============================================ WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.0.4093/17637 is trying to acquire lock: ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4315 [inline] ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: __dev_queue_xmit+0xd56/0x3920 net/core/dev.c:4916 but task is already holding lock: ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4315 [inline] ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: __dev_queue_xmit+0xd56/0x3920 net/core/dev.c:4916 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&sch->root_lock_key#396); lock(&sch->root_lock_key#396); *** DEADLOCK *** May be due to missing lock nesting notation locks held by syz.0.4093/17637: 10, last CPU#0: #0: ffff88805561cc60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff88805561cc60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_connect net/sctp/socket.c:4868 [inline] #0: ffff88805561cc60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_inet_connect+0xa0/0x210 net/sctp/socket.c:4890 #1: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x65/0x1b10 net/ipv4/ip_output.c:476 #2: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 net/ipv4/ip_output.c:432 #3: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x10b0 net/ipv4/ip_output.c:229 #4: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #4: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline] #4: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:4872 #5: ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #5: ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4315 [inline] #5: ffff888036150170 (&sch->root_lock_key#396){+.-.}-{3:3}, at: __dev_queue_xmit+0xd56/0x3920 net/core/dev.c:4916 #6: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #6: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline] #6: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:4872 #7: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #7: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #7: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 net/ipv4/ip_output.c:432 #8: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #8: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #8: ffffffff8fd5c8e0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x10b0 net/ipv4/ip_output.c:229 #9: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #9: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline] #9: ffffffff8fd5c940 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:4872 stack backtrace: CPU: 0 UID: 0 PID: 17637 Comm: syz.0.4093 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_deadlock_bug+0x27a/0x290 kernel/locking/lockdep.c:3085 check_deadlock kernel/locking/lockdep.c:3137 [inline] validate_chain kernel/locking/lockdep.c:3939 [inline] __lock_acquire+0x25db/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173 spin_lock include/linux/spinlock.h:347 [inline] __dev_xmit_skb net/core/dev.c:4315 [inline] __dev_queue_xmit+0xd56/0x3920 net/core/dev.c:4916 dev_queue_xmit include/linux/netdevice.h:3469 [inline] neigh_hh_output include/net/neighbour.h:544 [inline] neigh_output include/net/neighbour.h:558 [inline] ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236 ip_do_fragment+0x958/0x1810 net/ipv4/ip_output.c:922 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:437 iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97 ip_tunnel_xmit+0x195b/0x2040 net/ipv4/ip_tunnel.c:848 sit_tunnel_xmit__ net/ipv6/sit.c:1056 [inline] sit_tunnel_xmit+0x63f/0x1c60 net/ipv6/sit.c:-1 __netdev_start_xmit include/linux/netdevice.h:5437 [inline] netdev_start_xmit include/linux/netdevice.h:5446 [inline] xmit_one net/core/dev.c:3953 [inline] dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3969 __dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:4958 sch_frag_xmit_hook+0x28b/0x1550 net/sched/sch_frag.c:156 tcf_mirred_forward net/sched/act_mirred.c:242 [inline] tcf_mirred_to_dev+0x93e/0xe60 net/sched/act_mirred.c:330 tcf_mirred_act+0x1169/0x1880 net/sched/act_mirred.c:489 tc_act include/net/tc_wrapper.h:131 [inline] tcf_action_exec+0x185/0x8d0 net/sched/act_api.c:1161 tcf_exts_exec include/net/pkt_cls.h:361 [inline] basic_classify+0x1b2/0x2d0 net/sched/cls_basic.c:54 tc_classify include/net/tc_wrapper.h:198 [inline] __tcf_classify net/sched/cls_api.c:1779 [inline] tcf_classify+0x43d/0x1160 net/sched/cls_api.c:1875 tcf_classify_qdisc include/net/pkt_cls.h:164 [inline] hfsc_classify net/sched/sch_hfsc.c:1157 [inline] hfsc_enqueue+0x324/0x1100 net/sched/sch_hfsc.c:1567 dev_qdisc_enqueue+0x4e/0x260 net/core/dev.c:4242 __dev_xmit_skb net/core/dev.c:4357 [inline] __dev_queue_xmit+0x1b6c/0x3920 net/core/dev.c:4916 dev_queue_xmit include/linux/netdevice.h:3469 [inline] neigh_hh_output include/net/neighbour.h:544 [inline] neigh_output include/net/neighbour.h:558 [inline] ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236 ip_do_fragment+0x958/0x1810 net/ipv4/ip_output.c:922 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:437 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533 sctp_packet_transmit+0x25d0/0x2bb0 net/sctp/output.c:659 sctp_packet_singleton+0x22f/0x340 net/sctp/outqueue.c:784 sctp_outq_flush_ctrl net/sctp/outqueue.c:915 [inline] sctp_outq_flush+0x4fb/0x3380 net/sctp/outqueue.c:1213 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:-1 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1211 [inline] sctp_do_sm+0x55a1/0x5dd0 net/sctp/sm_sideeffect.c:1182 sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73 __sctp_connect+0x911/0xdc0 net/sctp/socket.c:1273 sctp_connect net/sctp/socket.c:4875 [inline] sctp_inet_connect+0x12e/0x210 net/sctp/socket.c:4890 connect_socket net/socket.c:2141 [inline] __sys_connect_file net/socket.c:2166 [inline] __sys_connect+0x316/0x450 net/socket.c:2183 __do_sys_connect net/socket.c:2189 [inline] __se_sys_connect net/socket.c:2186 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2186 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f885079f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f885157f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f8850a25fa0 RCX: 00007f885079f559 RDX: 0000000000000010 RSI: 0000200000000180 RDI: 0000000000000006 RBP: 00007f8850836b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8850a26038 R14: 00007f8850a25fa0 R15: 00007ffd49ecb738