============================================
WARNING: possible recursive locking detected
6.1.139-syzkaller #0 Not tainted
--------------------------------------------
syz-executor/12597 is trying to acquire lock:
ffff888076e4ea18 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888076e4ea18 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3925 [inline]
ffff888076e4ea18 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_queue_xmit+0x208f/0x3760 net/core/dev.c:4300
but task is already holding lock:
ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline]
ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline]
ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3882 [inline]
ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_queue_xmit+0x129a/0x3760 net/core/dev.c:4300
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
lock(dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
*** DEADLOCK ***
May be due to missing lock nesting notation
16 locks held by syz-executor/12597:
#0: ffff88805d93d3d8 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline]
#0: ffff88805d93d3d8 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5322 [inline]
#0: ffff88805d93d3d8 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x2e/0x2f0 mm/memory.c:5384
#1: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#1: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#1: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: filemap_map_pages+0x18b/0x10d0 mm/filemap.c:3444
#2: ffff88801d371a38 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#2: ffff88801d371a38 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: filemap_map_pages+0x8c1/0x10d0 mm/filemap.c:3455
#3: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#3: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#3: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: folio_memcg_lock+0x85/0x2e0 mm/memcontrol.c:2103
#4: ffffc900001e0bc0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc1/0x670 kernel/time/timer.c:1501
#5: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#5: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#5: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: ndisc_send_skb+0x1f2/0x1510 net/ipv6/ndisc.c:484
#6: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#6: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#6: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: ip6_finish_output2+0x593/0x1590 net/ipv6/ip6_output.c:123
#7: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#7: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
#7: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x26f/0x3760 net/core/dev.c:4257
#8: ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#8: ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline]
#8: ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3882 [inline]
#8: ffff888073cfd258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+.-.}-{2:2}, at: __dev_queue_xmit+0x129a/0x3760 net/core/dev.c:4300
#9: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#9: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#9: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: ip6_finish_output2+0x593/0x1590 net/ipv6/ip6_output.c:123
#10: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#10: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
#10: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x26f/0x3760 net/core/dev.c:4257
#11: ffff88802f7987f0 (k-slock-AF_INET6){+.-.}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#11: ffff88802f7987f0 (k-slock-AF_INET6){+.-.}-{2:2}, at: icmpv6_xmit_lock net/ipv6/icmp.c:108 [inline]
#11: ffff88802f7987f0 (k-slock-AF_INET6){+.-.}-{2:2}, at: icmp6_send+0xb5f/0x18d0 net/ipv6/icmp.c:553
#12: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#12: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: icmp6_send+0xaa6/0x18d0 net/ipv6/icmp.c:544
#13: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#13: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#13: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: ip6_send_skb+0x10b/0x380 net/ipv6/ip6_output.c:2007
#14: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#14: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#14: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: ip6_finish_output2+0x593/0x1590 net/ipv6/ip6_output.c:123
#15: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#15: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
#15: ffffffff8c92ab80 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x26f/0x3760 net/core/dev.c:4257
stack backtrace:
CPU: 1 PID: 12597 Comm: syz-executor Not tainted 6.1.139-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
__lock_acquire+0x122f/0x7c50 kernel/locking/lockdep.c:-1
lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
__dev_xmit_skb net/core/dev.c:3925 [inline]
__dev_queue_xmit+0x208f/0x3760 net/core/dev.c:4300
neigh_output include/net/neighbour.h:544 [inline]
ip6_finish_output2+0xda2/0x1590 net/ipv6/ip6_output.c:138
__ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
ip6_finish_output+0x5d3/0xa60 net/ipv6/ip6_output.c:216
ip6_send_skb+0x1d1/0x380 net/ipv6/ip6_output.c:2008
icmp6_send+0x1292/0x18d0 net/ipv6/icmp.c:632
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
ip6_link_failure+0x37/0x4c0 net/ipv6/route.c:2827
dst_link_failure include/net/dst.h:423 [inline]
ipip6_tunnel_xmit net/ipv6/sit.c:1039 [inline]
sit_tunnel_xmit+0xaf0/0x1f60 net/ipv6/sit.c:1076
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x262/0x870 net/core/dev.c:3674
sch_direct_xmit+0x24e/0x4a0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0xadf/0x15f0 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3958 [inline]
__dev_queue_xmit+0x107e/0x3760 net/core/dev.c:4300
neigh_output include/net/neighbour.h:544 [inline]
ip6_finish_output2+0xda2/0x1590 net/ipv6/ip6_output.c:138
__ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
ip6_finish_output+0x5d3/0xa60 net/ipv6/ip6_output.c:216
ip6tunnel_xmit+0x1a6/0x3a0 include/net/ip6_tunnel.h:161
ip6_tnl_xmit+0x225b/0x2ab0 net/ipv6/ip6_tunnel.c:1280
__gre6_xmit+0x960/0xc70 net/ipv6/ip6_gre.c:809
ip6gre_xmit_ipv6 net/ipv6/ip6_gre.c:865 [inline]
ip6gre_tunnel_xmit+0xf76/0x13d0 net/ipv6/ip6_gre.c:937
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x262/0x870 net/core/dev.c:3674
sch_direct_xmit+0x24e/0x4a0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3895 [inline]
__dev_queue_xmit+0x18cd/0x3760 net/core/dev.c:4300
neigh_output include/net/neighbour.h:544 [inline]
ip6_finish_output2+0xda2/0x1590 net/ipv6/ip6_output.c:138
__ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
ip6_finish_output+0x5d3/0xa60 net/ipv6/ip6_output.c:216
dst_output include/net/dst.h:453 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ndisc_send_skb+0xbfb/0x1510 net/ipv6/ndisc.c:513
addrconf_rs_timer+0x2b8/0x600 net/ipv6/addrconf.c:3985
call_timer_fn+0x1a0/0x670 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1549 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
handle_softirqs+0x2a1/0x920 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:661
irq_exit_rcu+0x5/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:instrument_atomic_read include/linux/instrumented.h:72 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
RIP: 0010:folio_memcg_lock+0x18b/0x2e0 mm/memcontrol.c:2118
Code: 48 c7 44 24 60 00 00 00 00 9c 8f 44 24 60 f6 44 24 61 02 0f 85 85 00 00 00 41 f7 c5 00 02 00 00 74 01 fb 4d 8d a7 40 09 00 00 <4c> 89 e7 be 04 00 00 00 e8 78 8e f9 ff 4c 89 e0 48 c1 e8 03 48 b9
RSP: 0000:ffffc90003d97940 EFLAGS: 00000206
RAX: 83d0ed671bee2400 RBX: ffffea0001c8c180 RCX: 83d0ed671bee2400
RDX: dffffc0000000000 RSI: ffffffff8a6c0000 RDI: ffffffff8abf1020
RBP: ffffc90003d97a18 R08: dffffc0000000000 R09: fffffbfff2117049
R10: fffffbfff2117049 R11: 1ffffffff2117048 R12: ffff88813ff70940
R13: 0000000000000286 R14: ffffffff81d8bc75 R15: ffff88813ff70000
page_add_file_rmap+0xe3/0x1500 mm/rmap.c:1293
do_set_pte+0x2f4/0x460 mm/memory.c:4424
filemap_map_pages+0xcab/0x10d0 mm/filemap.c:3481
do_fault_around mm/memory.c:4600 [inline]
do_read_fault mm/memory.c:4626 [inline]
do_fault mm/memory.c:4760 [inline]
handle_pte_fault mm/memory.c:5031 [inline]
__handle_mm_fault mm/memory.c:5173 [inline]
handle_mm_fault+0x2889/0x3e70 mm/memory.c:5294
do_user_addr_fault+0x51f/0xb10 arch/x86/mm/fault.c:1340
handle_page_fault arch/x86/mm/fault.c:1431 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1487
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f0a035a973b
Code: b9 cd cc cc cc cc cc cc cc 48 89 f1 0f 1f 00 48 89 f8 48 89 fe 48 83 e9 01 49 f7 e1 48 c1 ea 03 48 8d 04 92 48 01 c0 48 29 c6 <41> 0f b6 04 30 88 01 48 89 f8 48 89 d7 48 83 f8 09 77 d2 48 89 c8
RSP: 002b:00007fff3352ba58 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 00007fff3352bfc0 RCX: 00007fff3352bf67
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000009
RBP: 0000000000000016 R08: 00007f0a0364db20 R09: cccccccccccccccd
R10: 00000000ffffffff R11: 0000000000000001 R12: 0000000000000075
R13: 00007fff3352c140 R14: 00007fff3352bf68 R15: 0000000000000009
----------------
Code disassembly (best guess):
0: 48 c7 44 24 60 00 00 movq $0x0,0x60(%rsp)
7: 00 00
9: 9c pushf
a: 8f 44 24 60 pop 0x60(%rsp)
e: f6 44 24 61 02 testb $0x2,0x61(%rsp)
13: 0f 85 85 00 00 00 jne 0x9e
19: 41 f7 c5 00 02 00 00 test $0x200,%r13d
20: 74 01 je 0x23
22: fb sti
23: 4d 8d a7 40 09 00 00 lea 0x940(%r15),%r12
* 2a: 4c 89 e7 mov %r12,%rdi <-- trapping instruction
2d: be 04 00 00 00 mov $0x4,%esi
32: e8 78 8e f9 ff call 0xfff98eaf
37: 4c 89 e0 mov %r12,%rax
3a: 48 c1 e8 03 shr $0x3,%rax
3e: 48 rex.W
3f: b9 .byte 0xb9