======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
dhcpcd/5278 is trying to acquire lock:
ffffffff913da0b8 (lapb_list_lock){++.-}-{3:3}, at: lapb_devtostruct net/lapb/lapb_iface.c:102 [inline]
ffffffff913da0b8 (lapb_list_lock){++.-}-{3:3}, at: lapb_data_received+0x2f/0x1c0 net/lapb/lapb_iface.c:394

but task is already holding lock:
ffff888055f18f00 (&lapbeth->up_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
ffff888055f18f00 (&lapbeth->up_lock){+.-.}-{3:3}, at: lapbeth_rcv+0x24e/0x640 drivers/net/wan/lapbether.c:131

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&lapbeth->up_lock){+.-.}-{3:3}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
       _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
       spin_lock_bh include/linux/spinlock.h:353 [inline]
       lapbeth_xmit+0x32/0x260 drivers/net/wan/lapbether.c:191
       __netdev_start_xmit include/linux/netdevice.h:5432 [inline]
       netdev_start_xmit include/linux/netdevice.h:5441 [inline]
       xmit_one net/core/dev.c:3953 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3969
       __dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:4958
       dev_queue_xmit include/linux/netdevice.h:3464 [inline]
       tx+0x6b/0x190 drivers/block/aoe/aoenet.c:62
       kthread+0x1ed/0x420 drivers/block/aoe/aoecmd.c:1241
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #2 (_xmit_X25#2){+.-.}-{3:3}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
       spin_lock include/linux/spinlock.h:347 [inline]
       __netif_tx_lock include/linux/netdevice.h:4841 [inline]
       __dev_queue_xmit+0xe9d/0x3920 net/core/dev.c:4952
       neigh_output include/net/neighbour.h:560 [inline]
       ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
       NF_HOOK_COND include/linux/netfilter.h:314 [inline]
       ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
       iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
       udp_tunnel_xmit_skb+0x29b/0x3e0 net/ipv4/udp_tunnel_core.c:187
       vxlan_xmit_one+0x21f6/0x2eb0 drivers/net/vxlan/vxlan_core.c:2571
       vxlan_xmit+0x1e19/0x33b0 drivers/net/vxlan/vxlan_core.c:2860
       __netdev_start_xmit include/linux/netdevice.h:5432 [inline]
       netdev_start_xmit include/linux/netdevice.h:5441 [inline]
       xmit_one net/core/dev.c:3953 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3969
       __dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:4958
       lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
       lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
       lapb_establish_data_link+0x89/0xe0 net/lapb/lapb_out.c:-1
       lapb_device_event+0x4eb/0x680 net/lapb/lapb_iface.c:-1
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
       call_netdevice_notifiers net/core/dev.c:2327 [inline]
       __dev_notify_flags+0x31e/0x510 net/core/dev.c:9896
       netif_change_flags+0xde/0x1b0 net/core/dev.c:9925
       dev_change_flags+0x128/0x260 net/core/dev_api.c:68
       devinet_ioctl+0x966/0x1c50 net/ipv4/devinet.c:1199
       inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1010
       sock_do_ioctl+0x101/0x320 net/socket.c:1325
       sock_ioctl+0x57a/0x7e0 net/socket.c:1446
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:597 [inline]
       __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (&lapb->lock){+.-.}-{3:3}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
       _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
       spin_lock_bh include/linux/spinlock.h:353 [inline]
       lapb_unregister+0x1e1/0x450 net/lapb/lapb_iface.c:187
       lapbeth_close+0x56/0xb0 drivers/net/wan/lapbether.c:350
       __dev_close_many+0x366/0x6e0 net/core/dev.c:1798
       netif_close_many+0x249/0x660 net/core/dev.c:1824
       netif_close+0x160/0x220 net/core/dev.c:1842
       dev_close+0xf7/0x210 net/core/dev_api.c:221
       lapbeth_device_event+0x301/0x460 drivers/net/wan/lapbether.c:468
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
       call_netdevice_notifiers net/core/dev.c:2327 [inline]
       __dev_close_many+0x119/0x6e0 net/core/dev.c:1769
       netif_close_many+0x249/0x660 net/core/dev.c:1824
       unregister_netdevice_many_notify+0xb76/0x2140 net/core/dev.c:12530
       unregister_netdevice_many net/core/dev.c:12632 [inline]
       default_device_exit_batch+0x6d4/0x760 net/core/dev.c:13344
       ops_exit_list net/core/net_namespace.c:206 [inline]
       ops_undo_list+0x4b4/0x8d0 net/core/net_namespace.c:253
       cleanup_net+0x572/0x810 net/core/net_namespace.c:706
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (lapb_list_lock){++.-}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3209 [inline]
       check_prevs_add kernel/locking/lockdep.c:3328 [inline]
       validate_chain kernel/locking/lockdep.c:3952 [inline]
       __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
       __raw_read_lock_bh include/linux/rwlock_api_smp.h:192 [inline]
       _raw_read_lock_bh+0x3e/0x50 kernel/locking/spinlock.c:287
       lapb_devtostruct net/lapb/lapb_iface.c:102 [inline]
       lapb_data_received+0x2f/0x1c0 net/lapb/lapb_iface.c:394
       lapbeth_rcv+0x34d/0x640 drivers/net/wan/lapbether.c:142
       __netif_receive_skb_one_core net/core/dev.c:6297 [inline]
       __netif_receive_skb net/core/dev.c:6410 [inline]
       process_backlog+0xc26/0x18b0 net/core/dev.c:6761
       __napi_poll+0xaa/0x330 net/core/dev.c:7830
       napi_poll net/core/dev.c:7893 [inline]
       net_rx_action+0x61d/0xf50 net/core/dev.c:8050
       handle_softirqs+0x226/0x860 kernel/softirq.c:645
       do_softirq+0x77/0xd0 kernel/softirq.c:546
       __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
       spin_unlock_bh include/linux/spinlock.h:407 [inline]
       lapb_device_event+0x4f3/0x680 net/lapb/lapb_iface.c:527
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
       call_netdevice_notifiers net/core/dev.c:2327 [inline]
       __dev_notify_flags+0x31e/0x510 net/core/dev.c:9896
       netif_change_flags+0xde/0x1b0 net/core/dev.c:9925
       dev_change_flags+0x128/0x260 net/core/dev_api.c:68
       devinet_ioctl+0x966/0x1c50 net/ipv4/devinet.c:1199
       inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1010
       sock_do_ioctl+0x101/0x320 net/socket.c:1325
       sock_ioctl+0x57a/0x7e0 net/socket.c:1446
       vfs_ioctl fs/ioctl.c:51 [inline]
       __do_sys_ioctl fs/ioctl.c:597 [inline]
       __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  lapb_list_lock --> _xmit_X25#2 --> &lapbeth->up_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&lapbeth->up_lock);
                               lock(_xmit_X25#2);
                               lock(&lapbeth->up_lock);
  rlock(lapb_list_lock);

 *** DEADLOCK ***

locks held by dhcpcd/5278: 4, last CPU#0:
 #0: ffffffff9125a940 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 #0: ffffffff9125a940 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x2fb/0x1c50 net/ipv4/devinet.c:1120
 #1: ffffffff8fd5cde0 (rcu_read_lock){....}-{1:3}, at: local_lock_acquire include/linux/local_lock_internal.h:46 [inline]
 #1: ffffffff8fd5cde0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 net/core/dev.c:6757
 #2: ffffffff8fd5cde0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8fd5cde0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8fd5cde0 (rcu_read_lock){....}-{1:3}, at: lapbeth_rcv+0x12f/0x640 drivers/net/wan/lapbether.c:127
 #3: ffff888055f18f00 (&lapbeth->up_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
 #3: ffff888055f18f00 (&lapbeth->up_lock){+.-.}-{3:3}, at: lapbeth_rcv+0x24e/0x640 drivers/net/wan/lapbether.c:131

stack backtrace:
CPU: 0 UID: 0 PID: 5278 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
 check_prev_add kernel/locking/lockdep.c:3209 [inline]
 check_prevs_add kernel/locking/lockdep.c:3328 [inline]
 validate_chain kernel/locking/lockdep.c:3952 [inline]
 __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 __raw_read_lock_bh include/linux/rwlock_api_smp.h:192 [inline]
 _raw_read_lock_bh+0x3e/0x50 kernel/locking/spinlock.c:287
 lapb_devtostruct net/lapb/lapb_iface.c:102 [inline]
 lapb_data_received+0x2f/0x1c0 net/lapb/lapb_iface.c:394
 lapbeth_rcv+0x34d/0x640 drivers/net/wan/lapbether.c:142
 __netif_receive_skb_one_core net/core/dev.c:6297 [inline]
 __netif_receive_skb net/core/dev.c:6410 [inline]
 process_backlog+0xc26/0x18b0 net/core/dev.c:6761
 __napi_poll+0xaa/0x330 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8050
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 lapb_device_event+0x4f3/0x680 net/lapb/lapb_iface.c:527
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 __dev_notify_flags+0x31e/0x510 net/core/dev.c:9896
 netif_change_flags+0xde/0x1b0 net/core/dev.c:9925
 dev_change_flags+0x128/0x260 net/core/dev_api.c:68
 devinet_ioctl+0x966/0x1c50 net/ipv4/devinet.c:1199
 inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1010
 sock_do_ioctl+0x101/0x320 net/socket.c:1325
 sock_ioctl+0x57a/0x7e0 net/socket.c:1446
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fabf0f38378
Code: 00 00 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 07 89 d0 c3 0f 1f 40 00 48 8b 15 49 3a 0d
RSP: 002b:00007ffe445a31c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000020 RCX: 00007fabf0f38378
RDX: 00007ffe445b33c0 RSI: 0000000000008914 RDI: 0000000000000020
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe445c3560
R13: 00007fabf0e38708 R14: 0000000000000028 R15: 0000000000008914
 </TASK>