Warning: Permanently added '10.128.10.3' (ED25519) to the list of known hosts. [*] Starting reproducer for possible deadlock in lapb_connect_request... [+] socket(AF_NETLINK) successful. [+] socket(AF_INET) successful. [+] socket(AF_PACKET) successful. [+] Cleaned up previous tunnels. [+] Assigned 192.168.99.1/24 to lo and brought lo UP. [ 92.355888][ T30] audit: type=1400 audit(1792295391.387:201): avc: denied { create } for pid=5939 comm="syz-executor333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [*] Existing LAPB mask before gt0: 0x0000003f [+] Configured pre-existing lapb0 with route to 192.168.99.2 [+] Successfully created gretap gt0. [+] Brought gt0 UP. [+] Discovered LAPB device for gt0: lapb6 (ifindex 39) [+] Assigned IP 192.168.99.10/24 to lapb6. [+] Brought lapb6 UP. [+] Added host route for 192.168.99.2 via lapb6. [ 93.662698][ T30] audit: type=1400 audit(1792295392.697:202): avc: denied { write } for pid=5992 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 93.786855][ T30] audit: type=1400 audit(1792295392.817:203): avc: denied { write } for pid=6014 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.153990][ T30] audit: type=1400 audit(1792295393.187:204): avc: denied { write } for pid=6021 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.271710][ T30] audit: type=1400 audit(1792295393.307:205): avc: denied { write } for pid=6042 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.828270][ T30] audit: type=1400 audit(1792295393.867:206): avc: denied { write } for pid=6058 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.937666][ T30] audit: type=1400 audit(1792295393.977:207): avc: denied { write } for pid=6079 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [+] Successfully created gretap gt1. [+] Discovered second LAPB device: lapb7 (ifindex 41) [+] Brought lapb7 UP, triggering route traversal. [*] Toggling lapb6 DOWN and UP to trigger lockdep registration... [+] lapb6 cycled UP and route restored. [*] Sending X25_IFACE_CONNECT on lapb6 via AF_PACKET... [ 95.247911][ T5939] [ 95.248527][ T30] audit: type=1400 audit(1792295394.287:208): avc: denied { write } for pid=5939 comm="syz-executor333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 95.270117][ T5939] ====================================================== [ 95.277137][ T5939] WARNING: possible circular locking dependency detected [ 95.284143][ T5939] syzkaller #0 Not tainted [ 95.288541][ T5939] ------------------------------------------------------ [ 95.295543][ T5939] syz-executor333/5939 is trying to acquire lock: [ 95.301943][ T5939] ffffffff91f49b18 (lapb_list_lock){++..}-{3:3}, at: lapb_connect_request+0x26/0x1a0 [ 95.311419][ T5939] [ 95.311419][ T5939] but task is already holding lock: [ 95.318802][ T5939] ffff88807a54cf00 (&lapbeth->up_lock){+...}-{3:3}, at: lapbeth_xmit+0x24/0x250 [ 95.327853][ T5939] [ 95.327853][ T5939] which lock already depends on the new lock. [ 95.327853][ T5939] [ 95.338235][ T5939] [ 95.338235][ T5939] the existing dependency chain (in reverse order) is: [ 95.347231][ T5939] [ 95.347231][ T5939] -> #3 (&lapbeth->up_lock){+...}-{3:3}: [ 95.355051][ T5939] lock_acquire+0x1d1/0x380 [ 95.360071][ T5939] _raw_spin_lock_bh+0x33/0x40 [ 95.365353][ T5939] lapbeth_xmit+0x24/0x250 [ 95.370285][ T5939] dev_hard_start_xmit+0x121/0x760 [ 95.376258][ T5939] __dev_queue_xmit+0x1c25/0x4a40 [ 95.381797][ T5939] tx+0xc4/0x130 [ 95.385849][ T5939] kthread+0x1d8/0x3c0 [ 95.390432][ T5939] kthread+0x373/0x450 [ 95.395019][ T5939] ret_from_fork+0x730/0xd60 [ 95.400117][ T5939] ret_from_fork_asm+0x1a/0x30 [ 95.405389][ T5939] [ 95.405389][ T5939] -> #2 (_xmit_X25#2){+...}-{3:3}: [ 95.412679][ T5939] lock_acquire+0x1d1/0x380 [ 95.417693][ T5939] _raw_spin_lock+0x2e/0x40 [ 95.422708][ T5939] __dev_queue_xmit+0x1ac6/0x4a40 [ 95.428246][ T5939] ip_finish_output2+0x851/0x2400 [ 95.433781][ T5939] __ip_finish_output.part.0+0x444/0x6f0 [ 95.439926][ T5939] ip_output+0x39b/0xc10 [ 95.444677][ T5939] ip_local_out+0x193/0x1f0 [ 95.449691][ T5939] iptunnel_xmit+0x722/0xd30 [ 95.454800][ T5939] ip_tunnel_xmit+0x1b91/0x3210 [ 95.460161][ T5939] __gre_xmit+0x91a/0xc90 [ 95.464996][ T5939] gre_tap_xmit+0x44e/0x700 [ 95.470004][ T5939] dev_hard_start_xmit+0x121/0x760 [ 95.475630][ T5939] sch_direct_xmit+0x1b2/0xc70 [ 95.480903][ T5939] __dev_queue_xmit+0x2812/0x4a40 [ 95.486439][ T5939] lapb_data_transmit+0x96/0xc0 [ 95.491800][ T5939] lapb_transmit_buffer+0xce/0x3a0 [ 95.497415][ T5939] lapb_send_control+0x1ce/0x330 [ 95.502944][ T5939] lapb_establish_data_link+0xeb/0x110 [ 95.508905][ T5939] lapb_device_event+0x315/0x580 [ 95.514353][ T5939] notifier_call_chain+0x99/0x3f0 [ 95.519895][ T5939] call_netdevice_notifiers_info+0xbe/0x110 [ 95.526299][ T5939] __dev_notify_flags+0x22c/0x4b0 [ 95.531835][ T5939] netif_change_flags+0x108/0x160 [ 95.537368][ T5939] dev_change_flags+0xba/0x260 [ 95.542644][ T5939] devinet_ioctl+0x110b/0x1f10 [ 95.547927][ T5939] inet_ioctl+0x3aa/0x3f0 [ 95.552766][ T5939] sock_do_ioctl+0x118/0x280 [ 95.557865][ T5939] sock_ioctl+0x599/0x6b0 [ 95.562705][ T5939] __x64_sys_ioctl+0x18e/0x210 [ 95.567980][ T5939] do_syscall_64+0x123/0x790 [ 95.573092][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.579494][ T5939] [ 95.579494][ T5939] -> #1 (&lapb->lock){+.-.}-{3:3}: [ 95.586783][ T5939] lock_acquire+0x1d1/0x380 [ 95.591803][ T5939] _raw_spin_lock_bh+0x33/0x40 [ 95.597078][ T5939] lapb_unregister+0x112/0x400 [ 95.602349][ T5939] lapbeth_close+0x56/0x90 [ 95.607281][ T5939] __dev_close_many+0x312/0x710 [ 95.612640][ T5939] __dev_change_flags+0x307/0x850 [ 95.618168][ T5939] netif_change_flags+0x8d/0x160 [ 95.623609][ T5939] dev_change_flags+0xba/0x260 [ 95.628879][ T5939] devinet_ioctl+0x110b/0x1f10 [ 95.634152][ T5939] inet_ioctl+0x3aa/0x3f0 [ 95.638995][ T5939] sock_do_ioctl+0x118/0x280 [ 95.644096][ T5939] sock_ioctl+0x599/0x6b0 [ 95.648936][ T5939] __x64_sys_ioctl+0x18e/0x210 [ 95.654211][ T5939] do_syscall_64+0x123/0x790 [ 95.659312][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.665712][ T5939] [ 95.665712][ T5939] -> #0 (lapb_list_lock){++..}-{3:3}: [ 95.673255][ T5939] check_prev_add+0xeb/0xe60 [ 95.678353][ T5939] __lock_acquire+0x1528/0x1f40 [ 95.683711][ T5939] lock_acquire+0x1d1/0x380 [ 95.688718][ T5939] _raw_read_lock_bh+0x3f/0x70 [ 95.693993][ T5939] lapb_connect_request+0x26/0x1a0 [ 95.699611][ T5939] lapbeth_xmit+0x1cb/0x250 [ 95.704626][ T5939] dev_hard_start_xmit+0x121/0x760 [ 95.710251][ T5939] __dev_queue_xmit+0x1c25/0x4a40 [ 95.715790][ T5939] packet_xmit+0x243/0x310 [ 95.720714][ T5939] packet_sendmsg+0x32ee/0x5040 [ 95.726090][ T5939] __sys_sendto+0x48b/0x4e0 [ 95.731116][ T5939] __x64_sys_sendto+0xe0/0x1c0 [ 95.736385][ T5939] do_syscall_64+0x123/0x790 [ 95.741493][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.747898][ T5939] [ 95.747898][ T5939] other info that might help us debug this: [ 95.747898][ T5939] [ 95.758105][ T5939] Chain exists of: [ 95.758105][ T5939] lapb_list_lock --> _xmit_X25#2 --> &lapbeth->up_lock [ 95.758105][ T5939] [ 95.770872][ T5939] Possible unsafe locking scenario: [ 95.770872][ T5939] [ 95.778301][ T5939] CPU0 CPU1 [ 95.783646][ T5939] ---- ---- [ 95.788987][ T5939] lock(&lapbeth->up_lock); [ 95.793563][ T5939] lock(_xmit_X25#2); [ 95.800489][ T5939] lock(&lapbeth->up_lock); [ 95.807608][ T5939] rlock(lapb_list_lock); [ 95.812011][ T5939] [ 95.812011][ T5939] *** DEADLOCK *** [ 95.812011][ T5939] [ 95.820138][ T5939] locks held by syz-executor333/5939: 3, last CPU#0: [ 95.826797][ T5939] #0: ffffffff8fdec580 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x296/0x4a40 [ 95.836722][ T5939] #1: ffff888023beb558 (_xmit_X25#2){+...}-{3:3}, at: __dev_queue_xmit+0x1ac6/0x4a40 [ 95.846314][ T5939] #2: ffff88807a54cf00 (&lapbeth->up_lock){+...}-{3:3}, at: lapbeth_xmit+0x24/0x250 [ 95.855802][ T5939] [ 95.855802][ T5939] stack backtrace: [ 95.861710][ T5939] CPU: 0 UID: 0 PID: 5939 Comm: syz-executor333 Not tainted syzkaller #0 PREEMPT(full) [ 95.871433][ T5939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 95.881510][ T5939] Call Trace: [ 95.884781][ T5939] [ 95.887706][ T5939] dump_stack_lvl+0x100/0x190 [ 95.892392][ T5939] print_circular_bug.cold+0x178/0x1be [ 95.897862][ T5939] check_noncircular+0x146/0x160 [ 95.902791][ T5939] ? __skb_flow_dissect+0x3d5/0x6d40 [ 95.908073][ T5939] check_prev_add+0xeb/0xe60 [ 95.912655][ T5939] __lock_acquire+0x1528/0x1f40 [ 95.917508][ T5939] lock_acquire+0x1d1/0x380 [ 95.922002][ T5939] ? lapb_connect_request+0x26/0x1a0 [ 95.927278][ T5939] ? do_raw_spin_lock+0x128/0x260 [ 95.932296][ T5939] _raw_read_lock_bh+0x3f/0x70 [ 95.937058][ T5939] ? lapb_connect_request+0x26/0x1a0 [ 95.942354][ T5939] lapb_connect_request+0x26/0x1a0 [ 95.947543][ T5939] lapbeth_xmit+0x1cb/0x250 [ 95.952045][ T5939] dev_hard_start_xmit+0x121/0x760 [ 95.957154][ T5939] __dev_queue_xmit+0x1c25/0x4a40 [ 95.962177][ T5939] ? find_held_lock+0x2b/0x80 [ 95.966851][ T5939] ? __might_fault+0xc5/0x140 [ 95.971514][ T5939] ? __pfx___dev_queue_xmit+0x10/0x10 [ 95.976892][ T5939] ? _copy_from_iter+0x270/0x1690 [ 95.981913][ T5939] ? __pfx__copy_from_iter+0x10/0x10 [ 95.987194][ T5939] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 95.992646][ T5939] ? packet_parse_headers+0x596/0x800 [ 95.998011][ T5939] ? packet_parse_headers+0x5a2/0x800 [ 96.003372][ T5939] ? packet_parse_headers+0x29f/0x800 [ 96.008732][ T5939] ? __pfx_packet_parse_headers+0x10/0x10 [ 96.014441][ T5939] packet_xmit+0x243/0x310 [ 96.018852][ T5939] packet_sendmsg+0x32ee/0x5040 [ 96.023691][ T5939] ? avc_has_perm_noaudit+0x3f0/0x470 [ 96.029061][ T5939] ? sock_has_perm+0x25a/0x2f0 [ 96.033817][ T5939] ? __pfx_sock_has_perm+0x10/0x10 [ 96.038926][ T5939] ? __pfx_packet_sendmsg+0x10/0x10 [ 96.044112][ T5939] ? __might_fault+0xc5/0x140 [ 96.048787][ T5939] ? selinux_socket_sendmsg+0x198/0x2f0 [ 96.054338][ T5939] __sys_sendto+0x48b/0x4e0 [ 96.058831][ T5939] ? __pfx_packet_sendmsg+0x10/0x10 [ 96.064021][ T5939] ? __pfx___sys_sendto+0x10/0x10 [ 96.069069][ T5939] ? sock_ioctl+0x2dc/0x6b0 [ 96.073571][ T5939] ? ksys_write+0x1ac/0x250 [ 96.078067][ T5939] ? __pfx_ksys_write+0x10/0x10 [ 96.082917][ T5939] __x64_sys_sendto+0xe0/0x1c0 [ 96.087667][ T5939] ? do_syscall_64+0xae/0x790 [ 96.092343][ T5939] ? lockdep_hardirqs_on+0x7d/0x110 [ 96.097540][ T5939] do_syscall_64+0x123/0x790 [ 96.102128][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.108010][ T5939] RIP: 0033:0x7ff79ae040b7 [ 96.112414][ T5939] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 96.132031][ T5939] RSP: 002b:00007ffe8b1e5860 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 96.140450][ T5939] RAX: ffffffffffffffda RBX: 0000555590b13400 RCX: 00007ff79ae040b7 [+] sendto AF_PACKET (index 39) sent 1 bytes. [*] Sending X25_IFACE_CONNECT on lapb0 via AF_PACKET... [+] sendto AF_PACKET (index 23) sent 1 bytes. [*] Triggering via AF_X25 connect()... [+] SIOCADDRT AF_X25 on lapb6 successful. [+] connect(AF_X25) on lapb6 attempted. [+] Operations complete. Waiting for lockdep output... [ 96.148408][ T5939] RDX: 0000000000000001 RSI: 00007ffe8b1e58bf RDI: 0000000000000005 [ 96.156365][ T5939] RBP: 0000000000000004 R08: 00007ffe8b1e58c0 R09: 0000000000000014 [ 96.164319][ T5939] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000003 [ 96.172274][ T5939] R13: 0000000000000005 R14: 00007ff79ae3d059 R15: 00007ff79ae3d044 [ 96.180238][ T5939] [ 96.186548][ T30] audit: type=1400 audit(1792295395.227:209): avc: denied { create } for pid=5939 comm="syz-executor333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 96.186745][ T30] audit: type=1400 audit(1792295395.227:210): avc: denied { ioctl } for pid=5939 comm="syz-executor333" path="socket:[8597]" dev="sockfs" ino=8597 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [+] Reproducer finished.