============================================ WARNING: possible recursive locking detected 4.16.0-rc7+ #282 Not tainted -------------------------------------------- syz-executor6/14574 is trying to acquire lock: (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] spin_lock include/linux/spinlock.h:310 [inline] (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] __netif_tx_lock include/linux/netdevice.h:3561 [inline] (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325 but task is already holding lock: (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] spin_lock include/linux/spinlock.h:310 [inline] (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] __netif_tx_lock include/linux/netdevice.h:3561 [inline] (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(_xmit_ETHER#2); lock(_xmit_ETHER#2); *** DEADLOCK *** May be due to missing lock nesting notation 11 locks held by syz-executor6/14574: #0: (rcu_read_lock){....}, at: [<000000001c252321>] arch_static_branch arch/x86/include/asm/jump_label.h:36 [inline] #0: (rcu_read_lock){....}, at: [<000000001c252321>] static_key_false include/linux/jump_label.h:142 [inline] #0: (rcu_read_lock){....}, at: [<000000001c252321>] netif_receive_skb_internal+0xa2/0x670 net/core/dev.c:4675 #1: (k-slock-AF_INET){+.-.}, at: [<00000000ec18bfad>] spin_trylock include/linux/spinlock.h:320 [inline] #1: (k-slock-AF_INET){+.-.}, at: [<00000000ec18bfad>] icmp_xmit_lock net/ipv4/icmp.c:219 [inline] #1: (k-slock-AF_INET){+.-.}, at: [<00000000ec18bfad>] icmp_send+0x758/0x19b0 net/ipv4/icmp.c:668 #2: (rcu_read_lock_bh){....}, at: [<00000000847d3523>] lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline] #2: (rcu_read_lock_bh){....}, at: [<00000000847d3523>] ip_finish_output2+0x2aa/0x1550 net/ipv4/ip_output.c:213 #3: (rcu_read_lock_bh){....}, at: [<00000000e68b5f93>] __dev_queue_xmit+0x2fe/0x2fc0 net/core/dev.c:3491 #4: (rcu_read_lock){....}, at: [<0000000001ee978a>] br_dev_xmit+0x11d/0x1550 net/bridge/br_device.c:43 #5: (rcu_read_lock_bh){....}, at: [<00000000e68b5f93>] __dev_queue_xmit+0x2fe/0x2fc0 net/core/dev.c:3491 #6: (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] spin_lock include/linux/spinlock.h:310 [inline] #6: (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] __netif_tx_lock include/linux/netdevice.h:3561 [inline] #6: (_xmit_ETHER#2){+.-.}, at: [<000000009881b2e6>] sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325 #7: (rcu_read_lock_bh){....}, at: [<00000000847d3523>] lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline] #7: (rcu_read_lock_bh){....}, at: [<00000000847d3523>] ip_finish_output2+0x2aa/0x1550 net/ipv4/ip_output.c:213 #8: (rcu_read_lock_bh){....}, at: [<00000000e68b5f93>] __dev_queue_xmit+0x2fe/0x2fc0 net/core/dev.c:3491 #9: (rcu_read_lock){....}, at: [<0000000001ee978a>] br_dev_xmit+0x11d/0x1550 net/bridge/br_device.c:43 #10: (rcu_read_lock_bh){....}, at: [<00000000e68b5f93>] __dev_queue_xmit+0x2fe/0x2fc0 net/core/dev.c:3491 stack backtrace: CPU: 1 PID: 14574 Comm: syz-executor6 Not tainted 4.16.0-rc7+ #282 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_deadlock_bug kernel/locking/lockdep.c:1761 [inline] check_deadlock kernel/locking/lockdep.c:1805 [inline] validate_chain kernel/locking/lockdep.c:2401 [inline] __lock_acquire+0xe8f/0x3e00 kernel/locking/lockdep.c:3431 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] __netif_tx_lock include/linux/netdevice.h:3561 [inline] sch_direct_xmit+0x361/0x1140 net/sched/sch_generic.c:325 qdisc_restart net/sched/sch_generic.c:393 [inline] __qdisc_run+0x57d/0x18e0 net/sched/sch_generic.c:401 __dev_xmit_skb net/core/dev.c:3217 [inline] __dev_queue_xmit+0xb8b/0x2fc0 net/core/dev.c:3525 dev_queue_xmit+0x17/0x20 net/core/dev.c:3590 br_dev_queue_push_xmit+0x196/0x5a0 net/bridge/br_forward.c:55 NF_HOOK include/linux/netfilter.h:288 [inline] br_forward_finish+0xc8/0x530 net/bridge/br_forward.c:67 NF_HOOK include/linux/netfilter.h:288 [inline] __br_forward+0x533/0xc80 net/bridge/br_forward.c:112 br_flood+0x665/0x770 net/bridge/br_forward.c:225 br_dev_xmit+0xa68/0x1550 net/bridge/br_device.c:87 __netdev_start_xmit include/linux/netdevice.h:4066 [inline] netdev_start_xmit include/linux/netdevice.h:4075 [inline] xmit_one net/core/dev.c:3026 [inline] dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3042 __dev_queue_xmit+0x26bf/0x2fc0 net/core/dev.c:3557 dev_queue_xmit+0x17/0x20 net/core/dev.c:3590 neigh_hh_output include/net/neighbour.h:472 [inline] neigh_output include/net/neighbour.h:480 [inline] ip_finish_output2+0xf4d/0x1550 net/ipv4/ip_output.c:229 ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:277 [inline] ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390 dst_output include/net/dst.h:443 [inline] ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124 iptunnel_xmit+0x556/0x810 net/ipv4/ip_tunnel_core.c:91 ip_tunnel_xmit+0x177b/0x3550 net/ipv4/ip_tunnel.c:785 __gre_xmit+0x546/0x8b0 net/ipv4/ip_gre.c:449 erspan_xmit+0x779/0x22a0 net/ipv4/ip_gre.c:728 __netdev_start_xmit include/linux/netdevice.h:4066 [inline] netdev_start_xmit include/linux/netdevice.h:4075 [inline] xmit_one net/core/dev.c:3026 [inline] dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3042 sch_direct_xmit+0x40d/0x1140 net/sched/sch_generic.c:327 qdisc_restart net/sched/sch_generic.c:393 [inline] __qdisc_run+0x57d/0x18e0 net/sched/sch_generic.c:401 __dev_xmit_skb net/core/dev.c:3217 [inline] __dev_queue_xmit+0xb8b/0x2fc0 net/core/dev.c:3525 dev_queue_xmit+0x17/0x20 net/core/dev.c:3590 br_dev_queue_push_xmit+0x196/0x5a0 net/bridge/br_forward.c:55 NF_HOOK include/linux/netfilter.h:288 [inline] br_forward_finish+0xc8/0x530 net/bridge/br_forward.c:67 NF_HOOK include/linux/netfilter.h:288 [inline] __br_forward+0x533/0xc80 net/bridge/br_forward.c:112 br_flood+0x665/0x770 net/bridge/br_forward.c:225 br_dev_xmit+0xa68/0x1550 net/bridge/br_device.c:87 __netdev_start_xmit include/linux/netdevice.h:4066 [inline] netdev_start_xmit include/linux/netdevice.h:4075 [inline] xmit_one net/core/dev.c:3026 [inline] dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3042 __dev_queue_xmit+0x26bf/0x2fc0 net/core/dev.c:3557 dev_queue_xmit+0x17/0x20 net/core/dev.c:3590 neigh_resolve_output+0x5e2/0xa00 net/core/neighbour.c:1350 neigh_output include/net/neighbour.h:482 [inline] ip_finish_output2+0x91a/0x1550 net/ipv4/ip_output.c:229 ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:277 [inline] ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390 dst_output include/net/dst.h:443 [inline] ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124 ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1414 ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1434 icmp_push_reply+0x395/0x4f0 net/ipv4/icmp.c:394 icmp_send+0x1136/0x19b0 net/ipv4/icmp.c:741 ip_options_compile+0xc21/0x1a50 net/ipv4/ip_options.c:472 ip_rcv_options net/ipv4/ip_input.c:284 [inline] ip_rcv_finish+0x8ee/0x2040 net/ipv4/ip_input.c:365 NF_HOOK include/linux/netfilter.h:288 [inline] ip_rcv+0xb76/0x1820 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x1a41/0x3460 net/core/dev.c:4562 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4627 netif_receive_skb_internal+0x10b/0x670 net/core/dev.c:4701 netif_receive_skb+0xae/0x390 net/core/dev.c:4725 tun_rx_batched.isra.50+0x5ee/0x870 drivers/net/tun.c:1555 tun_get_user+0x299e/0x3c20 drivers/net/tun.c:1962 tun_chr_write_iter+0xb9/0x160 drivers/net/tun.c:1990 call_write_iter include/linux/fs.h:1782 [inline] do_iter_readv_writev+0x55c/0x830 fs/read_write.c:653 do_iter_write+0x154/0x540 fs/read_write.c:932 compat_writev+0x225/0x420 fs/read_write.c:1246 do_compat_writev+0x115/0x220 fs/read_write.c:1267 C_SYSC_writev fs/read_write.c:1278 [inline] compat_SyS_writev+0x26/0x30 fs/read_write.c:1274 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7fd6c99 RSP: 002b:00000000f5fd2044 EFLAGS: 00000292 ORIG_RAX: 0000000000000092 RAX: ffffffffffffffda RBX: 00000000000000fc RCX: 00000000f5fd2094 RDX: 0000000000000001 RSI: 000000000813af00 RDI: 00000000ffffffff RBP: 00000000f5fd2158 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000