======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
dhcpcd/15136 is trying to acquire lock:
ffff888072a08d58 (_xmit_X25#2){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
ffff888072a08d58 (_xmit_X25#2){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4864 [inline]
ffff888072a08d58 (_xmit_X25#2){+.-.}-{3:3}, at: __dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:5060

but task is already holding lock:
ffff8880561895c0 (&lapb->lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
ffff8880561895c0 (&lapb->lock){+.-.}-{3:3}, at: lapb_t1timer_expiry+0x33/0xaa0 net/lapb/lapb_timer.c:99

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&lapb->lock){+.-.}-{3:3}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
       _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
       spin_lock_bh include/linux/spinlock.h:353 [inline]
       lapb_data_received+0xfc/0x1c0 net/lapb/lapb_iface.c:398
       lapbeth_rcv+0x34d/0x640 drivers/net/wan/lapbether.c:142
       __netif_receive_skb_one_core net/core/dev.c:6405 [inline]
       __netif_receive_skb net/core/dev.c:6518 [inline]
       process_backlog+0xc26/0x18b0 net/core/dev.c:6869
       __napi_poll+0xaa/0x330 net/core/dev.c:7938
       napi_poll net/core/dev.c:8001 [inline]
       net_rx_action+0x61d/0xf50 net/core/dev.c:8158
       handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
       do_softirq+0x77/0xd0 kernel/softirq.c:569
       __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
       spin_unlock_bh include/linux/spinlock.h:407 [inline]
       lapb_device_event+0x4f3/0x680 net/lapb/lapb_iface.c:527
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:86
       call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
       call_netdevice_notifiers net/core/dev.c:2365 [inline]
       __dev_notify_flags+0x31e/0x510 net/core/dev.c:10004
       netif_change_flags+0xde/0x1b0 net/core/dev.c:10033
       dev_change_flags+0x128/0x260 net/core/dev_api.c:68
       devinet_ioctl+0x966/0x1c50 net/ipv4/devinet.c:1189
       inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1007
       sock_do_ioctl+0x101/0x320 net/socket.c:1328
       sock_ioctl+0x57a/0x7e0 net/socket.c:1449
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:597 [inline]
       __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&lapbeth->up_lock){+.-.}-{3:3}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
       _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
       spin_lock_bh include/linux/spinlock.h:353 [inline]
       lapbeth_xmit+0x32/0x260 drivers/net/wan/lapbether.c:191
       __netdev_start_xmit include/linux/netdevice.h:5455 [inline]
       netdev_start_xmit include/linux/netdevice.h:5464 [inline]
       xmit_one net/core/dev.c:4057 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4073
       __dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:5066
       dev_queue_xmit include/linux/netdevice.h:3483 [inline]
       tx+0x6b/0x190 drivers/block/aoe/aoenet.c:62
       kthread+0x1ed/0x420 drivers/block/aoe/aoecmd.c:1241
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (_xmit_X25#2){+.-.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3209 [inline]
       check_prevs_add kernel/locking/lockdep.c:3328 [inline]
       validate_chain kernel/locking/lockdep.c:3952 [inline]
       __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
       __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
       spin_lock include/linux/spinlock.h:347 [inline]
       __netif_tx_lock include/linux/netdevice.h:4864 [inline]
       __dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:5060
       neigh_output include/net/neighbour.h:554 [inline]
       ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
       NF_HOOK_COND include/linux/netfilter.h:314 [inline]
       ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
       iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
       udp_tunnel_xmit_skb+0x29b/0x3e0 net/ipv4/udp_tunnel_core.c:187
       vxlan_xmit_one+0x20d2/0x2f80 drivers/net/vxlan/vxlan_core.c:2607
       vxlan_xmit+0x2afc/0x45c0 drivers/net/vxlan/vxlan_core.c:2917
       __netdev_start_xmit include/linux/netdevice.h:5455 [inline]
       netdev_start_xmit include/linux/netdevice.h:5464 [inline]
       xmit_one net/core/dev.c:4057 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4073
       __dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:5066
       lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
       lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
       lapb_t1timer_expiry+0x68d/0xaa0 net/lapb/lapb_timer.c:-1
       call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
       expire_timers kernel/time/timer.c:1799 [inline]
       __run_timers kernel/time/timer.c:2374 [inline]
       __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
       run_timer_base kernel/time/timer.c:2395 [inline]
       run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
       handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
       __do_softirq kernel/softirq.c:703 [inline]
       invoke_softirq kernel/softirq.c:542 [inline]
       __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
       irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
       sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
       asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
       seqcount_lockdep_reader_access+0x9d/0xc0 include/linux/seqlock.h:76
       read_seqbegin include/linux/seqlock.h:838 [inline]
       zone_span_seqbegin include/linux/memory_hotplug.h:87 [inline]
       page_outside_zone_boundaries mm/page_alloc.c:584 [inline]
       bad_range+0x8e/0x2a0 mm/page_alloc.c:603
       rmqueue mm/page_alloc.c:3428 [inline]
       get_page_from_freelist+0x21fa/0x2280 mm/page_alloc.c:3930
       __alloc_frozen_pages_noprof+0x1fc/0x400 mm/page_alloc.c:5429
       alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2511
       folio_alloc_mpol_noprof+0x39/0x160 mm/mempolicy.c:2530
       vma_alloc_folio_noprof+0xe1/0x1e0 mm/mempolicy.c:2565
       folio_prealloc mm/memory.c:-1 [inline]
       wp_page_copy mm/memory.c:3973 [inline]
       do_wp_page+0x1178/0x4b70 mm/memory.c:4438
       handle_pte_fault mm/memory.c:6554 [inline]
       __handle_mm_fault mm/memory.c:6679 [inline]
       handle_mm_fault+0x15d7/0x3750 mm/memory.c:6846
       do_user_addr_fault+0xb35/0x1480 arch/x86/mm/fault.c:1343
       handle_page_fault arch/x86/mm/fault.c:1483 [inline]
       exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
       asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595

other info that might help us debug this:

Chain exists of:
  _xmit_X25#2 --> &lapbeth->up_lock --> &lapb->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&lapb->lock);
                               lock(&lapbeth->up_lock);
                               lock(&lapb->lock);
  lock(_xmit_X25#2);

 *** DEADLOCK ***

locks held by dhcpcd/15136: 9, last CPU#1:
 #0: ffff88807bce9a88 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:309
 #1: ffffc90000a08ce0 ((&lapb->t1timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
 #2: ffff8880561895c0 (&lapb->lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
 #2: ffff8880561895c0 (&lapb->lock){+.-.}-{3:3}, at: lapb_t1timer_expiry+0x33/0xaa0 net/lapb/lapb_timer.c:99
 #3: ffffffff8fd5a3c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #3: ffffffff8fd5a3c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
 #3: ffffffff8fd5a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:4980
 #4: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #4: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #4: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: vxlan_xmit+0xd8/0x45c0 drivers/net/vxlan/vxlan_core.c:2804
 #5: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #5: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #5: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: vxlan_xmit_one+0x149d/0x2f80 drivers/net/vxlan/vxlan_core.c:2522
 #6: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #6: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #6: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 net/ipv4/ip_output.c:432
 #7: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #7: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #7: ffffffff8fd5a360 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x10b0 net/ipv4/ip_output.c:229
 #8: ffffffff8fd5a3c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #8: ffffffff8fd5a3c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
 #8: ffffffff8fd5a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:4980

stack backtrace:
CPU: 1 UID: 0 PID: 15136 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
 check_prev_add kernel/locking/lockdep.c:3209 [inline]
 check_prevs_add kernel/locking/lockdep.c:3328 [inline]
 validate_chain kernel/locking/lockdep.c:3952 [inline]
 __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
 spin_lock include/linux/spinlock.h:347 [inline]
 __netif_tx_lock include/linux/netdevice.h:4864 [inline]
 __dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:5060
 neigh_output include/net/neighbour.h:554 [inline]
 ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
 udp_tunnel_xmit_skb+0x29b/0x3e0 net/ipv4/udp_tunnel_core.c:187
 vxlan_xmit_one+0x20d2/0x2f80 drivers/net/vxlan/vxlan_core.c:2607
 vxlan_xmit+0x2afc/0x45c0 drivers/net/vxlan/vxlan_core.c:2917
 __netdev_start_xmit include/linux/netdevice.h:5455 [inline]
 netdev_start_xmit include/linux/netdevice.h:5464 [inline]
 xmit_one net/core/dev.c:4057 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4073
 __dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:5066
 lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
 lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
 lapb_t1timer_expiry+0x68d/0xaa0 net/lapb/lapb_timer.c:-1
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
 __do_softirq kernel/softirq.c:703 [inline]
 invoke_softirq kernel/softirq.c:542 [inline]
 __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:seqcount_lockdep_reader_access+0x9d/0xc0 include/linux/seqlock.h:76
Code: 72 ff 48 83 c4 08 48 89 df 4c 89 f6 e8 6c 6c 72 ff e8 57 7a 9f ff 9c 58 a9 00 02 00 00 75 15 41 f7 c7 00 02 00 00 74 01 fb 5b <41> 5e 41 5f e9 ca 6e cb 09 cc e8 b4 5a c8 09 41 f7 c7 00 02 00 00
RSP: 0000:ffffc9000faaf5d8 EFLAGS: 00000206
RAX: 0000000000000006 RBX: ffff88813fffbb00 RCX: 0000000000000046
RDX: 0000000000000007 RSI: ffffffff8e48f29d RDI: ffffffff8c6e7280
RBP: ffffea00014bf040 R08: ffffffff917c77bf R09: 1ffffffff22f8ef7
R10: dffffc0000000000 R11: fffffbfff22f8ef8 R12: ffff88813fffbbd8
R13: 0000000000000981 R14: ffffffff8231c40e R15: 0000000000000a06
 read_seqbegin include/linux/seqlock.h:838 [inline]
 zone_span_seqbegin include/linux/memory_hotplug.h:87 [inline]
 page_outside_zone_boundaries mm/page_alloc.c:584 [inline]
 bad_range+0x8e/0x2a0 mm/page_alloc.c:603
 rmqueue mm/page_alloc.c:3428 [inline]
 get_page_from_freelist+0x21fa/0x2280 mm/page_alloc.c:3930
 __alloc_frozen_pages_noprof+0x1fc/0x400 mm/page_alloc.c:5429
 alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2511
 folio_alloc_mpol_noprof+0x39/0x160 mm/mempolicy.c:2530
 vma_alloc_folio_noprof+0xe1/0x1e0 mm/mempolicy.c:2565
 folio_prealloc mm/memory.c:-1 [inline]
 wp_page_copy mm/memory.c:3973 [inline]
 do_wp_page+0x1178/0x4b70 mm/memory.c:4438
 handle_pte_fault mm/memory.c:6554 [inline]
 __handle_mm_fault mm/memory.c:6679 [inline]
 handle_mm_fault+0x15d7/0x3750 mm/memory.c:6846
 do_user_addr_fault+0xb35/0x1480 arch/x86/mm/fault.c:1343
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7f84e32b3604
Code: ff ff ff 03 00 00 00 48 b9 00 00 00 00 02 00 00 00 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 78 8b 87 50 03 00 00 83 e8 01 <89> 87 50 03 00 00 48 23 b7 50 03 00 00 48 39 ce 0f 85 e0 01 00 00
RSP: 002b:00007ffe99fc6f80 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 000055ca61d7a460 RCX: 0000000200000000
RDX: 000055ca61d7a460 RSI: 00000003ffffffff RDI: 000055ca61d7a460
RBP: 00007ffe99fc7020 R08: 000055ca61d7a460 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000000 R12: 00007ffe99fc71d0
R13: 0000000000000001 R14: 0000000000000000 R15: 000055ca49db7ac0
 </TASK>
----------------
Code disassembly (best guess):
   0:	72 ff                	jb     0x1
   2:	48 83 c4 08          	add    $0x8,%rsp
   6:	48 89 df             	mov    %rbx,%rdi
   9:	4c 89 f6             	mov    %r14,%rsi
   c:	e8 6c 6c 72 ff       	call   0xff726c7d
  11:	e8 57 7a 9f ff       	call   0xff9f7a6d
  16:	9c                   	pushf
  17:	58                   	pop    %rax
  18:	a9 00 02 00 00       	test   $0x200,%eax
  1d:	75 15                	jne    0x34
  1f:	41 f7 c7 00 02 00 00 	test   $0x200,%r15d
  26:	74 01                	je     0x29
  28:	fb                   	sti
  29:	5b                   	pop    %rbx
* 2a:	41 5e                	pop    %r14 <-- trapping instruction
  2c:	41 5f                	pop    %r15
  2e:	e9 ca 6e cb 09       	jmp    0x9cb6efd
  33:	cc                   	int3
  34:	e8 b4 5a c8 09       	call   0x9c85aed
  39:	41 f7 c7 00 02 00 00 	test   $0x200,%r15d