============================================= [ INFO: possible recursive locking detected ] 4.4.174+ #4 Not tainted --------------------------------------------- syz-executor.4/13169 is trying to acquire lock: (_xmit_TUNNEL6#2){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 but task is already holding lock: (_xmit_TUNNEL6#2){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] (_xmit_TUNNEL6#2){+.-...}, at: [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(_xmit_TUNNEL6#2); lock(_xmit_TUNNEL6#2); *** DEADLOCK *** May be due to missing lock nesting notation 10 locks held by syz-executor.4/13169: #0: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1497 [inline] #0: (sk_lock-AF_INET6){+.+.+.}, at: [] inet_stream_connect+0x44/0xa0 net/ipv4/af_inet.c:675 #1: (rcu_read_lock){......}, at: [] inet6_csk_xmit+0x108/0x4b0 net/ipv6/inet6_connection_sock.c:163 #2: (rcu_read_lock_bh){......}, at: [] ip6_finish_output2+0x1e1/0x1dc0 net/ipv6/ip6_output.c:71 #3: (rcu_read_lock_bh){......}, at: [] __dev_queue_xmit+0x1d7/0x1bb0 net/core/dev.c:3161 #4: (_xmit_TUNNEL6#2){+.-...}, at: [] spin_lock include/linux/spinlock.h:302 [inline] #4: (_xmit_TUNNEL6#2){+.-...}, at: [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] #4: (_xmit_TUNNEL6#2){+.-...}, at: [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 #5: (rcu_read_lock){......}, at: [] icmpv6_send+0x0/0x1b0 net/ipv6/ip6_icmp.c:30 #6: (slock-AF_INET6){+.-...}, at: [] spin_trylock include/linux/spinlock.h:312 [inline] #6: (slock-AF_INET6){+.-...}, at: [] icmpv6_xmit_lock net/ipv6/icmp.c:120 [inline] #6: (slock-AF_INET6){+.-...}, at: [] icmp6_send+0x7bd/0x1b40 net/ipv6/icmp.c:485 #7: (rcu_read_lock){......}, at: [] icmp6_send+0xf44/0x1b40 net/ipv6/icmp.c:517 #8: (rcu_read_lock_bh){......}, at: [] ip6_finish_output2+0x1e1/0x1dc0 net/ipv6/ip6_output.c:71 #9: (rcu_read_lock_bh){......}, at: [] __dev_queue_xmit+0x1d7/0x1bb0 net/core/dev.c:3161 stack backtrace: CPU: 1 PID: 13169 Comm: syz-executor.4 Not tainted 4.4.174+ #4 0000000000000000 1eb1886b711bdc36 ffff8801bc6b63d0 ffffffff81aad1a1 ffffffff84057a80 ffff8801bb2baf80 ffffffff83ad5a30 ffff8801bb2bb8e8 ffff8801bb2bb908 ffff8801bc6b6558 ffffffff813ad6ff 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_deadlock_bug kernel/locking/lockdep.c:1752 [inline] [] check_deadlock kernel/locking/lockdep.c:1796 [inline] [] validate_chain kernel/locking/lockdep.c:2128 [inline] [] __lock_acquire.cold+0x118/0x592 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151 [] spin_lock include/linux/spinlock.h:302 [inline] [] __netif_tx_lock include/linux/netdevice.h:3306 [inline] [] __dev_queue_xmit+0x1439/0x1bb0 net/core/dev.c:3225 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip6_finish_output2+0x9c7/0x1dc0 net/ipv6/ip6_output.c:113 [] ip6_finish_output+0x2f3/0x750 net/ipv6/ip6_output.c:131 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip6_output+0x1b4/0x520 net/ipv6/ip6_output.c:145 [] dst_output include/net/dst.h:498 [inline] [] ip6_local_out+0x9c/0x180 net/ipv6/output_core.c:169 [] ip6_send_skb+0xa2/0x340 net/ipv6/ip6_output.c:1725 [] ip6_push_pending_frames+0xbb/0xe0 net/ipv6/ip6_output.c:1745 [] icmpv6_push_pending_frames+0x336/0x530 net/ipv6/icmp.c:276 [] icmp6_send+0x1506/0x1b40 net/ipv6/icmp.c:537 [] icmpv6_send+0xb1/0x1b0 net/ipv6/ip6_icmp.c:42 [] ip6_link_failure+0x2d/0x3e0 net/ipv6/route.c:1313 [] dst_link_failure include/net/dst.h:481 [inline] [] ip6_tnl_xmit2+0x4da/0x2320 net/ipv6/ip6_tunnel.c:1089 [] ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1193 [inline] [] ip6_tnl_xmit+0x5d5/0xe00 net/ipv6/ip6_tunnel.c:1215 [] __netdev_start_xmit include/linux/netdevice.h:3750 [inline] [] netdev_start_xmit include/linux/netdevice.h:3759 [inline] [] xmit_one net/core/dev.c:2781 [inline] [] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797 [] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip6_finish_output2+0x9c7/0x1dc0 net/ipv6/ip6_output.c:113 [] ip6_finish_output+0x2f3/0x750 net/ipv6/ip6_output.c:131 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip6_output+0x1b4/0x520 net/ipv6/ip6_output.c:145 [] dst_output include/net/dst.h:498 [inline] [] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline] [] NF_HOOK include/linux/netfilter.h:249 [inline] [] ip6_xmit+0xc76/0x1a60 net/ipv6/ip6_output.c:240 [] inet6_csk_xmit+0x24c/0x4b0 net/ipv6/inet6_connection_sock.c:176 [] __tcp_transmit_skb+0x1904/0x2cf0 net/ipv4/tcp_output.c:1034 [] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline] [] tcp_connect+0x223d/0x31b0 net/ipv4/tcp_output.c:3295 [] tcp_v6_connect+0x1391/0x1b30 net/ipv6/tcp_ipv6.c:294 [] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615 [] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676 [] SYSC_connect net/socket.c:1570 [inline] [] SyS_connect+0x1a5/0x2e0 net/socket.c:1551 [] entry_SYSCALL_64_fastpath+0x1e/0x9a syz-executor.4 (13169) used greatest stack depth: 22672 bytes left audit: type=1400 audit(1571146103.496:6084): avc: denied { create } for pid=13179 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146104.216:6085): avc: denied { create } for pid=13196 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146104.446:6086): avc: denied { create } for pid=13202 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146104.476:6087): avc: denied { create } for pid=13203 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146104.516:6088): avc: denied { ioctl } for pid=13202 comm="syz-executor.4" path="socket:[196662]" dev="sockfs" ino=196662 ioctlcmd=894b scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146104.616:6089): avc: denied { create } for pid=13213 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146105.066:6090): avc: denied { create } for pid=13222 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146105.096:6091): avc: denied { write } for pid=13222 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit_printk_skb: 3 callbacks suppressed audit: type=1400 audit(1571146107.636:6093): avc: denied { create } for pid=13247 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146107.796:6094): avc: denied { create } for pid=13256 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146108.096:6095): avc: denied { create } for pid=13268 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146110.706:6096): avc: denied { create } for pid=13293 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146111.176:6097): avc: denied { create } for pid=13309 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1571146111.266:6098): avc: denied { create } for pid=13312 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1