============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.3.3059/19151 is trying to acquire lock: ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4710 [inline] ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: sch_direct_xmit+0x3ba/0xcd0 net/sched/sch_generic.c:345 but task is already holding lock: ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4710 [inline] ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: generic_xdp_tx+0x2c8/0x550 net/core/dev.c:5583 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&qdisc_xmit_lock_key#3); lock(&qdisc_xmit_lock_key#3); *** DEADLOCK *** May be due to missing lock nesting notation 10 locks held by syz.3.3059/19151: #0: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: tun_get_user+0xebb/0x3cc0 drivers/net/tun.c:1894 #1: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #1: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #1: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_internal net/core/dev.c:6338 [inline] #1: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb+0xf6/0x760 net/core/dev.c:6410 #2: ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4710 [inline] #2: ffff88802849d958 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: generic_xdp_tx+0x2c8/0x550 net/core/dev.c:5583 #3: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #3: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #3: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: icmp6_send+0x272/0x3c50 net/ipv6/icmp.c:667 #4: ffff88814ce70a20 (k-slock-AF_INET6){+.-.}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline] #4: ffff88814ce70a20 (k-slock-AF_INET6){+.-.}-{3:3}, at: icmpv6_xmit_lock net/ipv6/icmp.c:108 [inline] #4: ffff88814ce70a20 (k-slock-AF_INET6){+.-.}-{3:3}, at: icmp6_send+0x92e/0x3c50 net/ipv6/icmp.c:744 #5: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #5: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #5: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: ip6_send_skb+0xb9/0x460 net/ipv6/ip6_output.c:1993 #6: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #6: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #6: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: ip6_output+0xe3/0x710 net/ipv6/ip6_output.c:235 #7: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #7: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #7: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x1ab/0x1f50 net/ipv6/ndisc.c:482 #8: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #8: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #8: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: ip6_output+0xe3/0x710 net/ipv6/ip6_output.c:235 #9: ffffffff8e3c95c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #9: ffffffff8e3c95c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline] #9: ffffffff8e3c95c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x270/0x46c0 net/core/dev.c:4757 stack backtrace: CPU: 1 UID: 0 PID: 19151 Comm: syz.3.3059 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_deadlock_bug+0x225/0x2f0 kernel/locking/lockdep.c:3041 check_deadlock kernel/locking/lockdep.c:3093 [inline] validate_chain kernel/locking/lockdep.c:3895 [inline] __lock_acquire+0x1497/0x2890 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x179/0x330 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4710 [inline] sch_direct_xmit+0x3ba/0xcd0 net/sched/sch_generic.c:345 __dev_xmit_skb net/core/dev.c:4249 [inline] __dev_queue_xmit+0x3997/0x46c0 net/core/dev.c:4798 dev_queue_xmit include/linux/netdevice.h:3381 [inline] neigh_connected_output+0x3da/0x620 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ndisc_send_skb+0xa85/0x1f50 net/ipv6/ndisc.c:512 ndisc_send_ns+0xc6/0x140 net/ipv6/ndisc.c:670 ndisc_solicit+0x30c/0x520 net/ipv6/ndisc.c:761 neigh_probe+0xce/0x110 net/core/neighbour.c:1097 __neigh_event_send+0xab0/0x1390 net/core/neighbour.c:1270 neigh_event_send_probe include/net/neighbour.h:480 [inline] neigh_event_send include/net/neighbour.h:486 [inline] neigh_event_send include/net/neighbour.h:484 [inline] neigh_resolve_output+0x56b/0x940 net/core/neighbour.c:1578 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] ip6_local_out+0xd1/0x4d0 net/ipv6/output_core.c:157 ip6_send_skb+0x112/0x460 net/ipv6/ip6_output.c:1994 ip6_push_pending_frames+0xdd/0x100 net/ipv6/ip6_output.c:2015 icmpv6_push_pending_frames+0x2dc/0x460 net/ipv6/icmp.c:312 icmp6_send+0x2223/0x3c50 net/ipv6/icmp.c:827 __icmpv6_send include/linux/icmpv6.h:28 [inline] icmpv6_send include/linux/icmpv6.h:49 [inline] ip6_link_failure+0x31/0x5a0 net/ipv6/route.c:2854 dst_link_failure include/net/dst.h:432 [inline] vti6_xmit net/ipv6/ip6_vti.c:542 [inline] vti6_tnl_xmit+0x7c9/0x21d0 net/ipv6/ip6_vti.c:580 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] generic_xdp_tx+0x194/0x550 net/core/dev.c:5585 dev_map_generic_redirect+0x498/0x5f0 kernel/bpf/devmap.c:697 dev_map_redirect_multi+0x3b9/0x9e0 kernel/bpf/devmap.c:788 xdp_do_generic_redirect_map net/core/filter.c:4554 [inline] xdp_do_generic_redirect+0x6b8/0x830 net/core/filter.c:4617 do_xdp_generic+0xb4d/0x1310 net/core/dev.c:5613 __netif_receive_skb_core.constprop.0+0xcec/0x35b0 net/core/dev.c:5962 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6150 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x137/0x760 net/core/dev.c:6410 tun_rx_batched.isra.0+0x3ee/0x740 drivers/net/tun.c:1509 tun_get_user+0x28b2/0x3cc0 drivers/net/tun.c:1953 tun_chr_write_iter+0xdc/0x210 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x7d3/0x11d0 fs/read_write.c:686 ksys_write+0x12a/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f87b1d8e1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 RSP: 002b:00007f87b2c38000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f87b1fe5fa0 RCX: 00007f87b1d8e1ff RDX: 000000000000007a RSI: 0000200000000000 RDI: 00000000000000c8 RBP: 00007f87b1e13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000007a R11: 0000000000000293 R12: 0000000000000000 R13: 00007f87b1fe6038 R14: 00007f87b1fe5fa0 R15: 00007ffec4988f88