======================================================
[ INFO: possible circular locking dependency detected ]
4.4.169+ #7 Not tainted
-------------------------------------------------------
syz-executor1/28598 is trying to acquire lock:
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff823b6a5b>] spin_lock include/linux/spinlock.h:302 [inline]
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff823b6a5b>] ip_defrag+0x31b/0x40c0 net/ipv4/ip_fragment.c:680

but task is already holding lock:
 (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] spin_lock include/linux/spinlock.h:302 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] __netif_tx_lock include/linux/netdevice.h:3306 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] sch_direct_xmit+0x233/0x6c0 net/sched/sch_generic.c:163

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff8120384e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff827155ce>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline]
       [<ffffffff827155ce>] _raw_spin_lock_irqsave+0x4e/0x70 kernel/locking/spinlock.c:159
       [<ffffffff8124f655>] lock_timer_base+0xd5/0x170 kernel/time/timer.c:779
       [<ffffffff8125752b>] del_timer+0xdb/0x1b0 kernel/time/timer.c:1037
       [<ffffffff824def21>] inet_frag_kill+0x21/0x1d0 net/ipv4/inet_fragment.c:279
       [<ffffffff82690d24>] nf_ct_frag6_reasm net/ipv6/netfilter/nf_conntrack_reasm.c:386 [inline]
       [<ffffffff82690d24>] nf_ct_frag6_gather+0x1364/0x34e0 net/ipv6/netfilter/nf_conntrack_reasm.c:623
       [<ffffffff8268f2ea>] ipv6_defrag+0x21a/0x5c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:66
       [<ffffffff822f3c32>] nf_iterate+0x182/0x210 net/netfilter/core.c:274
       [<ffffffff822f3e76>] nf_hook_slow+0x1b6/0x340 net/netfilter/core.c:306
       [<ffffffff825b24b5>] nf_hook_thresh include/linux/netfilter.h:187 [inline]
       [<ffffffff825b24b5>] NF_HOOK_THRESH include/linux/netfilter.h:224 [inline]
       [<ffffffff825b24b5>] NF_HOOK include/linux/netfilter.h:249 [inline]
       [<ffffffff825b24b5>] ipv6_rcv+0x1455/0x1d10 net/ipv6/ip6_input.c:186
       [<ffffffff8222a868>] __netif_receive_skb_core+0x12c8/0x2820 net/core/dev.c:4041
       [<ffffffff82232f1b>] __netif_receive_skb+0x5b/0x1c0 net/core/dev.c:4076
       [<ffffffff8223a2ba>] process_backlog+0x20a/0x670 net/core/dev.c:4673
       [<ffffffff822396c7>] napi_poll net/core/dev.c:4911 [inline]
       [<ffffffff822396c7>] net_rx_action+0x367/0xd50 net/core/dev.c:4976
       [<ffffffff8271922a>] __do_softirq+0x22a/0xa3e kernel/softirq.c:273
       [<ffffffff8271741c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:956
       [<ffffffff810e2204>] do_softirq.part.2+0x54/0x60 kernel/softirq.c:317
       [<ffffffff810e2369>] do_softirq+0x19/0x20 kernel/softirq.c:320
       [<ffffffff82228ecc>] netif_rx_ni+0xec/0x3a0 net/core/dev.c:3675
       [<ffffffff81e1c58a>] tun_get_user+0xf3a/0x2690 drivers/net/tun.c:1264
       [<ffffffff81e1def5>] tun_chr_write_iter+0xd5/0x190 drivers/net/tun.c:1283
       [<ffffffff81492723>] do_iter_readv_writev+0x133/0x1d0 fs/read_write.c:664
       [<ffffffff814942a7>] compat_do_readv_writev+0x337/0x6f0 fs/read_write.c:982
       [<ffffffff81494a01>] compat_writev+0xe1/0x150 fs/read_write.c:1090
       [<ffffffff81496d18>] C_SYSC_writev fs/read_write.c:1110 [inline]
       [<ffffffff81496d18>] compat_SyS_writev+0xd8/0x1c0 fs/read_write.c:1099
       [<ffffffff81006101>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff81006101>] do_fast_syscall_32+0x321/0xa80 arch/x86/entry/common.c:397
       [<ffffffff82717a90>] sysenter_flags_fixed+0xd/0x1a

       [<ffffffff81200384>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff81200384>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff81200384>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff81200384>] __lock_acquire+0x3cd4/0x5530 kernel/locking/lockdep.c:3213
       [<ffffffff8120384e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff82715416>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
       [<ffffffff82715416>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
       [<ffffffff823b6a5b>] spin_lock include/linux/spinlock.h:302 [inline]
       [<ffffffff823b6a5b>] ip_defrag+0x31b/0x40c0 net/ipv4/ip_fragment.c:680
       [<ffffffff823baba7>] ip_check_defrag+0x3a7/0x700 net/ipv4/ip_fragment.c:728
       [<ffffffff826dd28a>] packet_rcv_fanout+0x52a/0x5e0 net/packet/af_packet.c:1458
       [<ffffffff8223eff0>] deliver_skb net/core/dev.c:1842 [inline]
       [<ffffffff8223eff0>] dev_queue_xmit_nit net/core/dev.c:1898 [inline]
       [<ffffffff8223eff0>] xmit_one net/core/dev.c:2777 [inline]
       [<ffffffff8223eff0>] dev_hard_start_xmit+0x280/0x11c0 net/core/dev.c:2797
       [<ffffffff822acf68>] sch_direct_xmit+0x2b8/0x6c0 net/sched/sch_generic.c:165
       [<ffffffff822411b5>] __dev_xmit_skb net/core/dev.c:2979 [inline]
       [<ffffffff822411b5>] __dev_queue_xmit+0xf95/0x1c30 net/core/dev.c:3197
       [<ffffffff82241e67>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3263
       [<ffffffff823c2970>] neigh_hh_output include/net/neighbour.h:486 [inline]
       [<ffffffff823c2970>] dst_neigh_output include/net/dst.h:459 [inline]
       [<ffffffff823c2970>] ip_finish_output2+0xd70/0x12a0 net/ipv4/ip_output.c:213
       [<ffffffff823c4f10>] ip_do_fragment+0x1870/0x1f60 net/ipv4/ip_output.c:635
       [<ffffffff823c8be5>] ip_fragment.constprop.5+0x145/0x200 net/ipv4/ip_output.c:505
       [<ffffffff823c9036>] ip_finish_output+0x396/0xc00 net/ipv4/ip_output.c:286
       [<ffffffff823cc7b7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
       [<ffffffff823cc7b7>] ip_mc_output+0x237/0x980 net/ipv4/ip_output.c:347
       [<ffffffff823ca03b>] dst_output include/net/dst.h:498 [inline]
       [<ffffffff823ca03b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
       [<ffffffff823cfd5c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
       [<ffffffff82474f83>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
       [<ffffffff8247573e>] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870
       [<ffffffff8247cac5>] udp_sendpage+0x2a5/0x400 net/ipv4/udp.c:1183
       [<ffffffff824a65d1>] inet_sendpage+0x221/0x510 net/ipv4/af_inet.c:772
       [<ffffffff821d1d43>] kernel_sendpage+0x93/0xf0 net/socket.c:3320
       [<ffffffff821d1e2c>] sock_sendpage+0x8c/0xc0 net/socket.c:793
       [<ffffffff8152b1c6>] pipe_to_sendpage+0x266/0x330 fs/splice.c:724
       [<ffffffff8152dfc4>] splice_from_pipe_feed fs/splice.c:776 [inline]
       [<ffffffff8152dfc4>] __splice_from_pipe+0x364/0x790 fs/splice.c:901
       [<ffffffff81531089>] splice_from_pipe+0xf9/0x170 fs/splice.c:936
       [<ffffffff8153113c>] generic_splice_sendpage+0x3c/0x50 fs/splice.c:1109
       [<ffffffff81532251>] do_splice_from fs/splice.c:1128 [inline]
       [<ffffffff81532251>] do_splice fs/splice.c:1404 [inline]
       [<ffffffff81532251>] SYSC_splice fs/splice.c:1707 [inline]
       [<ffffffff81532251>] SyS_splice+0xde1/0x1430 fs/splice.c:1690
       [<ffffffff81006101>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff81006101>] do_fast_syscall_32+0x321/0xa80 arch/x86/entry/common.c:397
       [<ffffffff82717a90>] sysenter_flags_fixed+0xd/0x1a

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(_xmit_NETROM);
                               lock(&(&q->lock)->rlock);
                               lock(_xmit_NETROM);
  lock(&(&q->lock)->rlock);

 *** DEADLOCK ***

6 locks held by syz-executor1/28598:
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814aa5de>] pipe_lock_nested fs/pipe.c:65 [inline]
 #0:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814aa5de>] pipe_lock+0x5e/0x70 fs/pipe.c:73
 #1:  (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff8247c942>] lock_sock include/net/sock.h:1493 [inline]
 #1:  (sk_lock-AF_INET){+.+.+.}, at: [<ffffffff8247c942>] udp_sendpage+0x122/0x400 net/ipv4/udp.c:1160
 #2:  (rcu_read_lock_bh){......}, at: [<ffffffff823c1e0f>] ip_finish_output2+0x20f/0x12a0 net/ipv4/ip_output.c:193
 #3:  (rcu_read_lock_bh){......}, at: [<ffffffff822403f7>] __dev_queue_xmit+0x1d7/0x1c30 net/core/dev.c:3161
 #4:  (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] spin_lock include/linux/spinlock.h:302 [inline]
 #4:  (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] __netif_tx_lock include/linux/netdevice.h:3306 [inline]
 #4:  (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] sch_direct_xmit+0x233/0x6c0 net/sched/sch_generic.c:163
 #5:  (rcu_read_lock){......}, at: [<ffffffff8223ee18>] xmit_one net/core/dev.c:2776 [inline]
 #5:  (rcu_read_lock){......}, at: [<ffffffff8223ee18>] dev_hard_start_xmit+0xa8/0x11c0 net/core/dev.c:2797

stack backtrace:
CPU: 1 PID: 28598 Comm: syz-executor1 Not tainted 4.4.169+ #7
 0000000000000000 8cdcd16d1ae3fee0 ffff880094db6d40 ffffffff81aa635d
 ffffffff83af1ce0 ffffffff83af1ce0 ffff8800b3b597c0 ffffffff83ad1be0
 ffff8800b3b5a148 ffff880094db6d90 ffffffff813a9589 ffff8800b3b597c0
Call Trace:
 [<ffffffff81aa635d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aa635d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff813a9589>] print_circular_bug.cold.31+0x2f6/0x435 kernel/locking/lockdep.c:1226
 [<ffffffff81200384>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff81200384>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff81200384>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff81200384>] __lock_acquire+0x3cd4/0x5530 kernel/locking/lockdep.c:3213
 [<ffffffff8120384e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff82715416>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
 [<ffffffff82715416>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
 [<ffffffff823b6a5b>] spin_lock include/linux/spinlock.h:302 [inline]
 [<ffffffff823b6a5b>] ip_defrag+0x31b/0x40c0 net/ipv4/ip_fragment.c:680
 [<ffffffff823baba7>] ip_check_defrag+0x3a7/0x700 net/ipv4/ip_fragment.c:728
 [<ffffffff826dd28a>] packet_rcv_fanout+0x52a/0x5e0 net/packet/af_packet.c:1458
 [<ffffffff8223eff0>] deliver_skb net/core/dev.c:1842 [inline]
 [<ffffffff8223eff0>] dev_queue_xmit_nit net/core/dev.c:1898 [inline]
 [<ffffffff8223eff0>] xmit_one net/core/dev.c:2777 [inline]
 [<ffffffff8223eff0>] dev_hard_start_xmit+0x280/0x11c0 net/core/dev.c:2797
 [<ffffffff822acf68>] sch_direct_xmit+0x2b8/0x6c0 net/sched/sch_generic.c:165
 [<ffffffff822411b5>] __dev_xmit_skb net/core/dev.c:2979 [inline]
 [<ffffffff822411b5>] __dev_queue_xmit+0xf95/0x1c30 net/core/dev.c:3197
 [<ffffffff82241e67>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3263
 [<ffffffff823c2970>] neigh_hh_output include/net/neighbour.h:486 [inline]
 [<ffffffff823c2970>] dst_neigh_output include/net/dst.h:459 [inline]
 [<ffffffff823c2970>] ip_finish_output2+0xd70/0x12a0 net/ipv4/ip_output.c:213
 [<ffffffff823c4f10>] ip_do_fragment+0x1870/0x1f60 net/ipv4/ip_output.c:635
 [<ffffffff823c8be5>] ip_fragment.constprop.5+0x145/0x200 net/ipv4/ip_output.c:505
 [<ffffffff823c9036>] ip_finish_output+0x396/0xc00 net/ipv4/ip_output.c:286
 [<ffffffff823cc7b7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823cc7b7>] ip_mc_output+0x237/0x980 net/ipv4/ip_output.c:347
 [<ffffffff823ca03b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823ca03b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823cfd5c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
 [<ffffffff82474f83>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
 [<ffffffff8247573e>] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870
 [<ffffffff8247cac5>] udp_sendpage+0x2a5/0x400 net/ipv4/udp.c:1183
 [<ffffffff824a65d1>] inet_sendpage+0x221/0x510 net/ipv4/af_inet.c:772
 [<ffffffff821d1d43>] kernel_sendpage+0x93/0xf0 net/socket.c:3320
 [<ffffffff821d1e2c>] sock_sendpage+0x8c/0xc0 net/socket.c:793
 [<ffffffff8152b1c6>] pipe_to_sendpage+0x266/0x330 fs/splice.c:724
 [<ffffffff8152dfc4>] splice_from_pipe_feed fs/splice.c:776 [inline]
 [<ffffffff8152dfc4>] __splice_from_pipe+0x364/0x790 fs/splice.c:901
 [<ffffffff81531089>] splice_from_pipe+0xf9/0x170 fs/splice.c:936
 [<ffffffff8153113c>] generic_splice_sendpage+0x3c/0x50 fs/splice.c:1109
 [<ffffffff81532251>] do_splice_from fs/splice.c:1128 [inline]
 [<ffffffff81532251>] do_splice fs/splice.c:1404 [inline]
 [<ffffffff81532251>] SYSC_splice fs/splice.c:1707 [inline]
 [<ffffffff81532251>] SyS_splice+0xde1/0x1430 fs/splice.c:1690
 [<ffffffff81006101>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff81006101>] do_fast_syscall_32+0x321/0xa80 arch/x86/entry/common.c:397
 [<ffffffff82717a90>] sysenter_flags_fixed+0xd/0x1a
input: syz1 as /devices/virtual/input/input130
binder: 28662:28666 transaction failed 29189/-22, size 24-8 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
binder: 28683:28686 transaction failed 29189/-22, size 24-8 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
binder: 28702:28713 transaction failed 29189/-22, size 24-8 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
binder: 28735:28743 transaction failed 29189/-22, size 24-8 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
binder: 28759:28762 transaction failed 29189/-22, size 24-8 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
binder: 28789:28791 transaction failed 29189/-22, size 24-8 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
binder: 28865:28870 ioctl c0306201 0 returned -14
audit_printk_skb: 42 callbacks suppressed
audit: type=1400 audit(1546100561.243:355): avc:  denied  { create } for  pid=28839 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100561.753:356): avc:  denied  { create } for  pid=28904 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100562.243:357): avc:  denied  { create } for  pid=28973 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
binder: 29015:29018 transaction failed 29189/-22, size 0-8 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
binder: 29025:29037 transaction failed 29189/-22, size 0-0 line 3014
binder: undelivered TRANSACTION_ERROR: 29189
audit: type=1400 audit(1546100562.723:358): avc:  denied  { create } for  pid=29035 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100563.203:359): avc:  denied  { create } for  pid=29090 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100563.853:360): avc:  denied  { create } for  pid=29151 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100564.483:361): avc:  denied  { create } for  pid=29223 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100565.353:362): avc:  denied  { create } for  pid=29287 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100565.753:363): avc:  denied  { create } for  pid=29330 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1546100566.093:364): avc:  denied  { create } for  pid=29371 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit_printk_skb: 3 callbacks suppressed
audit: type=1400 audit(1546100566.973:366): avc:  denied  { create } for  pid=29453 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0