====================================================== WARNING: possible circular locking dependency detected 5.17.0-rc4-syzkaller-00020-g705d84a366cf #0 Not tainted ------------------------------------------------------ syz-executor.0/25541 is trying to acquire lock: ffffe8ffada45308 (&pcpu->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline] ffffe8ffada45308 (&pcpu->lock){+.-.}-{2:2}, at: nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:540 [inline] ffffe8ffada45308 (&pcpu->lock){+.-.}-{2:2}, at: init_conntrack.constprop.0+0xd2d/0x1430 net/netfilter/nf_conntrack_core.c:1692 but task is already holding lock: ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline] ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4123 [inline] ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x318/0xbe0 net/sched/sch_generic.c:340 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (_xmit_ETHER#2){+.-.}-{2:2}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:349 [inline] __netif_tx_lock include/linux/netdevice.h:4123 [inline] sch_direct_xmit+0x318/0xbe0 net/sched/sch_generic.c:340 __dev_xmit_skb net/core/dev.c:3700 [inline] __dev_queue_xmit+0x148f/0x3660 net/core/dev.c:4081 neigh_resolve_output net/core/neighbour.c:1528 [inline] neigh_resolve_output+0x50e/0x830 net/core/neighbour.c:1508 neigh_output include/net/neighbour.h:549 [inline] ip6_finish_output2+0x56e/0x14f0 net/ipv6/ip6_output.c:126 __ip6_finish_output net/ipv6/ip6_output.c:191 [inline] __ip6_finish_output+0x61e/0xe90 net/ipv6/ip6_output.c:170 ip6_finish_output+0x32/0x200 net/ipv6/ip6_output.c:201 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:451 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] mld_sendpack+0x9a3/0xe40 net/ipv6/mcast.c:1826 mld_send_cr net/ipv6/mcast.c:2127 [inline] mld_ifc_work+0x71c/0xdc0 net/ipv6/mcast.c:2659 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #1 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:349 [inline] __dev_xmit_skb net/core/dev.c:3729 [inline] __dev_queue_xmit+0x2d5d/0x3660 net/core/dev.c:4081 __netlink_deliver_tap_skb net/netlink/af_netlink.c:305 [inline] __netlink_deliver_tap net/netlink/af_netlink.c:323 [inline] netlink_deliver_tap+0x9cb/0xc30 net/netlink/af_netlink.c:336 __netlink_sendskb net/netlink/af_netlink.c:1261 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1396 [inline] do_one_broadcast net/netlink/af_netlink.c:1474 [inline] netlink_broadcast+0x83c/0xd50 net/netlink/af_netlink.c:1514 nlmsg_multicast include/net/netlink.h:1033 [inline] nlmsg_notify+0x8f/0x280 net/netlink/af_netlink.c:2537 ctnetlink_conntrack_event+0xd43/0x15c0 net/netfilter/nf_conntrack_netlink.c:828 __nf_conntrack_eventmask_report+0x1a5/0x4e0 net/netfilter/nf_conntrack_ecache.c:154 nf_conntrack_eventmask_report net/netfilter/nf_conntrack_ecache.c:194 [inline] nf_conntrack_eventmask_report+0x1c7/0x360 net/netfilter/nf_conntrack_ecache.c:170 nf_conntrack_event include/net/netfilter/nf_conntrack_ecache.h:153 [inline] ecache_work_evict_list+0x28f/0x540 net/netfilter/nf_conntrack_ecache.c:74 ecache_work+0x13f/0x2a0 net/netfilter/nf_conntrack_ecache.c:111 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #0 (&pcpu->lock){+.-.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3063 [inline] check_prevs_add kernel/locking/lockdep.c:3186 [inline] validate_chain kernel/locking/lockdep.c:3801 [inline] __lock_acquire+0x2ad4/0x56c0 kernel/locking/lockdep.c:5027 lock_acquire kernel/locking/lockdep.c:5639 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:349 [inline] nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:540 [inline] init_conntrack.constprop.0+0xd2d/0x1430 net/netfilter/nf_conntrack_core.c:1692 resolve_normal_ct net/netfilter/nf_conntrack_core.c:1745 [inline] nf_conntrack_in+0xdc0/0x17f0 net/netfilter/nf_conntrack_core.c:1903 ipv4_conntrack_local+0x11c/0x260 net/netfilter/nf_conntrack_proto.c:213 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:619 nf_hook+0x1cb/0x5b0 include/linux/netfilter.h:262 __ip_local_out+0x262/0x520 net/ipv4/ip_output.c:115 ip_local_out+0x26/0x1a0 net/ipv4/ip_output.c:124 iptunnel_xmit+0x68c/0xa50 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x10aa/0x2b70 net/ipv4/ip_tunnel.c:810 erspan_xmit+0x7e6/0x29c0 net/ipv4/ip_gre.c:713 __netdev_start_xmit include/linux/netdevice.h:4683 [inline] netdev_start_xmit include/linux/netdevice.h:4697 [inline] xmit_one net/core/dev.c:3473 [inline] dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489 sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3700 [inline] __dev_queue_xmit+0x148f/0x3660 net/core/dev.c:4081 neigh_resolve_output net/core/neighbour.c:1528 [inline] neigh_resolve_output+0x50e/0x830 net/core/neighbour.c:1508 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x782/0x2170 net/ipv4/ip_output.c:228 __ip_finish_output net/ipv4/ip_output.c:306 [inline] __ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288 ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x196/0x310 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] ip_send_skb+0xd4/0x260 net/ipv4/ip_output.c:1570 udp_send_skb+0x6d2/0x11b0 net/ipv4/udp.c:967 udp_sendmsg+0x1bad/0x2730 net/ipv4/udp.c:1254 udpv6_sendmsg+0x14df/0x2c30 net/ipv6/udp.c:1362 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Chain exists of: &pcpu->lock --> dev->qdisc_tx_busylock ?: &qdisc_tx_busylock --> _xmit_ETHER#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(_xmit_ETHER#2); lock(dev->qdisc_tx_busylock ?: &qdisc_tx_busylock); lock(_xmit_ETHER#2); lock(&pcpu->lock); *** DEADLOCK *** 5 locks held by syz-executor.0/25541: #0: ffffffff8bb81800 (rcu_read_lock_bh){....}-{1:2}, at: lwtunnel_xmit_redirect include/net/lwtunnel.h:95 [inline] #0: ffffffff8bb81800 (rcu_read_lock_bh){....}-{1:2}, at: ip_finish_output2+0x292/0x2170 net/ipv4/ip_output.c:214 #1: ffffffff8bb81800 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1e3/0x3660 net/core/dev.c:4040 #2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: spin_trylock include/linux/spinlock.h:359 [inline] #2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:187 [inline] #2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:184 [inline] #2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3687 [inline] #2: ffff88801a4ac258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1262/0x3660 net/core/dev.c:4081 #3: ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline] #3: ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4123 [inline] #3: ffff8880180810d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x318/0xbe0 net/sched/sch_generic.c:340 #4: ffffffff8bb81860 (rcu_read_lock){....}-{1:2}, at: nf_hook+0x0/0x5b0 include/linux/skbuff.h:1014 stack backtrace: CPU: 0 PID: 25541 Comm: syz-executor.0 Not tainted 5.17.0-rc4-syzkaller-00020-g705d84a366cf #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2143 check_prev_add kernel/locking/lockdep.c:3063 [inline] check_prevs_add kernel/locking/lockdep.c:3186 [inline] validate_chain kernel/locking/lockdep.c:3801 [inline] __lock_acquire+0x2ad4/0x56c0 kernel/locking/lockdep.c:5027 lock_acquire kernel/locking/lockdep.c:5639 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:349 [inline] nf_ct_add_to_unconfirmed_list net/netfilter/nf_conntrack_core.c:540 [inline] init_conntrack.constprop.0+0xd2d/0x1430 net/netfilter/nf_conntrack_core.c:1692 resolve_normal_ct net/netfilter/nf_conntrack_core.c:1745 [inline] nf_conntrack_in+0xdc0/0x17f0 net/netfilter/nf_conntrack_core.c:1903 ipv4_conntrack_local+0x11c/0x260 net/netfilter/nf_conntrack_proto.c:213 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:619 nf_hook+0x1cb/0x5b0 include/linux/netfilter.h:262 __ip_local_out+0x262/0x520 net/ipv4/ip_output.c:115 ip_local_out+0x26/0x1a0 net/ipv4/ip_output.c:124 iptunnel_xmit+0x68c/0xa50 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x10aa/0x2b70 net/ipv4/ip_tunnel.c:810 erspan_xmit+0x7e6/0x29c0 net/ipv4/ip_gre.c:713 __netdev_start_xmit include/linux/netdevice.h:4683 [inline] netdev_start_xmit include/linux/netdevice.h:4697 [inline] xmit_one net/core/dev.c:3473 [inline] dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489 sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3700 [inline] __dev_queue_xmit+0x148f/0x3660 net/core/dev.c:4081 neigh_resolve_output net/core/neighbour.c:1528 [inline] neigh_resolve_output+0x50e/0x830 net/core/neighbour.c:1508 neigh_output include/net/neighbour.h:549 [inline] ip_finish_output2+0x782/0x2170 net/ipv4/ip_output.c:228 __ip_finish_output net/ipv4/ip_output.c:306 [inline] __ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288 ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x196/0x310 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] ip_send_skb+0xd4/0x260 net/ipv4/ip_output.c:1570 udp_send_skb+0x6d2/0x11b0 net/ipv4/udp.c:967 udp_sendmsg+0x1bad/0x2730 net/ipv4/udp.c:1254 udpv6_sendmsg+0x14df/0x2c30 net/ipv6/udp.c:1362 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x331/0x810 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmmsg+0x195/0x470 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f3f0e10c059 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3f0ca81168 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f3f0e21ef60 RCX: 00007f3f0e10c059 RDX: 0400000000000132 RSI: 0000000020004d80 RDI: 0000000000000003 RBP: 00007f3f0e16608d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffb9b5cd5f R14: 00007f3f0ca81300 R15: 0000000000022000 syz-executor.0 (25541) used greatest stack depth: 22288 bytes left