======================================================
WARNING: possible circular locking dependency detected
5.17.0-rc4-syzkaller-00020-g705d84a366cf #0 Not tainted
------------------------------------------------------
syz-executor.0/25541 is trying to acquire lock:
ffffe8ffada45308 (&pcpu->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
ffffe8ffada45308 (&pcpu->lock){+.-.}-{2:2}, at: nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:540 [inline]
ffffe8ffada45308 (&pcpu->lock){+.-.}-{2:2}, at: init_conntrack.constprop.0+0xd2d/0x1430 net/netfilter/nf_conntrack_core.c:1692
but task is already holding lock:
ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4123 [inline]
ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x318/0xbe0 net/sched/sch_generic.c:340
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (_xmit_ETHER#2){+.-.}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
__netif_tx_lock include/linux/netdevice.h:4123 [inline]
sch_direct_xmit+0x318/0xbe0 net/sched/sch_generic.c:340
__dev_xmit_skb net/core/dev.c:3700 [inline]
__dev_queue_xmit+0x148f/0x3660 net/core/dev.c:4081
neigh_resolve_output net/core/neighbour.c:1528 [inline]
neigh_resolve_output+0x50e/0x830 net/core/neighbour.c:1508
neigh_output include/net/neighbour.h:549 [inline]
ip6_finish_output2+0x56e/0x14f0 net/ipv6/ip6_output.c:126
__ip6_finish_output net/ipv6/ip6_output.c:191 [inline]
__ip6_finish_output+0x61e/0xe90 net/ipv6/ip6_output.c:170
ip6_finish_output+0x32/0x200 net/ipv6/ip6_output.c:201
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:224
dst_output include/net/dst.h:451 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
mld_sendpack+0x9a3/0xe40 net/ipv6/mcast.c:1826
mld_send_cr net/ipv6/mcast.c:2127 [inline]
mld_ifc_work+0x71c/0xdc0 net/ipv6/mcast.c:2659
process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
worker_thread+0x657/0x1110 kernel/workqueue.c:2454
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
__dev_xmit_skb net/core/dev.c:3729 [inline]
__dev_queue_xmit+0x2d5d/0x3660 net/core/dev.c:4081
__netlink_deliver_tap_skb net/netlink/af_netlink.c:305 [inline]
__netlink_deliver_tap net/netlink/af_netlink.c:323 [inline]
netlink_deliver_tap+0x9cb/0xc30 net/netlink/af_netlink.c:336
__netlink_sendskb net/netlink/af_netlink.c:1261 [inline]
netlink_broadcast_deliver net/netlink/af_netlink.c:1396 [inline]
do_one_broadcast net/netlink/af_netlink.c:1474 [inline]
netlink_broadcast+0x83c/0xd50 net/netlink/af_netlink.c:1514
nlmsg_multicast include/net/netlink.h:1033 [inline]
nlmsg_notify+0x8f/0x280 net/netlink/af_netlink.c:2537
ctnetlink_conntrack_event+0xd43/0x15c0 net/netfilter/nf_conntrack_netlink.c:828
__nf_conntrack_eventmask_report+0x1a5/0x4e0 net/netfilter/nf_conntrack_ecache.c:154
nf_conntrack_eventmask_report net/netfilter/nf_conntrack_ecache.c:194 [inline]
nf_conntrack_eventmask_report+0x1c7/0x360 net/netfilter/nf_conntrack_ecache.c:170
nf_conntrack_event include/net/netfilter/nf_conntrack_ecache.h:153 [inline]
ecache_work_evict_list+0x28f/0x540 net/netfilter/nf_conntrack_ecache.c:74
ecache_work+0x13f/0x2a0 net/netfilter/nf_conntrack_ecache.c:111
process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
worker_thread+0x657/0x1110 kernel/workqueue.c:2454
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #0 (&pcpu->lock){+.-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3063 [inline]
check_prevs_add kernel/locking/lockdep.c:3186 [inline]
validate_chain kernel/locking/lockdep.c:3801 [inline]
__lock_acquire+0x2ad4/0x56c0 kernel/locking/lockdep.c:5027
lock_acquire kernel/locking/lockdep.c:5639 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:540 [inline]
init_conntrack.constprop.0+0xd2d/0x1430 net/netfilter/nf_conntrack_core.c:1692
resolve_normal_ct net/netfilter/nf_conntrack_core.c:1745 [inline]
nf_conntrack_in+0xdc0/0x17f0 net/netfilter/nf_conntrack_core.c:1903
ipv4_conntrack_local+0x11c/0x260 net/netfilter/nf_conntrack_proto.c:213
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:619
nf_hook+0x1cb/0x5b0 include/linux/netfilter.h:262
__ip_local_out+0x262/0x520 net/ipv4/ip_output.c:115
ip_local_out+0x26/0x1a0 net/ipv4/ip_output.c:124
iptunnel_xmit+0x68c/0xa50 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x10aa/0x2b70 net/ipv4/ip_tunnel.c:810
erspan_xmit+0x7e6/0x29c0 net/ipv4/ip_gre.c:713
__netdev_start_xmit include/linux/netdevice.h:4683 [inline]
netdev_start_xmit include/linux/netdevice.h:4697 [inline]
xmit_one net/core/dev.c:3473 [inline]
dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489
sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3700 [inline]
__dev_queue_xmit+0x148f/0x3660 net/core/dev.c:4081
neigh_resolve_output net/core/neighbour.c:1528 [inline]
neigh_resolve_output+0x50e/0x830 net/core/neighbour.c:1508
neigh_output include/net/neighbour.h:549 [inline]
ip_finish_output2+0x782/0x2170 net/ipv4/ip_output.c:228
__ip_finish_output net/ipv4/ip_output.c:306 [inline]
__ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip_output+0x196/0x310 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:451 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
ip_send_skb+0xd4/0x260 net/ipv4/ip_output.c:1570
udp_send_skb+0x6d2/0x11b0 net/ipv4/udp.c:967
udp_sendmsg+0x1bad/0x2730 net/ipv4/udp.c:1254
udpv6_sendmsg+0x14df/0x2c30 net/ipv6/udp.c:1362
inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:725
____sys_sendmsg+0x331/0x810 net/socket.c:2413
___sys_sendmsg+0xf3/0x170 net/socket.c:2467
__sys_sendmmsg+0x195/0x470 net/socket.c:2553
__do_sys_sendmmsg net/socket.c:2582 [inline]
__se_sys_sendmmsg net/socket.c:2579 [inline]
__x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of:
&pcpu->lock --> dev->qdisc_tx_busylock ?: &qdisc_tx_busylock --> _xmit_ETHER#2
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(_xmit_ETHER#2);
lock(dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
lock(_xmit_ETHER#2);
lock(&pcpu->lock);
*** DEADLOCK ***
5 locks held by syz-executor.0/25541:
#0: ffffffff8bb81800 (rcu_read_lock_bh){....}-{1:2}, at: lwtunnel_xmit_redirect include/net/lwtunnel.h:95 [inline]
#0: ffffffff8bb81800 (rcu_read_lock_bh){....}-{1:2}, at: ip_finish_output2+0x292/0x2170 net/ipv4/ip_output.c:214
#1: ffffffff8bb81800 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1e3/0x3660 net/core/dev.c:4040
#2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: spin_trylock include/linux/spinlock.h:359 [inline]
#2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:187 [inline]
#2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:184 [inline]
#2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3687 [inline]
#2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1262/0x3660 net/core/dev.c:4081
#3: ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
#3: ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4123 [inline]
#3: ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x318/0xbe0 net/sched/sch_generic.c:340
#4: ffffffff8bb81860 (rcu_read_lock){....}-{1:2}, at: nf_hook+0x0/0x5b0 include/linux/skbuff.h:1014
stack backtrace:
CPU: 0 PID: 25541 Comm: syz-executor.0 Not tainted 5.17.0-rc4-syzkaller-00020-g705d84a366cf #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2143
check_prev_add kernel/locking/lockdep.c:3063 [inline]
check_prevs_add kernel/locking/lockdep.c:3186 [inline]
validate_chain kernel/locking/lockdep.c:3801 [inline]
__lock_acquire+0x2ad4/0x56c0 kernel/locking/lockdep.c:5027
lock_acquire kernel/locking/lockdep.c:5639 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:349 [inline]
nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:540 [inline]
init_conntrack.constprop.0+0xd2d/0x1430 net/netfilter/nf_conntrack_core.c:1692
resolve_normal_ct net/netfilter/nf_conntrack_core.c:1745 [inline]
nf_conntrack_in+0xdc0/0x17f0 net/netfilter/nf_conntrack_core.c:1903
ipv4_conntrack_local+0x11c/0x260 net/netfilter/nf_conntrack_proto.c:213
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:619
nf_hook+0x1cb/0x5b0 include/linux/netfilter.h:262
__ip_local_out+0x262/0x520 net/ipv4/ip_output.c:115
ip_local_out+0x26/0x1a0 net/ipv4/ip_output.c:124
iptunnel_xmit+0x68c/0xa50 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x10aa/0x2b70 net/ipv4/ip_tunnel.c:810
erspan_xmit+0x7e6/0x29c0 net/ipv4/ip_gre.c:713
__netdev_start_xmit include/linux/netdevice.h:4683 [inline]
netdev_start_xmit include/linux/netdevice.h:4697 [inline]
xmit_one net/core/dev.c:3473 [inline]
dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489
sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3700 [inline]
__dev_queue_xmit+0x148f/0x3660 net/core/dev.c:4081
neigh_resolve_output net/core/neighbour.c:1528 [inline]
neigh_resolve_output+0x50e/0x830 net/core/neighbour.c:1508
neigh_output include/net/neighbour.h:549 [inline]
ip_finish_output2+0x782/0x2170 net/ipv4/ip_output.c:228
__ip_finish_output net/ipv4/ip_output.c:306 [inline]
__ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip_output+0x196/0x310 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:451 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
ip_send_skb+0xd4/0x260 net/ipv4/ip_output.c:1570
udp_send_skb+0x6d2/0x11b0 net/ipv4/udp.c:967
udp_sendmsg+0x1bad/0x2730 net/ipv4/udp.c:1254
udpv6_sendmsg+0x14df/0x2c30 net/ipv6/udp.c:1362
inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:725
____sys_sendmsg+0x331/0x810 net/socket.c:2413
___sys_sendmsg+0xf3/0x170 net/socket.c:2467
__sys_sendmmsg+0x195/0x470 net/socket.c:2553
__do_sys_sendmmsg net/socket.c:2582 [inline]
__se_sys_sendmmsg net/socket.c:2579 [inline]
__x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f3f0e10c059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3f0ca81168 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f3f0e21ef60 RCX: 00007f3f0e10c059
RDX: 0400000000000132 RSI: 0000000020004d80 RDI: 0000000000000003
RBP: 00007f3f0e16608d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffb9b5cd5f R14: 00007f3f0ca81300 R15: 0000000000022000
</TASK>
syz-executor.0 (25541) used greatest stack depth: 22288 bytes left