device syzkaller0 entered promiscuous mode
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.4.71/4599 is trying to acquire lock:
ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3964 [inline]
ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: __dev_queue_xmit+0x998/0x3154 net/core/dev.c:4337

but task is already holding lock:
ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3964 [inline]
ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: __dev_queue_xmit+0x998/0x3154 net/core/dev.c:4337

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&sch->root_lock_key#91);
  lock(&sch->root_lock_key#91);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz.4.71/4599:
 #0: ffff8000155674a0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349
 #1: ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #1: ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3964 [inline]
 #1: ffff0000f7b8c108 (&sch->root_lock_key#91){+...}-{2:2}, at: __dev_queue_xmit+0x998/0x3154 net/core/dev.c:4337
 #2: ffff8000155674a0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349

stack backtrace:
CPU: 1 PID: 4599 Comm: syz.4.71 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 __lock_acquire+0x15d0/0x6634 kernel/locking/lockdep.c:-1
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 __dev_xmit_skb net/core/dev.c:3964 [inline]
 __dev_queue_xmit+0x998/0x3154 net/core/dev.c:4337
 dev_queue_xmit+0x24/0x34 include/linux/netdevice.h:3051
 sch_frag_xmit_hook+0x228/0xf34 net/sched/sch_frag.c:148
 tcf_dev_queue_xmit+0x4c/0x50 net/sched/act_api.c:36
 tcf_mirred_forward net/sched/act_mirred.c:218 [inline]
 tcf_mirred_act+0xa90/0x1394 net/sched/act_mirred.c:323
 tcf_action_exec+0x164/0x544 net/sched/act_api.c:1098
 tcf_exts_exec include/net/pkt_cls.h:351 [inline]
 basic_classify+0x1ec/0x314 net/sched/cls_basic.c:52
 __tcf_classify net/sched/cls_api.c:1569 [inline]
 tcf_classify+0x1b4/0x9d4 net/sched/cls_api.c:1635
 qfq_classify net/sched/sch_qfq.c:714 [inline]
 qfq_enqueue+0x288/0xf74 net/sched/sch_qfq.c:1238
 dev_qdisc_enqueue+0x5c/0x388 net/core/dev.c:3900
 __dev_xmit_skb net/core/dev.c:3989 [inline]
 __dev_queue_xmit+0xaf0/0x3154 net/core/dev.c:4337
 dev_queue_xmit+0x24/0x34 include/linux/netdevice.h:3051
 packet_snd net/packet/af_packet.c:3137 [inline]
 packet_sendmsg+0x3034/0x4038 net/packet/af_packet.c:3168
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x588/0x90c net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x288/0x374 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585