============================================
WARNING: possible recursive locking detected
6.14.0-syzkaller-05877-g1a9239bb4253 #0 Not tainted
--------------------------------------------
syz.5.271/7010 is trying to acquire lock:
ffff888059bd0f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888059bd0f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x1bc/0x280 net/hsr/hsr_device.c:234
but task is already holding lock:
ffff8880329def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880329def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x1bc/0x280 net/hsr/hsr_device.c:234
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
9 locks held by syz.5.271/7010:
#0: ffffc90000a08ca8 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0x117/0x620 kernel/time/timer.c:1786
#1: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#1: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#1: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x1ab/0x1e40 net/ipv6/ndisc.c:484
#2: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#2: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#2: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x39d/0x2020 net/ipv6/ip6_output.c:126
#3: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#3: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#3: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x276/0x43e0 net/core/dev.c:4558
#4: ffff8880329def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#4: ffff8880329def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x1bc/0x280 net/hsr/hsr_device.c:234
#5: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#5: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#5: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xa6/0x2910 net/hsr/hsr_forward.c:728
#6: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#6: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#6: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x276/0x43e0 net/core/dev.c:4558
#7: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#7: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#7: ffffffff8e3bdb40 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x18d/0x1880 net/bridge/br_device.c:52
#8: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#8: ffffffff8e3bdae0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x276/0x43e0 net/core/dev.c:4558
stack backtrace:
CPU: 1 UID: 0 PID: 7010 Comm: syz.5.271 Not tainted 6.14.0-syzkaller-05877-g1a9239bb4253 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_deadlock_bug+0x1e9/0x240 kernel/locking/lockdep.c:3042
check_deadlock kernel/locking/lockdep.c:3094 [inline]
validate_chain kernel/locking/lockdep.c:3896 [inline]
__lock_acquire+0xff7/0x1ba0 kernel/locking/lockdep.c:5235
lock_acquire kernel/locking/lockdep.c:5866 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5823
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x1bc/0x280 net/hsr/hsr_device.c:234
__netdev_start_xmit include/linux/netdevice.h:5201 [inline]
netdev_start_xmit include/linux/netdevice.h:5210 [inline]
xmit_one net/core/dev.c:3780 [inline]
dev_hard_start_xmit+0x96/0x740 net/core/dev.c:3796
__dev_queue_xmit+0x7eb/0x43e0 net/core/dev.c:4633
dev_queue_xmit include/linux/netdevice.h:3350 [inline]
br_dev_queue_push_xmit+0x272/0x8a0 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
br_forward_finish+0xf5/0x130 net/bridge/br_forward.c:66
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
__br_forward+0x1e5/0x5b0 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xf1/0x180 net/bridge/br_forward.c:190
br_flood+0x17c/0x650 net/bridge/br_forward.c:237
br_dev_xmit+0xf70/0x1880 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5201 [inline]
netdev_start_xmit include/linux/netdevice.h:5210 [inline]
xmit_one net/core/dev.c:3780 [inline]
dev_hard_start_xmit+0x96/0x740 net/core/dev.c:3796
__dev_queue_xmit+0x7eb/0x43e0 net/core/dev.c:4633
dev_queue_xmit include/linux/netdevice.h:3350 [inline]
hsr_xmit net/hsr/hsr_forward.c:430 [inline]
hsr_forward_do net/hsr/hsr_forward.c:571 [inline]
hsr_forward_skb+0xcd3/0x2910 net/hsr/hsr_forward.c:733
hsr_dev_xmit+0x1c7/0x280 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5201 [inline]
netdev_start_xmit include/linux/netdevice.h:5210 [inline]
xmit_one net/core/dev.c:3780 [inline]
dev_hard_start_xmit+0x96/0x740 net/core/dev.c:3796
__dev_queue_xmit+0x7eb/0x43e0 net/core/dev.c:4633
dev_queue_xmit include/linux/netdevice.h:3350 [inline]
neigh_connected_output+0x3da/0x620 net/core/neighbour.c:1541
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0xaee/0x2020 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:215 [inline]
ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x1f9/0x540 net/ipv6/ip6_output.c:247
dst_output include/net/dst.h:459 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xa91/0x1e40 net/ipv6/ndisc.c:513
ndisc_send_rs+0x129/0x670 net/ipv6/ndisc.c:723
addrconf_rs_timer+0x40d/0x840 net/ipv6/addrconf.c:4033
call_timer_fn+0x19a/0x620 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2414
__run_timer_base kernel/time/timer.c:2426 [inline]
__run_timer_base kernel/time/timer.c:2418 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2435
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2445
handle_softirqs+0x219/0x8e0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:finish_task_switch.isra.0+0x22a/0xc10 kernel/sched/core.c:5240
Code: fb 09 00 00 44 8b 05 f9 c9 f9 0e 45 85 c0 0f 85 be 01 00 00 4c 89 e7 e8 a4 f6 ff ff e8 cf 5e 39 00 fb 65 48 8b 1d be 87 14 12 <48> 8d bb 18 16 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc9001ec776f8 EFLAGS: 00000202
RAX: 000000000000b3df RBX: ffff888034fe9e00 RCX: ffffffff81c2c61f
RDX: 0000000000000000 RSI: ffffffff8dbb3511 RDI: ffffffff8bf36540
RBP: ffffc9001ec77740 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9082ff17 R11: 0000000000000000 R12: ffff8880b8539f00
R13: ffff88802dd83c00 R14: 0000000000000001 R15: ffff8880b853ad30
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x1131/0x5c00 kernel/sched/core.c:6747
__schedule_loop kernel/sched/core.c:6824 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6839
schedule_timeout+0x242/0x280 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x3e2/0x600 kernel/sched/completion.c:116
rdmsr_safe_on_cpu+0x1dc/0x210 arch/x86/lib/msr-smp.c:181
msr_read+0x19d/0x250 arch/x86/kernel/msr.c:66
vfs_read+0x1e1/0xc70 fs/read_write.c:568
ksys_read+0x12a/0x240 fs/read_write.c:713
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fec7298d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fec73741038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fec72ba5fa0 RCX: 00007fec7298d169
RDX: 0000000000018ff8 RSI: 0000200000019680 RDI: 0000000000000003
RBP: 00007fec72a0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fec72ba5fa0 R15: 00007ffd2e28ab38
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 00 00 add %al,(%rax)
2: 44 8b 05 f9 c9 f9 0e mov 0xef9c9f9(%rip),%r8d # 0xef9ca02
9: 45 85 c0 test %r8d,%r8d
c: 0f 85 be 01 00 00 jne 0x1d0
12: 4c 89 e7 mov %r12,%rdi
15: e8 a4 f6 ff ff call 0xfffff6be
1a: e8 cf 5e 39 00 call 0x395eee
1f: fb sti
20: 65 48 8b 1d be 87 14 mov %gs:0x121487be(%rip),%rbx # 0x121487e6
27: 12
* 28: 48 8d bb 18 16 00 00 lea 0x1618(%rbx),%rdi <-- trapping instruction
2f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
36: fc ff df
39: 48 89 fa mov %rdi,%rdx
3c: 48 rex.W
3d: c1 .byte 0xc1