======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz-executor/18675 is trying to acquire lock:
ffff8880793d3d58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
ffff8880793d3d58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4799 [inline]
ffff8880793d3d58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370

but task is already holding lock:
ffff888031fed030 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline]
ffff888031fed030 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3cd/0xcf0 net/hsr/hsr_device.c:330

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&hsr->seqnr_lock){+.-.}-{3:3}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline]
       _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:182
       spin_lock_bh include/linux/spinlock.h:348 [inline]
       hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
       __netdev_start_xmit include/linux/netdevice.h:5387 [inline]
       netdev_start_xmit include/linux/netdevice.h:5396 [inline]
       xmit_one net/core/dev.c:3889 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3905
       __dev_queue_xmit+0x1435/0x37f0 net/core/dev.c:4872
       NF_HOOK+0x33a/0x3c0 include/linux/netfilter.h:-1
       arp_xmit+0x16c/0x270 net/ipv4/arp.c:665
       arp_solicit+0xbdc/0xe40 net/ipv4/arp.c:392
       neigh_probe net/core/neighbour.c:1093 [inline]
       __neigh_event_send+0xf0c/0x1510 net/core/neighbour.c:1273
       neigh_event_send_probe include/net/neighbour.h:480 [inline]
       neigh_event_send include/net/neighbour.h:486 [inline]
       neigh_resolve_output+0x1a1/0x720 net/core/neighbour.c:1600
       neigh_output include/net/neighbour.h:560 [inline]
       ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
       NF_HOOK_COND include/linux/netfilter.h:307 [inline]
       ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
       iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
       ip_tunnel_xmit+0x195b/0x2040 net/ipv4/ip_tunnel.c:848
       __gre_xmit+0x19e/0x240 net/ipv4/ip_gre.c:491
       erspan_xmit+0xad5/0x1590 net/ipv4/ip_gre.c:750
       __netdev_start_xmit include/linux/netdevice.h:5387 [inline]
       netdev_start_xmit include/linux/netdevice.h:5396 [inline]
       xmit_one net/core/dev.c:3889 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3905
       sch_direct_xmit+0x257/0x4c0 net/sched/sch_generic.c:372
       __dev_xmit_skb net/core/dev.c:4211 [inline]
       __dev_queue_xmit+0x1754/0x37f0 net/core/dev.c:4833
       dev_queue_xmit include/linux/netdevice.h:3436 [inline]
       alb_send_lp_vid+0x348/0x550 drivers/net/bonding/bond_alb.c:949
       alb_send_learning_packets+0x12c/0x300 drivers/net/bonding/bond_alb.c:1012
       alb_fasten_mac_swap+0x45d/0xf70 drivers/net/bonding/bond_alb.c:1076
       bond_alb_handle_active_change+0xc85/0xf50 drivers/net/bonding/bond_alb.c:1774
       bond_change_active_slave+0x1098/0x36d0 drivers/net/bonding/bond_main.c:1309
       bond_select_active_slave+0x8a6/0xcd0 drivers/net/bonding/bond_main.c:1379
       bond_enslave+0x239c/0x3b10 drivers/net/bonding/bond_main.c:2298
       do_set_master+0x563/0x720 net/core/rtnetlink.c:3012
       rtnl_newlink_create+0x641/0xb00 net/core/rtnetlink.c:3919
       __rtnl_newlink net/core/rtnetlink.c:4036 [inline]
       rtnl_newlink+0x167f/0x1bd0 net/core/rtnetlink.c:4151
       rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7068
       netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
       netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
       netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345
       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
       sock_sendmsg_nosec net/socket.c:787 [inline]
       __sock_sendmsg net/socket.c:802 [inline]
       ____sys_sendmsg+0x9b9/0xa20 net/socket.c:2699
       ___sys_sendmsg+0x2a5/0x360 net/socket.c:2753
       __sys_sendmsg net/socket.c:2785 [inline]
       __do_sys_sendmsg net/socket.c:2790 [inline]
       __se_sys_sendmsg net/socket.c:2788 [inline]
       __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2788
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3165 [inline]
       check_prevs_add kernel/locking/lockdep.c:3284 [inline]
       validate_chain kernel/locking/lockdep.c:3908 [inline]
       __lock_acquire+0x1520/0x2cd0 kernel/locking/lockdep.c:5237
       lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
       __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
       spin_lock include/linux/spinlock.h:342 [inline]
       __netif_tx_lock include/linux/netdevice.h:4799 [inline]
       sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
       __dev_xmit_skb net/core/dev.c:4211 [inline]
       __dev_queue_xmit+0x1754/0x37f0 net/core/dev.c:4833
       dev_queue_xmit include/linux/netdevice.h:3436 [inline]
       hsr_xmit net/hsr/hsr_forward.c:440 [inline]
       hsr_forward_do net/hsr/hsr_forward.c:581 [inline]
       hsr_forward_skb+0x152a/0x28c0 net/hsr/hsr_forward.c:743
       send_hsr_supervision_frame+0x733/0xcf0 net/hsr/hsr_device.c:364
       hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421
       call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
       expire_timers kernel/time/timer.c:1799 [inline]
       __run_timers kernel/time/timer.c:2374 [inline]
       __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
       run_timer_base kernel/time/timer.c:2395 [inline]
       run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
       handle_softirqs+0x225/0x840 kernel/softirq.c:622
       __do_softirq kernel/softirq.c:656 [inline]
       invoke_softirq kernel/softirq.c:496 [inline]
       __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
       irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
       instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
       sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
       asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
       unwind_next_frame+0x11df/0x2550 arch/x86/kernel/unwind_orc.c:670
       arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
       stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
       kasan_save_stack mm/kasan/common.c:57 [inline]
       kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
       poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
       __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
       kasan_kmalloc include/linux/kasan.h:263 [inline]
       __do_kmalloc_node mm/slub.c:5296 [inline]
       __kmalloc_noprof+0x358/0x750 mm/slub.c:5308
       kmalloc_noprof include/linux/slab.h:954 [inline]
       kzalloc_noprof include/linux/slab.h:1188 [inline]
       lsm_blob_alloc security/security.c:218 [inline]
       lsm_sock_alloc security/security.c:4478 [inline]
       security_sk_alloc+0x52/0x360 security/security.c:4494
       sk_prot_alloc+0x101/0x210 net/core/sock.c:2255
       sk_alloc+0x3a/0x390 net/core/sock.c:2308
       inet_create+0x7a9/0xff0 net/ipv4/af_inet.c:333
       __sock_create+0x4b3/0x9d0 net/socket.c:1665
       sock_create net/socket.c:1723 [inline]
       __sys_socket_create net/socket.c:1760 [inline]
       __sys_socket+0xd6/0x1b0 net/socket.c:1807
       __do_sys_socket net/socket.c:1821 [inline]
       __se_sys_socket net/socket.c:1819 [inline]
       __x64_sys_socket+0x7a/0x90 net/socket.c:1819
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&hsr->seqnr_lock);
                               lock(&qdisc_xmit_lock_key#4);
                               lock(&hsr->seqnr_lock);
  lock(&qdisc_xmit_lock_key#4);

 *** DEADLOCK ***

7 locks held by syz-executor/18675:
 #0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
 #0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
 #1: ffffc90000007cc0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745
 #2: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #2: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #2: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 net/hsr/hsr_device.c:419
 #3: ffff888031fed030 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline]
 #3: ffff888031fed030 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3cd/0xcf0 net/hsr/hsr_device.c:330
 #4: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #4: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #4: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x28c0 net/hsr/hsr_forward.c:738
 #5: ffffffff8e95c7e0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #5: ffffffff8e95c7e0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
 #5: ffffffff8e95c7e0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x37f0 net/core/dev.c:4793
 #6: ffff8880330af228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:354 [inline]
 #6: ffff8880330af228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:205 [inline]
 #6: ffff8880330af228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4198 [inline]
 #6: ffff8880330af228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x112b/0x37f0 net/core/dev.c:4833

stack backtrace:
CPU: 0 UID: 0 PID: 18675 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043
 check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
 check_prev_add kernel/locking/lockdep.c:3165 [inline]
 check_prevs_add kernel/locking/lockdep.c:3284 [inline]
 validate_chain kernel/locking/lockdep.c:3908 [inline]
 __lock_acquire+0x1520/0x2cd0 kernel/locking/lockdep.c:5237
 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
 spin_lock include/linux/spinlock.h:342 [inline]
 __netif_tx_lock include/linux/netdevice.h:4799 [inline]
 sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
 __dev_xmit_skb net/core/dev.c:4211 [inline]
 __dev_queue_xmit+0x1754/0x37f0 net/core/dev.c:4833
 dev_queue_xmit include/linux/netdevice.h:3436 [inline]
 hsr_xmit net/hsr/hsr_forward.c:440 [inline]
 hsr_forward_do net/hsr/hsr_forward.c:581 [inline]
 hsr_forward_skb+0x152a/0x28c0 net/hsr/hsr_forward.c:743
 send_hsr_supervision_frame+0x733/0xcf0 net/hsr/hsr_device.c:364
 hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421
 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:unwind_next_frame+0x11df/0x2550 arch/x86/kernel/unwind_orc.c:670
Code: 89 3b 43 0f b6 44 25 00 84 c0 0f 85 29 11 00 00 49 8d 46 36 c6 00 00 49 8d 5e 50 4c 8b 6c 24 18 48 8b 44 24 30 42 0f b6 04 20 <84> c0 4c 8b 04 24 0f 85 46 0e 00 00 42 0f b6 44 25 00 84 c0 0f 85
RSP: 0018:ffffc900052af820 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc900052af918 RCX: 0000000000000000
RDX: ffffffff90d25b88 RSI: 0000000000000000 RDI: ffffc900052af928
RBP: 1ffffffff21a4b71 R08: ffffc900052af927 R09: 0000000000000000
R10: ffffc900052af918 R11: fffff52000a55f25 R12: dffffc0000000000
R13: ffffffff90d25b84 R14: ffffc900052af8c8 R15: ffffc900052af910
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5296 [inline]
 __kmalloc_noprof+0x358/0x750 mm/slub.c:5308
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 lsm_blob_alloc security/security.c:218 [inline]
 lsm_sock_alloc security/security.c:4478 [inline]
 security_sk_alloc+0x52/0x360 security/security.c:4494
 sk_prot_alloc+0x101/0x210 net/core/sock.c:2255
 sk_alloc+0x3a/0x390 net/core/sock.c:2308
 inet_create+0x7a9/0xff0 net/ipv4/af_inet.c:333
 __sock_create+0x4b3/0x9d0 net/socket.c:1665
 sock_create net/socket.c:1723 [inline]
 __sys_socket_create net/socket.c:1760 [inline]
 __sys_socket+0xd6/0x1b0 net/socket.c:1807
 __do_sys_socket net/socket.c:1821 [inline]
 __se_sys_socket net/socket.c:1819 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1819
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbe7bd9e6c7
Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd311dbfa8 EFLAGS: 00000202 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbe7bd9e6c7
RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00007ffd311dc6ac R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000061
R13: 0000555566fc3a00 R14: 000000000009777b R15: 00007ffd311dc700
 </TASK>
ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
ip6_tunnel: ip6tnl7 xmit: Local address not yet configured!
----------------
Code disassembly (best guess):
   0:	89 3b                	mov    %edi,(%rbx)
   2:	43 0f b6 44 25 00    	movzbl 0x0(%r13,%r12,1),%eax
   8:	84 c0                	test   %al,%al
   a:	0f 85 29 11 00 00    	jne    0x1139
  10:	49 8d 46 36          	lea    0x36(%r14),%rax
  14:	c6 00 00             	movb   $0x0,(%rax)
  17:	49 8d 5e 50          	lea    0x50(%r14),%rbx
  1b:	4c 8b 6c 24 18       	mov    0x18(%rsp),%r13
  20:	48 8b 44 24 30       	mov    0x30(%rsp),%rax
  25:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	4c 8b 04 24          	mov    (%rsp),%r8
  30:	0f 85 46 0e 00 00    	jne    0xe7c
  36:	42 0f b6 44 25 00    	movzbl 0x0(%rbp,%r12,1),%eax
  3c:	84 c0                	test   %al,%al
  3e:	0f                   	.byte 0xf
  3f:	85                   	.byte 0x85