======================================================
[ INFO: possible circular locking dependency detected ]
4.4.174+ #17 Not tainted
-------------------------------------------------------
syz-executor.2/11855 is trying to acquire lock:
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff823ba312>] spin_lock include/linux/spinlock.h:302 [inline]
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff823ba312>] ip_defrag+0x322/0x3b70 net/ipv4/ip_fragment.c:690

but task is already holding lock:
 (_xmit_NETROM){+.-...}, at: [<ffffffff822b1b58>] spin_lock include/linux/spinlock.h:302 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff822b1b58>] __netif_tx_lock include/linux/netdevice.h:3306 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff822b1b58>] sch_direct_xmit+0x238/0x700 net/sched/sch_generic.c:163

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff81205f6e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff82717c98>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
       [<ffffffff82717c98>] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151
       [<ffffffff81a550a8>] spin_lock include/linux/spinlock.h:302 [inline]
       [<ffffffff81a550a8>] task_lock include/linux/sched.h:2969 [inline]
       [<ffffffff81a550a8>] create_task_io_context+0x288/0x410 block/blk-ioc.c:260
       [<ffffffff81a3a2fa>] create_io_context block/blk.h:288 [inline]
       [<ffffffff81a3a2fa>] generic_make_request_checks+0xd1a/0x13b0 block/blk-core.c:1982
       [<ffffffff81a401ae>] generic_make_request+0x7e/0x800 block/blk-core.c:2032
       [<ffffffff81a40a1d>] submit_bio+0xed/0x3b0 block/blk-core.c:2150
       [<ffffffff815457ed>] submit_bh_wbc.isra.0+0x33d/0x4a0 fs/buffer.c:3045
       [<ffffffff81549fc1>] submit_bh fs/buffer.c:3057 [inline]
       [<ffffffff81549fc1>] __sync_dirty_buffer+0xf1/0x1d0 fs/buffer.c:3142
       [<ffffffff8154a0bb>] sync_dirty_buffer+0x1b/0x20 fs/buffer.c:3155
       [<ffffffff817097be>] __ext4_handle_dirty_metadata+0x16e/0x4b0 fs/ext4/ext4_jbd2.c:295
       [<ffffffff8174b162>] ext4_handle_dirty_xattr_block fs/ext4/xattr.c:166 [inline]
       [<ffffffff8174b162>] ext4_xattr_block_set+0x1f52/0x29b0 fs/ext4/xattr.c:848
       [<ffffffff8174ed1b>] ext4_xattr_set_handle+0x73b/0xb20 fs/ext4/xattr.c:1187
       [<ffffffff8174f39f>] ext4_xattr_set+0x29f/0x460 fs/ext4/xattr.c:1251
       [<ffffffff81750f10>] ext4_xattr_user_set+0x110/0x180 fs/ext4/xattr_user.c:55
       [<ffffffff8150c025>] generic_removexattr+0x105/0x170 fs/xattr.c:785
       [<ffffffff8150c683>] vfs_removexattr+0x153/0x2a0 fs/xattr.c:304
       [<ffffffff8150c88c>] removexattr+0xbc/0x110 fs/xattr.c:612
       [<ffffffff8150e7c5>] SYSC_fremovexattr fs/xattr.c:659 [inline]
       [<ffffffff8150e7c5>] SyS_fremovexattr+0x105/0x170 fs/xattr.c:649
       [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
       [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a

       [<ffffffff81202d86>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff81202d86>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff81202d86>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff81202d86>] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213
       [<ffffffff81205f6e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff82717c98>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
       [<ffffffff82717c98>] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151
       [<ffffffff823ba312>] spin_lock include/linux/spinlock.h:302 [inline]
       [<ffffffff823ba312>] ip_defrag+0x322/0x3b70 net/ipv4/ip_fragment.c:690
       [<ffffffff823bdf36>] ip_check_defrag net/ipv4/ip_fragment.c:738 [inline]
       [<ffffffff823bdf36>] ip_check_defrag+0x3d6/0x5b0 net/ipv4/ip_fragment.c:705
       [<ffffffff826dfb3e>] packet_rcv_fanout+0x51e/0x5f0 net/packet/af_packet.c:1458
       [<ffffffff82244b38>] deliver_skb net/core/dev.c:1842 [inline]
       [<ffffffff82244b38>] dev_queue_xmit_nit net/core/dev.c:1898 [inline]
       [<ffffffff82244b38>] xmit_one net/core/dev.c:2777 [inline]
       [<ffffffff82244b38>] dev_hard_start_xmit+0x288/0x11e0 net/core/dev.c:2797
       [<ffffffff822b1bd6>] sch_direct_xmit+0x2b6/0x700 net/sched/sch_generic.c:165
       [<ffffffff82246aa4>] __dev_xmit_skb net/core/dev.c:2979 [inline]
       [<ffffffff82246aa4>] __dev_queue_xmit+0xd24/0x1bb0 net/core/dev.c:3197
       [<ffffffff82247948>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
       [<ffffffff823c5962>] neigh_hh_output include/net/neighbour.h:486 [inline]
       [<ffffffff823c5962>] dst_neigh_output include/net/dst.h:459 [inline]
       [<ffffffff823c5962>] ip_finish_output2+0xbf2/0x1280 net/ipv4/ip_output.c:213
       [<ffffffff823c805c>] ip_do_fragment+0x187c/0x1f70 net/ipv4/ip_output.c:635
       [<ffffffff823cbd7b>] ip_fragment.constprop.0+0x14b/0x200 net/ipv4/ip_output.c:505
       [<ffffffff823cc1e9>] ip_finish_output+0x3b9/0xc60 net/ipv4/ip_output.c:286
       [<ffffffff823d04a7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
       [<ffffffff823d04a7>] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362
       [<ffffffff823cd21c>] dst_output include/net/dst.h:498 [inline]
       [<ffffffff823cd21c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119
       [<ffffffff823d300e>] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453
       [<ffffffff82478ded>] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842
       [<ffffffff824795ae>] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870
       [<ffffffff8247f63b>] udp_sendmsg+0x116b/0x1c60 net/ipv4/udp.c:1104
       [<ffffffff8261430d>] udpv6_sendmsg+0x1e5d/0x24f0 net/ipv6/udp.c:1178
       [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
       [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
       [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
       [<ffffffff821d9e69>] ___sys_sendmsg+0x369/0x890 net/socket.c:1975
       [<ffffffff821dd386>] __sys_sendmmsg+0x1d6/0x2e0 net/socket.c:2053
       [<ffffffff822ace22>] C_SYSC_sendmmsg net/compat.c:731 [inline]
       [<ffffffff822ace22>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:728
       [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
       [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(_xmit_NETROM);
                               lock(&(&q->lock)->rlock);
                               lock(_xmit_NETROM);
  lock(&(&q->lock)->rlock);

 *** DEADLOCK ***

5 locks held by syz-executor.2/11855:
 #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff8247f324>] lock_sock include/net/sock.h:1497 [inline]
 #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff8247f324>] udp_sendmsg+0xe54/0x1c60 net/ipv4/udp.c:922
 #1:  (rcu_read_lock_bh){......}, at: [<ffffffff823c4f7b>] ip_finish_output2+0x20b/0x1280 net/ipv4/ip_output.c:193
 #2:  (rcu_read_lock_bh){......}, at: [<ffffffff82245f57>] __dev_queue_xmit+0x1d7/0x1bb0 net/core/dev.c:3161
 #3:  (_xmit_NETROM){+.-...}, at: [<ffffffff822b1b58>] spin_lock include/linux/spinlock.h:302 [inline]
 #3:  (_xmit_NETROM){+.-...}, at: [<ffffffff822b1b58>] __netif_tx_lock include/linux/netdevice.h:3306 [inline]
 #3:  (_xmit_NETROM){+.-...}, at: [<ffffffff822b1b58>] sch_direct_xmit+0x238/0x700 net/sched/sch_generic.c:163
 #4:  (rcu_read_lock){......}, at: [<ffffffff82244963>] xmit_one net/core/dev.c:2776 [inline]
 #4:  (rcu_read_lock){......}, at: [<ffffffff82244963>] dev_hard_start_xmit+0xb3/0x11e0 net/core/dev.c:2797

stack backtrace:
CPU: 0 PID: 11855 Comm: syz-executor.2 Not tainted 4.4.174+ #17
 0000000000000000 84b57d973e598b1c ffff8800ac6fe900 ffffffff81aad1a1
 ffffffff84057a80 ffff8801d0a88000 ffffffff83ad7f50 ffffffff83ad51c0
 ffffffff83ad7f50 ffff8800ac6fe950 ffffffff813abcda ffff8800ac6fea30
Call Trace:
 [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff813abcda>] print_circular_bug.cold+0x2f7/0x44e kernel/locking/lockdep.c:1226
 [<ffffffff81202d86>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff81202d86>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff81202d86>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff81202d86>] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213
 [<ffffffff81205f6e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff82717c98>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
 [<ffffffff82717c98>] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151
 [<ffffffff823ba312>] spin_lock include/linux/spinlock.h:302 [inline]
 [<ffffffff823ba312>] ip_defrag+0x322/0x3b70 net/ipv4/ip_fragment.c:690
 [<ffffffff823bdf36>] ip_check_defrag net/ipv4/ip_fragment.c:738 [inline]
 [<ffffffff823bdf36>] ip_check_defrag+0x3d6/0x5b0 net/ipv4/ip_fragment.c:705
 [<ffffffff826dfb3e>] packet_rcv_fanout+0x51e/0x5f0 net/packet/af_packet.c:1458
 [<ffffffff82244b38>] deliver_skb net/core/dev.c:1842 [inline]
 [<ffffffff82244b38>] dev_queue_xmit_nit net/core/dev.c:1898 [inline]
 [<ffffffff82244b38>] xmit_one net/core/dev.c:2777 [inline]
 [<ffffffff82244b38>] dev_hard_start_xmit+0x288/0x11e0 net/core/dev.c:2797
 [<ffffffff822b1bd6>] sch_direct_xmit+0x2b6/0x700 net/sched/sch_generic.c:165
 [<ffffffff82246aa4>] __dev_xmit_skb net/core/dev.c:2979 [inline]
 [<ffffffff82246aa4>] __dev_queue_xmit+0xd24/0x1bb0 net/core/dev.c:3197
 [<ffffffff82247948>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
 [<ffffffff823c5962>] neigh_hh_output include/net/neighbour.h:486 [inline]
 [<ffffffff823c5962>] dst_neigh_output include/net/dst.h:459 [inline]
 [<ffffffff823c5962>] ip_finish_output2+0xbf2/0x1280 net/ipv4/ip_output.c:213
 [<ffffffff823c805c>] ip_do_fragment+0x187c/0x1f70 net/ipv4/ip_output.c:635
 [<ffffffff823cbd7b>] ip_fragment.constprop.0+0x14b/0x200 net/ipv4/ip_output.c:505
 [<ffffffff823cc1e9>] ip_finish_output+0x3b9/0xc60 net/ipv4/ip_output.c:286
 [<ffffffff823d04a7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823d04a7>] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823cd21c>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823cd21c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823d300e>] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453
 [<ffffffff82478ded>] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842
 [<ffffffff824795ae>] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870
 [<ffffffff8247f63b>] udp_sendmsg+0x116b/0x1c60 net/ipv4/udp.c:1104
 [<ffffffff8261430d>] udpv6_sendmsg+0x1e5d/0x24f0 net/ipv6/udp.c:1178
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821d9e69>] ___sys_sendmsg+0x369/0x890 net/socket.c:1975
 [<ffffffff821dd386>] __sys_sendmmsg+0x1d6/0x2e0 net/socket.c:2053
 [<ffffffff822ace22>] C_SYSC_sendmmsg net/compat.c:731 [inline]
 [<ffffffff822ace22>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:728
 [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
 [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a