============================================
WARNING: possible recursive locking detected
syzkaller #0 Tainted: G L
--------------------------------------------
syz-executor/14379 is trying to acquire lock:
ffff88807915ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88807915ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff8880595def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880595def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
16 locks held by syz-executor/14379:
#0: ffffffff8dffe370 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1485 [inline]
#0: ffffffff8dffe370 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x131/0x4b0 kernel/fork.c:1538
#1: ffff88802950a800 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:353 [inline]
#1: ffff88802950a800 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x125/0x1b80 mm/mmap.c:1726
#2: ffff88802950f180 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:343 [inline]
#2: ffff88802950f180 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x20d/0x1b80 mm/mmap.c:1733
#3: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#3: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#3: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x29/0x240 mm/pgtable-generic.c:288
#4: ffff888033da7e58 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffff888033da7e58 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x13e/0x210 mm/pgtable-generic.c:403
#5: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#5: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#5: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x29/0x240 mm/pgtable-generic.c:288
#6: ffff888024afdc18 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1256 [inline]
#6: ffff888024afdc18 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x69d/0x7e00 mm/memory.c:1392
#7: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#7: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#7: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: page_table_check_set+0x148/0x610 mm/page_table_check.c:112
#8: ffffc90000a08be0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x590 kernel/time/timer.c:1745
#9: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#9: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#9: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x83/0x360 net/hsr/hsr_device.c:419
#10: ffff8880595def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#10: ffff8880595def30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
#11: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#11: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#11: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860 net/hsr/hsr_forward.c:736
#12: ffffffff8df41e80 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#12: ffffffff8df41e80 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#12: ffffffff8df41e80 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x289/0x3140 net/core/dev.c:4742
#13: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#13: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#13: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x185/0x1840 net/bridge/br_device.c:52
#14: ffffffff8df41e80 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#14: ffffffff8df41e80 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#14: ffffffff8df41e80 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x289/0x3140 net/core/dev.c:4742
#15: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#15: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#15: ffffffff8df41e20 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 1 UID: 0 PID: 14379 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x2540/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x117/0x340 kernel/locking/lockdep.c:5868
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5273 [inline]
netdev_start_xmit include/linux/netdevice.h:5282 [inline]
xmit_one net/core/dev.c:3853 [inline]
dev_hard_start_xmit+0x2cd/0x800 net/core/dev.c:3869
__dev_queue_xmit+0x1493/0x3140 net/core/dev.c:4817
dev_queue_xmit include/linux/netdevice.h:3381 [inline]
br_dev_queue_push_xmit+0x6c5/0x890 net/bridge/br_forward.c:53
NF_HOOK+0x320/0x3c0 include/linux/netfilter.h:318
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x320/0x3c0 include/linux/netfilter.h:318
__br_forward+0x41e/0x600 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xb5/0x160 net/bridge/br_forward.c:191
br_flood+0x31a/0x6a0 net/bridge/br_forward.c:238
br_dev_xmit+0x11b3/0x1840 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5273 [inline]
netdev_start_xmit include/linux/netdevice.h:5282 [inline]
xmit_one net/core/dev.c:3853 [inline]
dev_hard_start_xmit+0x2cd/0x800 net/core/dev.c:3869
__dev_queue_xmit+0x1493/0x3140 net/core/dev.c:4817
dev_queue_xmit include/linux/netdevice.h:3381 [inline]
hsr_xmit net/hsr/hsr_forward.c:438 [inline]
hsr_forward_do net/hsr/hsr_forward.c:579 [inline]
hsr_forward_skb+0x158b/0x2860 net/hsr/hsr_forward.c:741
send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364
hsr_announce+0x1d5/0x360 net/hsr/hsr_device.c:421
call_timer_fn+0x16e/0x590 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2404
handle_softirqs+0x27d/0x850 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:addr_has_metadata mm/kasan/kasan.h:333 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:188 [inline]
RIP: 0010:kasan_check_range+0x43/0x2c0 mm/kasan/generic.c:200
Code: 4c 8d 04 37 49 39 f8 0f 82 82 02 00 00 49 b9 00 00 00 00 00 80 ff ff eb 11 cc cc cc f3 0f 1e fa 49 b9 00 00 00 00 00 00 00 ff 0f 1e fa 4c 39 cf 0f 82 58 02 00 00 49 89 ff 49 c1 ef 03 49 ba
RSP: 0018:ffffc90004ed7350 EFLAGS: 00000212
RAX: ffffffff82334a01 RBX: ffff88801c55e2c8 RCX: ffffffff82334b05
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88801c55e2cc
RBP: ffff88801c55e280 R08: ffff88801c55e2d0 R09: ffff800000000000
R10: dffffc0000000000 R11: ffffed10038abc5a R12: 0000000000000001
R13: 0000000000044608 R14: 0000000000000001 R15: 0000000000000000
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline]
page_table_check_set+0x2d5/0x610 mm/page_table_check.c:121
page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
set_ptes include/linux/pgtable.h:292 [inline]
__copy_present_ptes mm/memory.c:1102 [inline]
copy_present_ptes mm/memory.c:1181 [inline]
copy_pte_range mm/memory.c:1304 [inline]
copy_pmd_range+0x4d02/0x7e00 mm/memory.c:1392
copy_pud_range mm/memory.c:1429 [inline]
copy_p4d_range mm/memory.c:1453 [inline]
copy_page_range+0xb88/0x11d0 mm/memory.c:1535
dup_mmap+0xf4a/0x1b80 mm/mmap.c:1827
dup_mm kernel/fork.c:1486 [inline]
copy_mm+0x13c/0x4b0 kernel/fork.c:1538
copy_process+0x165d/0x3950 kernel/fork.c:2178
kernel_clone+0x21e/0x820 kernel/fork.c:2608
__do_sys_clone kernel/fork.c:2749 [inline]
__se_sys_clone kernel/fork.c:2733 [inline]
__x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2733
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7950b85e93
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007f7950f0fca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7950b85e93
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 000055558ce0e7d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 00000000000c8d8e R15: 00007f7950f0fe40
----------------
Code disassembly (best guess):
0: 4c 8d 04 37 lea (%rdi,%rsi,1),%r8
4: 49 39 f8 cmp %rdi,%r8
7: 0f 82 82 02 00 00 jb 0x28f
d: 49 b9 00 00 00 00 00 movabs $0xffff800000000000,%r9
14: 80 ff ff
17: eb 11 jmp 0x2a
19: cc int3
1a: cc int3
1b: cc int3
1c: f3 0f 1e fa endbr64
20: 49 b9 00 00 00 00 00 movabs $0xff00000000000000,%r9
27: 00 00 ff
* 2a: f3 0f 1e fa endbr64 <-- trapping instruction
2e: 4c 39 cf cmp %r9,%rdi
31: 0f 82 58 02 00 00 jb 0x28f
37: 49 89 ff mov %rdi,%r15
3a: 49 c1 ef 03 shr $0x3,%r15
3e: 49 rex.WB
3f: ba .byte 0xba