============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.1.3203/19213 is trying to acquire lock:
ffff8880777f4f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880777f4f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff88807a1eaf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88807a1eaf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
13 locks held by syz.1.3203/19213:
#0: ffffffff8fa19af0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffff8880513ce0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#1: ffff8880513ce0e8 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline]
#1: ffff8880513ce0e8 (&dev->mutex){....}-{4:4}, at: devlink_get_from_attrs_lock+0x246/0x3b0 net/devlink/netlink.c:198
#2: ffff88806926a250 (&devlink->lock_key#6){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline]
#2: ffff88806926a250 (&devlink->lock_key#6){+.+.}-{4:4}, at: devlink_get_from_attrs_lock+0x255/0x3b0 net/devlink/netlink.c:198
#3: ffffffff8f9abf08 (rtnl_mutex){+.+.}-{4:4}, at: nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1052 [inline]
#3: ffffffff8f9abf08 (rtnl_mutex){+.+.}-{4:4}, at: nsim_create+0x839/0x1100 drivers/net/netdevsim/netdev.c:1146
#4: ffffffff8e6d13f8 (pin_fs_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffffffff8e6d13f8 (pin_fs_lock){+.+.}-{3:3}, at: simple_pin_fs+0x31/0x160 fs/libfs.c:1098
#5: ffffc90000a08ce0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5a0 kernel/time/timer.c:1745
#6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 net/hsr/hsr_device.c:419
#7: ffff88807a1eaf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#7: ffff88807a1eaf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
#8: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#8: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#8: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x2860 net/hsr/hsr_forward.c:738
#9: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#9: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#9: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 net/core/dev.c:4754
#10: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#10: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#10: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1920 net/bridge/br_device.c:52
#11: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#11: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 net/core/dev.c:4754
#12: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#12: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#12: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 1 UID: 0 PID: 19213 Comm: syz.1.3203 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5275 [inline]
netdev_start_xmit include/linux/netdevice.h:5284 [inline]
xmit_one net/core/dev.c:3864 [inline]
dev_hard_start_xmit+0x2cd/0x7f0 net/core/dev.c:3880
__dev_queue_xmit+0x168f/0x3850 net/core/dev.c:4829
dev_queue_xmit include/linux/netdevice.h:3384 [inline]
br_dev_queue_push_xmit+0x370/0x4a0 net/bridge/br_forward.c:53
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
__br_forward+0x397/0x540 net/bridge/br_forward.c:115
br_dev_xmit+0x127a/0x1920 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5275 [inline]
netdev_start_xmit include/linux/netdevice.h:5284 [inline]
xmit_one net/core/dev.c:3864 [inline]
dev_hard_start_xmit+0x2cd/0x7f0 net/core/dev.c:3880
__dev_queue_xmit+0x168f/0x3850 net/core/dev.c:4829
dev_queue_xmit include/linux/netdevice.h:3384 [inline]
hsr_xmit net/hsr/hsr_forward.c:440 [inline]
hsr_forward_do net/hsr/hsr_forward.c:581 [inline]
hsr_forward_skb+0x157b/0x2860 net/hsr/hsr_forward.c:743
send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364
hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421
call_timer_fn+0x192/0x5a0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline]
RIP: 0010:lock_release+0x93/0x3a0 kernel/locking/lockdep.c:5885
Code: 0f 85 0d 02 00 00 65 4c 8b 3d f1 01 53 11 41 83 bf 2c 0b 00 00 00 0f 85 f7 01 00 00 49 81 3e c0 33 b7 93 0f 84 ea 01 00 00 9c <5b> fa 48 c7 c7 a2 a6 ce 8d e8 0f cc f7 09 65 ff 05 68 47 53 11 c7
RSP: 0018:ffffc900041bec98 EFLAGS: 00000283
RAX: 0000000000000000 RBX: ffffffff8e6d13e0 RCX: 0000000080000002
RDX: 0000000000000000 RSI: ffffffff8c0739e0 RDI: ffffffff8c0739a0
RBP: 0000000000008180 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000837d94 R12: dffffc0000000000
R13: ffffffff824b8490 R14: ffffffff8e6d13f8 R15: ffff8880540c3d00
__raw_spin_unlock include/linux/spinlock_api_smp.h:141 [inline]
_raw_spin_unlock+0x16/0x50 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:391 [inline]
simple_pin_fs+0x90/0x160 fs/libfs.c:1110
debugfs_start_creating+0x80/0x1a0 fs/debugfs/inode.c:379
__debugfs_create_file+0x6f/0x400 fs/debugfs/inode.c:428
debugfs_create_file_unsafe+0x3a/0x50 fs/debugfs/inode.c:509
nsim_bpf_init+0x172/0x270 drivers/net/netdevsim/bpf.c:641
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1057 [inline]
nsim_create+0xb4e/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1493
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1549
nsim_dev_reload_create drivers/net/netdevsim/dev.c:1601 [inline]
nsim_dev_reload_up+0x45f/0x7c0 drivers/net/netdevsim/dev.c:1058
devlink_reload+0x505/0x8d0 net/devlink/dev.c:474
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9b1019aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9b110cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f9b10415fa0 RCX: 00007f9b1019aeb9
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007f9b10208c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9b10416038 R14: 00007f9b10415fa0 R15: 00007ffc9170b078
----------------
Code disassembly (best guess):
0: 0f 85 0d 02 00 00 jne 0x213
6: 65 4c 8b 3d f1 01 53 mov %gs:0x115301f1(%rip),%r15 # 0x115301ff
d: 11
e: 41 83 bf 2c 0b 00 00 cmpl $0x0,0xb2c(%r15)
15: 00
16: 0f 85 f7 01 00 00 jne 0x213
1c: 49 81 3e c0 33 b7 93 cmpq $0xffffffff93b733c0,(%r14)
23: 0f 84 ea 01 00 00 je 0x213
29: 9c pushf
* 2a: 5b pop %rbx <-- trapping instruction
2b: fa cli
2c: 48 c7 c7 a2 a6 ce 8d mov $0xffffffff8dcea6a2,%rdi
33: e8 0f cc f7 09 call 0x9f7cc47
38: 65 ff 05 68 47 53 11 incl %gs:0x11534768(%rip) # 0x115347a7
3f: c7 .byte 0xc7