============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.3.3594/19394 is trying to acquire lock:
ffff888055194fb0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline]
ffff888055194fb0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff888034ae8fb0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline]
ffff888034ae8fb0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
13 locks held by syz.3.3594/19394:
#0: ffff888057df8240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1029 [inline]
#0: ffff888057df8240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release net/socket.c:721 [inline]
#0: ffff888057df8240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x9b/0x240 net/socket.c:1514
#1: ffffffff8fe3be28 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 kernel/notifier.c:379
#2: ffff88807d130128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#2: ffff88807d130128 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1154 [inline]
#2: ffff88807d130128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 drivers/base/dd.c:1352
#3: ffffffff901894e0 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
#3: ffffffff901894e0 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410
#4: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: sock_def_readable+0xae/0x550 net/core/sock.c:3611
#5: ffffc90000007cc0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745
#6: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#6: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#6: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 net/hsr/hsr_device.c:419
#7: ffff888034ae8fb0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline]
#7: ffff888034ae8fb0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
#8: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#8: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#8: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xbb/0x2a80 net/hsr/hsr_forward.c:738
#9: ffffffff8e95d080 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#9: ffffffff8e95d080 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#9: ffffffff8e95d080 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#10: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#10: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#10: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1990 net/bridge/br_device.c:52
#11: ffffffff8e95d080 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8e95d080 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#11: ffffffff8e95d080 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#12: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#12: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#12: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 0 UID: 0 PID: 19394 Comm: syz.3.3594 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:182
spin_lock_bh include/linux/spinlock.h:348 [inline]
hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5343 [inline]
netdev_start_xmit include/linux/netdevice.h:5352 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3904
__dev_queue_xmit+0x14d9/0x3950 net/core/dev.c:4870
dev_queue_xmit include/linux/netdevice.h:3401 [inline]
br_dev_queue_push_xmit+0x370/0x4b0 net/bridge/br_forward.c:53
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
__br_forward+0x397/0x540 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver net/bridge/br_forward.c:191 [inline]
br_flood+0x6ee/0xb80 net/bridge/br_forward.c:238
br_dev_xmit+0x12bd/0x1990 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5343 [inline]
netdev_start_xmit include/linux/netdevice.h:5352 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3904
__dev_queue_xmit+0x14d9/0x3950 net/core/dev.c:4870
dev_queue_xmit include/linux/netdevice.h:3401 [inline]
hsr_xmit net/hsr/hsr_forward.c:440 [inline]
hsr_forward_do net/hsr/hsr_forward.c:581 [inline]
hsr_forward_skb+0x167e/0x2a80 net/hsr/hsr_forward.c:743
send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364
hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x22a/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch+0x427/0xbe0 kernel/sched/core.c:5239
Code: 41 c7 84 24 e0 0d 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 86 f4 20 0a e8 21 6d 38 00 fb 49 8d bd a8 16 00 00 <48> 89 f8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 7b 03 00 00 41 80
RSP: 0018:ffffc90004c27350 EFLAGS: 00000206
RAX: 00000000000024e7 RBX: 1ffff110170c7784 RCX: 0000000080000001
RDX: 0000000000000006 RSI: ffffffff8dfb65fa RDI: ffff888029f1b568
RBP: ffffc90004c273b0 R08: ffffffff903215b7 R09: 1ffffffff20642b6
R10: dffffc0000000000 R11: fffffbfff20642b7 R12: ffff8880b863ae88
R13: ffff888029f19ec0 R14: ffff88801e3b9ec0 R15: dffffc0000000000
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x17bc/0x5680 kernel/sched/core.c:7183
preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7364
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
_raw_spin_unlock_irqrestore+0x74/0x80 kernel/locking/spinlock.c:198
spin_unlock_irqrestore include/linux/spinlock.h:408 [inline]
__wake_up_common_lock+0x190/0x1f0 kernel/sched/wait.c:127
sock_def_readable+0x1eb/0x550 net/core/sock.c:3614
__netlink_sendskb net/netlink/af_netlink.c:1263 [inline]
netlink_broadcast_deliver net/netlink/af_netlink.c:1399 [inline]
do_one_broadcast net/netlink/af_netlink.c:1488 [inline]
netlink_broadcast_filtered+0xb32/0xeb0 net/netlink/af_netlink.c:1533
netlink_broadcast+0x37/0x50 net/netlink/af_netlink.c:1557
uevent_net_broadcast_untagged lib/kobject_uevent.c:331 [inline]
kobject_uevent_net_broadcast+0x378/0x560 lib/kobject_uevent.c:410
kobject_uevent_env+0x55c/0x9e0 lib/kobject_uevent.c:611
__device_release_driver drivers/base/dd.c:1344 [inline]
device_release_driver_internal+0x76f/0x870 drivers/base/dd.c:1355
mac80211_hwsim_del_radio+0x2b7/0x490 drivers/net/wireless/virtual/mac80211_hwsim.c:6133
remove_user_radios drivers/net/wireless/virtual/mac80211_hwsim.c:6949 [inline]
mac80211_hwsim_netlink_notify+0xfae/0x1310 drivers/net/wireless/virtual/mac80211_hwsim.c:6963
notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761
__sock_release net/socket.c:722 [inline]
sock_close+0xc3/0x240 net/socket.c:1514
__fput+0x44f/0xa60 fs/file_table.c:510
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:328 [inline]
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f919699c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe921753a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f9196c17da0 RCX: 00007f919699c819
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f9196c17da0 R08: 00007f9196c16128 R09: 0000000000000000
R10: 000000000003fc68 R11: 0000000000000246 R12: 000000000007a214
R13: 00007f9196c1618c R14: 0000000000079f4e R15: 00007ffe921754b0
----------------
Code disassembly (best guess):
0: 41 c7 84 24 e0 0d 00 movl $0x0,0xde0(%r12)
7: 00 00 00 00 00
c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
11: 49 83 c4 48 add $0x48,%r12
15: 4c 89 e7 mov %r12,%rdi
18: e8 86 f4 20 0a call 0xa20f4a3
1d: e8 21 6d 38 00 call 0x386d43
22: fb sti
23: 49 8d bd a8 16 00 00 lea 0x16a8(%r13),%rdi
* 2a: 48 89 f8 mov %rdi,%rax <-- trapping instruction
2d: 48 c1 e8 03 shr $0x3,%rax
31: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
36: 84 c0 test %al,%al
38: 0f 85 7b 03 00 00 jne 0x3b9
3e: 41 rex.B
3f: 80 .byte 0x80