============================================
WARNING: possible recursive locking detected
6.14.0-rc2-syzkaller-00158-g071ed42cff4f #0 Not tainted
--------------------------------------------
syz-executor/5830 is trying to acquire lock:
ffff8880346cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880346cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234
but task is already holding lock:
ffff8880346cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff8880346cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x1a7/0x7b0 net/hsr/hsr_device.c:384
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
18 locks held by syz-executor/5830:
#0: ffffffff8ebedcf0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1699 [inline]
#0: ffffffff8ebedcf0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x1db/0x2160 kernel/fork.c:1752
#1: ffff88806c8c1fe0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:152 [inline]
#1: ffff88806c8c1fe0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap kernel/fork.c:642 [inline]
#1: ffff88806c8c1fe0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mm kernel/fork.c:1700 [inline]
#1: ffff88806c8c1fe0 (&mm->mmap_lock){++++}-{4:4}, at: copy_mm+0x2b7/0x2160 kernel/fork.c:1752
#2: ffff88807ae665e0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:142 [inline]
#2: ffff88807ae665e0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap kernel/fork.c:649 [inline]
#2: ffff88807ae665e0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mm kernel/fork.c:1700 [inline]
#2: ffff88807ae665e0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: copy_mm+0x458/0x2160 kernel/fork.c:1752
#3: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#3: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x82/0x380 mm/pgtable-generic.c:287
#4: ffff88806d53ea98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffff88806d53ea98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x1ba/0x300 mm/pgtable-generic.c:402
#5: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#5: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#5: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x82/0x380 mm/pgtable-generic.c:287
#6: ffff888063d6c498 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1126 [inline]
#6: ffff888063d6c498 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x772/0x77b0 mm/memory.c:1262
#7: ffffffff8eb38ee0 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#7: ffffffff8eb38ee0 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:941 [inline]
#7: ffffffff8eb38ee0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xf6/0x450 include/linux/mmzone.h:2067
#8: ffffc90000007be0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1786
#9: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#9: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#9: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0xaa/0x3a0 net/hsr/hsr_device.c:413
#10: ffff8880346cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#10: ffff8880346cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x1a7/0x7b0 net/hsr/hsr_device.c:384
#11: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#11: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#11: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb6/0x2cc0 net/hsr/hsr_forward.c:728
#12: ffffffff8eb38fc0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#12: ffffffff8eb38fc0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline]
#12: ffffffff8eb38fc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f4/0x3f50 net/core/dev.c:4509
#13: ffff88805f787258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#13: ffff88805f787258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:197 [inline]
#13: ffff88805f787258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:3961 [inline]
#13: ffff88805f787258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_queue_xmit+0x13bc/0x3f50 net/core/dev.c:4550
#14: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#14: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#14: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x63b/0x17c0 net/ipv6/ip6_output.c:126
#15: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#15: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#15: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x1eb/0x1530 net/ipv6/ndisc.c:484
#16: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#16: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#16: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x63b/0x17c0 net/ipv6/ip6_output.c:126
#17: ffffffff8eb38fc0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#17: ffffffff8eb38fc0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline]
#17: ffffffff8eb38fc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f4/0x3f50 net/core/dev.c:4509
stack backtrace:
CPU: 0 UID: 0 PID: 5830 Comm: syz-executor Not tainted 6.14.0-rc2-syzkaller-00158-g071ed42cff4f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3039
check_deadlock kernel/locking/lockdep.c:3091 [inline]
validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3893
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234
__netdev_start_xmit include/linux/netdevice.h:5150 [inline]
netdev_start_xmit include/linux/netdevice.h:5159 [inline]
xmit_one net/core/dev.c:3735 [inline]
dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3751
__dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4584
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x12bc/0x17c0 net/ipv6/ip6_output.c:141
ip6_finish_output+0x41e/0x840 net/ipv6/ip6_output.c:226
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xb52/0x1530 net/ipv6/ndisc.c:513
ndisc_solicit+0x493/0x6a0
neigh_probe net/core/neighbour.c:1026 [inline]
__neigh_event_send+0xef5/0x15d0 net/core/neighbour.c:1193
neigh_event_send_probe include/net/neighbour.h:463 [inline]
neigh_event_send include/net/neighbour.h:469 [inline]
neigh_resolve_output+0x1b5/0x740 net/core/neighbour.c:1498
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x12bc/0x17c0 net/ipv6/ip6_output.c:141
ip6_finish_output+0x41e/0x840 net/ipv6/ip6_output.c:226
ip6tunnel_xmit+0x1a8/0x3b0 include/net/ip6_tunnel.h:161
ip6_tnl_xmit+0x21de/0x2980 net/ipv6/ip6_tunnel.c:1281
__gre6_xmit+0xaf8/0xdf0 net/ipv6/ip6_gre.c:815
ip6gre_xmit_other net/ipv6/ip6_gre.c:901 [inline]
ip6gre_tunnel_xmit+0xdc2/0x15b0 net/ipv6/ip6_gre.c:928
__netdev_start_xmit include/linux/netdevice.h:5150 [inline]
netdev_start_xmit include/linux/netdevice.h:5159 [inline]
xmit_one net/core/dev.c:3735 [inline]
dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3751
sch_direct_xmit+0x29c/0x5d0 net/sched/sch_generic.c:343
__dev_xmit_skb net/core/dev.c:3974 [inline]
__dev_queue_xmit+0x1a8f/0x3f50 net/core/dev.c:4550
dev_queue_xmit include/linux/netdevice.h:3311 [inline]
hsr_xmit net/hsr/hsr_forward.c:430 [inline]
hsr_forward_do net/hsr/hsr_forward.c:571 [inline]
hsr_forward_skb+0x17ed/0x2cc0 net/hsr/hsr_forward.c:733
send_prp_supervision_frame+0x36d/0x7b0 net/hsr/hsr_device.c:399
hsr_announce+0x1f8/0x3a0 net/hsr/hsr_device.c:415
call_timer_fn+0x187/0x650 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5855
Code: 2b 00 74 08 4c 89 f7 e8 9a 45 8c 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc9000411f020 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92000823e10 RCX: ffff88802dc6e4e8
RDX: dffffc0000000000 RSI: ffffffff8c2ab680 RDI: ffffffff8c80ec80
RBP: ffffc9000411f170 R08: ffffffff94544847 R09: 1ffffffff28a8908
R10: dffffc0000000000 R11: fffffbfff28a8909 R12: 1ffff92000823e0c
R13: dffffc0000000000 R14: ffffc9000411f080 R15: 0000000000000246
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock_sched include/linux/rcupdate.h:941 [inline]
pfn_valid+0x113/0x450 include/linux/mmzone.h:2067
page_table_check_set+0x22/0x540 mm/page_table_check.c:110
__page_table_check_ptes_set+0x30f/0x410 mm/page_table_check.c:225
page_table_check_ptes_set include/linux/page_table_check.h:74 [inline]
set_ptes include/linux/pgtable.h:288 [inline]
__copy_present_ptes mm/memory.c:968 [inline]
copy_present_ptes mm/memory.c:1051 [inline]
copy_pte_range mm/memory.c:1174 [inline]
copy_pmd_range+0x4523/0x77b0 mm/memory.c:1262
copy_pud_range mm/memory.c:1299 [inline]
copy_p4d_range mm/memory.c:1323 [inline]
copy_page_range+0x99f/0xe90 mm/memory.c:1421
dup_mmap kernel/fork.c:748 [inline]
dup_mm kernel/fork.c:1700 [inline]
copy_mm+0x1269/0x2160 kernel/fork.c:1752
copy_process+0x17d1/0x3cf0 kernel/fork.c:2403
kernel_clone+0x226/0x8e0 kernel/fork.c:2815
__do_sys_clone kernel/fork.c:2958 [inline]
__se_sys_clone kernel/fork.c:2942 [inline]
__x64_sys_clone+0x258/0x2a0 kernel/fork.c:2942
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2e3ed83653
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffe1c863978 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2e3ed83653
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 00005555647727d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 0000000000026ebb R15: 00007ffe1c863b10
----------------
Code disassembly (best guess):
0: 2b 00 sub (%rax),%eax
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 9a 45 8c 00 call 0x8c45a6
c: f6 44 24 61 02 testb $0x2,0x61(%rsp)
11: 0f 85 85 01 00 00 jne 0x19c
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1)
3a: 00 00
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 25 .byte 0x25