Extracting prog: 1m18.873013451s
Minimizing prog: 11m16.454449651s
Simplifying prog options: 0s
Extracting C: 30.650199168s
Simplifying C: 6m17.637723369s


extracting reproducer from 75 programs
testing a last program of every proc
single: executing 25 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$printer-syz_usb_control_io$hid-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ncm-syz_usb_connect-socket$netlink-socket$can_j1939-bind$can_j1939-syz_open_dev$swradio-ioctl$VIDIOC_TRY_FMT-landlock_create_ruleset-landlock_create_ruleset-landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="00f50100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_usb_connect(0x0, 0x1cb, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
bind$can_j1939(r2, &(0x7f0000000240)={0x1d, 0x0, 0x2, {0x0, 0x0, 0x4}}, 0x18)
r3 = syz_open_dev$swradio(&(0x7f0000000040), 0x0, 0x2)
ioctl$VIDIOC_TRY_FMT(r3, 0xc0d05640, &(0x7f0000000140)={0x8, @win={{0x6, 0x6, 0x8005, 0x19}, 0x8, 0xe, 0x0, 0x2, 0x0, 0xff}})
r4 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x10, 0x0)
r5 = landlock_create_ruleset(&(0x7f0000000040)={0x4004, 0x1, 0x2}, 0x18, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r5, 0x1, &(0x7f00000000c0)={0x100, r4}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-ioctl$SNDCTL_SEQ_OUTOFBAND-socket$nl_route-socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000100)=@t={0x81, 0x6, 0x7, 0x6})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r4=>0x0})
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c00000010000100"/20, @ANYRES32=r4, @ANYBLOB="00000000000000002c0012800b00010065727370616e00001c0002800600100000000000050016000000000006000e000040"], 0x4c}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8, 0x1, r4}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program crashed: possible deadlock in sch_direct_xmit
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-ioctl$SNDCTL_SEQ_OUTOFBAND-socket$nl_route-socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000100)=@t={0x81, 0x6, 0x7, 0x6})
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r3=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c00000010000100"/20, @ANYRES32=r3, @ANYBLOB="00000000000000002c0012800b00010065727370616e00001c0002800600100000000000050016000000000006000e000040"], 0x4c}}, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-ioctl$SNDCTL_SEQ_OUTOFBAND-socket$nl_route-socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000100)=@t={0x81, 0x6, 0x7, 0x6})
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r3=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8, 0x1, r3}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program crashed: possible deadlock in sch_direct_xmit
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-ioctl$SNDCTL_SEQ_OUTOFBAND-socket$nl_route-socket$nl_route-socket$packet-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000100)=@t={0x81, 0x6, 0x7, 0x6})
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$packet(0x11, 0x2, 0x300)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-ioctl$SNDCTL_SEQ_OUTOFBAND-socket$nl_route-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000100)=@t={0x81, 0x6, 0x7, 0x6})
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r2=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-ioctl$SNDCTL_SEQ_OUTOFBAND-socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000100)=@t={0x81, 0x6, 0x7, 0x6})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r3=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8, 0x1, r3}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program crashed: possible deadlock in sch_direct_xmit
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-ioctl$SNDCTL_SEQ_OUTOFBAND-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000100)=@t={0x81, 0x6, 0x7, 0x6})
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r2=>0x0})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer-socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program crashed: possible deadlock in sch_direct_xmit
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program crashed: possible deadlock in sch_direct_xmit
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @gre={{0x8}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @loopback}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3d}, @IFLA_GRE_LINK={0x8}, @IFLA_GRE_TOS={0x5, 0x9, 0x1}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x58}}, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00'})
sendmsg$nl_route(r0, 0x0, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0)

program did not crash
testing program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x30, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @gre={{0x8}, {0x4}}}]}, 0x30}}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=46.201743601s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
simplifying C reproducer
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program did not crash
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program did not crash
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program did not crash
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
testing compiled C program (duration=46.201743601s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$packet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route
program crashed: possible deadlock in sch_direct_xmit
reproducing took 19m23.615422144s
repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0 Not tainted
--------------------------------------------
kworker/1:3/5842 is trying to acquire lock:
ffff888029aa4918 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888029aa4918 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4371 [inline]
ffff888029aa4918 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: sch_direct_xmit+0x1a7/0x5d0 net/sched/sch_generic.c:341

but task is already holding lock:
ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4371 [inline]
ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __dev_queue_xmit+0x17ca/0x3ed0 net/core/dev.c:4428

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&qdisc_xmit_lock_key#2);
  lock(&qdisc_xmit_lock_key#2);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

10 locks held by kworker/1:3/5842:
 #0: ffff88814d329548 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
 #0: ffff88814d329548 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310
 #1: ffffc90003d9fd00 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
 #1: ffffc90003d9fd00 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310
 #2: ffff88805a091538 (&idev->mc_lock){+.+.}-{3:3}, at: mld_ifc_work+0x2d/0xd90 net/ipv6/mcast.c:2650
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: mld_sendpack+0x1e8/0xdb0 net/ipv6/mcast.c:1791
 #4: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #4: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #4: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: ip6_finish_output2+0x75c/0x1730 net/ipv6/ip6_output.c:126
 #5: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #5: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline]
 #5: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2da/0x3ed0 net/core/dev.c:4357
 #6: ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #6: ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4371 [inline]
 #6: ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __dev_queue_xmit+0x17ca/0x3ed0 net/core/dev.c:4428
 #7: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #7: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #7: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x45f/0x1390 net/ipv4/ip_output.c:229
 #8: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #8: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline]
 #8: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2da/0x3ed0 net/core/dev.c:4357
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline]
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:197 [inline]
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3812 [inline]
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_queue_xmit+0x1364/0x3ed0 net/core/dev.c:4398

stack backtrace:
CPU: 1 UID: 0 PID: 5842 Comm: kworker/1:3 Not tainted 6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Workqueue: mld mld_ifc_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037
 check_deadlock kernel/locking/lockdep.c:3089 [inline]
 validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891
 __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 __netif_tx_lock include/linux/netdevice.h:4371 [inline]
 sch_direct_xmit+0x1a7/0x5d0 net/sched/sch_generic.c:341
 __dev_xmit_skb net/core/dev.c:3825 [inline]
 __dev_queue_xmit+0x1a2d/0x3ed0 net/core/dev.c:4398
 NF_HOOK+0x3a5/0x450 include/linux/netfilter.h:314
 arp_solicit+0xc64/0xe90 net/ipv4/arp.c:392
 neigh_probe net/core/neighbour.c:1077 [inline]
 __neigh_event_send+0xed4/0x15b0 net/core/neighbour.c:1244
 neigh_event_send_probe include/net/neighbour.h:466 [inline]
 neigh_event_send include/net/neighbour.h:472 [inline]
 neigh_resolve_output+0x1b5/0x740 net/core/neighbour.c:1549
 neigh_output include/net/neighbour.h:542 [inline]
 ip_finish_output2+0xe70/0x1390 net/ipv4/ip_output.c:236
 iptunnel_xmit+0x540/0x9b0 net/ipv4/ip_tunnel_core.c:82
 ip_tunnel_xmit+0x1fb0/0x26a0 net/ipv4/ip_tunnel.c:858
 __gre_xmit net/ipv4/ip_gre.c:484 [inline]
 ipgre_xmit+0x8d6/0xc90 net/ipv4/ip_gre.c:688
 __netdev_start_xmit include/linux/netdevice.h:4928 [inline]
 netdev_start_xmit include/linux/netdevice.h:4937 [inline]
 xmit_one net/core/dev.c:3588 [inline]
 dev_hard_start_xmit+0x27a/0x7e0 net/core/dev.c:3604
 __dev_queue_xmit+0x1b11/0x3ed0 net/core/dev.c:4432
 neigh_output include/net/neighbour.h:542 [inline]
 ip6_finish_output2+0x1001/0x1730 net/ipv6/ip6_output.c:141
 ip6_finish_output+0x41e/0x810 net/ipv6/ip6_output.c:226
 NF_HOOK+0x9e/0x430 include/linux/netfilter.h:314
 mld_sendpack+0x843/0xdb0 net/ipv6/mcast.c:1819
 mld_send_cr net/ipv6/mcast.c:2120 [inline]
 mld_ifc_work+0x7d9/0xd90 net/ipv6/mcast.c:2651
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

final repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0 Not tainted
--------------------------------------------
kworker/1:3/5842 is trying to acquire lock:
ffff888029aa4918 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888029aa4918 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4371 [inline]
ffff888029aa4918 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: sch_direct_xmit+0x1a7/0x5d0 net/sched/sch_generic.c:341

but task is already holding lock:
ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4371 [inline]
ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __dev_queue_xmit+0x17ca/0x3ed0 net/core/dev.c:4428

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&qdisc_xmit_lock_key#2);
  lock(&qdisc_xmit_lock_key#2);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

10 locks held by kworker/1:3/5842:
 #0: ffff88814d329548 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
 #0: ffff88814d329548 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310
 #1: ffffc90003d9fd00 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline]
 #1: ffffc90003d9fd00 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310
 #2: ffff88805a091538 (&idev->mc_lock){+.+.}-{3:3}, at: mld_ifc_work+0x2d/0xd90 net/ipv6/mcast.c:2650
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: mld_sendpack+0x1e8/0xdb0 net/ipv6/mcast.c:1791
 #4: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #4: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #4: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: ip6_finish_output2+0x75c/0x1730 net/ipv6/ip6_output.c:126
 #5: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #5: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline]
 #5: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2da/0x3ed0 net/core/dev.c:4357
 #6: ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #6: ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4371 [inline]
 #6: ffff888056bcad18 (&qdisc_xmit_lock_key#2){+...}-{2:2}, at: __dev_queue_xmit+0x17ca/0x3ed0 net/core/dev.c:4428
 #7: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #7: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #7: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x45f/0x1390 net/ipv4/ip_output.c:229
 #8: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #8: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline]
 #8: ffffffff8e937e00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2da/0x3ed0 net/core/dev.c:4357
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline]
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:197 [inline]
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3812 [inline]
 #9: ffff88807b035258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_queue_xmit+0x1364/0x3ed0 net/core/dev.c:4398

stack backtrace:
CPU: 1 UID: 0 PID: 5842 Comm: kworker/1:3 Not tainted 6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Workqueue: mld mld_ifc_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037
 check_deadlock kernel/locking/lockdep.c:3089 [inline]
 validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891
 __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 __netif_tx_lock include/linux/netdevice.h:4371 [inline]
 sch_direct_xmit+0x1a7/0x5d0 net/sched/sch_generic.c:341
 __dev_xmit_skb net/core/dev.c:3825 [inline]
 __dev_queue_xmit+0x1a2d/0x3ed0 net/core/dev.c:4398
 NF_HOOK+0x3a5/0x450 include/linux/netfilter.h:314
 arp_solicit+0xc64/0xe90 net/ipv4/arp.c:392
 neigh_probe net/core/neighbour.c:1077 [inline]
 __neigh_event_send+0xed4/0x15b0 net/core/neighbour.c:1244
 neigh_event_send_probe include/net/neighbour.h:466 [inline]
 neigh_event_send include/net/neighbour.h:472 [inline]
 neigh_resolve_output+0x1b5/0x740 net/core/neighbour.c:1549
 neigh_output include/net/neighbour.h:542 [inline]
 ip_finish_output2+0xe70/0x1390 net/ipv4/ip_output.c:236
 iptunnel_xmit+0x540/0x9b0 net/ipv4/ip_tunnel_core.c:82
 ip_tunnel_xmit+0x1fb0/0x26a0 net/ipv4/ip_tunnel.c:858
 __gre_xmit net/ipv4/ip_gre.c:484 [inline]
 ipgre_xmit+0x8d6/0xc90 net/ipv4/ip_gre.c:688
 __netdev_start_xmit include/linux/netdevice.h:4928 [inline]
 netdev_start_xmit include/linux/netdevice.h:4937 [inline]
 xmit_one net/core/dev.c:3588 [inline]
 dev_hard_start_xmit+0x27a/0x7e0 net/core/dev.c:3604
 __dev_queue_xmit+0x1b11/0x3ed0 net/core/dev.c:4432
 neigh_output include/net/neighbour.h:542 [inline]
 ip6_finish_output2+0x1001/0x1730 net/ipv6/ip6_output.c:141
 ip6_finish_output+0x41e/0x810 net/ipv6/ip6_output.c:226
 NF_HOOK+0x9e/0x430 include/linux/netfilter.h:314
 mld_sendpack+0x843/0xdb0 net/ipv6/mcast.c:1819
 mld_send_cr net/ipv6/mcast.c:2120 [inline]
 mld_ifc_work+0x7d9/0xd90 net/ipv6/mcast.c:2651
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>