=============================================
[ INFO: possible recursive locking detected ]
4.9.165+ #29 Not tainted
---------------------------------------------
syz-executor.0/26176 is trying to acquire lock:
 (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] spin_lock include/linux/spinlock.h:302 [inline]
 (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] __netif_tx_lock include/linux/netdevice.h:3573 [inline]
 (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] __dev_queue_xmit+0x1116/0x1bd0 net/core/dev.c:3469
but task is already holding lock:
 (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] spin_lock include/linux/spinlock.h:302 [inline]
 (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] __netif_tx_lock include/linux/netdevice.h:3573 [inline]
 (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] __dev_queue_xmit+0x1116/0x1bd0 net/core/dev.c:3469
other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(_xmit_TUNNEL6#2);
  lock(_xmit_TUNNEL6#2);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

6 locks held by syz-executor.0/26176:
 #0:  (rcu_read_lock_bh){......}, at: [<ffffffff824a373b>] ip_finish_output2+0x20b/0x1280 net/ipv4/ip_output.c:198
 #1:  (rcu_read_lock_bh){......}, at: [<ffffffff8231d1d4>] __dev_queue_xmit+0x1d4/0x1bd0 net/core/dev.c:3407
 #2:  (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] spin_lock include/linux/spinlock.h:302 [inline]
 #2:  (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] __netif_tx_lock include/linux/netdevice.h:3573 [inline]
 #2:  (_xmit_TUNNEL6#2){+.-...}, at: [<ffffffff8231e116>] __dev_queue_xmit+0x1116/0x1bd0 net/core/dev.c:3469
 #3:  (slock-AF_INET){+.-...}, at: [<ffffffff82579a7b>] spin_trylock include/linux/spinlock.h:312 [inline]
 #3:  (slock-AF_INET){+.-...}, at: [<ffffffff82579a7b>] icmp_xmit_lock net/ipv4/icmp.c:220 [inline]
 #3:  (slock-AF_INET){+.-...}, at: [<ffffffff82579a7b>] __icmp_send+0x48b/0x1420 net/ipv4/icmp.c:656
 #4:  (rcu_read_lock_bh){......}, at: [<ffffffff824a373b>] ip_finish_output2+0x20b/0x1280 net/ipv4/ip_output.c:198
 #5:  (rcu_read_lock_bh){......}, at: [<ffffffff8231d1d4>] __dev_queue_xmit+0x1d4/0x1bd0 net/core/dev.c:3407

stack backtrace:
CPU: 0 PID: 26176 Comm: syz-executor.0 Not tainted 4.9.165+ #29
 ffff8800af0f6600 ffffffff81b4baf1 ffffffff8424ac80 ffffffff83cca590
 ffffffff83cca590 60621605be1fe2f1 ffff8800b0f6df00 ffff8800af0f67a0
 ffffffff81402df0 0000000000000005 ffff8800b0f6df00 ffff8800af0f67c0
Call Trace:
 [<ffffffff81b4baf1>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b4baf1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81402df0>] print_deadlock_bug kernel/locking/lockdep.c:1727 [inline]
 [<ffffffff81402df0>] check_deadlock kernel/locking/lockdep.c:1771 [inline]
 [<ffffffff81402df0>] validate_chain kernel/locking/lockdep.c:2249 [inline]
 [<ffffffff81402df0>] __lock_acquire.cold+0x384/0x734 kernel/locking/lockdep.c:3345
 [<ffffffff8120cd43>] lock_acquire+0x133/0x3d0 kernel/locking/lockdep.c:3756
 [<ffffffff8280b588>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
 [<ffffffff8280b588>] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151
 [<ffffffff8231e116>] spin_lock include/linux/spinlock.h:302 [inline]
 [<ffffffff8231e116>] __netif_tx_lock include/linux/netdevice.h:3573 [inline]
 [<ffffffff8231e116>] __dev_queue_xmit+0x1116/0x1bd0 net/core/dev.c:3469
 [<ffffffff8231ebe8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3506
 [<ffffffff82336856>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1365
 [<ffffffff824a3bd2>] dst_neigh_output include/net/dst.h:470 [inline]
 [<ffffffff824a3bd2>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:225
 [<ffffffff824aaa54>] ip_finish_output+0x3c4/0xce0 net/ipv4/ip_output.c:313
 [<ffffffff824aef0c>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 [<ffffffff824aef0c>] ip_output+0x1ec/0x5b0 net/ipv4/ip_output.c:401
 [<ffffffff824abc7c>] dst_output include/net/dst.h:507 [inline]
 [<ffffffff824abc7c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:124
 [<ffffffff824b1c1e>] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1489
 [<ffffffff824b1d04>] ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1509
 [<ffffffff82578b8e>] icmp_push_reply+0x39e/0x510 net/ipv4/icmp.c:381
 [<ffffffff8257a0c9>] __icmp_send+0xad9/0x1420 net/ipv4/icmp.c:728
 [<ffffffff8247d76d>] icmp_send include/net/icmp.h:47 [inline]
 [<ffffffff8247d76d>] ipv4_link_failure+0x2d/0x1d0 net/ipv4/route.c:1181
 [<ffffffff8278c058>] dst_link_failure include/net/dst.h:490 [inline]
 [<ffffffff8278c058>] vti6_xmit net/ipv6/ip6_vti.c:522 [inline]
 [<ffffffff8278c058>] vti6_tnl_xmit+0xb08/0x17f0 net/ipv6/ip6_vti.c:561
 [<ffffffff8231c5e5>] __netdev_start_xmit include/linux/netdevice.h:4072 [inline]
 [<ffffffff8231c5e5>] netdev_start_xmit include/linux/netdevice.h:4081 [inline]
 [<ffffffff8231c5e5>] xmit_one net/core/dev.c:2977 [inline]
 [<ffffffff8231c5e5>] dev_hard_start_xmit+0x195/0x8b0 net/core/dev.c:2993
 [<ffffffff8231e1a3>] __dev_queue_xmit+0x11a3/0x1bd0 net/core/dev.c:3473
 [<ffffffff8231ebe8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3506
 [<ffffffff82336856>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1365
 [<ffffffff824a3bd2>] dst_neigh_output include/net/dst.h:470 [inline]
 [<ffffffff824a3bd2>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:225
 [<ffffffff824aaa54>] ip_finish_output+0x3c4/0xce0 net/ipv4/ip_output.c:313
 [<ffffffff824aef0c>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 [<ffffffff824aef0c>] ip_output+0x1ec/0x5b0 net/ipv4/ip_output.c:401
 [<ffffffff824abc7c>] dst_output include/net/dst.h:507 [inline]
 [<ffffffff824abc7c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:124
 [<ffffffff824b1c1e>] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1489
 [<ffffffff8255c13c>] udp_send_skb+0x4fc/0xc60 net/ipv4/udp.c:833
 [<ffffffff82564764>] udp_sendmsg+0x1634/0x1c60 net/ipv4/udp.c:1057
 [<ffffffff827006ff>] udpv6_sendmsg+0x12af/0x2430 net/ipv6/udp.c:1086
 [<ffffffff8258d892>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:766
 [<ffffffff822a8f9e>] sock_sendmsg_nosec net/socket.c:648 [inline]
 [<ffffffff822a8f9e>] sock_sendmsg+0xbe/0x110 net/socket.c:658
 [<ffffffff822aa957>] ___sys_sendmsg+0x387/0x8b0 net/socket.c:1982
 [<ffffffff822addd4>] __sys_sendmmsg+0x164/0x3d0 net/socket.c:2072
 [<ffffffff822ae075>] SYSC_sendmmsg net/socket.c:2103 [inline]
 [<ffffffff822ae075>] SyS_sendmmsg+0x35/0x60 net/socket.c:2098
 [<ffffffff810056bd>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
 [<ffffffff8280c213>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Dead loop on virtual device ip6_vti1, fix it urgently!
Dead loop on virtual device ip6_vti1, fix it urgently!
Dead loop on virtual device ip6_vti1, fix it urgently!
Dead loop on virtual device ip6_vti1, fix it urgently!
Dead loop on virtual device ip6_vti1, fix it urgently!
Dead loop on virtual device ip6_vti1, fix it urgently!
selinux_nlmsg_perm: 11 callbacks suppressed
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26235 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26245 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26262 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26312 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26320 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26321 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26339 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26342 comm=syz-executor.5
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26371 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pig=26405 comm=syz-executor.3