possible deadlock in __dev_queue_xmit (4)

Status: upstream: reported C repro on 2026/08/24 18:32
Reported-by: syzbot+cd266a6fcd5fc6190b6c@syzkaller.appspotmail.com
First crash: 36d, last: 17h22m
▶ ▼ Similar bugs (15)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 possible deadlock in __dev_queue_xmit 4 4 2656d 2725d 0/3 auto-closed as invalid on 2019/10/25 08:36
upstream possible deadlock in __dev_queue_xmit (3) net 4 syz, C done inconclusive 1155 2d19h 2492d 0/29 upstream: reported C repro on 2019/12/03 09:55
linux-6.6 possible deadlock in __dev_queue_xmit 4 1 234d 234d 0/2 auto-obsoleted due to no activity on 2026/05/18 03:49
linux-4.19 possible deadlock in __dev_queue_xmit 4 syz, C error 5 1833d 2251d 0/1 upstream: reported C repro on 2020/07/31 07:05
android-414 possible deadlock in __dev_queue_xmit 4 3 2715d 2726d 0/1 auto-closed as invalid on 2019/10/21 21:31
linux-6.1 possible deadlock in __dev_queue_xmit (3) 4 104 404d 704d 0/3 auto-obsoleted due to no activity on 2025/10/30 22:15
android-44 possible deadlock in __dev_queue_xmit 4 14 2491d 2553d 0/2 auto-closed as invalid on 2020/04/02 07:14
linux-6.1 possible deadlock in __dev_queue_xmit 4 98 1076d 1189d 0/3 auto-obsoleted due to no activity on 2023/12/28 22:22
linux-4.14 possible deadlock in __dev_queue_xmit 4 7 2202d 2647d 0/1 auto-closed as invalid on 2021/01/16 21:33
upstream possible deadlock in __dev_queue_xmit net 4 1 2814d 2814d 0/29 closed as invalid on 2019/03/10 18:51
linux-5.15 possible deadlock in __dev_queue_xmit 4 113 1140d 1276d 0/3 auto-obsoleted due to no activity on 2023/10/25 04:56
linux-6.1 possible deadlock in __dev_queue_xmit (2) 4 7 874d 984d 0/3 auto-obsoleted due to no activity on 2024/08/16 05:44
linux-5.15 possible deadlock in __dev_queue_xmit (2) origin:lts-only 4 syz, C done 282 16h50m 1020d 0/3 upstream: reported C repro on 2023/12/15 02:11
upstream possible deadlock in __dev_queue_xmit (2) kernel 4 2 2626d 2742d 0/29 auto-closed as invalid on 2019/11/19 09:01
linux-6.6 possible deadlock in __dev_queue_xmit (2) 4 syz, C 28 28d 36d 0/2 upstream: reported C repro on 2026/08/24 18:29

Sample crash report:
device syzkaller0 entered promiscuous mode
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.0.17/4428 is trying to acquire lock:
ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3964 [inline]
ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 net/core/dev.c:4337

but task is already holding lock:
ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3964 [inline]
ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 net/core/dev.c:4337

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&sch->root_lock_key#43);
  lock(&sch->root_lock_key#43);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz.0.17/4428:
 #0: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #0: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
 #0: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 net/core/dev.c:4294
 #1: ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #1: ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3964 [inline]
 #1: ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 net/core/dev.c:4337
 #2: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #2: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:843 [inline]
 #2: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 net/core/dev.c:4294

stack backtrace:
CPU: 0 PID: 4428 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 __lock_acquire+0x12c8/0x7c40 kernel/locking/lockdep.c:-1
 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 __dev_xmit_skb net/core/dev.c:3964 [inline]
 __dev_queue_xmit+0xe46/0x3810 net/core/dev.c:4337
 sch_frag_xmit_hook+0x2a4/0x11c0 net/sched/sch_frag.c:148
 tcf_mirred_forward net/sched/act_mirred.c:218 [inline]
 tcf_mirred_act+0xb1c/0x1640 net/sched/act_mirred.c:323
 tcf_action_exec+0x174/0x590 net/sched/act_api.c:1098
 tcf_exts_exec include/net/pkt_cls.h:351 [inline]
 basic_classify+0x1ae/0x2c0 net/sched/cls_basic.c:52
 __tcf_classify net/sched/cls_api.c:1569 [inline]
 tcf_classify+0x33e/0xbf0 net/sched/cls_api.c:1635
 qfq_classify net/sched/sch_qfq.c:714 [inline]
 qfq_enqueue+0x31c/0x12c0 net/sched/sch_qfq.c:1238
 dev_qdisc_enqueue+0x4c/0x2b0 net/core/dev.c:3900
 __dev_xmit_skb net/core/dev.c:3989 [inline]
 __dev_queue_xmit+0x1031/0x3810 net/core/dev.c:4337
 packet_snd net/packet/af_packet.c:3160 [inline]
 packet_sendmsg+0x3a9e/0x4c30 net/packet/af_packet.c:3191
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5ed/0x9a0 net/socket.c:2519
 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2573
 __sys_sendmsg net/socket.c:2602 [inline]
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg+0x1c3/0x2b0 net/socket.c:2609
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f6362f9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd6aaf61d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f6363225fa0 RCX: 00007f6362f9e159
RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000006
RBP: 00007f636303503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6363225fac R14: 00007f6363225fa0 R15: 00007f6363225fa0
 </TASK>

Crashes (137):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/15 05:39 linux-6.1.y 1a8763b93150 81a27d1a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/08/24 21:54 linux-6.1.y 05208478041c b55bd4c3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/08/24 20:39 linux-6.1.y 05208478041c b55bd4c3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/26 01:42 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/20 23:55 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/14 22:45 linux-6.1.y 1a8763b93150 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/14 04:29 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/12 18:51 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/12 12:35 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/10 05:19 linux-6.1.y cf82dcca9634 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/09 01:00 linux-6.1.y cf82dcca9634 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/06 01:30 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/05 06:27 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/04 17:40 linux-6.1.y cf82dcca9634 f65209a4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/03 12:48 linux-6.1.y cf82dcca9634 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/03 03:30 linux-6.1.y cf82dcca9634 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/08/29 21:09 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/08/29 15:33 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/08/28 17:56 linux-6.1.y d64a499eea6b e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/08/28 17:54 linux-6.1.y d64a499eea6b e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/08/28 17:53 linux-6.1.y d64a499eea6b e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in __dev_queue_xmit
2026/09/29 08:23 linux-6.1.y 1a8763b93150 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/25 12:54 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/25 09:28 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/25 01:53 linux-6.1.y 1a8763b93150 3c3cdf19 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/21 09:19 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/21 09:19 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/20 20:29 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/20 02:53 linux-6.1.y 1a8763b93150 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/18 04:57 linux-6.1.y 1a8763b93150 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/18 02:40 linux-6.1.y 1a8763b93150 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/18 01:24 linux-6.1.y 1a8763b93150 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/16 16:53 linux-6.1.y 1a8763b93150 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/16 15:43 linux-6.1.y 1a8763b93150 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/16 02:42 linux-6.1.y 1a8763b93150 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/14 21:41 linux-6.1.y 1a8763b93150 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/13 20:55 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/13 09:23 linux-6.1.y cf82dcca9634 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/10 01:13 linux-6.1.y cf82dcca9634 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/08 22:25 linux-6.1.y cf82dcca9634 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/05 15:54 linux-6.1.y cf82dcca9634 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/02 22:30 linux-6.1.y cf82dcca9634 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/01 03:17 linux-6.1.y d64a499eea6b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/01 03:16 linux-6.1.y d64a499eea6b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/09/01 01:52 linux-6.1.y d64a499eea6b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/08/29 10:54 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/08/29 06:23 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
2026/08/24 18:31 linux-6.1.y 05208478041c b55bd4c3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in __dev_queue_xmit
* Struck through repros no longer work on HEAD.