====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ ipvs-e:8:0/10761 is trying to acquire lock: ffff88805163f218 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88805163f218 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+.-.}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4186 [inline] ffff88805163f218 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+.-.}-{3:3}, at: __dev_queue_xmit+0x33ff/0x4490 net/core/dev.c:4729 but task is already holding lock: ffff8880349bed58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff8880349bed58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4685 [inline] ffff8880349bed58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x3ba/0xcf0 net/sched/sch_generic.c:342 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __netif_tx_lock include/linux/netdevice.h:4685 [inline] sch_direct_xmit+0x3ba/0xcf0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:4152 [inline] __dev_queue_xmit+0x144d/0x4490 net/core/dev.c:4729 dev_queue_xmit include/linux/netdevice.h:3365 [inline] neigh_resolve_output net/core/neighbour.c:1595 [inline] neigh_resolve_output+0x53a/0x940 net/core/neighbour.c:1575 neigh_output include/net/neighbour.h:547 [inline] ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] mld_sendpack+0xac1/0x1350 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x740/0xbf0 net/ipv6/mcast.c:2693 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #0 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+.-.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __dev_xmit_skb net/core/dev.c:4186 [inline] __dev_queue_xmit+0x33ff/0x4490 net/core/dev.c:4729 dev_queue_xmit include/linux/netdevice.h:3365 [inline] neigh_resolve_output net/core/neighbour.c:1595 [inline] neigh_resolve_output+0x53a/0x940 net/core/neighbour.c:1575 neigh_output include/net/neighbour.h:547 [inline] ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ndisc_send_skb+0xa85/0x1f50 net/ipv6/ndisc.c:512 ndisc_send_ns+0xc6/0x140 net/ipv6/ndisc.c:670 ndisc_solicit+0x2f6/0x510 net/ipv6/ndisc.c:761 neigh_probe+0xce/0x110 net/core/neighbour.c:1098 __neigh_event_send+0xac5/0x13c0 net/core/neighbour.c:1271 neigh_event_send_probe include/net/neighbour.h:471 [inline] neigh_event_send include/net/neighbour.h:477 [inline] neigh_event_send include/net/neighbour.h:475 [inline] neigh_resolve_output+0x56b/0x940 net/core/neighbour.c:1579 neigh_output include/net/neighbour.h:547 [inline] ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] ip6_local_out+0xd1/0x4d0 net/ipv6/output_core.c:157 ip6_send_skb+0x112/0x460 net/ipv6/ip6_output.c:1994 ip6_push_pending_frames+0xdd/0x100 net/ipv6/ip6_output.c:2015 icmpv6_push_pending_frames+0x2dc/0x460 net/ipv6/icmp.c:312 icmp6_send+0x1ec9/0x2be0 net/ipv6/icmp.c:633 __icmpv6_send include/linux/icmpv6.h:28 [inline] icmpv6_send include/linux/icmpv6.h:49 [inline] ip6_link_failure+0x31/0x5a0 net/ipv6/route.c:2843 dst_link_failure include/net/dst.h:432 [inline] ip_tunnel_xmit+0x2fd7/0x3850 net/ipv4/ip_tunnel.c:851 __gre_xmit+0x8bb/0xc00 net/ipv4/ip_gre.c:488 erspan_xmit+0x56b/0x25d0 net/ipv4/ip_gre.c:747 __netdev_start_xmit include/linux/netdevice.h:5248 [inline] netdev_start_xmit include/linux/netdevice.h:5257 [inline] xmit_one net/core/dev.c:3845 [inline] dev_hard_start_xmit+0x97/0x740 net/core/dev.c:3861 sch_direct_xmit+0x1b2/0xcf0 net/sched/sch_generic.c:344 qdisc_restart net/sched/sch_generic.c:409 [inline] __qdisc_run+0x54a/0x1c00 net/sched/sch_generic.c:417 qdisc_run include/net/pkt_sched.h:126 [inline] qdisc_run include/net/pkt_sched.h:123 [inline] net_tx_action+0x74f/0xce0 net/core/dev.c:5724 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 get_current arch/x86/include/asm/current.h:25 [inline] finish_task_switch.isra.0+0x22a/0xc10 kernel/sched/core.c:5193 context_switch kernel/sched/core.c:5328 [inline] __schedule+0x1198/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99 ip_vs_estimation_kthread+0x888/0x3310 net/netfilter/ipvs/ip_vs_est.c:209 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&qdisc_xmit_lock_key#4); lock(dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3); lock(&qdisc_xmit_lock_key#4); lock(dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3); *** DEADLOCK *** 9 locks held by ipvs-e:8:0/10761: #0: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: net_tx_action+0x39a/0xce0 net/core/dev.c:5693 #1: ffff8880349bed58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] #1: ffff8880349bed58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4685 [inline] #1: ffff8880349bed58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x3ba/0xcf0 net/sched/sch_generic.c:342 #2: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #2: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: icmp6_send+0x24c/0x2be0 net/ipv6/icmp.c:478 #3: ffff88810a5901e0 (k-slock-AF_INET6){+.-.}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline] #3: ffff88810a5901e0 (k-slock-AF_INET6){+.-.}-{3:3}, at: icmpv6_xmit_lock net/ipv6/icmp.c:108 [inline] #3: ffff88810a5901e0 (k-slock-AF_INET6){+.-.}-{3:3}, at: icmp6_send+0x8a5/0x2be0 net/ipv6/icmp.c:555 #4: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #4: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #4: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: ip6_send_skb+0xb9/0x460 net/ipv6/ip6_output.c:1993 #5: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #5: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #5: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: ip6_output+0xe3/0x710 net/ipv6/ip6_output.c:235 #6: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #6: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #6: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x1ab/0x1f50 net/ipv6/ndisc.c:482 #7: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #7: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #7: ffffffff8e3c4720 (rcu_read_lock){....}-{1:3}, at: ip6_output+0xe3/0x710 net/ipv6/ip6_output.c:235 #8: ffffffff8e3c46c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #8: ffffffff8e3c46c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline] #8: ffffffff8e3c46c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x276/0x4490 net/core/dev.c:4688 stack backtrace: CPU: 0 UID: 0 PID: 10761 Comm: ipvs-e:8:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_circular_bug+0x275/0x350 kernel/locking/lockdep.c:2043 check_noncircular+0x14c/0x170 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __dev_xmit_skb net/core/dev.c:4186 [inline] __dev_queue_xmit+0x33ff/0x4490 net/core/dev.c:4729 dev_queue_xmit include/linux/netdevice.h:3365 [inline] neigh_resolve_output net/core/neighbour.c:1595 [inline] neigh_resolve_output+0x53a/0x940 net/core/neighbour.c:1575 neigh_output include/net/neighbour.h:547 [inline] ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ndisc_send_skb+0xa85/0x1f50 net/ipv6/ndisc.c:512 ndisc_send_ns+0xc6/0x140 net/ipv6/ndisc.c:670 ndisc_solicit+0x2f6/0x510 net/ipv6/ndisc.c:761 neigh_probe+0xce/0x110 net/core/neighbour.c:1098 __neigh_event_send+0xac5/0x13c0 net/core/neighbour.c:1271 neigh_event_send_probe include/net/neighbour.h:471 [inline] neigh_event_send include/net/neighbour.h:477 [inline] neigh_event_send include/net/neighbour.h:475 [inline] neigh_resolve_output+0x56b/0x940 net/core/neighbour.c:1579 neigh_output include/net/neighbour.h:547 [inline] ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209 ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:464 [inline] ip6_local_out+0xd1/0x4d0 net/ipv6/output_core.c:157 ip6_send_skb+0x112/0x460 net/ipv6/ip6_output.c:1994 ip6_push_pending_frames+0xdd/0x100 net/ipv6/ip6_output.c:2015 icmpv6_push_pending_frames+0x2dc/0x460 net/ipv6/icmp.c:312 icmp6_send+0x1ec9/0x2be0 net/ipv6/icmp.c:633 __icmpv6_send include/linux/icmpv6.h:28 [inline] icmpv6_send include/linux/icmpv6.h:49 [inline] ip6_link_failure+0x31/0x5a0 net/ipv6/route.c:2843 dst_link_failure include/net/dst.h:432 [inline] ip_tunnel_xmit+0x2fd7/0x3850 net/ipv4/ip_tunnel.c:851 __gre_xmit+0x8bb/0xc00 net/ipv4/ip_gre.c:488 erspan_xmit+0x56b/0x25d0 net/ipv4/ip_gre.c:747 __netdev_start_xmit include/linux/netdevice.h:5248 [inline] netdev_start_xmit include/linux/netdevice.h:5257 [inline] xmit_one net/core/dev.c:3845 [inline] dev_hard_start_xmit+0x97/0x740 net/core/dev.c:3861 sch_direct_xmit+0x1b2/0xcf0 net/sched/sch_generic.c:344 qdisc_restart net/sched/sch_generic.c:409 [inline] __qdisc_run+0x54a/0x1c00 net/sched/sch_generic.c:417 qdisc_run include/net/pkt_sched.h:126 [inline] qdisc_run include/net/pkt_sched.h:123 [inline] net_tx_action+0x74f/0xce0 net/core/dev.c:5724 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:finish_task_switch.isra.0+0x22a/0xc10 kernel/sched/core.c:5193 Code: fb 09 00 00 44 8b 05 49 17 f8 0e 45 85 c0 0f 85 be 01 00 00 4c 89 e7 e8 a4 f6 ff ff e8 7f d4 3a 00 fb 65 48 8b 1d ee 59 17 12 <48> 8d bb 58 16 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 RSP: 0018:ffffc900048679a8 EFLAGS: 00000206 RAX: 000000000000f14d RBX: ffff888025bf0000 RCX: ffffffff81c4f99f RDX: 0000000000000000 RSI: ffffffff8da2b6a1 RDI: ffffffff8bf070c0 RBP: ffffc900048679f0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90820cd7 R11: 0000000000000001 R12: ffff88806a43a380 R13: ffff88801d6b8000 R14: ffff88806a43a380 R15: ffff88806a43b1b0 context_switch kernel/sched/core.c:5328 [inline] __schedule+0x1198/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99 ip_vs_estimation_kthread+0x888/0x3310 net/netfilter/ipvs/ip_vs_est.c:209 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 00 00 add %al,(%rax) 2: 44 8b 05 49 17 f8 0e mov 0xef81749(%rip),%r8d # 0xef81752 9: 45 85 c0 test %r8d,%r8d c: 0f 85 be 01 00 00 jne 0x1d0 12: 4c 89 e7 mov %r12,%rdi 15: e8 a4 f6 ff ff call 0xfffff6be 1a: e8 7f d4 3a 00 call 0x3ad49e 1f: fb sti 20: 65 48 8b 1d ee 59 17 mov %gs:0x121759ee(%rip),%rbx # 0x12175a16 27: 12 * 28: 48 8d bb 58 16 00 00 lea 0x1658(%rbx),%rdi <-- trapping instruction 2f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 36: fc ff df 39: 48 89 fa mov %rdi,%rdx 3c: 48 rex.W 3d: c1 .byte 0xc1