Re: [syzbot] [net?] possible deadlock in __netdev_update_features (3)

[syzbot <syzbot+c6c86a1c56b5131f2d97@syzkaller.appspotmail.com>]

syzbot has found a reproducer for the following issue on:

HEAD commit:    7a19f0cc94ad Merge branch 'for-next/core' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=14b5b831580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=26d6221a572842ac
dashboard link: https://syzkaller.appspot.com/bug?extid=c6c86a1c56b5131f2d97
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15311081580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=159e0481580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/296cd4b77dbf/disk-7a19f0cc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e57669ed895f/vmlinux-7a19f0cc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c679c1ad76d4/Image-7a19f0cc.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c6c86a1c56b5131f2d97@syzkaller.appspotmail.com

batman_adv: batadv0: Interface activated: macvlan2
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.0.17/4904 is trying to acquire lock:
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2864 [inline]
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_sync_lower_features net/core/dev.c:10983 [inline]
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: __netdev_update_features+0x988/0x1894 net/core/dev.c:11153

but task is already holding lock:
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2864 [inline]
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: __dev_ethtool net/ethtool/ioctl.c:3627 [inline]
ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: dev_ethtool+0x384/0x1a98 net/ethtool/ioctl.c:3669
and the lock comparison function returns 0:

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&dev_instance_lock_key#23);
  lock(&dev_instance_lock_key#23);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

locks held by syz.0.17/4904: 2, last CPU#0:
 #0: ffff80008aa8ec80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80
 #1: ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2864 [inline]
 #1: ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
 #1: ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: __dev_ethtool net/ethtool/ioctl.c:3627 [inline]
 #1: ffff0000cbc0ce78 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: dev_ethtool+0x384/0x1a98 net/ethtool/ioctl.c:3669

stack backtrace:
CPU: 0 UID: 0 PID: 4904 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_deadlock_bug+0x2e8/0x2f0 kernel/locking/lockdep.c:3085
 check_deadlock kernel/locking/lockdep.c:3137 [inline]
 validate_chain kernel/locking/lockdep.c:3939 [inline]
 __lock_acquire+0x2404/0x2b08 kernel/locking/lockdep.c:5288
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 __mutex_lock_common kernel/locking/mutex.c:646 [inline]
 __mutex_lock+0x164/0x1078 kernel/locking/mutex.c:821
 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874
 netdev_lock include/linux/netdevice.h:2864 [inline]
 netdev_lock_ops include/net/netdev_lock.h:42 [inline]
 netdev_sync_lower_features net/core/dev.c:10983 [inline]
 __netdev_update_features+0x988/0x1894 net/core/dev.c:11153
 netdev_update_features+0x78/0xf4 net/core/dev.c:11210
 macvlan_device_event+0x530/0x778 drivers/net/macvlan.c:1883
 notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:85
 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 netdev_features_change+0x84/0xcc net/core/dev.c:1612
 dev_ethtool_locked net/ethtool/ioctl.c:3576 [inline]
 __dev_ethtool net/ethtool/ioctl.c:3634 [inline]
 dev_ethtool+0x165c/0x1a98 net/ethtool/ioctl.c:3669
 dev_ioctl+0x284/0xc88 net/core/dev_ioctl.c:745
 sock_do_ioctl+0x198/0x254 net/socket.c:1339
 sock_ioctl+0x55c/0x7ec net/socket.c:1446
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.