[ 133.686527][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.686620][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 Warning: Permanently added '10.128.1.99' (ED25519) to the list of known hosts. [*] Starting reproducer for lapb_data_received circular locking dependency... [+] AF_INET socket opened successfully. [+] NETLINK_ROUTE socket opened successfully. [+] AF_PACKET socket opened successfully. [+] /dev/net/tun opened successfully. [+] Created tap0 interface successfully. [+] Brought tap0 UP successfully. [+] Detected lapb interface for tap0: lapb6 (ifindex 40) [+] Brought lapb6 UP successfully. [+] Brought lapb6 DOWN successfully (established lapb_list_lock -> &lapb->lock). [+] Brought lapb6 back UP successfully. [+] Configured 192.168.1.1/24 on lapb6 successfully. [+] Configured route to 192.168.1.2/32 dev lapb6 successfully. [+] Direct transmit on lapb6 succeeded (4 bytes, established _xmit_X25 -> &lapbeth->up_lock). [+] Created vxlan0 successfully. [+] Brought vxlan0 UP successfully. [+] Detected lapb interface for vxlan0: lapb7 (ifindex 42) [+] Brought lapb7 UP successfully (established &lapb->lock -> _xmit_X25). [*] Injecting ETH_P_DEC frames into tap0 to trigger circular deadlock in lapb_data_received... [ 136.915384][ T72] netdevsim netdevsim0 eth8: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.915435][ T72] netdevsim netdevsim0 eth7: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.915471][ T72] netdevsim netdevsim0 eth6: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.915507][ T72] netdevsim netdevsim0 eth5: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.915543][ T72] netdevsim netdevsim4 eth4: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.915578][ T72] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.915613][ T72] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.915664][ T72] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 4789 - 0 [ 136.921298][ T6011] [ 136.992206][ T6011] ====================================================== [ 136.999238][ T6011] WARNING: possible circular locking dependency detected [ 137.006389][ T6011] syzkaller #0 Not tainted [ 137.010998][ T6011] ------------------------------------------------------ [ 137.018206][ T6011] syz-executor220/6011 is trying to acquire lock: [ 137.024894][ T6011] ffffffff913da7b8 (lapb_list_lock){++..}-{3:3}, at: lapb_data_received+0x2f/0x1c0 [ 137.034615][ T6011] [ 137.034615][ T6011] but task is already holding lock: [ 137.042353][ T6011] ffff88802af94f00 (&lapbeth->up_lock){+...}-{3:3}, at: lapbeth_rcv+0x24e/0x640 [ 137.051603][ T6011] [ 137.051603][ T6011] which lock already depends on the new lock. [ 137.051603][ T6011] [ 137.062220][ T6011] [ 137.062220][ T6011] the existing dependency chain (in reverse order) is: [ 137.071268][ T6011] [ 137.071268][ T6011] -> #3 (&lapbeth->up_lock){+...}-{3:3}: [ 137.079243][ T6011] _raw_spin_lock_bh+0x36/0x50 [ 137.084648][ T6011] lapbeth_xmit+0x32/0x260 [ 137.089803][ T6011] dev_hard_start_xmit+0x2cd/0x830 [ 137.095639][ T6011] __dev_queue_xmit+0x14d1/0x3920 [ 137.101402][ T6011] tx+0x6b/0x190 [ 137.105541][ T6011] kthread+0x1ed/0x420 [ 137.110281][ T6011] kthread+0x38b/0x480 [ 137.115075][ T6011] ret_from_fork+0x514/0xb70 [ 137.120300][ T6011] ret_from_fork_asm+0x1a/0x30 [ 137.125700][ T6011] [ 137.125700][ T6011] -> #2 (_xmit_X25#2){+...}-{3:3}: [ 137.133176][ T6011] _raw_spin_lock+0x2e/0x40 [ 137.138531][ T6011] __dev_queue_xmit+0xe9d/0x3920 [ 137.144225][ T6011] ip_finish_output2+0xc4b/0x10b0 [ 137.149805][ T6011] ip_output+0x29f/0x450 [ 137.154703][ T6011] iptunnel_xmit+0x626/0xd10 [ 137.160220][ T6011] udp_tunnel_xmit_skb+0x29b/0x3e0 [ 137.166069][ T6011] vxlan_xmit_one+0x21f6/0x2eb0 [ 137.171483][ T6011] vxlan_xmit+0x1e19/0x33b0 [ 137.176795][ T6011] dev_hard_start_xmit+0x2cd/0x830 [ 137.182466][ T6011] __dev_queue_xmit+0x14d1/0x3920 [ 137.188084][ T6011] lapb_data_transmit+0x90/0xb0 [ 137.193605][ T6011] lapb_transmit_buffer+0x163/0x200 [ 137.199855][ T6011] lapb_establish_data_link+0x89/0xe0 [ 137.205882][ T6011] lapb_device_event+0x4eb/0x680 [ 137.211469][ T6011] notifier_call_chain+0x1a5/0x3d0 [ 137.217695][ T6011] __dev_notify_flags+0x31e/0x510 [ 137.223446][ T6011] netif_change_flags+0xde/0x1b0 [ 137.228936][ T6011] dev_change_flags+0x128/0x260 [ 137.234412][ T6011] devinet_ioctl+0x966/0x1c50 [ 137.239645][ T6011] inet_ioctl+0x42a/0x560 [ 137.244732][ T6011] sock_do_ioctl+0x101/0x320 [ 137.249919][ T6011] sock_ioctl+0x57a/0x7e0 [ 137.254817][ T6011] __se_sys_ioctl+0xfc/0x170 [ 137.259963][ T6011] do_syscall_64+0x166/0x520 [ 137.265300][ T6011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.272217][ T6011] [ 137.272217][ T6011] -> #1 (&lapb->lock){+.-.}-{3:3}: [ 137.279693][ T6011] _raw_spin_lock_bh+0x36/0x50 [ 137.285220][ T6011] lapb_unregister+0x1e1/0x450 [ 137.290792][ T6011] lapbeth_close+0x56/0xb0 [ 137.296009][ T6011] __dev_close_many+0x366/0x6e0 [ 137.301691][ T6011] __dev_change_flags+0x3f5/0x820 [ 137.307462][ T6011] netif_change_flags+0x7c/0x1b0 [ 137.313213][ T6011] dev_change_flags+0x128/0x260 [ 137.318811][ T6011] devinet_ioctl+0x966/0x1c50 [ 137.324401][ T6011] inet_ioctl+0x42a/0x560 [ 137.329406][ T6011] sock_do_ioctl+0x101/0x320 [ 137.335042][ T6011] sock_ioctl+0x57a/0x7e0 [ 137.340366][ T6011] __se_sys_ioctl+0xfc/0x170 [ 137.345699][ T6011] do_syscall_64+0x166/0x520 [ 137.351219][ T6011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.358000][ T6011] [ 137.358000][ T6011] -> #0 (lapb_list_lock){++..}-{3:3}: [ 137.366300][ T6011] __lock_acquire+0x164c/0x2de0 [ 137.371972][ T6011] lock_acquire+0x115/0x350 [ 137.377204][ T6011] _raw_read_lock_bh+0x3e/0x50 [ 137.382704][ T6011] lapb_data_received+0x2f/0x1c0 [ 137.388301][ T6011] lapbeth_rcv+0x34d/0x640 [ 137.393439][ T6011] netif_receive_skb+0x4af/0xbf0 [ 137.399274][ T6011] tun_rx_batched+0x1de/0x790 [ 137.404542][ T6011] tun_get_user+0x2be0/0x44d0 [ 137.410191][ T6011] tun_chr_write_iter+0x113/0x200 [ 137.415956][ T6011] vfs_write+0x612/0xba0 [ 137.420769][ T6011] ksys_write+0x150/0x270 [ 137.426190][ T6011] do_syscall_64+0x166/0x520 [ 137.431530][ T6011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.438108][ T6011] [ 137.438108][ T6011] other info that might help us debug this: [ 137.438108][ T6011] [ 137.448939][ T6011] Chain exists of: [ 137.448939][ T6011] lapb_list_lock --> _xmit_X25#2 --> &lapbeth->up_lock [ 137.448939][ T6011] [ 137.462376][ T6011] Possible unsafe locking scenario: [ 137.462376][ T6011] [ 137.470653][ T6011] CPU0 CPU1 [ 137.476852][ T6011] ---- ---- [ 137.482726][ T6011] lock(&lapbeth->up_lock); [ 137.487714][ T6011] lock(_xmit_X25#2); [ 137.494912][ T6011] lock(&lapbeth->up_lock); [ 137.503588][ T6011] rlock(lapb_list_lock); [ 137.508392][ T6011] [ 137.508392][ T6011] *** DEADLOCK *** [ 137.508392][ T6011] [ 137.516820][ T6011] locks held by syz-executor220/6011: 4, last CPU#0: [ 137.523966][ T6011] #0: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: tun_get_user+0x27b0/0x44d0 [ 137.533866][ T6011] #1: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb+0x102/0xbf0 [ 137.544109][ T6011] #2: ffffffff8fd5ce60 (rcu_read_lock){....}-{1:3}, at: lapbeth_rcv+0x12f/0x640 [ 137.553664][ T6011] #3: ffff88802af94f00 (&lapbeth->up_lock){+...}-{3:3}, at: lapbeth_rcv+0x24e/0x640 [ 137.564014][ T6011] [ 137.564014][ T6011] stack backtrace: [ 137.569977][ T6011] CPU: 0 UID: 0 PID: 6011 Comm: syz-executor220 Not tainted syzkaller #0 PREEMPT(full) [ 137.579915][ T6011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 137.590388][ T6011] Call Trace: [ 137.593719][ T6011] [ 137.596801][ T6011] dump_stack_lvl+0xe8/0x150 [ 137.601701][ T6011] print_circular_bug+0x2e2/0x300 [ 137.606795][ T6011] check_noncircular+0x12f/0x150 [ 137.611951][ T6011] __lock_acquire+0x164c/0x2de0 [ 137.616870][ T6011] ? __lock_acquire+0x1511/0x2de0 [ 137.621958][ T6011] lock_acquire+0x115/0x350 [ 137.626511][ T6011] ? lapb_data_received+0x2f/0x1c0 [ 137.632019][ T6011] ? do_raw_spin_lock+0x12b/0x2f0 [ 137.637218][ T6011] ? lapb_data_received+0x2f/0x1c0 [ 137.642458][ T6011] _raw_read_lock_bh+0x3e/0x50 [ 137.647255][ T6011] ? lapb_data_received+0x2f/0x1c0 [ 137.652577][ T6011] lapb_data_received+0x2f/0x1c0 [ 137.657816][ T6011] lapbeth_rcv+0x34d/0x640 [ 137.662358][ T6011] ? lapbeth_rcv+0x12f/0x640 [ 137.667089][ T6011] ? netif_receive_skb+0x102/0xbf0 [ 137.672283][ T6011] ? __pfx_lapbeth_rcv+0x10/0x10 [ 137.677454][ T6011] netif_receive_skb+0x4af/0xbf0 [ 137.682525][ T6011] ? __pfx_netif_receive_skb+0x10/0x10 [ 137.688225][ T6011] ? tun_rx_batched+0x185/0x790 [ 137.693314][ T6011] tun_rx_batched+0x1de/0x790 [ 137.698148][ T6011] ? __pfx_tun_rx_batched+0x10/0x10 [ 137.703475][ T6011] ? lock_acquire+0x115/0x350 [ 137.708267][ T6011] ? tun_get_user+0x23ba/0x44d0 [ 137.713146][ T6011] ? __local_bh_enable_ip+0xd6/0x140 [ 137.718859][ T6011] ? tun_get_user+0x27b0/0x44d0 [ 137.723863][ T6011] tun_get_user+0x2be0/0x44d0 [ 137.728701][ T6011] ? tun_get_user+0x27b0/0x44d0 [ 137.733960][ T6011] ? aa_file_perm+0x4ed/0x15f0 [ 137.739026][ T6011] ? __pfx_tun_get_user+0x10/0x10 [ 137.744120][ T6011] ? __lock_acquire+0x747/0x2de0 [ 137.749204][ T6011] ? ref_tracker_alloc+0x341/0x4b0 [ 137.754347][ T6011] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 137.759835][ T6011] ? lock_acquire+0x115/0x350 [ 137.764735][ T6011] ? tun_get+0x1c/0x2f0 [ 137.769380][ T6011] ? tun_get+0x1c/0x2f0 [ 137.773686][ T6011] ? tun_get+0x1c/0x2f0 [ 137.778423][ T6011] tun_chr_write_iter+0x113/0x200 [ 137.783674][ T6011] vfs_write+0x612/0xba0 [ 137.787986][ T6011] ? __pfx_vfs_write+0x10/0x10 [ 137.792856][ T6011] ksys_write+0x150/0x270 [ 137.797313][ T6011] ? __pfx_ksys_write+0x10/0x10 [ 137.802811][ T6011] do_syscall_64+0x166/0x520 [ 137.807493][ T6011] ? trace_irq_disable+0x3b/0x140 [ 137.812754][ T6011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.819152][ T6011] ? clear_bhb_loop+0x70/0xc0 [ 137.824218][ T6011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.831001][ T6011] RIP: 0033:0x7f523ead1137 [ 137.835638][ T6011] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 137.856151][ T6011] RSP: 002b:00007ffcbef91f00 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 137.865238][ T6011] RAX: ffffffffffffffda RBX: 00005555890c4400 RCX: 00007f523ead1137 [+] Injected ETH_P_DEC frames successfully. [*] Waiting for lockdep warnings... [ 137.873518][ T6011] RDX: 0000000000000010 RSI: 00007ffcbef91fb0 RDI: 0000000000000006 [ 137.881709][ T6011] RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 [ 137.889987][ T6011] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 137.898361][ T6011] R13: 00007ffcbef91fb0 R14: 00007ffcbef91fa0 R15: 000000000000002c [ 137.906474][ T6011] [ 140.004674][ T59] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 4789 - 0 [ 140.004728][ T59] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 4789 - 0 [ 140.004761][ T59] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 4789 - 0 [ 140.004807][ T59] netdevsim netdevsim4 eth4: unset [0, 0] type 1 family 0 port 4789 - 0 [ 140.004839][ T59] netdevsim netdevsim0 eth5: unset [0, 0] type 1 family 0 port 4789 - 0 [+] Reproducer finished. [ 140.004871][ T59] netdevsim netdevsim0 eth6: un