============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz-executor/5636 is trying to acquire lock:
ffff88802a58b158 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
ffff88802a58b158 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4781 [inline]
ffff88802a58b158 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
but task is already holding lock:
ffff88805882a558 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
ffff88805882a558 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4781 [inline]
ffff88805882a558 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&qdisc_xmit_lock_key#3);
lock(&qdisc_xmit_lock_key#3);
*** DEADLOCK ***
May be due to missing lock nesting notation
20 locks held by syz-executor/5636:
#0: ffffffff8ea2c2b0 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1533 [inline]
#0: ffffffff8ea2c2b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x130/0x4a0 kernel/fork.c:1586
#1: ffff8880365a58f8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:554 [inline]
#1: ffff8880365a58f8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x181/0x1d90 mm/mmap.c:1739
#2: ffff8880202e3438 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:544 [inline]
#2: ffff8880202e3438 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x26f/0x1d90 mm/mmap.c:1746
#3: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#3: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
#4: ffff888078814678 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
#4: ffff888078814678 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
#5: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#5: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
#6: ffff88805efd0558 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1256 [inline]
#6: ffff88805efd0558 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x6cb/0x5970 mm/memory.c:1392
#7: ffffc90000007cc0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745
#8: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#8: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#8: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x215/0x1670 net/ipv6/ndisc.c:482
#9: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#9: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#9: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x126/0x550 net/ipv6/ip6_output.c:234
#10: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#10: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#10: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#11: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#11: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#11: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: bond_start_xmit+0xb4/0x1900 drivers/net/bonding/bond_main.c:5589
#12: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#12: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#12: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#13: ffff8880307ab228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:354 [inline]
#13: ffff8880307ab228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:205 [inline]
#13: ffff8880307ab228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4196 [inline]
#13: ffff8880307ab228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x11a6/0x3950 net/core/dev.c:4831
#14: ffff88805882a558 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
#14: ffff88805882a558 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4781 [inline]
#14: ffff88805882a558 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
#15: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#15: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#15: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450 net/ipv4/ip_output.c:433
#16: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#16: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#16: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3c2/0x1070 net/ipv4/ip_output.c:230
#17: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#17: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#17: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x23/0x270 net/ipv4/arp.c:663
#18: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#18: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#18: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#19: ffff88802cc90228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:354 [inline]
#19: ffff88802cc90228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:205 [inline]
#19: ffff88802cc90228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4196 [inline]
#19: ffff88802cc90228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x11a6/0x3950 net/core/dev.c:4831
stack backtrace:
CPU: 0 UID: 0 PID: 5636 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
spin_lock include/linux/spinlock.h:342 [inline]
__netif_tx_lock include/linux/netdevice.h:4781 [inline]
sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
__dev_xmit_skb net/core/dev.c:4209 [inline]
__dev_queue_xmit+0x180f/0x3950 net/core/dev.c:4831
NF_HOOK+0x33a/0x3c0 include/linux/netfilter.h:-1
arp_xmit+0x16c/0x270 net/ipv4/arp.c:665
arp_solicit+0xbe0/0xe40 net/ipv4/arp.c:392
neigh_probe net/core/neighbour.c:1096 [inline]
__neigh_event_send+0xf05/0x14d0 net/core/neighbour.c:1276
neigh_event_send_probe include/net/neighbour.h:480 [inline]
neigh_event_send include/net/neighbour.h:486 [inline]
neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1603
neigh_output include/net/neighbour.h:556 [inline]
ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:438
iptunnel_xmit+0x621/0xd10 net/ipv4/ip_tunnel_core.c:97
ip_tunnel_xmit+0x193a/0x1f20 net/ipv4/ip_tunnel.c:845
__gre_xmit+0x19e/0x240 net/ipv4/ip_gre.c:491
erspan_xmit+0xa41/0x14d0 net/ipv4/ip_gre.c:750
__netdev_start_xmit include/linux/netdevice.h:5368 [inline]
netdev_start_xmit include/linux/netdevice.h:5377 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3904
sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:372
__dev_xmit_skb net/core/dev.c:4209 [inline]
__dev_queue_xmit+0x180f/0x3950 net/core/dev.c:4831
__bond_start_xmit drivers/net/bonding/bond_main.c:5569 [inline]
bond_start_xmit+0x766/0x1900 drivers/net/bonding/bond_main.c:5591
__netdev_start_xmit include/linux/netdevice.h:5368 [inline]
netdev_start_xmit include/linux/netdevice.h:5377 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3904
__dev_queue_xmit+0x14d9/0x3950 net/core/dev.c:4870
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:470 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xd0b/0x1670 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4049
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x22a/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__kasan_check_byte+0x12/0x40 mm/kasan/common.c:573
Code: e9 33 fa ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 41 56 53 48 89 f3 49 89 fe e8 3e 15 00 00 <84> c0 75 16 be 01 00 00 00 4c 89 f7 31 d2 48 89 d9 89 c3 e8 f6 04
RSP: 0018:ffffc90003f071b8 EFLAGS: 00000293
RAX: 0000000000000001 RBX: ffffffff823c8576 RCX: 0000000080000004
RDX: 0000000000000000 RSI: ffffffff823c8576 RDI: 1ffffffff1d2b9c4
RBP: ffffffff823c855a R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff94000329911 R12: 0000000000000002
R13: ffffffff8e95ce20 R14: ffffffff8e95ce20 R15: 0000000000000000
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire+0x84/0x350 kernel/locking/lockdep.c:5842
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock_sched include/linux/rcupdate.h:936 [inline]
pfn_valid+0xd6/0x480 include/linux/mmzone.h:2281
page_table_check_set+0x25/0x510 mm/page_table_check.c:105
page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
set_ptes include/linux/pgtable.h:413 [inline]
__copy_present_ptes mm/memory.c:1102 [inline]
copy_present_ptes mm/memory.c:1181 [inline]
copy_pte_range mm/memory.c:1304 [inline]
copy_pmd_range+0x486a/0x5970 mm/memory.c:1392
copy_pud_range mm/memory.c:1429 [inline]
copy_p4d_range mm/memory.c:1453 [inline]
copy_page_range+0xbe8/0x11f0 mm/memory.c:1539
dup_mmap+0xf40/0x1d90 mm/mmap.c:1840
dup_mm kernel/fork.c:1534 [inline]
copy_mm+0x13b/0x4a0 kernel/fork.c:1586
copy_process+0x1f1c/0x4450 kernel/fork.c:2262
kernel_clone+0x284/0x8f0 kernel/fork.c:2723
__do_sys_clone kernel/fork.c:2864 [inline]
__se_sys_clone kernel/fork.c:2848 [inline]
__x64_sys_clone+0x1b6/0x230 kernel/fork.c:2848
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2b2d1c5852
Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffc4d45f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc4d45f570 RCX: 00007f2b2d1c5852
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc4d45f6fc R08: 0000000000000000 R09: 0000000000000001
R10: 000055555f6cc7d0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 000000000004d972 R15: 00007ffc4d45f750
----------------
Code disassembly (best guess):
0: e9 33 fa ff ff jmp 0xfffffa38
5: 0f 1f 00 nopl (%rax)
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 0f 1f 40 d6 nopl -0x2a(%rax)
1c: 41 56 push %r14
1e: 53 push %rbx
1f: 48 89 f3 mov %rsi,%rbx
22: 49 89 fe mov %rdi,%r14
25: e8 3e 15 00 00 call 0x1568
* 2a: 84 c0 test %al,%al <-- trapping instruction
2c: 75 16 jne 0x44
2e: be 01 00 00 00 mov $0x1,%esi
33: 4c 89 f7 mov %r14,%rdi
36: 31 d2 xor %edx,%edx
38: 48 89 d9 mov %rbx,%rcx
3b: 89 c3 mov %eax,%ebx
3d: e8 .byte 0xe8
3e: f6 .byte 0xf6
3f: 04 .byte 0x4