============================================
WARNING: possible recursive locking detected
syzkaller #0 Tainted: G L
--------------------------------------------
syz.1.4057/22548 is trying to acquire lock:
ffff88805f486f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:347 [inline]
ffff88805f486f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff888077ee6f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:347 [inline]
ffff888077ee6f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
10 locks held by syz.1.4057/22548:
#0: ffffffff8ec6a818 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#0: ffffffff8ec6a818 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#0: ffffffff8ec6a818 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline]
#0: ffffffff8ec6a818 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x219/0x630 security/tomoyo/file.c:727
#1: ffffffff8e69ba30 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffffffff8e69ba30 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294
#2: ffffc90000007ce0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5a0 kernel/time/timer.c:1745
#3: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#3: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#3: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 net/hsr/hsr_device.c:419
#4: ffff888077ee6f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:347 [inline]
#4: ffff888077ee6f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
#5: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#5: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#5: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x2880 net/hsr/hsr_forward.c:738
#6: ffffffff8e55ddc0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#6: ffffffff8e55ddc0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:903 [inline]
#6: ffffffff8e55ddc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 net/core/dev.c:4757
#7: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#7: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#7: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1920 net/bridge/br_device.c:52
#8: ffffffff8e55ddc0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8e55ddc0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:903 [inline]
#8: ffffffff8e55ddc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 net/core/dev.c:4757
#9: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#9: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#9: ffffffff8e55dd60 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 0 UID: 0 PID: 22548 Comm: syz.1.4057 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:347 [inline]
hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5273 [inline]
netdev_start_xmit include/linux/netdevice.h:5282 [inline]
xmit_one net/core/dev.c:3866 [inline]
dev_hard_start_xmit+0x2cd/0x7f0 net/core/dev.c:3882
__dev_queue_xmit+0x168f/0x3850 net/core/dev.c:4832
dev_queue_xmit include/linux/netdevice.h:3381 [inline]
br_dev_queue_push_xmit+0x6d2/0x8b0 net/bridge/br_forward.c:53
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x360/0x3f0 include/linux/netfilter.h:318
__br_forward+0x397/0x540 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver net/bridge/br_forward.c:191 [inline]
br_flood+0x6ee/0xb80 net/bridge/br_forward.c:238
br_dev_xmit+0x127a/0x1920 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5273 [inline]
netdev_start_xmit include/linux/netdevice.h:5282 [inline]
xmit_one net/core/dev.c:3866 [inline]
dev_hard_start_xmit+0x2cd/0x7f0 net/core/dev.c:3882
__dev_queue_xmit+0x168f/0x3850 net/core/dev.c:4832
dev_queue_xmit include/linux/netdevice.h:3381 [inline]
hsr_xmit net/hsr/hsr_forward.c:440 [inline]
hsr_forward_do net/hsr/hsr_forward.c:581 [inline]
hsr_forward_skb+0x15a0/0x2880 net/hsr/hsr_forward.c:743
send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364
hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421
call_timer_fn+0x192/0x5a0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:page_slab mm/slab.h:143 [inline]
RIP: 0010:virt_to_slab mm/slab.h:178 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:131 [inline]
RIP: 0010:qlist_free_all+0x4a/0x100 mm/kasan/quarantine.c:176
Code: 89 ef 4d 89 f4 4d 85 f6 75 40 4c 8b 25 cf 32 ca 0b 4c 89 ff e8 27 d1 49 ff 48 c1 e8 06 48 83 e0 c0 49 8d 0c 04 49 8b 44 04 08 <48> 89 c2 48 ff ca a8 01 48 0f 44 d1 0f b6 42 33 c1 e0 18 3d 00 00
RSP: 0018:ffffc90005577a68 EFLAGS: 00000202
RAX: ffffea0002348e01 RBX: ffffc90005577aa0 RCX: ffffea0002348e80
RDX: ffffc9001317f000 RSI: 0000000000007e2e RDI: 0000000000007e2f
RBP: ffff88808d23a000 R08: 0000000000000000 R09: ffffffff822db2bc
R10: dffffc0000000000 R11: fffffbfff1fe024f R12: ffffea0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88808d23a000
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__do_kmalloc_node mm/slub.c:5656 [inline]
__kmalloc_noprof+0x3c2/0x7e0 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:962 [inline]
tomoyo_realpath_from_path+0xe3/0x5d0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_number_perm+0x246/0x630 security/tomoyo/file.c:728
security_file_ioctl+0xc3/0x2a0 security/security.c:2435
__do_sys_ioctl fs/ioctl.c:591 [inline]
__se_sys_ioctl+0x47/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f729cd9bc0b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007f729afd3450 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f729cd9bc0b
RDX: 00007f729afd3bd0 RSI: 000000004020ae46 RDI: 0000000000000004
RBP: 0000000000000004 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 00000000fec00000
R13: 00007f729afd3bd0 R14: 0000200000011000 R15: 0000000000000011
----------------
Code disassembly (best guess):
0: 89 ef mov %ebp,%edi
2: 4d 89 f4 mov %r14,%r12
5: 4d 85 f6 test %r14,%r14
8: 75 40 jne 0x4a
a: 4c 8b 25 cf 32 ca 0b mov 0xbca32cf(%rip),%r12 # 0xbca32e0
11: 4c 89 ff mov %r15,%rdi
14: e8 27 d1 49 ff call 0xff49d140
19: 48 c1 e8 06 shr $0x6,%rax
1d: 48 83 e0 c0 and $0xffffffffffffffc0,%rax
21: 49 8d 0c 04 lea (%r12,%rax,1),%rcx
25: 49 8b 44 04 08 mov 0x8(%r12,%rax,1),%rax
* 2a: 48 89 c2 mov %rax,%rdx <-- trapping instruction
2d: 48 ff ca dec %rdx
30: a8 01 test $0x1,%al
32: 48 0f 44 d1 cmove %rcx,%rdx
36: 0f b6 42 33 movzbl 0x33(%rdx),%eax
3a: c1 e0 18 shl $0x18,%eax
3d: 3d .byte 0x3d