============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- kworker/1:4/4371 is trying to acquire lock: ffff0000d34eb0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff0000d34eb0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4345 [inline] ffff0000d34eb0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: sch_direct_xmit+0x138/0x4ac net/sched/sch_generic.c:343 but task is already holding lock: ffff0000da61b0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff0000da61b0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4345 [inline] ffff0000da61b0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: sch_direct_xmit+0x138/0x4ac net/sched/sch_generic.c:343 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&qdisc_xmit_lock_key#2); lock(&qdisc_xmit_lock_key#2); *** DEADLOCK *** May be due to missing lock nesting notation 16 locks held by kworker/1:4/4371: #0: ffff0000d3ff5138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1 #1: ffff8000212e7c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267 #2: ffff8000179a32c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 #3: ffff0000ef5a4538 (&idev->mc_lock){+.+.}-{3:3}, at: ipv6_mc_dad_complete+0x34/0x218 net/ipv6/mcast.c:2249 #4: ffff800015507440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #5: ffff800015507440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #6: ffff8000155074a0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349 #7: ffff800015507440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #8: ffff8000155074a0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349 #9: ffff0000d7c38258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] #9: ffff0000d7c38258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] #9: ffff0000d7c38258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3919 [inline] #9: ffff0000d7c38258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_queue_xmit+0xe80/0x3154 net/core/dev.c:4337 #10: ffff0000da61b0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #10: ffff0000da61b0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4345 [inline] #10: ffff0000da61b0d8 (&qdisc_xmit_lock_key#2){+.-.}-{2:2}, at: sch_direct_xmit+0x138/0x4ac net/sched/sch_generic.c:343 #11: ffff800015507440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #12: ffff800015507440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #13: ffff800015507440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #14: ffff8000155074a0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349 #15: ffff0000dc67e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] #15: ffff0000dc67e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] #15: ffff0000dc67e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3919 [inline] #15: ffff0000dc67e258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_queue_xmit+0xe80/0x3154 net/core/dev.c:4337 stack backtrace: CPU: 1 PID: 4371 Comm: kworker/1:4 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 Workqueue: ipv6_addrconf addrconf_dad_work Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 __lock_acquire+0x157c/0x6610 kernel/locking/lockdep.c:-1 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5662 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4345 [inline] sch_direct_xmit+0x138/0x4ac net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3932 [inline] __dev_queue_xmit+0x1394/0x3154 net/core/dev.c:4337 dev_queue_xmit include/linux/netdevice.h:3051 [inline] arp_xmit_finish+0x24/0x34 net/ipv4/arp.c:654 NF_HOOK+0x2d0/0x360 include/linux/netfilter.h:302 arp_xmit+0x160/0x26c net/ipv4/arp.c:664 arp_send_dst+0x1c8/0x258 net/ipv4/arp.c:320 arp_solicit+0xa7c/0xc88 net/ipv4/arp.c:392 neigh_probe+0xc4/0x124 net/core/neighbour.c:1080 __neigh_event_send+0xcf4/0x1494 net/core/neighbour.c:1247 neigh_event_send_probe include/net/neighbour.h:469 [inline] neigh_event_send include/net/neighbour.h:475 [inline] neigh_resolve_output+0x184/0x664 net/core/neighbour.c:1552 neigh_output include/net/neighbour.h:545 [inline] ip_finish_output2+0xc50/0x10a8 net/ipv4/ip_output.c:228 __ip_finish_output+0x1b0/0x448 net/ipv4/ip_output.c:-1 ip_finish_output+0x40/0x264 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0x3b4/0x554 net/ipv4/ip_output.c:434 dst_output include/net/dst.h:453 [inline] ip_local_out+0x120/0x15c net/ipv4/ip_output.c:126 iptunnel_xmit+0x3c4/0x860 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1548/0x2244 net/ipv4/ip_tunnel.c:844 __gre_xmit net/ipv4/ip_gre.c:474 [inline] erspan_xmit+0x828/0x1404 net/ipv4/ip_gre.c:723 __netdev_start_xmit include/linux/netdevice.h:4894 [inline] netdev_start_xmit include/linux/netdevice.h:4908 [inline] xmit_one net/core/dev.c:3695 [inline] dev_hard_start_xmit+0x234/0x8c8 net/core/dev.c:3711 sch_direct_xmit+0x234/0x4ac net/sched/sch_generic.c:345 __dev_xmit_skb net/core/dev.c:3932 [inline] __dev_queue_xmit+0x1394/0x3154 net/core/dev.c:4337 dev_queue_xmit include/linux/netdevice.h:3051 [inline] bond_dev_queue_xmit+0x9c/0x140 drivers/net/bonding/bond_main.c:309 bond_do_alb_xmit+0x5dc/0x7cc drivers/net/bonding/bond_alb.c:1358 bond_tlb_xmit+0x38/0x48 drivers/net/bonding/bond_alb.c:1416 __bond_start_xmit drivers/net/bonding/bond_main.c:5589 [inline] bond_start_xmit+0x6e8/0x17dc drivers/net/bonding/bond_main.c:5611 __netdev_start_xmit include/linux/netdevice.h:4894 [inline] netdev_start_xmit include/linux/netdevice.h:4908 [inline] xmit_one net/core/dev.c:3695 [inline] dev_hard_start_xmit+0x234/0x8c8 net/core/dev.c:3711 __dev_queue_xmit+0x1590/0x3154 net/core/dev.c:4375 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_hh_output include/net/neighbour.h:529 [inline] neigh_output include/net/neighbour.h:543 [inline] ip6_finish_output2+0xd3c/0x1864 net/ipv6/ip6_output.c:138 __ip6_finish_output net/ipv6/ip6_output.c:205 [inline] ip6_finish_output+0x598/0x930 net/ipv6/ip6_output.c:216 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237 dst_output include/net/dst.h:453 [inline] NF_HOOK+0x15c/0x44c include/linux/netfilter.h:302 mld_sendpack+0x87c/0x112c net/ipv6/mcast.c:1825 mld_send_initial_cr+0x1e0/0x270 net/ipv6/mcast.c:2244 ipv6_mc_dad_complete+0x74/0x218 net/ipv6/mcast.c:2252 addrconf_dad_completed+0x600/0xb3c net/ipv6/addrconf.c:4276 addrconf_dad_work+0x904/0x10a0 net/ipv6/addrconf.c:-1 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850