============================================ WARNING: possible recursive locking detected syzkaller #0 Tainted: G L -------------------------------------------- ktimers/1/29 is trying to acquire lock: ffff88803e8c57f8 (&br->multicast_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] ffff88803e8c57f8 (&br->multicast_lock){+...}-{3:3}, at: br_ip6_multicast_query net/bridge/br_multicast.c:3583 [inline] ffff88803e8c57f8 (&br->multicast_lock){+...}-{3:3}, at: br_multicast_ipv6_rcv net/bridge/br_multicast.c:3979 [inline] ffff88803e8c57f8 (&br->multicast_lock){+...}-{3:3}, at: br_multicast_rcv+0x2dda/0x7650 net/bridge/br_multicast.c:4034 but task is already holding lock: ffff88805c9897f8 (&br->multicast_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] ffff88805c9897f8 (&br->multicast_lock){+...}-{3:3}, at: br_multicast_port_query_expired net/bridge/br_multicast.c:1903 [inline] ffff88805c9897f8 (&br->multicast_lock){+...}-{3:3}, at: br_ip6_multicast_port_query_expired+0x6b/0x380 net/bridge/br_multicast.c:1931 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&br->multicast_lock); lock(&br->multicast_lock); *** DEADLOCK *** May be due to missing lock nesting notation 12 locks held by ktimers/1/29: #0: ffffffff8dc631c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #1: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #2: ffff8880b8926320 (&base->expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff8880b8926320 (&base->expiry_lock){+...}-{3:3}, at: timer_base_lock_expiry kernel/time/timer.c:1502 [inline] #2: ffff8880b8926320 (&base->expiry_lock){+...}-{3:3}, at: __run_timer_base+0x120/0x9f0 kernel/time/timer.c:2383 #3: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #3: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #3: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 #4: ffffc90000a3fa80 ((&pmctx->ip6_own_query.timer)){+...}-{0:0}, at: call_timer_fn+0xd4/0x640 kernel/time/timer.c:1745 #5: ffff88805c9897f8 (&br->multicast_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #5: ffff88805c9897f8 (&br->multicast_lock){+...}-{3:3}, at: br_multicast_port_query_expired net/bridge/br_multicast.c:1903 [inline] #5: ffff88805c9897f8 (&br->multicast_lock){+...}-{3:3}, at: br_ip6_multicast_port_query_expired+0x6b/0x380 net/bridge/br_multicast.c:1931 #6: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #6: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #6: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #6: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 #7: ffffffff8dc631c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #8: ffffffff8ddcb9e0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #8: ffffffff8ddcb9e0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:903 [inline] #8: ffffffff8ddcb9e0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27d/0x39b0 net/core/dev.c:4778 #9: ffffffff8dc631c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #10: ffffffff8ddcb9e0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #10: ffffffff8ddcb9e0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:903 [inline] #10: ffffffff8ddcb9e0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27d/0x39b0 net/core/dev.c:4778 #11: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #11: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #11: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1980 net/bridge/br_device.c:52 stack backtrace: CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041 check_deadlock kernel/locking/lockdep.c:3093 [inline] validate_chain kernel/locking/lockdep.c:3895 [inline] __lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 spin_lock include/linux/spinlock_rt.h:45 [inline] br_ip6_multicast_query net/bridge/br_multicast.c:3583 [inline] br_multicast_ipv6_rcv net/bridge/br_multicast.c:3979 [inline] br_multicast_rcv+0x2dda/0x7650 net/bridge/br_multicast.c:4034 br_dev_xmit+0xb67/0x1980 net/bridge/br_device.c:98 __netdev_start_xmit include/linux/netdevice.h:5325 [inline] netdev_start_xmit include/linux/netdevice.h:5334 [inline] xmit_one net/core/dev.c:3888 [inline] dev_hard_start_xmit+0x2f2/0x8b0 net/core/dev.c:3904 __dev_queue_xmit+0x171a/0x39b0 net/core/dev.c:4854 dev_queue_xmit include/linux/netdevice.h:3385 [inline] team_dev_queue_xmit include/linux/if_team.h:239 [inline] lb_transmit+0x241/0x680 drivers/net/team/team_mode_loadbalance.c:230 team_xmit+0x25b/0x3d0 drivers/net/team/team_core.c:1687 __netdev_start_xmit include/linux/netdevice.h:5325 [inline] netdev_start_xmit include/linux/netdevice.h:5334 [inline] xmit_one net/core/dev.c:3888 [inline] dev_hard_start_xmit+0x2f2/0x8b0 net/core/dev.c:3904 __dev_queue_xmit+0x171a/0x39b0 net/core/dev.c:4854 dev_queue_xmit include/linux/netdevice.h:3385 [inline] br_dev_queue_push_xmit+0x370/0x4a0 net/bridge/br_forward.c:53 NF_HOOK include/linux/netfilter.h:318 [inline] __br_multicast_send_query+0x2f4a/0x4630 net/bridge/br_multicast.c:1807 br_multicast_send_query+0x509/0x6b0 net/bridge/br_multicast.c:1886 br_multicast_port_query_expired net/bridge/br_multicast.c:1911 [inline] br_ip6_multicast_port_query_expired+0x2b5/0x380 net/bridge/br_multicast.c:1931 call_timer_fn+0x192/0x640 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404 handle_softirqs+0x1de/0x6f0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1138 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245