============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
kworker/u8:19/8648 is trying to acquire lock:
ffff888093c02f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888093c02f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff8880558f6f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880558f6f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
13 locks held by kworker/u8:19/8648:
#0: ffff88813fe69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813fe69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340
#1: ffffc9000402fbc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000402fbc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340
#2: ffff88803f678788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6441 [inline]
#2: ffff88803f678788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x450 net/wireless/core.c:426
#3: ffffffff8e54c760 (console_lock){+.+.}-{0:0}, at: _printk+0xdd/0x130 kernel/printk/printk.c:2451
#4: ffffffff8e434018 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:336 [inline]
#4: ffffffff8e434018 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:409 [inline]
#4: ffffffff8e434018 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:289 [inline]
#4: ffffffff8e434018 (console_srcu){....}-{0:0}, at: console_flush_one_record kernel/printk/printk.c:3192 [inline]
#4: ffffffff8e434018 (console_srcu){....}-{0:0}, at: console_flush_all+0x123/0xb20 kernel/printk/printk.c:3289
#5: ffffc90000007ce0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5a0 kernel/time/timer.c:1745
#6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 net/hsr/hsr_device.c:419
#7: ffff8880558f6f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#7: ffff8880558f6f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
#8: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#8: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#8: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x2860 net/hsr/hsr_forward.c:738
#9: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#9: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#9: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 net/core/dev.c:4754
#10: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#10: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#10: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1920 net/bridge/br_device.c:52
#11: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#11: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 net/core/dev.c:4754
#12: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#12: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#12: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 0 UID: 0 PID: 8648 Comm: kworker/u8:19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5275 [inline]
netdev_start_xmit include/linux/netdevice.h:5284 [inline]
xmit_one net/core/dev.c:3864 [inline]
dev_hard_start_xmit+0x2cd/0x7f0 net/core/dev.c:3880
__dev_queue_xmit+0x168f/0x3850 net/core/dev.c:4829
dev_queue_xmit include/linux/netdevice.h:3384 [inline]
br_dev_queue_push_xmit+0x370/0x4a0 net/bridge/br_forward.c:53
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
__br_forward+0x397/0x540 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver net/bridge/br_forward.c:191 [inline]
br_flood+0x6ee/0xb80 net/bridge/br_forward.c:238
br_dev_xmit+0x127a/0x1920 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5275 [inline]
netdev_start_xmit include/linux/netdevice.h:5284 [inline]
xmit_one net/core/dev.c:3864 [inline]
dev_hard_start_xmit+0x2cd/0x7f0 net/core/dev.c:3880
__dev_queue_xmit+0x168f/0x3850 net/core/dev.c:4829
dev_queue_xmit include/linux/netdevice.h:3384 [inline]
hsr_xmit net/hsr/hsr_forward.c:440 [inline]
hsr_forward_do net/hsr/hsr_forward.c:581 [inline]
hsr_forward_skb+0x157b/0x2860 net/hsr/hsr_forward.c:743
send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364
hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421
call_timer_fn+0x192/0x5a0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:console_flush_one_record arch/x86/include/asm/irqflags.h:-1 [inline]
RIP: 0010:console_flush_all+0x801/0xb20 kernel/printk/printk.c:3289
Code: ff ff e8 b2 08 21 00 90 0f 0b 90 e9 85 fc ff ff e8 a4 08 21 00 e8 6f c0 f4 09 48 85 db 74 c0 e8 95 08 21 00 fb 48 8b 5c 24 08 <48> 8b 44 24 20 42 80 3c 20 00 4c 8b 74 24 18 74 08 4c 89 f7 e8 86
RSP: 0018:ffffc9000402f500 EFLAGS: 00000293
RAX: ffffffff81a34ebb RBX: ffffc9000402f660 RCX: ffff888028d7bd00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000402f610 R08: ffffffff8fef4977 R09: 1ffffffff1fde92e
R10: dffffc0000000000 R11: fffffbfff1fde92f R12: dffffc0000000000
R13: 0000000000000001 R14: 0000000000000000 R15: ffffffff8edeea80
__console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3359
vprintk_emit+0x485/0x560 kernel/printk/printk.c:2426
_printk+0xdd/0x130 kernel/printk/printk.c:2451
ieee80211_sta_find_ibss net/mac80211/ibss.c:1443 [inline]
ieee80211_ibss_work+0xdd2/0x10a0 net/mac80211/ibss.c:1666
cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:440
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340
worker_thread+0xda6/0x1360 kernel/workqueue.c:3421
kthread+0x726/0x8b0 kernel/kthread.c:463
ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5390 ms
lec:lec_tx_timeout: lec0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: ff ljmp (bad)
1: e8 b2 08 21 00 call 0x2108b8
6: 90 nop
7: 0f 0b ud2
9: 90 nop
a: e9 85 fc ff ff jmp 0xfffffc94
f: e8 a4 08 21 00 call 0x2108b8
14: e8 6f c0 f4 09 call 0x9f4c088
19: 48 85 db test %rbx,%rbx
1c: 74 c0 je 0xffffffde
1e: e8 95 08 21 00 call 0x2108b8
23: fb sti
24: 48 8b 5c 24 08 mov 0x8(%rsp),%rbx
* 29: 48 8b 44 24 20 mov 0x20(%rsp),%rax <-- trapping instruction
2e: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
33: 4c 8b 74 24 18 mov 0x18(%rsp),%r14
38: 74 08 je 0x42
3a: 4c 89 f7 mov %r14,%rdi
3d: e8 .byte 0xe8
3e: 86 .byte 0x86