audit: type=1400 audit(1545190476.227:110): avc:  denied  { setopt } for  pid=7553 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1

======================================================
[ INFO: possible circular locking dependency detected ]
4.4.167+ #4 Not tainted
-------------------------------------------------------
syz-executor2/7581 is trying to acquire lock:
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff823b6a5b>] spin_lock include/linux/spinlock.h:302 [inline]
 (&(&q->lock)->rlock){+.-...}, at: [<ffffffff823b6a5b>] ip_defrag+0x31b/0x40c0 net/ipv4/ip_fragment.c:680

but task is already holding lock:
 (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] spin_lock include/linux/spinlock.h:302 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] __netif_tx_lock include/linux/netdevice.h:3306 [inline]
 (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] sch_direct_xmit+0x233/0x6c0 net/sched/sch_generic.c:163

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff812037de>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff827151be>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline]
       [<ffffffff827151be>] _raw_spin_lock_irqsave+0x4e/0x70 kernel/locking/spinlock.c:159
       [<ffffffff811e5b1e>] __wake_up+0x1e/0x50 kernel/sched/wait.c:94
       [<ffffffff81401087>] shmem_fallocate+0x777/0xa30 mm/shmem.c:2107
       [<ffffffff8148ba83>] vfs_fallocate+0x333/0x5c0 fs/open.c:312
       [<ffffffff8145f479>] madvise_remove mm/madvise.c:325 [inline]
       [<ffffffff8145f479>] madvise_vma mm/madvise.c:377 [inline]
       [<ffffffff8145f479>] SYSC_madvise mm/madvise.c:527 [inline]
       [<ffffffff8145f479>] SyS_madvise+0xaa9/0xd60 mm/madvise.c:458
       [<ffffffff810060fe>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff810060fe>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:397
       [<ffffffff82717690>] sysenter_flags_fixed+0xd/0x1a

       [<ffffffff81200314>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff81200314>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff81200314>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff81200314>] __lock_acquire+0x3cd4/0x5530 kernel/locking/lockdep.c:3213
       [<ffffffff812037de>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff82715006>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
       [<ffffffff82715006>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
       [<ffffffff823b6a5b>] spin_lock include/linux/spinlock.h:302 [inline]
       [<ffffffff823b6a5b>] ip_defrag+0x31b/0x40c0 net/ipv4/ip_fragment.c:680
       [<ffffffff823baba7>] ip_check_defrag+0x3a7/0x700 net/ipv4/ip_fragment.c:728
       [<ffffffff826dce7a>] packet_rcv_fanout+0x52a/0x5e0 net/packet/af_packet.c:1458
       [<ffffffff8223f080>] deliver_skb net/core/dev.c:1842 [inline]
       [<ffffffff8223f080>] dev_queue_xmit_nit net/core/dev.c:1898 [inline]
       [<ffffffff8223f080>] xmit_one net/core/dev.c:2777 [inline]
       [<ffffffff8223f080>] dev_hard_start_xmit+0x280/0x11c0 net/core/dev.c:2797
       [<ffffffff822acf68>] sch_direct_xmit+0x2b8/0x6c0 net/sched/sch_generic.c:165
       [<ffffffff82241245>] __dev_xmit_skb net/core/dev.c:2979 [inline]
       [<ffffffff82241245>] __dev_queue_xmit+0xf95/0x1c30 net/core/dev.c:3197
       [<ffffffff82241ef7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3263
       [<ffffffff822623c0>] neigh_resolve_output+0x600/0x780 net/core/neighbour.c:1329
       [<ffffffff823c24f0>] dst_neigh_output include/net/dst.h:461 [inline]
       [<ffffffff823c24f0>] ip_finish_output2+0x8f0/0x1100 net/ipv4/ip_output.c:213
       [<ffffffff823c4d70>] ip_do_fragment+0x1870/0x1f60 net/ipv4/ip_output.c:635
       [<ffffffff823c8a45>] ip_fragment.constprop.5+0x145/0x200 net/ipv4/ip_output.c:505
       [<ffffffff823c8e96>] ip_finish_output+0x396/0xc00 net/ipv4/ip_output.c:286
       [<ffffffff823ccf79>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
       [<ffffffff823ccf79>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
       [<ffffffff823c9e9b>] dst_output include/net/dst.h:498 [inline]
       [<ffffffff823c9e9b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
       [<ffffffff823cfbbc>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
       [<ffffffff82474d13>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
       [<ffffffff824754ce>] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870
       [<ffffffff8247b617>] udp_sendmsg+0x1147/0x1c70 net/ipv4/udp.c:1104
       [<ffffffff82610229>] udpv6_sendmsg+0x1d59/0x24c0 net/ipv6/udp.c:1178
       [<ffffffff824a4e33>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
       [<ffffffff821d1f8b>] sock_sendmsg_nosec net/socket.c:638 [inline]
       [<ffffffff821d1f8b>] sock_sendmsg+0xbb/0x110 net/socket.c:648
       [<ffffffff821d3ad1>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
       [<ffffffff821d7104>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
       [<ffffffff822a8172>] C_SYSC_sendmmsg net/compat.c:728 [inline]
       [<ffffffff822a8172>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
       [<ffffffff810060fe>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff810060fe>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:397
       [<ffffffff82717690>] sysenter_flags_fixed+0xd/0x1a

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(_xmit_NETROM);
                               lock(&(&q->lock)->rlock);
                               lock(_xmit_NETROM);
  lock(&(&q->lock)->rlock);

 *** DEADLOCK ***

5 locks held by syz-executor2/7581:
 #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff8247b30b>] lock_sock include/net/sock.h:1493 [inline]
 #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff8247b30b>] udp_sendmsg+0xe3b/0x1c70 net/ipv4/udp.c:922
 #1:  (rcu_read_lock_bh){......}, at: [<ffffffff823c1e0b>] ip_finish_output2+0x20b/0x1100 net/ipv4/ip_output.c:193
 #2:  (rcu_read_lock_bh){......}, at: [<ffffffff82240487>] __dev_queue_xmit+0x1d7/0x1c30 net/core/dev.c:3161
 #3:  (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] spin_lock include/linux/spinlock.h:302 [inline]
 #3:  (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] __netif_tx_lock include/linux/netdevice.h:3306 [inline]
 #3:  (_xmit_NETROM){+.-...}, at: [<ffffffff822acee3>] sch_direct_xmit+0x233/0x6c0 net/sched/sch_generic.c:163
 #4:  (rcu_read_lock){......}, at: [<ffffffff8223eea8>] xmit_one net/core/dev.c:2776 [inline]
 #4:  (rcu_read_lock){......}, at: [<ffffffff8223eea8>] dev_hard_start_xmit+0xa8/0x11c0 net/core/dev.c:2797

stack backtrace:
CPU: 1 PID: 7581 Comm: syz-executor2 Not tainted 4.4.167+ #4
 0000000000000000 4c158f0483b54cd7 ffff8801cfc4e7b0 ffffffff81aa62cd
 ffffffff83aecf50 ffffffff83aecf50 ffff8801d12dc740 ffffffff83acf520
 ffff8801d12dd0a0 ffff8801cfc4e800 ffffffff813a9559 ffff8801d12dc740
Call Trace:
 [<ffffffff81aa62cd>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aa62cd>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff813a9559>] print_circular_bug.cold.31+0x2f6/0x435 kernel/locking/lockdep.c:1226
 [<ffffffff81200314>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff81200314>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff81200314>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff81200314>] __lock_acquire+0x3cd4/0x5530 kernel/locking/lockdep.c:3213
 [<ffffffff812037de>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff82715006>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
 [<ffffffff82715006>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
 [<ffffffff823b6a5b>] spin_lock include/linux/spinlock.h:302 [inline]
 [<ffffffff823b6a5b>] ip_defrag+0x31b/0x40c0 net/ipv4/ip_fragment.c:680
 [<ffffffff823baba7>] ip_check_defrag+0x3a7/0x700 net/ipv4/ip_fragment.c:728
 [<ffffffff826dce7a>] packet_rcv_fanout+0x52a/0x5e0 net/packet/af_packet.c:1458
 [<ffffffff8223f080>] deliver_skb net/core/dev.c:1842 [inline]
 [<ffffffff8223f080>] dev_queue_xmit_nit net/core/dev.c:1898 [inline]
 [<ffffffff8223f080>] xmit_one net/core/dev.c:2777 [inline]
 [<ffffffff8223f080>] dev_hard_start_xmit+0x280/0x11c0 net/core/dev.c:2797
 [<ffffffff822acf68>] sch_direct_xmit+0x2b8/0x6c0 net/sched/sch_generic.c:165
 [<ffffffff82241245>] __dev_xmit_skb net/core/dev.c:2979 [inline]
 [<ffffffff82241245>] __dev_queue_xmit+0xf95/0x1c30 net/core/dev.c:3197
 [<ffffffff82241ef7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3263
 [<ffffffff822623c0>] neigh_resolve_output+0x600/0x780 net/core/neighbour.c:1329
 [<ffffffff823c24f0>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff823c24f0>] ip_finish_output2+0x8f0/0x1100 net/ipv4/ip_output.c:213
 [<ffffffff823c4d70>] ip_do_fragment+0x1870/0x1f60 net/ipv4/ip_output.c:635
 [<ffffffff823c8a45>] ip_fragment.constprop.5+0x145/0x200 net/ipv4/ip_output.c:505
 [<ffffffff823c8e96>] ip_finish_output+0x396/0xc00 net/ipv4/ip_output.c:286
 [<ffffffff823ccf79>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823ccf79>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823c9e9b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823c9e9b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823cfbbc>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
 [<ffffffff82474d13>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
 [<ffffffff824754ce>] udp_push_pending_frames+0x4e/0xe0 net/ipv4/udp.c:870
 [<ffffffff8247b617>] udp_sendmsg+0x1147/0x1c70 net/ipv4/udp.c:1104
 [<ffffffff82610229>] udpv6_sendmsg+0x1d59/0x24c0 net/ipv6/udp.c:1178
 [<ffffffff824a4e33>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d1f8b>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d1f8b>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d3ad1>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff821d7104>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
 [<ffffffff822a8172>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff822a8172>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff810060fe>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff810060fe>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:397
 [<ffffffff82717690>] sysenter_flags_fixed+0xd/0x1a