============================================
WARNING: possible recursive locking detected
6.1.137-syzkaller #0 Not tainted
--------------------------------------------
syz-executor/4249 is trying to acquire lock:
ffff888027829458 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888027829458 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4347 [inline]
ffff888027829458 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x156/0x4a0 net/sched/sch_generic.c:340
but task is already holding lock:
ffff88805af0d8d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff88805af0d8d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4347 [inline]
ffff88805af0d8d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x156/0x4a0 net/sched/sch_generic.c:340
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(_xmit_ETHER#2);
lock(_xmit_ETHER#2);
*** DEADLOCK ***
May be due to missing lock nesting notation
13 locks held by syz-executor/4249:
#0: ffffffff8c9c6a70 (dup_mmap_sem){++++}-{0:0}, at: dup_mmap kernel/fork.c:593 [inline]
#0: ffffffff8c9c6a70 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1541 [inline]
#0: ffffffff8c9c6a70 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x2a9/0x15c0 kernel/fork.c:1590
#1: ffff88801cbb44d8 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
#1: ffff88801cbb44d8 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:594 [inline]
#1: ffff88801cbb44d8 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1541 [inline]
#1: ffff88801cbb44d8 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2c3/0x15c0 kernel/fork.c:1590
#2: ffff8880788408d8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline]
#2: ffff8880788408d8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:603 [inline]
#2: ffff8880788408d8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm kernel/fork.c:1541 [inline]
#2: ffff8880788408d8 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ad/0x15c0 kernel/fork.c:1590
#3: ffffc900001e0bc0 ((&in_dev->mr_ifc_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc1/0x670 kernel/time/timer.c:1501
#4: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#4: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#4: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x3e8/0x11b0 net/ipv4/ip_output.c:221
#5: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#5: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
#5: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x26f/0x3760 net/core/dev.c:4257
#6: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#6: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#6: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: br_dev_xmit+0x176/0x16e0 net/bridge/br_device.c:49
#7: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#7: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
#7: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x26f/0x3760 net/core/dev.c:4257
#8: ffff88807621c258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#8: ffff88807621c258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline]
#8: ffff88807621c258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3882 [inline]
#8: ffff88807621c258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x129a/0x3760 net/core/dev.c:4300
#9: ffff88805af0d8d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#9: ffff88805af0d8d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4347 [inline]
#9: ffff88805af0d8d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x156/0x4a0 net/sched/sch_generic.c:340
#10: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#10: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#10: ffffffff8c92a960 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x3e8/0x11b0 net/ipv4/ip_output.c:221
#11: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
#11: ffffffff8c92a9c0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x26f/0x3760 net/core/dev.c:4257
#12: ffff888055701258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#12: ffff888055701258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline]
#12: ffff888055701258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3882 [inline]
#12: ffff888055701258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x129a/0x3760 net/core/dev.c:4300
stack backtrace:
CPU: 1 PID: 4249 Comm: syz-executor Not tainted 6.1.137-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
__lock_acquire+0x122f/0x7c50 kernel/locking/lockdep.c:-1
lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
__netif_tx_lock include/linux/netdevice.h:4347 [inline]
sch_direct_xmit+0x156/0x4a0 net/sched/sch_generic.c:340
__dev_xmit_skb net/core/dev.c:3895 [inline]
__dev_queue_xmit+0x18cd/0x3760 net/core/dev.c:4300
neigh_output include/net/neighbour.h:544 [inline]
ip_finish_output2+0xd05/0x11b0 net/ipv4/ip_output.c:228
iptunnel_xmit+0x525/0x930 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x1c39/0x2360 net/ipv4/ip_tunnel.c:858
__gre_xmit net/ipv4/ip_gre.c:474 [inline]
erspan_xmit+0x9a5/0x1560 net/ipv4/ip_gre.c:723
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x262/0x870 net/core/dev.c:3674
sch_direct_xmit+0x24e/0x4a0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3895 [inline]
__dev_queue_xmit+0x18cd/0x3760 net/core/dev.c:4300
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
br_dev_queue_push_xmit+0x6a2/0x850 net/bridge/br_forward.c:53
NF_HOOK+0x33c/0x3d0 include/linux/netfilter.h:302
br_forward_finish+0xcf/0x120 net/bridge/br_forward.c:66
NF_HOOK+0x33c/0x3d0 include/linux/netfilter.h:302
__br_forward+0x41f/0x600 net/bridge/br_forward.c:115
br_dev_xmit+0x104a/0x16e0 net/bridge/br_device.c:105
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x262/0x870 net/core/dev.c:3674
__dev_queue_xmit+0x1bf1/0x3760 net/core/dev.c:4334
neigh_output include/net/neighbour.h:544 [inline]
ip_finish_output2+0xd05/0x11b0 net/ipv4/ip_output.c:228
igmpv3_send_cr net/ipv4/igmp.c:723 [inline]
igmp_ifc_timer_expire+0xbb2/0xdd0 net/ipv4/igmp.c:813
call_timer_fn+0x1a0/0x670 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1549 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
handle_softirqs+0x2a1/0x920 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:661
irq_exit_rcu+0x5/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:stack_trace_consume_entry+0x0/0x270 kernel/stacktrace.c:83
Code: 48 8b 0c 25 28 00 00 00 48 3b 4c 24 78 75 09 48 8d 65 f0 5b 41 5e 5d c3 e8 1d 77 9f 08 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <55> 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90003d673a0 EFLAGS: 00000282
RAX: ffffffff816f99a8 RBX: ffffc90003d67460 RCX: 0000000080000000
RDX: ffffc90003d67401 RSI: ffffffff816f99a8 RDI: ffffc90003d67460
RBP: ffffc90003d67430 R08: ffffc90003d67430 R09: ffffc90003d673f8
R10: fffff520007ace81 R11: 1ffff920007ace7f R12: ffff88801a7bd940
R13: ffff888017627140 R14: ffffffff816f99f0 R15: ffffc90003d673a8
arch_stack_walk+0x100/0x140 arch/x86/kernel/stacktrace.c:27
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
__kasan_slab_alloc+0x6b/0x80 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x4b/0x480 mm/slab.h:737
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x123/0x2f0 mm/slub.c:3422
anon_vma_alloc mm/rmap.c:93 [inline]
anon_vma_fork+0xda/0x4f0 mm/rmap.c:359
dup_mmap kernel/fork.c:663 [inline]
dup_mm kernel/fork.c:1541 [inline]
copy_mm+0xb44/0x15c0 kernel/fork.c:1590
copy_process+0x1947/0x4060 kernel/fork.c:2266
kernel_clone+0x225/0x8b0 kernel/fork.c:2681
__do_sys_clone kernel/fork.c:2822 [inline]
__se_sys_clone kernel/fork.c:2806 [inline]
__x64_sys_clone+0x17c/0x1d0 kernel/fork.c:2806
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2e905851d3
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffe69d48f68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2e905851d3
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 00005555634817d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 0000000000061292 R15: 00007ffe69d49100
----------------
Code disassembly (best guess):
0: 48 8b 0c 25 28 00 00 mov 0x28,%rcx
7: 00
8: 48 3b 4c 24 78 cmp 0x78(%rsp),%rcx
d: 75 09 jne 0x18
f: 48 8d 65 f0 lea -0x10(%rbp),%rsp
13: 5b pop %rbx
14: 41 5e pop %r14
16: 5d pop %rbp
17: c3 ret
18: e8 1d 77 9f 08 call 0x89f773a
1d: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
24: 00 00 00
27: 0f 1f 00 nopl (%rax)
* 2a: 55 push %rbp <-- trapping instruction
2b: 41 57 push %r15
2d: 41 56 push %r14
2f: 41 55 push %r13
31: 41 54 push %r12
33: 53 push %rbx
34: 48 83 ec 18 sub $0x18,%rsp
38: 48 rex.W
39: ba 00 00 00 00 mov $0x0,%edx
3e: 00 fc add %bh,%ah