possible deadlock in sch_direct_xmit

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 0df021b2 Linux 4.19.47
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1032579aa00000
kernel config: https://syzkaller.appspot.com/x/.config?x=82c2df0ca70e1122
dashboard link: https://syzkaller.appspot.com/bug?extid=fd20c9af1cdd5b41a13c
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fd20c9...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
audit: type=1400 audit(1559406269.108:38): avc: denied { associate } for
pid=7781 comm="syz-executor.0" name="syz0"
scontext=unconfined_u:object_r:unlabeled_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
============================================
WARNING: possible recursive locking detected
4.19.47 #19 Not tainted
--------------------------------------------
syz-executor.0/8271 is trying to acquire lock:
000000000277713c (_xmit_ETHER#2){+.-.}, at: spin_lock
include/linux/spinlock.h:329 [inline]
000000000277713c (_xmit_ETHER#2){+.-.}, at: __netif_tx_lock
include/linux/netdevice.h:3798 [inline]
000000000277713c (_xmit_ETHER#2){+.-.}, at: sch_direct_xmit+0x2de/0xfa0
net/sched/sch_generic.c:325

but task is already holding lock:
000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: spin_lock
include/linux/spinlock.h:329 [inline]
000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: __netif_tx_lock
include/linux/netdevice.h:3798 [inline]
000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: sch_direct_xmit+0x2de/0xfa0
net/sched/sch_generic.c:325

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(_xmit_ETHER#2);
lock(_xmit_ETHER#2);

*** DEADLOCK ***

May be due to missing lock nesting notation

9 locks held by syz-executor.0/8271:
#0: 00000000d16eb40f (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect
include/net/lwtunnel.h:92 [inline]
#0: 00000000d16eb40f (rcu_read_lock_bh){....}, at:
ip_finish_output2+0x2b0/0x1760 net/ipv4/ip_output.c:213
#1: 00000000d16eb40f (rcu_read_lock_bh){....}, at:
__dev_queue_xmit+0x214/0x3010 net/core/dev.c:3777
#2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: spin_trylock
include/linux/spinlock.h:339 [inline]
#2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: qdisc_run_begin
include/net/sch_generic.h:130 [inline]
#2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: qdisc_run
include/net/pkt_sched.h:119 [inline]
#2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at: __dev_xmit_skb
net/core/dev.c:3452 [inline]
#2: 0000000067133d5f (&(&sch->seqlock)->rlock){+...}, at:
__dev_queue_xmit+0x28cf/0x3010 net/core/dev.c:3811
#3: 00000000ff114ac1 (dev->qdisc_running_key ?: &qdisc_running_key){+...},
at: dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
#4: 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: spin_lock
include/linux/spinlock.h:329 [inline]
#4: 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at: __netif_tx_lock
include/linux/netdevice.h:3798 [inline]
#4: 000000006d93c4d7 (_xmit_ETHER#2){+.-.}, at:
sch_direct_xmit+0x2de/0xfa0 net/sched/sch_generic.c:325
#5: 00000000d16eb40f (rcu_read_lock_bh){....}, at: lwtunnel_xmit_redirect
include/net/lwtunnel.h:92 [inline]
#5: 00000000d16eb40f (rcu_read_lock_bh){....}, at:
ip_finish_output2+0x2b0/0x1760 net/ipv4/ip_output.c:213
#6: 00000000d16eb40f (rcu_read_lock_bh){....}, at:
__dev_queue_xmit+0x214/0x3010 net/core/dev.c:3777
#7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: spin_trylock
include/linux/spinlock.h:339 [inline]
#7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: qdisc_run_begin
include/net/sch_generic.h:130 [inline]
#7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: qdisc_run
include/net/pkt_sched.h:119 [inline]
#7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at: __dev_xmit_skb
net/core/dev.c:3452 [inline]
#7: 000000006e2d0b56 (&(&sch->seqlock)->rlock){+...}, at:
__dev_queue_xmit+0x28cf/0x3010 net/core/dev.c:3811
#8: 000000002f6d49b4 (dev->qdisc_running_key ?: &qdisc_running_key){+...},
at: dev_queue_xmit+0x18/0x20 net/core/dev.c:3876

stack backtrace:
CPU: 0 PID: 8271 Comm: syz-executor.0 Not tainted 4.19.47 #19
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_deadlock_bug kernel/locking/lockdep.c:1759 [inline]
check_deadlock kernel/locking/lockdep.c:1803 [inline]
validate_chain kernel/locking/lockdep.c:2399 [inline]
__lock_acquire.cold+0x135/0x4a1 kernel/locking/lockdep.c:3411
lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3900
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
spin_lock include/linux/spinlock.h:329 [inline]
__netif_tx_lock include/linux/netdevice.h:3798 [inline]
sch_direct_xmit+0x2de/0xfa0 net/sched/sch_generic.c:325
qdisc_restart net/sched/sch_generic.c:390 [inline]
__qdisc_run+0x57f/0x1960 net/sched/sch_generic.c:398
qdisc_run include/net/pkt_sched.h:120 [inline]
qdisc_run include/net/pkt_sched.h:117 [inline]
__dev_xmit_skb net/core/dev.c:3452 [inline]
__dev_queue_xmit+0x228d/0x3010 net/core/dev.c:3811
dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
neigh_resolve_output net/core/neighbour.c:1366 [inline]
neigh_resolve_output+0x5b7/0x980 net/core/neighbour.c:1346
neigh_output include/net/neighbour.h:501 [inline]
ip_finish_output2+0x93d/0x1760 net/ipv4/ip_output.c:229
ip_do_fragment+0x933/0x2570 net/ipv4/ip_output.c:814
ip_fragment.constprop.0+0x176/0x240 net/ipv4/ip_output.c:550
ip_finish_output+0x5f8/0xd20 net/ipv4/ip_output.c:315
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip_mc_output+0x298/0xf70 net/ipv4/ip_output.c:390
dst_output include/net/dst.h:444 [inline]
ip_local_out+0xbb/0x1b0 net/ipv4/ip_output.c:124
iptunnel_xmit+0x5c5/0x9b0 net/ipv4/ip_tunnel_core.c:91
ip_tunnel_xmit+0x1250/0x36ce net/ipv4/ip_tunnel.c:778
__gre_xmit+0x5e1/0x9a0 net/ipv4/ip_gre.c:450
erspan_xmit+0xa26/0x2b50 net/ipv4/ip_gre.c:759
__netdev_start_xmit include/linux/netdevice.h:4303 [inline]
netdev_start_xmit include/linux/netdevice.h:4312 [inline]
xmit_one net/core/dev.c:3257 [inline]
dev_hard_start_xmit+0x1a5/0x980 net/core/dev.c:3273
sch_direct_xmit+0x370/0xfa0 net/sched/sch_generic.c:327
qdisc_restart net/sched/sch_generic.c:390 [inline]
__qdisc_run+0x57f/0x1960 net/sched/sch_generic.c:398
qdisc_run include/net/pkt_sched.h:120 [inline]
qdisc_run include/net/pkt_sched.h:117 [inline]
__dev_xmit_skb net/core/dev.c:3452 [inline]
__dev_queue_xmit+0x228d/0x3010 net/core/dev.c:3811
dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
neigh_resolve_output net/core/neighbour.c:1366 [inline]
neigh_resolve_output+0x5b7/0x980 net/core/neighbour.c:1346
neigh_output include/net/neighbour.h:501 [inline]
ip_finish_output2+0x93d/0x1760 net/ipv4/ip_output.c:229
ip_do_fragment+0x1d8c/0x2570 net/ipv4/ip_output.c:679
ip_fragment.constprop.0+0x176/0x240 net/ipv4/ip_output.c:550
ip_finish_output+0x5f8/0xd20 net/ipv4/ip_output.c:315
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip_mc_output+0x298/0xf70 net/ipv4/ip_output.c:390
dst_output include/net/dst.h:444 [inline]
ip_local_out+0xbb/0x1b0 net/ipv4/ip_output.c:124
ip_send_skb+0x42/0xf0 net/ipv4/ip_output.c:1442
udp_send_skb.isra.0+0x6bb/0x11f0 net/ipv4/udp.c:837
udp_sendmsg+0x1e07/0x25f0 net/ipv4/udp.c:1124
inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:798
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
__sys_sendto+0x262/0x380 net/socket.c:1787
__do_sys_sendto net/socket.c:1799 [inline]
__se_sys_sendto net/socket.c:1795 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1795
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459279
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f73bba6cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459279
RDX: 00000000000005aa RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000120
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f73bba6d6d4
R13: 00000000004c6d91 R14: 00000000004dbc28 R15: 00000000ffffffff
syz-executor.0 (8271) used greatest stack depth: 22432 bytes left
kobject: 'loop0' (0000000021632b4c): kobject_uevent_env
kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (0000000021632b4c): kobject_uevent_env
kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (0000000021632b4c): kobject_uevent_env
kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path
= '/devices/virtual/block/loop0'
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
NET: Registered protocol family 30
Failed to register TIPC socket type
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
list_add double add: new=ffffffff892e7630, prev=ffffffff890f3140,
next=ffffffff892e7630.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:29!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8445 Comm: syz-executor.3 Not tainted 4.19.47 #19
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
kobject: 'loop0' (0000000021632b4c): kobject_uevent_env
RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
Code: 56 ff ff ff 4c 89 e1 48 c7 c7 a0 ae 81 87 e8 d0 f3 30 fe 0f 0b 48 89
f2 4c 89 e1 4c 89 ee 48 c7 c7 e0 af 81 87 e8 b9 f3 30 fe <0f> 0b 48 89 f1
48 c7 c7 60 af 81 87 4c 89 e6 e8 a5 f3 30 fe 0f 0b
RSP: 0018:ffff88808791fb88 EFLAGS: 00010282
RAX: 0000000000000058 RBX: ffffffff892e74a0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81559f66 RDI: ffffed1010f23f63
RBP: ffff88808791fba0 R08: 0000000000000058 R09: ffffed1015d03ee3
kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path
= '/devices/virtual/block/loop0'
R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffffffff892e7630
R13: ffffffff892e7630 R14: ffffffff892e7630 R15: ffffffff892e75d0
FS: 0000000001c8f940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a75e58 CR3: 000000007f673000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_add include/linux/list.h:60 [inline]
list_add include/linux/list.h:79 [inline]
proto_register+0x459/0x8e0 net/core/sock.c:3299
tipc_socket_init+0x1c/0x70 net/tipc/socket.c:3157
tipc_init_net+0x2ed/0x570 net/tipc/core.c:69
ops_init+0xb3/0x410 net/core/net_namespace.c:129
setup_net+0x2d3/0x740 net/core/net_namespace.c:315
copy_net_ns+0x1df/0x340 net/core/net_namespace.c:438
create_new_namespaces+0x400/0x7b0 kernel/nsproxy.c:107
unshare_nsproxy_namespaces+0xc2/0x200 kernel/nsproxy.c:206
ksys_unshare+0x440/0x980 kernel/fork.c:2525
__do_sys_unshare kernel/fork.c:2593 [inline]
__se_sys_unshare kernel/fork.c:2591 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:2591
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45bd47
Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 1d 8d fb ff c3
66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff
ff 0f 83 fd 8c fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcc3d777f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 000000000075c9a8 RCX: 000000000045bd47
RDX: 0000000000000000 RSI: 00007ffcc3d777a0 RDI: 0000000040000000
RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005
R10: 0000000000000000 R11: 0000000000000206 R12: 000000000075c9a8
R13: 00007ffcc3d77a68 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace a22065e820f89287 ]---
RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
Code: 56 ff ff ff 4c 89 e1 48 c7 c7 a0 ae 81 87 e8 d0 f3 30 fe 0f 0b 48 89
f2 4c 89 e1 4c 89 ee 48 c7 c7 e0 af 81 87 e8 b9 f3 30 fe <0f> 0b 48 89 f1
48 c7 c7 60 af 81 87 4c 89 e6 e8 a5 f3 30 fe 0f 0b
RSP: 0018:ffff88808791fb88 EFLAGS: 00010282
kobject: 'loop0' (0000000021632b4c): kobject_uevent_env
RAX: 0000000000000058 RBX: ffffffff892e74a0 RCX: 0000000000000000
kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path
= '/devices/virtual/block/loop0'
RDX: 0000000000000000 RSI: ffffffff81559f66 RDI: ffffed1010f23f63
RBP: ffff88808791fba0 R08: 0000000000000058 R09: ffffed1015d03ee3
R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffffffff892e7630
kobject: 'loop0' (0000000021632b4c): kobject_uevent_env
R13: ffffffff892e7630 R14: ffffffff892e7630 R15: ffffffff892e75d0
kobject: 'loop0' (0000000021632b4c): fill_kobj_path: path
= '/devices/virtual/block/loop0'
FS: 0000000001c8f940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffefcaf3f8c CR3: 000000007f673000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 8cb12398 Linux 4.14.123
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=157d405aa00000
kernel config: https://syzkaller.appspot.com/x/.config?x=23d8a92661a8b199
dashboard link: https://syzkaller.appspot.com/bug?extid=1bcbf05728afc3e8922f

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+1bcbf0...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0

IPVS: sync thread started: state = BACKUP, mcast_ifn = erspan0, syncid = 3,
id = 0

============================================
WARNING: possible recursive locking detected

4.14.123 #17 Not tainted
--------------------------------------------
ksoftirqd/1/17 is trying to acquire lock:
(_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>] spin_lock
include/linux/spinlock.h:317 [inline]
(_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>] __netif_tx_lock
include/linux/netdevice.h:3530 [inline]
(_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>]
sch_direct_xmit+0x1fc/0x550 net/sched/sch_generic.c:184

but task is already holding lock:

(_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>] spin_lock
include/linux/spinlock.h:317 [inline]
(_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>] __netif_tx_lock
include/linux/netdevice.h:3530 [inline]
(_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>]
sch_direct_xmit+0x1fc/0x550 net/sched/sch_generic.c:184

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(_xmit_ETHER#2);
lock(_xmit_ETHER#2);

*** DEADLOCK ***

May be due to missing lock nesting notation

8 locks held by ksoftirqd/1/17:
#0: (((&in_dev->mr_ifc_timer))){+.-.}, at: [<ffffffff814f56d8>]
lockdep_copy_map include/linux/lockdep.h:174 [inline]
#0: (((&in_dev->mr_ifc_timer))){+.-.}, at: [<ffffffff814f56d8>]
call_timer_fn+0xc8/0x670 kernel/time/timer.c:1269
#1: (rcu_read_lock_bh){....}, at: [<ffffffff851ef916>]
lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline]
#1: (rcu_read_lock_bh){....}, at: [<ffffffff851ef916>]
ip_finish_output2+0x256/0x14a0 net/ipv4/ip_output.c:213
#2: (rcu_read_lock_bh){....}, at: [<ffffffff84d33eb2>]
__dev_queue_xmit+0x1e2/0x25e0 net/core/dev.c:3459
#3: (dev->qdisc_running_key ?: &qdisc_running_key){+...}, at:
[<ffffffff84d362c8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
#4: (_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>] spin_lock
include/linux/spinlock.h:317 [inline]
#4: (_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>] __netif_tx_lock
include/linux/netdevice.h:3530 [inline]
#4: (_xmit_ETHER#2){+.-.}, at: [<ffffffff84e128bc>]
sch_direct_xmit+0x1fc/0x550 net/sched/sch_generic.c:184
#5: (rcu_read_lock_bh){....}, at: [<ffffffff851ef916>]
lwtunnel_xmit_redirect include/net/lwtunnel.h:92 [inline]
#5: (rcu_read_lock_bh){....}, at: [<ffffffff851ef916>]
ip_finish_output2+0x256/0x14a0 net/ipv4/ip_output.c:213
#6: (rcu_read_lock_bh){....}, at: [<ffffffff84d33eb2>]
__dev_queue_xmit+0x1e2/0x25e0 net/core/dev.c:3459
#7: (dev->qdisc_running_key ?: &qdisc_running_key){+...}, at:
[<ffffffff84d362c8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3558

stack backtrace:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.14.123 #17

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:

__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
print_deadlock_bug kernel/locking/lockdep.c:1796 [inline]
check_deadlock kernel/locking/lockdep.c:1843 [inline]
validate_chain kernel/locking/lockdep.c:2444 [inline]
__lock_acquire.cold+0x52a/0x8e2 kernel/locking/lockdep.c:3487
lock_acquire+0x16f/0x430 kernel/locking/lockdep.c:3991
__raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
_raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:152
spin_lock include/linux/spinlock.h:317 [inline]
__netif_tx_lock include/linux/netdevice.h:3530 [inline]
sch_direct_xmit+0x1fc/0x550 net/sched/sch_generic.c:184
__dev_xmit_skb net/core/dev.c:3218 [inline]
__dev_queue_xmit+0x1b6e/0x25e0 net/core/dev.c:3493
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
neigh_resolve_output net/core/neighbour.c:1361 [inline]
neigh_resolve_output+0x4d8/0x870 net/core/neighbour.c:1341
neigh_output include/net/neighbour.h:500 [inline]
ip_finish_output2+0x766/0x14a0 net/ipv4/ip_output.c:229
ip_finish_output+0x56d/0xc60 net/ipv4/ip_output.c:317
NF_HOOK_COND include/linux/netfilter.h:239 [inline]
ip_output+0x1e6/0x590 net/ipv4/ip_output.c:405
dst_output include/net/dst.h:459 [inline]
ip_local_out+0x97/0x170 net/ipv4/ip_output.c:124
iptunnel_xmit+0x564/0x930 net/ipv4/ip_tunnel_core.c:91
ip_tunnel_xmit+0xfd9/0x3189 net/ipv4/ip_tunnel.c:795
__gre_xmit+0x4eb/0x890 net/ipv4/ip_gre.c:444
erspan_xmit net/ipv4/ip_gre.c:750 [inline]
erspan_xmit+0x441/0x11c0 net/ipv4/ip_gre.c:725
__netdev_start_xmit include/linux/netdevice.h:4033 [inline]
netdev_start_xmit include/linux/netdevice.h:4042 [inline]
xmit_one net/core/dev.c:3009 [inline]
dev_hard_start_xmit+0x18c/0x8b0 net/core/dev.c:3025
sch_direct_xmit+0x27a/0x550 net/sched/sch_generic.c:186
__dev_xmit_skb net/core/dev.c:3218 [inline]
__dev_queue_xmit+0x1b6e/0x25e0 net/core/dev.c:3493
dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
neigh_resolve_output net/core/neighbour.c:1361 [inline]
neigh_resolve_output+0x4d8/0x870 net/core/neighbour.c:1341
neigh_output include/net/neighbour.h:500 [inline]
ip_finish_output2+0x766/0x14a0 net/ipv4/ip_output.c:229
ip_finish_output+0x56d/0xc60 net/ipv4/ip_output.c:317
NF_HOOK_COND include/linux/netfilter.h:239 [inline]
ip_output+0x1e6/0x590 net/ipv4/ip_output.c:405
dst_output include/net/dst.h:459 [inline]
ip_local_out+0x97/0x170 net/ipv4/ip_output.c:124
igmpv3_sendpack+0x1a2/0x2b0 net/ipv4/igmp.c:420
igmpv3_send_cr net/ipv4/igmp.c:708 [inline]
igmp_ifc_timer_expire+0x543/0x8b0 net/ipv4/igmp.c:796
call_timer_fn+0x161/0x670 kernel/time/timer.c:1279
expire_timers kernel/time/timer.c:1318 [inline]
__run_timers kernel/time/timer.c:1634 [inline]
__run_timers kernel/time/timer.c:1602 [inline]
run_timer_softirq+0x5b4/0x1570 kernel/time/timer.c:1647
__do_softirq+0x244/0x9a0 kernel/softirq.c:288
run_ksoftirqd kernel/softirq.c:670 [inline]
run_ksoftirqd+0x8c/0x1b0 kernel/softirq.c:662
smpboot_thread_fn+0x5f4/0x960 kernel/smpboot.c:164
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path

= '/devices/virtual/block/loop0'
IPVS: ftp: loaded support on port[0] = 21

NET: Registered protocol family 30
Failed to register TIPC socket type

kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path
= '/devices/virtual/block/loop0'
kobject: 'loop0' (ffff8880a49377a0): kobject_uevent_env
kobject: 'loop0' (ffff8880a49377a0): fill_kobj_path: path

= '/devices/virtual/block/loop0'
IPVS: ftp: loaded support on port[0] = 21

NET: Registered protocol family 30
Failed to register TIPC socket type
IPVS: ftp: loaded support on port[0] = 21
NET: Registered protocol family 30
Failed to register TIPC socket type
IPVS: ftp: loaded support on port[0] = 21
NET: Registered protocol family 30
Failed to register TIPC socket type
IPVS: ftp: loaded support on port[0] = 21
NET: Registered protocol family 30
Failed to register TIPC socket type
IPVS: ftp: loaded support on port[0] = 21
NET: Registered protocol family 30
Failed to register TIPC socket type

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.

[syzbot]