============================================ WARNING: possible recursive locking detected 4.14.0-rc1-syzkaller #0 Not tainted -------------------------------------------- syz-executor860/19792 is trying to acquire lock: (_xmit_ETHER#2){+.-.}, at: [] spin_lock include/linux/spinlock.h:316 [inline] (_xmit_ETHER#2){+.-.}, at: [] __netif_tx_lock include/linux/netdevice.h:3500 [inline] (_xmit_ETHER#2){+.-.}, at: [] sch_direct_xmit+0x21d/0x5c0 net/sched/sch_generic.c:184 but task is already holding lock: (_xmit_ETHER#2){+.-.}, at: [] spin_lock include/linux/spinlock.h:316 [inline] (_xmit_ETHER#2){+.-.}, at: [] __netif_tx_lock include/linux/netdevice.h:3500 [inline] (_xmit_ETHER#2){+.-.}, at: [] sch_direct_xmit+0x21d/0x5c0 net/sched/sch_generic.c:184 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(_xmit_ETHER#2); lock(_xmit_ETHER#2); *** DEADLOCK *** May be due to missing lock nesting notation 9 locks held by syz-executor860/19792: #0: (rcu_read_lock){....}, at: [] arch_static_branch arch/x86/include/asm/jump_label.h:35 [inline] #0: (rcu_read_lock){....}, at: [] static_key_false include/linux/jump_label.h:141 [inline] #0: (rcu_read_lock){....}, at: [] netif_receive_skb_internal+0x91/0x5a0 net/core/dev.c:4513 #1: (k-slock-AF_INET){+...}, at: [] spin_trylock include/linux/spinlock.h:326 [inline] #1: (k-slock-AF_INET){+...}, at: [] icmp_xmit_lock net/ipv4/icmp.c:219 [inline] #1: (k-slock-AF_INET){+...}, at: [] icmp_send+0x4e5/0x2250 net/ipv4/icmp.c:668 #2: (rcu_read_lock_bh){....}, at: [] lwtunnel_xmit_redirect include/net/lwtunnel.h:91 [inline] #2: (rcu_read_lock_bh){....}, at: [] ip_finish_output2+0x280/0x1400 net/ipv4/ip_output.c:213 #3: (rcu_read_lock_bh){....}, at: [] __dev_queue_xmit+0x280/0x2a80 net/core/dev.c:3410 #4: (dev->qdisc_running_key ?: &qdisc_running_key){+...}, at: [] dev_queue_xmit+0xb/0x10 net/core/dev.c:3509 #5: (_xmit_ETHER#2){+.-.}, at: [] spin_lock include/linux/spinlock.h:316 [inline] #5: (_xmit_ETHER#2){+.-.}, at: [] __netif_tx_lock include/linux/netdevice.h:3500 [inline] #5: (_xmit_ETHER#2){+.-.}, at: [] sch_direct_xmit+0x21d/0x5c0 net/sched/sch_generic.c:184 #6: (rcu_read_lock_bh){....}, at: [] lwtunnel_xmit_redirect include/net/lwtunnel.h:91 [inline] #6: (rcu_read_lock_bh){....}, at: [] ip_finish_output2+0x280/0x1400 net/ipv4/ip_output.c:213 #7: (rcu_read_lock_bh){....}, at: [] __dev_queue_xmit+0x280/0x2a80 net/core/dev.c:3410 #8: (dev->qdisc_running_key ?: &qdisc_running_key){+...}, at: [] dev_queue_xmit+0xb/0x10 net/core/dev.c:3509 stack backtrace: CPU: 1 PID: 19792 Comm: syz-executor860 Not tainted 4.14.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x145/0x1f0 lib/dump_stack.c:52 print_deadlock_bug kernel/locking/lockdep.c:1797 [inline] check_deadlock kernel/locking/lockdep.c:1844 [inline] validate_chain kernel/locking/lockdep.c:2453 [inline] __lock_acquire.cold.78+0x251/0x554 kernel/locking/lockdep.c:3498 lock_acquire+0x1dc/0x520 kernel/locking/lockdep.c:4002 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:316 [inline] __netif_tx_lock include/linux/netdevice.h:3500 [inline] sch_direct_xmit+0x21d/0x5c0 net/sched/sch_generic.c:184 __dev_xmit_skb net/core/dev.c:3177 [inline] __dev_queue_xmit+0x1dd9/0x2a80 net/core/dev.c:3444 dev_queue_xmit+0xb/0x10 net/core/dev.c:3509 neigh_resolve_output+0x54d/0x9c0 net/core/neighbour.c:1350 neigh_output include/net/neighbour.h:481 [inline] ip_finish_output2+0x855/0x1400 net/ipv4/ip_output.c:229 ip_finish_output+0x713/0xe90 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:238 [inline] ip_mc_output+0x265/0x11f0 net/ipv4/ip_output.c:390 dst_output include/net/dst.h:458 [inline] ip_local_out+0x78/0x130 net/ipv4/ip_output.c:124 iptunnel_xmit+0x4fc/0x860 net/ipv4/ip_tunnel_core.c:91 ip_tunnel_xmit+0x1204/0x3e04 net/ipv4/ip_tunnel.c:786 __gre_xmit+0x494/0xa00 net/ipv4/ip_gre.c:436 erspan_xmit+0x44f/0x12c0 net/ipv4/ip_gre.c:742 __netdev_start_xmit include/linux/netdevice.h:4000 [inline] netdev_start_xmit include/linux/netdevice.h:4009 [inline] xmit_one net/core/dev.c:2979 [inline] dev_hard_start_xmit+0x22e/0xa00 net/core/dev.c:2995 sch_direct_xmit+0x2ab/0x5c0 net/sched/sch_generic.c:186 __dev_xmit_skb net/core/dev.c:3177 [inline] __dev_queue_xmit+0x1dd9/0x2a80 net/core/dev.c:3444 dev_queue_xmit+0xb/0x10 net/core/dev.c:3509 neigh_resolve_output+0x54d/0x9c0 net/core/neighbour.c:1350 neigh_output include/net/neighbour.h:481 [inline] ip_finish_output2+0x855/0x1400 net/ipv4/ip_output.c:229 ip_finish_output+0x713/0xe90 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:238 [inline] ip_mc_output+0x265/0x11f0 net/ipv4/ip_output.c:390 dst_output include/net/dst.h:458 [inline] ip_local_out+0x78/0x130 net/ipv4/ip_output.c:124 ip_send_skb+0x36/0xa0 net/ipv4/ip_output.c:1414 ip_push_pending_frames+0x4d/0x70 net/ipv4/ip_output.c:1434 icmp_push_reply+0x321/0x590 net/ipv4/icmp.c:394 icmp_send+0x1455/0x2250 net/ipv4/icmp.c:741 ip_options_compile+0xca1/0x2510 net/ipv4/ip_options.c:471 ip_rcv_options net/ipv4/ip_input.c:284 [inline] ip_rcv_finish+0x6f2/0x2510 net/ipv4/ip_input.c:365 NF_HOOK include/linux/netfilter.h:249 [inline] ip_rcv+0xd4c/0x19d8 net/ipv4/ip_input.c:493 __netif_receive_skb_core+0x2094/0x35b0 net/core/dev.c:4428 __netif_receive_skb+0x1f/0x1a0 net/core/dev.c:4466 netif_receive_skb_internal+0xdc/0x5a0 net/core/dev.c:4539 netif_receive_skb+0x95/0x320 net/core/dev.c:4563 tun_rx_batched.isra.46+0x418/0x880 drivers/net/tun.c:1218 tun_get_user+0x1307/0x21b0 drivers/net/tun.c:1555 tun_chr_write_iter+0xd1/0x1a0 drivers/net/tun.c:1581 call_write_iter include/linux/fs.h:1770 [inline] do_iter_readv_writev+0x4a3/0xaa0 fs/read_write.c:673 do_iter_write+0x130/0x530 fs/read_write.c:952 vfs_writev+0x16b/0x320 fs/read_write.c:997 do_writev+0xf3/0x340 fs/read_write.c:1032 SYSC_writev fs/read_write.c:1105 [inline] SyS_writev+0xb/0x10 fs/read_write.c:1102 entry_SYSCALL_64_fastpath+0x23/0xc2 RIP: 0033:0x4450a0 RSP: 002b:00007ffd0b7e4008 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004450a0 RDX: 0000000000000001 RSI: 00007ffd0b7e4040 RDI: 0000000000000003 RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000023