random: sshd: uninitialized urandom read (32 bytes read, 127 bits of entropy available)
random: nonblocking pool is initialized
IPVS: Creating netns size=2552 id=1

======================================================
[ INFO: possible circular locking dependency detected ]
4.4.141-g1b37d68 #71 Not tainted
-------------------------------------------------------
syz-executor587/3838 is trying to acquire lock:
 (_xmit_NETROM){+.-...}, at: [<ffffffff83011a4c>] spin_lock include/linux/spinlock.h:302 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff83011a4c>] __netif_tx_lock include/linux/netdevice.h:3299 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff83011a4c>] sch_direct_xmit+0x23c/0x6e0 net/sched/sch_generic.c:163

but task is already holding lock:
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff834bfb25>] spin_lock include/linux/spinlock.h:302 [inline]
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff834bfb25>] ipv6_frag_rcv+0x605/0x4fd0 net/ipv6/reassembly.c:560

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff81235abe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff838c284e>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline]
       [<ffffffff838c284e>] _raw_spin_lock_irqsave+0x4e/0x70 kernel/locking/spinlock.c:159
       [<ffffffff8128e725>] lock_timer_base+0xd5/0x170 kernel/time/timer.c:779
       [<ffffffff812992b7>] __mod_timer kernel/time/timer.c:799 [inline]
       [<ffffffff812992b7>] mod_timer+0x1b7/0xa80 kernel/time/timer.c:925
       [<ffffffff833393ea>] inet_frag_intern net/ipv4/inet_fragment.c:350 [inline]
       [<ffffffff833393ea>] inet_frag_create net/ipv4/inet_fragment.c:397 [inline]
       [<ffffffff833393ea>] inet_frag_find+0x71a/0x9c0 net/ipv4/inet_fragment.c:426
       [<ffffffff83206aad>] ip_find net/ipv4/ip_fragment.c:275 [inline]
       [<ffffffff83206aad>] ip_defrag+0x2ed/0x3fe0 net/ipv4/ip_fragment.c:676
       [<ffffffff8320ab68>] ip_check_defrag+0x3c8/0x7e0 net/ipv4/ip_fragment.c:724
       [<ffffffff8357d0da>] packet_rcv_fanout+0x52a/0x5e0 net/packet/af_packet.c:1458
       [<ffffffff82f89734>] dev_queue_xmit_nit net/core/dev.c:1913 [inline]
       [<ffffffff82f89734>] xmit_one net/core/dev.c:2755 [inline]
       [<ffffffff82f89734>] dev_hard_start_xmit+0x644/0x11c0 net/core/dev.c:2775
       [<ffffffff83011ad1>] sch_direct_xmit+0x2c1/0x6e0 net/sched/sch_generic.c:165
       [<ffffffff82f8b463>] __dev_xmit_skb net/core/dev.c:2957 [inline]
       [<ffffffff82f8b463>] __dev_queue_xmit+0xef3/0x1c80 net/core/dev.c:3175
       [<ffffffff82f8c207>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
       [<ffffffff82fa8cd7>] neigh_resolve_output+0x637/0x790 net/core/neighbour.c:1326
       [<ffffffff832163ab>] dst_neigh_output include/net/dst.h:461 [inline]
       [<ffffffff832163ab>] ip_finish_output2+0x6ab/0x1110 net/ipv4/ip_output.c:213
       [<ffffffff832187dc>] ip_do_fragment+0x19cc/0x2190 net/ipv4/ip_output.c:633
       [<ffffffff832190e3>] ip_fragment.constprop.51+0x143/0x200 net/ipv4/ip_output.c:503
       [<ffffffff8321962a>] ip_finish_output+0x48a/0xc00 net/ipv4/ip_output.c:286
       [<ffffffff8321ca53>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
       [<ffffffff8321ca53>] ip_mc_output+0x233/0x980 net/ipv4/ip_output.c:347
       [<ffffffff8321a27b>] dst_output include/net/dst.h:498 [inline]
       [<ffffffff8321a27b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
       [<ffffffff8321fffc>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1451
       [<ffffffff832c8943>] udp_send_skb+0x5c3/0xc60 net/ipv4/udp.c:842
       [<ffffffff832d14f9>] udp_sendmsg+0x16c9/0x1c70 net/ipv4/udp.c:1072
       [<ffffffff83301113>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
       [<ffffffff82f1e2fc>] sock_sendmsg_nosec net/socket.c:625 [inline]
       [<ffffffff82f1e2fc>] sock_sendmsg+0xcc/0x110 net/socket.c:635
       [<ffffffff82f1efdc>] SYSC_sendto+0x21c/0x370 net/socket.c:1665
       [<ffffffff82f21660>] SyS_sendto+0x40/0x50 net/socket.c:1633
       [<ffffffff838c2c25>] entry_SYSCALL_64_fastpath+0x22/0x9e

       [<ffffffff81232972>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff81232972>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff81232972>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff81232972>] __lock_acquire+0x3902/0x5270 kernel/locking/lockdep.c:3213
       [<ffffffff81235abe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff838c1d36>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
       [<ffffffff838c1d36>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
       [<ffffffff83011a4c>] spin_lock include/linux/spinlock.h:302 [inline]
       [<ffffffff83011a4c>] __netif_tx_lock include/linux/netdevice.h:3299 [inline]
       [<ffffffff83011a4c>] sch_direct_xmit+0x23c/0x6e0 net/sched/sch_generic.c:163
       [<ffffffff82f8b463>] __dev_xmit_skb net/core/dev.c:2957 [inline]
       [<ffffffff82f8b463>] __dev_queue_xmit+0xef3/0x1c80 net/core/dev.c:3175
       [<ffffffff82f8c207>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
       [<ffffffff82fa8cd7>] neigh_resolve_output+0x637/0x790 net/core/neighbour.c:1326
       [<ffffffff83429fb9>] dst_neigh_output include/net/dst.h:461 [inline]
       [<ffffffff83429fb9>] ip6_finish_output2+0x929/0x1ca0 net/ipv6/ip6_output.c:113
       [<ffffffff834335f8>] ip6_finish_output+0x3b8/0x760 net/ipv6/ip6_output.c:131
       [<ffffffff83433b58>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
       [<ffffffff83433b58>] ip6_output+0x1b8/0x520 net/ipv6/ip6_output.c:145
       [<ffffffff8355cf8b>] dst_output include/net/dst.h:498 [inline]
       [<ffffffff8355cf8b>] ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:169
       [<ffffffff83435b91>] ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1725
       [<ffffffff83435ee3>] ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1745
       [<ffffffff834a4e4c>] icmpv6_push_pending_frames+0x33c/0x530 net/ipv6/icmp.c:276
       [<ffffffff834a660d>] icmp6_send+0x15cd/0x1b80 net/ipv6/icmp.c:537
       [<ffffffff834a7fc9>] icmpv6_param_prob+0x29/0x40 net/ipv6/icmp.c:551
       [<ffffffff834c34b4>] ip6_frag_queue net/ipv6/reassembly.c:263 [inline]
       [<ffffffff834c34b4>] ipv6_frag_rcv+0x3f94/0x4fd0 net/ipv6/reassembly.c:562
       [<ffffffff83436c7e>] ip6_input_finish+0x32e/0x1550 net/ipv6/ip6_input.c:248
       [<ffffffff83439c66>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
       [<ffffffff83439c66>] NF_HOOK include/linux/netfilter.h:249 [inline]
       [<ffffffff83439c66>] ip6_input+0xf6/0x200 net/ipv6/ip6_input.c:280
       [<ffffffff8343644d>] dst_input include/net/dst.h:504 [inline]
       [<ffffffff8343644d>] ip6_rcv_finish+0x13d/0x640 net/ipv6/ip6_input.c:62
       [<ffffffff83438f6b>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
       [<ffffffff83438f6b>] NF_HOOK include/linux/netfilter.h:249 [inline]
       [<ffffffff83438f6b>] ipv6_rcv+0x10cb/0x1cd0 net/ipv6/ip6_input.c:186
       [<ffffffff82f7ebd6>] __netif_receive_skb_core+0x12d6/0x2940 net/core/dev.c:4019
       [<ffffffff82f8029b>] __netif_receive_skb+0x5b/0x1b0 net/core/dev.c:4054
       [<ffffffff82f84826>] process_backlog+0x216/0x6a0 net/core/dev.c:4647
       [<ffffffff82f81662>] napi_poll net/core/dev.c:4885 [inline]
       [<ffffffff82f81662>] net_rx_action+0x3a2/0xdb0 net/core/dev.c:4950
       [<ffffffff838c60ec>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
       [<ffffffff838c3e9c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:929
       [<ffffffff8113da14>] do_softirq.part.16+0x54/0x60 kernel/softirq.c:317
       [<ffffffff8113f709>] do_softirq+0x19/0x20 kernel/softirq.c:320
       [<ffffffff82f7cb7c>] netif_rx_ni+0xec/0x3a0 net/core/dev.c:3653
       [<ffffffff82752b17>] tun_get_user+0xbe7/0x2410 drivers/net/tun.c:1264
       [<ffffffff82754555>] tun_chr_write_iter+0xd5/0x190 drivers/net/tun.c:1283
       [<ffffffff8151d96c>] do_iter_readv_writev+0x13c/0x1e0 fs/read_write.c:664
       [<ffffffff8151f090>] do_readv_writev+0x2e0/0x6e0 fs/read_write.c:808
       [<ffffffff8151f5bb>] vfs_writev+0x7b/0xb0 fs/read_write.c:847
       [<ffffffff81521a89>] SYSC_writev fs/read_write.c:880 [inline]
       [<ffffffff81521a89>] SyS_writev+0xd9/0x250 fs/read_write.c:872
       [<ffffffff838c2c25>] entry_SYSCALL_64_fastpath+0x22/0x9e

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&(&q->lock)->rlock);
                               lock(_xmit_NETROM);
                               lock(&(&q->lock)->rlock);
  lock(_xmit_NETROM);

 *** DEADLOCK ***

7 locks held by syz-executor587/3838:
 #0:  (rcu_read_lock){......}, at: [<ffffffff82f847c2>] __skb_unlink include/linux/skbuff.h:1643 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff82f847c2>] __skb_dequeue include/linux/skbuff.h:1659 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff82f847c2>] process_backlog+0x1b2/0x6a0 net/core/dev.c:4644
 #1:  (rcu_read_lock){......}, at: [<ffffffff83436950>] ip6_input_finish+0x0/0x1550 include/linux/compiler.h:218
 #2:  (&(&q->lock)->rlock){+.-...}, at: [<ffffffff834bfb25>] spin_lock include/linux/spinlock.h:302 [inline]
 #2:  (&(&q->lock)->rlock){+.-...}, at: [<ffffffff834bfb25>] ipv6_frag_rcv+0x605/0x4fd0 net/ipv6/reassembly.c:560
 #3:  (slock-AF_INET6){+.....}, at: [<ffffffff834a5828>] spin_trylock include/linux/spinlock.h:312 [inline]
 #3:  (slock-AF_INET6){+.....}, at: [<ffffffff834a5828>] icmpv6_xmit_lock net/ipv6/icmp.c:120 [inline]
 #3:  (slock-AF_INET6){+.....}, at: [<ffffffff834a5828>] icmp6_send+0x7e8/0x1b80 net/ipv6/icmp.c:485
 #4:  (rcu_read_lock){......}, at: [<ffffffff834a606b>] icmp6_send+0x102b/0x1b80 net/ipv6/icmp.c:517
 #5:  (rcu_read_lock_bh){......}, at: [<ffffffff83429865>] ip6_finish_output2+0x1d5/0x1ca0 net/ipv6/ip6_output.c:71
 #6:  (rcu_read_lock_bh){......}, at: [<ffffffff82f8a747>] __dev_queue_xmit+0x1d7/0x1c80 net/core/dev.c:3139

stack backtrace:
CPU: 1 PID: 3838 Comm: syz-executor587 Not tainted 4.4.141-g1b37d68 #71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 b2691544065b0181 ffff8801db306a48 ffffffff81e0e18d
 ffffffff853eb720 ffffffff853ebf90 ffffffff853eb720 ffff8801d8c2d150
 ffff8801d8c2c800 ffff8801db306a90 ffffffff8140e71b 0000000000000003
Call Trace:
 <IRQ>  [<ffffffff81e0e18d>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81e0e18d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8140e71b>] print_circular_bug.cold.50+0x1bd/0x27d kernel/locking/lockdep.c:1226
 [<ffffffff81232972>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff81232972>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff81232972>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff81232972>] __lock_acquire+0x3902/0x5270 kernel/locking/lockdep.c:3213
 [<ffffffff81235abe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff838c1d36>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
 [<ffffffff838c1d36>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
 [<ffffffff83011a4c>] spin_lock include/linux/spinlock.h:302 [inline]
 [<ffffffff83011a4c>] __netif_tx_lock include/linux/netdevice.h:3299 [inline]
 [<ffffffff83011a4c>] sch_direct_xmit+0x23c/0x6e0 net/sched/sch_generic.c:163
 [<ffffffff82f8b463>] __dev_xmit_skb net/core/dev.c:2957 [inline]
 [<ffffffff82f8b463>] __dev_queue_xmit+0xef3/0x1c80 net/core/dev.c:3175
 [<ffffffff82f8c207>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
 [<ffffffff82fa8cd7>] neigh_resolve_output+0x637/0x790 net/core/neighbour.c:1326
 [<ffffffff83429fb9>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff83429fb9>] ip6_finish_output2+0x929/0x1ca0 net/ipv6/ip6_output.c:113
 [<ffffffff834335f8>] ip6_finish_output+0x3b8/0x760 net/ipv6/ip6_output.c:131
 [<ffffffff83433b58>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff83433b58>] ip6_output+0x1b8/0x520 net/ipv6/ip6_output.c:145
 [<ffffffff8355cf8b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff8355cf8b>] ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:169
 [<ffffffff83435b91>] ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1725
 [<ffffffff83435ee3>] ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1745
 [<ffffffff834a4e4c>] icmpv6_push_pending_frames+0x33c/0x530 net/ipv6/icmp.c:276
 [<ffffffff834a660d>] icmp6_send+0x15cd/0x1b80 net/ipv6/icmp.c:537
 [<ffffffff834a7fc9>] icmpv6_param_prob+0x29/0x40 net/ipv6/icmp.c:551
 [<ffffffff834c34b4>] ip6_frag_queue net/ipv6/reassembly.c:263 [inline]
 [<ffffffff834c34b4>] ipv6_frag_rcv+0x3f94/0x4fd0 net/ipv6/reassembly.c:562
 [<ffffffff83436c7e>] ip6_input_finish+0x32e/0x1550 net/ipv6/ip6_input.c:248
 [<ffffffff83439c66>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff83439c66>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff83439c66>] ip6_input+0xf6/0x200 net/ipv6/ip6_input.c:280
 [<ffffffff8343644d>] dst_input include/net/dst.h:504 [inline]
 [<ffffffff8343644d>] ip6_rcv_finish+0x13d/0x640 net/ipv6/ip6_input.c:62
 [<ffffffff83438f6b>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff83438f6b>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff83438f6b>] ipv6_rcv+0x10cb/0x1cd0 net/ipv6/ip6_input.c:186
 [<ffffffff82f7ebd6>] __netif_receive_skb_core+0x12d6/0x2940 net/core/dev.c:4019
 [<ffffffff82f8029b>] __netif_receive_skb+0x5b/0x1b0 net/core/dev.c:4054
 [<ffffffff82f84826>] process_backlog+0x216/0x6a0 net/core/dev.c:4647
 [<ffffffff82f81662>] napi_poll net/core/dev.c:4885 [inline]
 [<ffffffff82f81662>] net_rx_action+0x3a2/0xdb0 net/core/dev.c:4950
 [<ffffffff838c60ec>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff838c3e9c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:929
 <EOI>  [<ffffffff8113da14>] do_softirq.part.16+0x54/0x60 kernel/softirq.c:317
 [<ffffffff8113f709>] do_softirq+0x19/0x20 kernel/softirq.c:320
 [<ffffffff82f7cb7c>] netif_rx_ni+0xec/0x3a0 net/core/dev.c:3653
 [<ffffffff82752b17>] tun_get_user+0xbe7/0x2410 drivers/net/tun.c:1264
 [<ffffffff82754555>] tun_chr_write_iter+0xd5/0x190 drivers/net/tun.c:1283
 [<ffffffff8151d96c>] do_iter_readv_writev+0x13c/0x1e0 fs/read_write.c:664
 [<ffffffff8151f090>] do_readv_writev+0x2e0/0x6e0 fs/read_write.c:808
 [<ffffffff8151f5bb>] vfs_writev+0x7b/0xb0 fs/read_write.c:847
 [<ffffffff81521a89>] SYSC_writev fs/read_write.c:880 [inline]
 [<ffffffff81521a89>] SyS_writev+0xd9/0x250 fs/read_write.c:872
 [<ffffffff838c2c25>] entry_SYSCALL_64_fastpath+0x22/0x9e