======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
cmp/14772 is trying to acquire lock:
ffff888054bef958 (_xmit_X25#2){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
ffff888054bef958 (_xmit_X25#2){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4865 [inline]
ffff888054bef958 (_xmit_X25#2){+.-.}-{3:3}, at: __dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:5060
but task is already holding lock:
ffff888055d8d5c0 (&lapb->lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
ffff888055d8d5c0 (&lapb->lock){+.-.}-{3:3}, at: lapb_t1timer_expiry+0x33/0xaa0 net/lapb/lapb_timer.c:99
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&lapb->lock){+.-.}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
spin_lock_bh include/linux/spinlock.h:353 [inline]
lapb_data_received+0xfc/0x1c0 net/lapb/lapb_iface.c:398
lapbeth_rcv+0x34d/0x640 drivers/net/wan/lapbether.c:142
__netif_receive_skb_one_core net/core/dev.c:6405 [inline]
__netif_receive_skb net/core/dev.c:6518 [inline]
process_backlog+0xc26/0x18b0 net/core/dev.c:6869
__napi_poll+0xaa/0x330 net/core/dev.c:7938
napi_poll net/core/dev.c:8001 [inline]
net_rx_action+0x61d/0xf50 net/core/dev.c:8158
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
do_softirq+0x77/0xd0 kernel/softirq.c:569
__local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
spin_unlock_bh include/linux/spinlock.h:407 [inline]
lapb_device_event+0x4f3/0x680 net/lapb/lapb_iface.c:527
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:86
call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
call_netdevice_notifiers net/core/dev.c:2365 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:10004
netif_change_flags+0xde/0x1b0 net/core/dev.c:10033
dev_change_flags+0x128/0x260 net/core/dev_api.c:68
devinet_ioctl+0x966/0x1c50 net/ipv4/devinet.c:1189
inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1007
sock_do_ioctl+0x101/0x320 net/socket.c:1328
sock_ioctl+0x57a/0x7e0 net/socket.c:1449
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&lapbeth->up_lock){+.-.}-{3:3}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
spin_lock_bh include/linux/spinlock.h:353 [inline]
lapbeth_xmit+0x32/0x260 drivers/net/wan/lapbether.c:191
__netdev_start_xmit include/linux/netdevice.h:5456 [inline]
netdev_start_xmit include/linux/netdevice.h:5465 [inline]
xmit_one net/core/dev.c:4057 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4073
__dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:5066
dev_queue_xmit include/linux/netdevice.h:3483 [inline]
tx+0x6b/0x190 drivers/block/aoe/aoenet.c:62
kthread+0x1ed/0x420 drivers/block/aoe/aoecmd.c:1241
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
-> #0 (_xmit_X25#2){+.-.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
spin_lock include/linux/spinlock.h:347 [inline]
__netif_tx_lock include/linux/netdevice.h:4865 [inline]
__dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:5060
neigh_output include/net/neighbour.h:554 [inline]
ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
udp_tunnel_xmit_skb+0x29b/0x3e0 net/ipv4/udp_tunnel_core.c:187
vxlan_xmit_one+0x20d2/0x2f80 drivers/net/vxlan/vxlan_core.c:2607
vxlan_xmit+0x2afc/0x45c0 drivers/net/vxlan/vxlan_core.c:2917
__netdev_start_xmit include/linux/netdevice.h:5456 [inline]
netdev_start_xmit include/linux/netdevice.h:5465 [inline]
xmit_one net/core/dev.c:4057 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4073
__dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:5066
lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
lapb_t1timer_expiry+0x68d/0xaa0 net/lapb/lapb_timer.c:-1
call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1749
expire_timers kernel/time/timer.c:1800 [inline]
__run_timers kernel/time/timer.c:2375 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2387
run_timer_base kernel/time/timer.c:2396 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2406
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
lock_is_held_type+0x106/0x150 kernel/locking/lockdep.c:6021
lock_is_held include/linux/lockdep.h:249 [inline]
mt_locked lib/maple_tree.c:-1 [inline]
mt_slot lib/maple_tree.c:676 [inline]
mas_next_slot+0x9c7/0xd70 lib/maple_tree.c:4228
mas_find+0x6d6/0xcb0 lib/maple_tree.c:5451
unmap_vmas+0x439/0x550 mm/memory.c:2274
exit_mmap+0x290/0xa40 mm/mmap.c:1315
__mmput+0x118/0x420 kernel/fork.c:1192
exit_mm+0x18e/0x240 kernel/exit.c:586
do_exit+0x6a8/0x2360 kernel/exit.c:967
do_group_exit+0x22d/0x2f0 kernel/exit.c:1123
__do_sys_exit_group kernel/exit.c:1134 [inline]
__se_sys_exit_group kernel/exit.c:1132 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1132
x64_sys_call+0x18c6/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
_xmit_X25#2 --> &lapbeth->up_lock --> &lapb->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&lapb->lock);
lock(&lapbeth->up_lock);
lock(&lapb->lock);
lock(_xmit_X25#2);
*** DEADLOCK ***
locks held by cmp/14772: 9, last CPU#0:
#0: ffff88807462e540 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline]
#0: ffff88807462e540 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x19c/0xa40 mm/mmap.c:1299
#1: ffffc90000007ce0 ((&lapb->t1timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1746
#2: ffff888055d8d5c0 (&lapb->lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
#2: ffff888055d8d5c0 (&lapb->lock){+.-.}-{3:3}, at: lapb_t1timer_expiry+0x33/0xaa0 net/lapb/lapb_timer.c:99
#3: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#3: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
#3: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:4980
#4: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#4: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#4: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: vxlan_xmit+0xd8/0x45c0 drivers/net/vxlan/vxlan_core.c:2804
#5: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#5: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#5: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: vxlan_xmit_one+0x149d/0x2f80 drivers/net/vxlan/vxlan_core.c:2522
#6: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#6: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#6: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 net/ipv4/ip_output.c:432
#7: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#7: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#7: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x10b0 net/ipv4/ip_output.c:229
#8: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
#8: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:4980
stack backtrace:
CPU: 0 UID: 0 PID: 14772 Comm: cmp Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
check_prev_add kernel/locking/lockdep.c:3209 [inline]
check_prevs_add kernel/locking/lockdep.c:3328 [inline]
validate_chain kernel/locking/lockdep.c:3952 [inline]
__lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
spin_lock include/linux/spinlock.h:347 [inline]
__netif_tx_lock include/linux/netdevice.h:4865 [inline]
__dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:5060
neigh_output include/net/neighbour.h:554 [inline]
ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
udp_tunnel_xmit_skb+0x29b/0x3e0 net/ipv4/udp_tunnel_core.c:187
vxlan_xmit_one+0x20d2/0x2f80 drivers/net/vxlan/vxlan_core.c:2607
vxlan_xmit+0x2afc/0x45c0 drivers/net/vxlan/vxlan_core.c:2917
__netdev_start_xmit include/linux/netdevice.h:5456 [inline]
netdev_start_xmit include/linux/netdevice.h:5465 [inline]
xmit_one net/core/dev.c:4057 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4073
__dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:5066
lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
lapb_t1timer_expiry+0x68d/0xaa0 net/lapb/lapb_timer.c:-1
call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1749
expire_timers kernel/time/timer.c:1800 [inline]
__run_timers kernel/time/timer.c:2375 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2387
run_timer_base kernel/time/timer.c:2396 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2406
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_is_held_type+0x106/0x150 kernel/locking/lockdep.c:6021
Code: 1c 00 00 b8 ff ff ff ff 65 0f c1 05 8c ee bd 08 83 f8 01 75 25 9c 58 a9 00 02 00 00 75 39 41 f7 c4 00 02 00 00 74 01 fb 89 d8 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 0b 10 03 00 cc 90 0f 0b 90 48 c7
RSP: 0018:ffffc90015faf788 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000046
RDX: 0000000000000000 RSI: ffffffff8e92befd RDI: ffffffff8c8e8c80
RBP: 00000000ffffffff R08: ffff888030fb0000 R09: 0000000000000005
R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000246
R13: ffff888030fb0000 R14: ffff88807462e540 R15: 0000000000000000
lock_is_held include/linux/lockdep.h:249 [inline]
mt_locked lib/maple_tree.c:-1 [inline]
mt_slot lib/maple_tree.c:676 [inline]
mas_next_slot+0x9c7/0xd70 lib/maple_tree.c:4228
mas_find+0x6d6/0xcb0 lib/maple_tree.c:5451
unmap_vmas+0x439/0x550 mm/memory.c:2274
exit_mmap+0x290/0xa40 mm/mmap.c:1315
__mmput+0x118/0x420 kernel/fork.c:1192
exit_mm+0x18e/0x240 kernel/exit.c:586
do_exit+0x6a8/0x2360 kernel/exit.c:967
do_group_exit+0x22d/0x2f0 kernel/exit.c:1123
__do_sys_exit_group kernel/exit.c:1134 [inline]
__se_sys_exit_group kernel/exit.c:1132 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1132
x64_sys_call+0x18c6/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f299c25c6c5
Code: Unable to access opcode bytes at 0x7f299c25c69b.
RSP: 002b:00007fff8e07baa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f299c35dfe8 RCX: 00007f299c25c6c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000000
RBP: 0000000000000001 R08: 00007fff8e07ba38 R09: 0000000000000000
R10: 00007fff8e07b8d0 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f299c35c680 R15: 00007f299c35e000
----------------
Code disassembly (best guess):
0: 1c 00 sbb $0x0,%al
2: 00 b8 ff ff ff ff add %bh,-0x1(%rax)
8: 65 0f c1 05 8c ee bd xadd %eax,%gs:0x8bdee8c(%rip) # 0x8bdee9c
f: 08
10: 83 f8 01 cmp $0x1,%eax
13: 75 25 jne 0x3a
15: 9c pushf
16: 58 pop %rax
17: a9 00 02 00 00 test $0x200,%eax
1c: 75 39 jne 0x57
1e: 41 f7 c4 00 02 00 00 test $0x200,%r12d
25: 74 01 je 0x28
27: fb sti
28: 89 d8 mov %ebx,%eax
* 2a: 5b pop %rbx <-- trapping instruction
2b: 41 5c pop %r12
2d: 41 5d pop %r13
2f: 41 5e pop %r14
31: 41 5f pop %r15
33: 5d pop %rbp
34: e9 0b 10 03 00 jmp 0x31044
39: cc int3
3a: 90 nop
3b: 0f 0b ud2
3d: 90 nop
3e: 48 rex.W
3f: c7 .byte 0xc7