678342][ T1] mac80211_hwsim: initializing netlink
[ 7.705471][ T1] list_add double add: new=ffff8880277a4da0, prev=ffff888027870d70, next=ffff8880277a4da0.
[ 7.707421][ T1] ------------[ cut here ]------------
[ 7.708474][ T1] kernel BUG at lib/list_debug.c:37!
[ 7.709432][ T1] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
[ 7.710420][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc6-syzkaller-gbfc6c67ec2d6-dirty #0
[ 7.712038][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 7.713504][ T1] RIP: 0010:__list_add_valid_or_report+0xa4/0x130
[ 7.714682][ T1] Code: f7 74 11 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 48 c7 c7 20 03 81 8c 4c 89 fe 4c 89 e2 4c 89 f1 e8 0d 73 2a fc 90 <0f> 0b 48 c7 c7 20 01 81 8c e8 fe 72 2a fc 90 0f 0b 48 c7 c7 c0 01
[ 7.715028][ T1] RSP: 0000:ffffc90000067300 EFLAGS: 00010246
[ 7.715028][ T1] RAX: 0000000000000058 RBX: 1ffff11004f0e1ae RCX: 34f309c9fab66800
[ 7.715028][ T1] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
[ 7.715028][ T1] RBP: 1ffff11004ef49b5 R08: ffffffff81a1458c R09: fffffbfff1d3a69c
[ 7.715028][ T1] R10: dffffc0000000000 R11: fffffbfff1d3a69c R12: ffff888027870d70
[ 7.715028][ T1] R13: dffffc0000000000 R14: ffff8880277a4da0 R15: ffff8880277a4da0
[ 7.715028][ T1] FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
[ 7.715028][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.715028][ T1] CR2: 0000000000000000 CR3: 000000000e938000 CR4: 00000000003526f0
[ 7.715028][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7.715028][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 7.715028][ T1] Call Trace:
[ 7.715028][ T1] <TASK>
[ 7.715028][ T1] ? __die_body+0x5f/0xb0
[ 7.715028][ T1] ? die+0x9e/0xc0
[ 7.715028][ T1] ? do_trap+0x15a/0x3a0
[ 7.715028][ T1] ? __list_add_valid_or_report+0xa4/0x130
[ 7.715028][ T1] ? do_error_trap+0x1dc/0x2c0
[ 7.715028][ T1] ? __list_add_valid_or_report+0xa4/0x130
[ 7.715028][ T1] ? __pfx___mutex_trylock_common+0x10/0x10
[ 7.715028][ T1] ? __pfx_do_error_trap+0x10/0x10
[ 7.715028][ T1] ? handle_invalid_op+0x34/0x40
[ 7.715028][ T1] ? __list_add_valid_or_report+0xa4/0x130
[ 7.715028][ T1] ? exc_invalid_op+0x38/0x50
[ 7.715028][ T1] ? asm_exc_invalid_op+0x1a/0x20
[ 7.715028][ T1] ? __wake_up_klogd+0xcc/0x110
[ 7.715028][ T1] ? __list_add_valid_or_report+0xa4/0x130
[ 7.715028][ T1] cfg80211_register_wdev+0x16a/0x410
[ 7.715028][ T1] cfg80211_register_netdevice+0x19c/0x2c0
[ 7.715028][ T1] ieee80211_if_add+0x119d/0x1780
[ 7.715028][ T1] ieee80211_register_hw+0x3708/0x42e0
[ 7.715028][ T1] ? ieee80211_register_hw+0x1611/0x42e0
[ 7.715028][ T1] ? __pfx_ieee80211_register_hw+0x10/0x10
[ 7.715028][ T1] ? __asan_memset+0x23/0x50
[ 7.715028][ T1] ? __hrtimer_init+0x170/0x250
[ 7.715028][ T1] mac80211_hwsim_new_radio+0x2a89/0x49f0
[ 7.715028][ T1] ? kasan_quarantine_put+0xdc/0x230
[ 7.715028][ T1] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[ 7.715028][ T1] ? sysfs_create_groups+0x9b/0x120
[ 7.715028][ T1] ? class_register+0x302/0x380
[ 7.715028][ T1] init_mac80211_hwsim+0x87a/0xb00
[ 7.715028][ T1] ? __pfx_init_mac80211_hwsim+0x10/0x10
[ 7.715028][ T1] ? usb_register_driver+0x2e2/0x380
[ 7.715028][ T1] ? __pfx_init_mac80211_hwsim+0x10/0x10
[ 7.715028][ T1] do_one_initcall+0x248/0x930
[ 7.715028][ T1] ? __pfx_init_mac80211_hwsim+0x10/0x10
[ 7.715028][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 7.715028][ T1] ? __pfx_parse_args+0x10/0x10
[ 7.715028][ T1] ? rcu_is_watching+0x15/0xb0
[ 7.715028][ T1] do_initcall_level+0x157/0x210
[ 7.715028][ T1] do_initcalls+0x71/0xd0
[ 7.715028][ T1] kernel_init_freeable+0x435/0x5d0
[ 7.715028][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 7.715028][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 7.715028][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.715028][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.715028][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.715028][ T1] kernel_init+0x1d/0x2b0
[ 7.715028][ T1] ret_from_fork+0x4b/0x80
[ 7.715028][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.715028][ T1] ret_from_fork_asm+0x1a/0x30
[ 7.715028][ T1] </TASK>
[ 7.715028][ T1] Modules linked in:
[ 7.769984][ T1] ---[ end trace 0000000000000000 ]---
[ 7.771150][ T1] RIP: 0010:__list_add_valid_or_report+0xa4/0x130
[ 7.772404][ T1] Code: f7 74 11 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 48 c7 c7 20 03 81 8c 4c 89 fe 4c 89 e2 4c 89 f1 e8 0d 73 2a fc 90 <0f> 0b 48 c7 c7 20 01 81 8c e8 fe 72 2a fc 90 0f 0b 48 c7 c7 c0 01
[ 7.775821][ T1] RSP: 0000:ffffc90000067300 EFLAGS: 00010246
[ 7.776716][ T1] RAX: 0000000000000058 RBX: 1ffff11004f0e1ae RCX: 34f309c9fab66800
[ 7.777976][ T1] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
[ 7.779137][ T1] RBP: 1ffff11004ef49b5 R08: ffffffff81a1458c R09: fffffbfff1d3a69c
[ 7.780370][ T1] R10: dffffc0000000000 R11: fffffbfff1d3a69c R12: ffff888027870d70
[ 7.781997][ T1] R13: dffffc0000000000 R14: ffff8880277a4da0 R15: ffff8880277a4da0
[ 7.783289][ T1] FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
[ 7.784799][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.785960][ T1] CR2: 0000000000000000 CR3: 000000000e938000 CR4: 00000000003526f0
[ 7.787590][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7.789103][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 7.790409][ T1] Kernel panic - not syncing: Fatal exception
[ 7.791627][ T1] Kernel Offset: disabled
[ 7.792351][ T1] Rebooting in 86400 seconds..

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1502864929=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at e28266709d
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e28266709dd2a1d1452d4a5bbf271700e10335c6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250313-150626'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"e28266709dd2a1d1452d4a5bbf271700e10335c6\"

/usr/bin/ld: /tmp/ccc6buJh.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=15237874580000

Tested on:

commit: bfc6c67e net/smc: use the correct ndev to find pnetid ..
git tree: net-next
kernel config: https://syzkaller.appspot.com/x/.config?x=aeeec842a6bdc8b9
dashboard link: https://syzkaller.appspot.com/bug?extid=30de9d963fdd95d745f8
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=14378fa8580000

[Edward Adam Davis]

#syz test

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 738de269e13f..87a970c18e96 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -301,7 +301,7 @@ static int ieee80211_change_mac(struct net_device *dev, void *addr)
* active (maybe other cases?) and we must get removed from it.
* But we really don't care anymore if it's not registered now.
*/
- if (!dev->ieee80211_ptr->registered)
+ if (!dev->ieee80211_ptr->registered || dev->ieee80211_ptr->registering)
return 0;

guard(wiphy)(local->hw.wiphy);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

72.433667][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 72.445739][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 72.457663][ T5886] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.466980][ T5886] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.476086][ T5886] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.485383][ T5886] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 72.632760][ T4915] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 72.692574][ T4915] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 72.784028][ T4915] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 72.874605][ T4915] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/03/16 01:22:38 executed programs: 0
[ 73.931356][ T5851] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 73.940395][ T5851] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 73.950465][ T5851] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 73.960767][ T5851] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 73.968729][ T5851] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 73.976076][ T5851] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 74.076074][ T5939] chnl_net:caif_netlink_parms(): no params data found
[ 74.128718][ T5939] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.135896][ T5939] bridge0: port 1(bridge_slave_0) entered disabled state
[ 74.143357][ T5939] bridge_slave_0: entered allmulticast mode
[ 74.150540][ T5939] bridge_slave_0: entered promiscuous mode
[ 74.157725][ T5939] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.165646][ T5939] bridge0: port 2(bridge_slave_1) entered disabled state
[ 74.173064][ T5939] bridge_slave_1: entered allmulticast mode
[ 74.179810][ T5939] bridge_slave_1: entered promiscuous mode
[ 74.204642][ T5939] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 74.215916][ T5939] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 74.241618][ T5939] team0: Port device team_slave_0 added
[ 74.250900][ T5939] team0: Port device team_slave_1 added
[ 74.269595][ T5939] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 74.276571][ T5939] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 74.303099][ T5939] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 74.316822][ T5939] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 74.323877][ T5939] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 74.351065][ T5939] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 74.387353][ T5939] hsr_slave_0: entered promiscuous mode
[ 74.393586][ T5939] hsr_slave_1: entered promiscuous mode
[ 74.400465][ T5939] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 74.408569][ T5939] Cannot create hsr debugfs directory
[ 75.504126][ T4915] bridge_slave_1: left allmulticast mode
[ 75.510136][ T4915] bridge_slave_1: left promiscuous mode
[ 75.516970][ T4915] bridge0: port 2(bridge_slave_1) entered disabled state
[ 75.536981][ T4915] bridge_slave_0: left allmulticast mode
[ 75.544581][ T4915] bridge_slave_0: left promiscuous mode
[ 75.551159][ T4915] bridge0: port 1(bridge_slave_0) entered disabled state
[ 75.802024][ T4915] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 75.814407][ T4915] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 75.824472][ T4915] bond0 (unregistering): Released all slaves
[ 75.921046][ T4915] hsr_slave_0: left promiscuous mode
[ 75.927724][ T4915] hsr_slave_1: left promiscuous mode
[ 75.936428][ T4915] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 75.944464][ T4915] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 75.955660][ T4915] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 75.964004][ T4915] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 75.985966][ T4915] veth1_macvtap: left promiscuous mode
[ 75.994538][ T4915] veth0_macvtap: left promiscuous mode
[ 76.001124][ T4915] veth1_vlan: left promiscuous mode
[ 76.006763][ T4915] veth0_vlan: left promiscuous mode
[ 76.029255][ T5148] Bluetooth: hci0: command tx timeout
[ 76.386411][ T4915] team0 (unregistering): Port device team_slave_1 removed
[ 76.416643][ T4915] team0 (unregistering): Port device team_slave_0 removed
[ 76.680651][ T5503]
[ 76.682998][ T5503] ============================================
[ 76.689143][ T5503] WARNING: possible recursive locking detected
[ 76.695340][ T5503] 6.14.0-rc6-syzkaller-gbfc6c67ec2d6-dirty #0 Not tainted
[ 76.702636][ T5503] --------------------------------------------
[ 76.708784][ T5503] dhcpcd/5503 is trying to acquire lock:
[ 76.714415][ T5503] ffff888030558d28 (&dev->lock){+.+.}-{4:4}, at: lapbeth_device_event+0x766/0xa20
[ 76.723635][ T5503]
[ 76.723635][ T5503] but task is already holding lock:
[ 76.731089][ T5503] ffff888029c3cd28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 76.740207][ T5503]
[ 76.740207][ T5503] other info that might help us debug this:
[ 76.748254][ T5503] Possible unsafe locking scenario:
[ 76.748254][ T5503]
[ 76.755709][ T5503] CPU0
[ 76.758970][ T5503] ----
[ 76.762241][ T5503] lock(&dev->lock);
[ 76.766387][ T5503] lock(&dev->lock);
[ 76.770359][ T5503]
[ 76.770359][ T5503] *** DEADLOCK ***
[ 76.770359][ T5503]
[ 76.778512][ T5503] May be due to missing lock nesting notation
[ 76.778512][ T5503]
[ 76.786821][ T5503] 2 locks held by dhcpcd/5503:
[ 76.791564][ T5503] #0: ffffffff8fed6cc8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34c/0x1d80
[ 76.800771][ T5503] #1: ffff888029c3cd28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[ 76.810056][ T5503]
[ 76.810056][ T5503] stack backtrace:
[ 76.815937][ T5503] CPU: 1 UID: 0 PID: 5503 Comm: dhcpcd Not tainted 6.14.0-rc6-syzkaller-gbfc6c67ec2d6-dirty #0
[ 76.815948][ T5503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 76.815957][ T5503] Call Trace:
[ 76.815964][ T5503] <TASK>
[ 76.815969][ T5503] dump_stack_lvl+0x241/0x360
[ 76.815985][ T5503] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.815995][ T5503] ? __pfx__printk+0x10/0x10
[ 76.816004][ T5503] ? lockdep_unlock+0x16a/0x300
[ 76.816019][ T5503] print_deadlock_bug+0x483/0x620
[ 76.816035][ T5503] validate_chain+0x15e2/0x5920
[ 76.816047][ T5503] ? is_bpf_text_address+0x26/0x2a0
[ 76.816056][ T5503] ? unwind_next_frame+0x18e6/0x22d0
[ 76.816070][ T5503] ? __pfx_validate_chain+0x10/0x10
[ 76.816079][ T5503] ? preempt_count_add+0x93/0x190
[ 76.816092][ T5503] ? is_bpf_text_address+0x285/0x2a0
[ 76.816100][ T5503] ? is_bpf_text_address+0x26/0x2a0
[ 76.816107][ T5503] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 76.816120][ T5503] ? kernel_text_address+0xa7/0xe0
[ 76.816130][ T5503] ? look_up_lock_class+0x77/0x170
[ 76.816141][ T5503] ? register_lock_class+0x102/0x980
[ 76.816155][ T5503] ? __pfx_register_lock_class+0x10/0x10
[ 76.816168][ T5503] ? mark_lock+0x9a/0x360
[ 76.816176][ T5503] __lock_acquire+0x1397/0x2100
[ 76.816193][ T5503] lock_acquire+0x1ed/0x550
[ 76.816205][ T5503] ? lapbeth_device_event+0x766/0xa20
[ 76.816216][ T5503] ? __pfx_lock_acquire+0x10/0x10
[ 76.816229][ T5503] ? __pfx___might_resched+0x10/0x10
[ 76.816243][ T5503] __mutex_lock+0x19c/0x1010
[ 76.816255][ T5503] ? lapbeth_device_event+0x766/0xa20
[ 76.816264][ T5503] ? __asan_memset+0x23/0x50
[ 76.816274][ T5503] ? lapbeth_device_event+0x766/0xa20
[ 76.816283][ T5503] ? __pfx___mutex_lock+0x10/0x10
[ 76.816298][ T5503] ? __raw_spin_lock_init+0x45/0x100
[ 76.816310][ T5503] lapbeth_device_event+0x766/0xa20
[ 76.816319][ T5503] notifier_call_chain+0x1a5/0x3f0
[ 76.816334][ T5503] __dev_notify_flags+0x207/0x400
[ 76.816345][ T5503] ? dev_set_rx_mode+0xb8/0x2e0
[ 76.816354][ T5503] ? __pfx___dev_notify_flags+0x10/0x10
[ 76.816363][ T5503] ? __dev_change_flags+0x515/0x6f0
[ 76.816372][ T5503] ? __pfx___mutex_lock+0x10/0x10
[ 76.816383][ T5503] ? __pfx___dev_change_flags+0x10/0x10
[ 76.816393][ T5503] ? __pfx___mutex_lock+0x10/0x10
[ 76.816404][ T5503] netif_change_flags+0xf0/0x1a0
[ 76.816414][ T5503] dev_change_flags+0x146/0x270
[ 76.816424][ T5503] devinet_ioctl+0xea2/0x1d80
[ 76.816440][ T5503] ? __pfx_devinet_ioctl+0x10/0x10
[ 76.816453][ T5503] ? get_user_ifreq+0x1bb/0x200
[ 76.816465][ T5503] inet_ioctl+0x3d7/0x4f0
[ 76.816476][ T5503] ? __pfx_inet_ioctl+0x10/0x10
[ 76.816486][ T5503] ? tomoyo_path_number_perm+0x5dd/0x770
[ 76.816503][ T5503] sock_do_ioctl+0x158/0x460
[ 76.816517][ T5503] ? __pfx_sock_do_ioctl+0x10/0x10
[ 76.816529][ T5503] ? __pfx_lock_release+0x10/0x10
[ 76.816544][ T5503] sock_ioctl+0x626/0x8e0
[ 76.816556][ T5503] ? __pfx_sock_ioctl+0x10/0x10
[ 76.816567][ T5503] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 76.816581][ T5503] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 76.816594][ T5503] ? __pfx_sock_ioctl+0x10/0x10
[ 76.816605][ T5503] __se_sys_ioctl+0xf5/0x170
[ 76.816616][ T5503] do_syscall_64+0xf3/0x230
[ 76.816628][ T5503] ? clear_bhb_loop+0x35/0x90
[ 76.816641][ T5503] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.816659][ T5503] RIP: 0033:0x7fafacad9d49
[ 76.816672][ T5503] Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8
[ 76.816679][ T5503] RSP: 002b:00007fff965e9208 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 76.816690][ T5503] RAX: ffffffffffffffda RBX: 00007fafaca0b6c0 RCX: 00007fafacad9d49
[ 76.816696][ T5503] RDX: 00007fff965f93f8 RSI: 0000000000008914 RDI: 000000000000000e
[ 76.816702][ T5503] RBP: 00007fff966095b8 R08: 00007fff965f93b8 R09: 00007fff965f9368
[ 76.816709][ T5503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 76.816714][ T5503] R13: 00007fff965f93f8 R14: 0000000000000028 R15: 0000000000008914
[ 76.816722][ T5503] </TASK>
[ 77.431447][ T5939] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 77.447065][ T5939] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 77.459986][ T5939] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 77.470884][ T5939] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 77.532921][ T5939] 8021q: adding VLAN 0 to HW filter on device bond0
[ 77.562340][ T5939] 8021q: adding VLAN 0 to HW filter on device team0
[ 77.580014][ T1055] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.587132][ T1055] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 77.706703][ T1055] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.713863][ T1055] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 77.881667][ T5939] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 77.938802][ T5939] veth0_vlan: entered promiscuous mode
[ 77.949800][ T5939] veth1_vlan: entered promiscuous mode
[ 77.990643][ T5939] veth0_macvtap: entered promiscuous mode
[ 77.999872][ T5939] veth1_macvtap: entered promiscuous mode
[ 78.015141][ T5939] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 78.032460][ T5939] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 78.046046][ T5939] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.055528][ T5939] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.066650][ T5939] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.076163][ T5939] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.106714][ T5939] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[ 78.114482][ T5148] Bluetooth: hci0: command tx timeout
[ 78.135848][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.144458][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 78.152395][ T5939] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[ 78.176744][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.186077][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build162451828=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at e28266709d
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e28266709dd2a1d1452d4a5bbf271700e10335c6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250313-150626'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"e28266709dd2a1d1452d4a5bbf271700e10335c6\"

/usr/bin/ld: /tmp/cc7kFs5f.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=10d6483f980000

Tested on:

commit: bfc6c67e net/smc: use the correct ndev to find pnetid ..
git tree: net-next
kernel config: https://syzkaller.appspot.com/x/.config?x=aeeec842a6bdc8b9
dashboard link: https://syzkaller.appspot.com/bug?extid=30de9d963fdd95d745f8
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10c6483f980000

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.