============================================= [ INFO: possible recursive locking detected ] 4.4.174+ #4 Not tainted --------------------------------------------- syz-executor.5/30346 is trying to acquire lock: (_xmit_TUNNEL6#2){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 but task is already holding lock: (_xmit_TUNNEL6#2){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(_xmit_TUNNEL6#2); lock(_xmit_TUNNEL6#2); *** DEADLOCK *** May be due to missing lock nesting notation 10 locks held by syz-executor.5/30346: #0: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1497 [inline] #0: (sk_lock-AF_INET6){+.+.+.}, at: [] inet_stream_connect+0x44/0xa0 net/ipv4/af_inet.c:675 #1: (rcu_read_lock){......}, at: [] inet6_csk_xmit+0x108/0x4b0 net/ipv6/inet6_connection_sock.c:163 #2: (rcu_read_lock_bh){......}, at: [] ip6_finish_output2+0x1e1/0x1dc0 net/ipv6/ip6_output.c:71 #3: (rcu_read_lock_bh){......}, at: [] __dev_queue_xmit+0x1d7/0x1bb0 net/core/dev.c:3161 #4: (_xmit_TUNNEL6#2){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] #4: (_xmit_TUNNEL6#2){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] #4: (_xmit_TUNNEL6#2){+.-...}, at: [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 #5: (rcu_read_lock){......}, at: [] icmpv6_send+0x0/0x1b0 net/ipv6/ip6_icmp.c:30 #6: (slock-AF_INET6){+.-...}, at: [] spin_trylock include/linux/spinlock.h:312 [inline] #6: (slock-AF_INET6){+.-...}, at: [] icmpv6_xmit_lock net/ipv6/icmp.c:120 [inline] #6: (slock-AF_INET6){+.-...}, at: [] icmp6_send+0x7bd/0x1b40 net/ipv6/icmp.c:485 #7: (rcu_read_lock){......}, at: [] icmp6_send+0xf44/0x1b40 net/ipv6/icmp.c:517 #8: (rcu_read_lock_bh){......}, at: [] ip6_finish_output2+0x1e1/0x1dc0 net/ipv6/ip6_output.c:71 #9: (rcu_read_lock_bh){......}, at: [] __dev_queue_xmit+0x1d7/0x1bb0 net/core/dev.c:3161 stack backtrace: CPU: 1 PID: 30346 Comm: syz-executor.5 Not tainted 4.4.174+ #4 0000000000000000 f91c0a58ca5d66b2 ffff8800714ee3d0 ffffffff81aad1a1 ffffffff84057a80 ffff8800a28ddf00 ffffffff83ad5be0 ffff8800a28de868 ffff8800a28de888 ffff8800714ee558 ffffffff813ad6ff 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_deadlock_bug kernel/locking/lockdep.c:1752 [inline] [] check_deadlock kernel/locking/lockdep.c:1796 [inline] [] validate_chain kernel/locking/lockdep.c:2128 [inline] [] __lock_acquire.cold+0x118/0x592 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151 [] spin_lock include/linux/spinlock.h:302 [inline] [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip6_finish_output2+0x9c7/0x1dc0 net/ipv6/ip6_output.c:113 [] ip6_finish_output+0x2f3/0x750 net/ipv6/ip6_output.c:131 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip6_output+0x1b4/0x520 net/ipv6/ip6_output.c:145 [] dst_output include/net/dst.h:498 [inline] [] ip6_local_out+0x9c/0x180 net/ipv6/output_core.c:169 [] ip6_send_skb+0xa2/0x340 net/ipv6/ip6_output.c:1725 [] ip6_push_pending_frames+0xbb/0xe0 net/ipv6/ip6_output.c:1745 [] icmpv6_push_pending_frames+0x336/0x530 net/ipv6/icmp.c:276 [] icmp6_send+0x1506/0x1b40 net/ipv6/icmp.c:537 [] icmpv6_send+0xb1/0x1b0 net/ipv6/ip6_icmp.c:42 [] ip6_link_failure+0x2d/0x3e0 net/ipv6/route.c:1313 [] dst_link_failure include/net/dst.h:481 [inline] [] ip6_tnl_xmit2+0x4da/0x2320 net/ipv6/ip6_tunnel.c:1089 [] ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1193 [inline] [] ip6_tnl_xmit+0x5d5/0xe00 net/ipv6/ip6_tunnel.c:1215 [] __netdev_start_xmit include/linux/netdevice.h:3750 [inline] [] netdev_start_xmit include/linux/netdevice.h:3759 [inline] [] xmit_one net/core/dev.c:2781 [inline] [] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797 [] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip6_finish_output2+0x9c7/0x1dc0 net/ipv6/ip6_output.c:113 [] ip6_finish_output+0x2f3/0x750 net/ipv6/ip6_output.c:131 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip6_output+0x1b4/0x520 net/ipv6/ip6_output.c:145 [] dst_output include/net/dst.h:498 [inline] [] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline] [] NF_HOOK include/linux/netfilter.h:249 [inline] [] ip6_xmit+0xc76/0x1a60 net/ipv6/ip6_output.c:240 [] inet6_csk_xmit+0x24c/0x4b0 net/ipv6/inet6_connection_sock.c:176 [] __tcp_transmit_skb+0x1904/0x2cf0 net/ipv4/tcp_output.c:1034 [] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline] [] tcp_connect+0x223d/0x31b0 net/ipv4/tcp_output.c:3295 [] tcp_v6_connect+0x1391/0x1b30 net/ipv6/tcp_ipv6.c:294 [] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615 [] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676 [] SYSC_connect net/socket.c:1570 [inline] [] SyS_connect+0x1a5/0x2e0 net/socket.c:1551 [] entry_SYSCALL_64_fastpath+0x1e/0x9a audit: type=1400 audit(1571936274.748:1866): avc: denied { create } for pid=30374 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936274.788:1867): avc: denied { write } for pid=30374 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936274.958:1868): avc: denied { read } for pid=30374 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit_printk_skb: 30 callbacks suppressed audit: type=1400 audit(1571936277.588:1880): avc: denied { create } for pid=30497 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936277.558:1879): avc: denied { create } for pid=30493 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936277.658:1881): avc: denied { write } for pid=30497 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936277.688:1882): avc: denied { write } for pid=30493 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936277.888:1883): avc: denied { read } for pid=30497 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936277.918:1884): avc: denied { read } for pid=30493 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936278.528:1885): avc: denied { create } for pid=30541 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936278.558:1886): avc: denied { write } for pid=30541 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936278.648:1887): avc: denied { create } for pid=30548 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936278.728:1888): avc: denied { read } for pid=30541 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit_printk_skb: 99 callbacks suppressed audit: type=1400 audit(1571936282.718:1922): avc: denied { create } for pid=30751 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936282.748:1923): avc: denied { create } for pid=30758 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936282.748:1924): avc: denied { write } for pid=30758 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936282.848:1925): avc: denied { read } for pid=30758 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936282.848:1926): avc: denied { write } for pid=30751 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1571936282.848:1927): avc: denied { read } for pid=30751 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1