============================================
WARNING: possible recursive locking detected
syzkaller #0 Tainted: G L
--------------------------------------------
kworker/u8:4/15739 is trying to acquire lock:
ffff888074d5d5e0 (&br->multicast_lock){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
ffff888074d5d5e0 (&br->multicast_lock){+.-.}-{3:3}, at: br_ip4_multicast_query net/bridge/br_multicast.c:3500 [inline]
ffff888074d5d5e0 (&br->multicast_lock){+.-.}-{3:3}, at: br_multicast_ipv4_rcv net/bridge/br_multicast.c:3914 [inline]
ffff888074d5d5e0 (&br->multicast_lock){+.-.}-{3:3}, at: br_multicast_rcv+0x2a6d/0x7640 net/bridge/br_multicast.c:4030
but task is already holding lock:
ffff8880264415e0 (&br->multicast_lock){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
ffff8880264415e0 (&br->multicast_lock){+.-.}-{3:3}, at: br_multicast_port_query_expired net/bridge/br_multicast.c:1903 [inline]
ffff8880264415e0 (&br->multicast_lock){+.-.}-{3:3}, at: br_ip4_multicast_port_query_expired+0x68/0x380 net/bridge/br_multicast.c:1922
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&br->multicast_lock);
lock(&br->multicast_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
10 locks held by kworker/u8:4/15739:
#0: ffff88801e3d5940 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#0: ffff88801e3d5940 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3397
#1: ffffc90003e47c40 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3290 [inline]
#1: ffffc90003e47c40 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3397
#2: ffff8880612e60a0 (&ctx->uring_lock){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#2: ffff8880612e60a0 (&ctx->uring_lock){+.+.}-{4:4}, at: io_req_caches_free+0x14/0x40 io_uring/io_uring.c:2164
#3: ffffc90000a08cc0 ((&pmctx->ip4_own_query.timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745
#4: ffff8880264415e0 (&br->multicast_lock){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
#4: ffff8880264415e0 (&br->multicast_lock){+.-.}-{3:3}, at: br_multicast_port_query_expired net/bridge/br_multicast.c:1903 [inline]
#4: ffff8880264415e0 (&br->multicast_lock){+.-.}-{3:3}, at: br_ip4_multicast_port_query_expired+0x68/0x380 net/bridge/br_multicast.c:1922
#5: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#5: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#5: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#6: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#6: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#6: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#7: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#7: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#7: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: bond_start_xmit+0xb4/0x1900 drivers/net/bonding/bond_main.c:5591
#8: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]
#8: ffffffff8e95cd00 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 net/core/dev.c:4791
#9: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#9: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#9: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1990 net/bridge/br_device.c:52
stack backtrace:
CPU: 1 UID: 0 PID: 15739 Comm: kworker/u8:4 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: iou_exit io_ring_exit_work
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
spin_lock include/linux/spinlock.h:342 [inline]
br_ip4_multicast_query net/bridge/br_multicast.c:3500 [inline]
br_multicast_ipv4_rcv net/bridge/br_multicast.c:3914 [inline]
br_multicast_rcv+0x2a6d/0x7640 net/bridge/br_multicast.c:4030
br_dev_xmit+0xb67/0x1990 net/bridge/br_device.c:98
__netdev_start_xmit include/linux/netdevice.h:5368 [inline]
netdev_start_xmit include/linux/netdevice.h:5377 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3904
__dev_queue_xmit+0x14d9/0x3950 net/core/dev.c:4870
__bond_start_xmit drivers/net/bonding/bond_main.c:-1 [inline]
bond_start_xmit+0xd5c/0x1900 drivers/net/bonding/bond_main.c:5593
__netdev_start_xmit include/linux/netdevice.h:5368 [inline]
netdev_start_xmit include/linux/netdevice.h:5377 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3904
__dev_queue_xmit+0x14d9/0x3950 net/core/dev.c:4870
dev_queue_xmit_accel include/linux/netdevice.h:3424 [inline]
macvlan_queue_xmit drivers/net/macvlan.c:571 [inline]
macvlan_start_xmit+0x3ba/0x600 drivers/net/macvlan.c:595
__netdev_start_xmit include/linux/netdevice.h:5368 [inline]
netdev_start_xmit include/linux/netdevice.h:5377 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3904
__dev_queue_xmit+0x14d9/0x3950 net/core/dev.c:4870
dev_queue_xmit include/linux/netdevice.h:3418 [inline]
br_dev_queue_push_xmit+0x370/0x4b0 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:318 [inline]
__br_multicast_send_query+0x2f4a/0x4630 net/bridge/br_multicast.c:1807
br_multicast_send_query+0x509/0x6b0 net/bridge/br_multicast.c:1886
br_multicast_port_query_expired net/bridge/br_multicast.c:1911 [inline]
br_ip4_multicast_port_query_expired+0x2ab/0x380 net/bridge/br_multicast.c:1922
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x22a/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__unwind_start+0x2a/0x760 arch/x86/kernel/unwind_orc.c:715
Code: f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 83 ec 28 48 89 4c 24 10 49 89 d4 49 89 f5 48 89 fb 49 be 00 00 00 00 00 fc ff df 60 00 00 00 31 f6 e8 3a e9 b9 00 4c 89 f2 4c 8d 73 28 4d 89 f7
RSP: 0018:ffffc90003e47488 EFLAGS: 00000296
RAX: ffff88802e1f1ec0 RBX: ffffc90003e474e8 RCX: ffffc90003e47570
RDX: 0000000000000000 RSI: ffff88802e1f1ec0 RDI: ffffc90003e474e8
RBP: ffffc90003e47570 R08: ffffffff8178c54c R09: 0000000000000000
R10: ffffc90003e47630 R11: ffffffff81b0eff0 R12: 0000000000000000
R13: ffff88802e1f1ec0 R14: dffffc0000000000 R15: 0000000000000000
unwind_start arch/x86/include/asm/unwind.h:64 [inline]
arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
slab_free_hook mm/slub.c:2650 [inline]
slab_free mm/slub.c:6250 [inline]
kmem_cache_free+0x44f/0x650 mm/slub.c:6377
__io_req_caches_free+0x1c1/0x270 io_uring/io_uring.c:2153
io_req_caches_free+0x1c/0x40 io_uring/io_uring.c:2165
io_ring_exit_work+0x42f/0x980 io_uring/io_uring.c:2367
process_one_work kernel/workqueue.c:3314 [inline]
process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
kthread+0x389/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: f3 0f 1e fa endbr64
4: 55 push %rbp
5: 41 57 push %r15
7: 41 56 push %r14
9: 41 55 push %r13
b: 41 54 push %r12
d: 53 push %rbx
e: 48 83 ec 28 sub $0x28,%rsp
12: 48 89 4c 24 10 mov %rcx,0x10(%rsp)
17: 49 89 d4 mov %rdx,%r12
1a: 49 89 f5 mov %rsi,%r13
1d: 48 89 fb mov %rdi,%rbx
20: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
27: fc ff df
* 2a: ba 60 00 00 00 mov $0x60,%edx <-- trapping instruction
2f: 31 f6 xor %esi,%esi
31: e8 3a e9 b9 00 call 0xb9e970
36: 4c 89 f2 mov %r14,%rdx
39: 4c 8d 73 28 lea 0x28(%rbx),%r14
3d: 4d 89 f7 mov %r14,%r15