============================================
WARNING: possible recursive locking detected
6.15.0-rc1-syzkaller-00220-g6a325aed130b #0 Not tainted
--------------------------------------------
syz-executor/9198 is trying to acquire lock:
ffff88805f9a2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88805f9a2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234
but task is already holding lock:
ffff888027b12f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888027b12f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
11 locks held by syz-executor/9198:
#0: ffffffff8f890b20 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8f890b20 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8f890b20 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x22/0x250 net/core/rtnetlink.c:570
#1: ffffffff900fd448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff900fd448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff900fd448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xd68/0x1fe0 net/core/rtnetlink.c:4067
#2: ffffc90000007bc0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc2/0x650 kernel/time/timer.c:1786
#3: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#3: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#3: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x1ef/0x1560 net/ipv6/ndisc.c:484
#4: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#4: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x701/0x1750 net/ipv6/ip6_output.c:126
#5: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#5: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#5: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f9/0x3f60 net/core/dev.c:4604
#6: ffff888027b12f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#6: ffff888027b12f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234
#7: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#7: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#7: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb8/0x2d20 net/hsr/hsr_forward.c:728
#8: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#8: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f9/0x3f60 net/core/dev.c:4604
#9: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#9: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#9: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x220/0x1c00 net/bridge/br_device.c:52
#10: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#10: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#10: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f9/0x3f60 net/core/dev.c:4604
stack backtrace:
CPU: 0 UID: 0 PID: 9198 Comm: syz-executor Not tainted 6.15.0-rc1-syzkaller-00220-g6a325aed130b #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_deadlock_bug+0x2be/0x2d0 kernel/locking/lockdep.c:3042
check_deadlock kernel/locking/lockdep.c:3094 [inline]
validate_chain+0x928/0x24e0 kernel/locking/lockdep.c:3896
__lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235
lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234
__netdev_start_xmit include/linux/netdevice.h:5209 [inline]
netdev_start_xmit include/linux/netdevice.h:5218 [inline]
xmit_one net/core/dev.c:3826 [inline]
dev_hard_start_xmit+0x2d9/0x830 net/core/dev.c:3842
__dev_queue_xmit+0x1b80/0x3f60 net/core/dev.c:4679
dev_queue_xmit include/linux/netdevice.h:3355 [inline]
br_dev_queue_push_xmit+0x771/0x950 net/bridge/br_forward.c:53
NF_HOOK+0x3ac/0x460 include/linux/netfilter.h:314
br_forward_finish+0xd8/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x3ac/0x460 include/linux/netfilter.h:314
__br_forward+0x46a/0x640 net/bridge/br_forward.c:115
br_dev_xmit+0x12ac/0x1c00 net/bridge/br_device.c:-1
__netdev_start_xmit include/linux/netdevice.h:5209 [inline]
netdev_start_xmit include/linux/netdevice.h:5218 [inline]
xmit_one net/core/dev.c:3826 [inline]
dev_hard_start_xmit+0x2d9/0x830 net/core/dev.c:3842
__dev_queue_xmit+0x1b80/0x3f60 net/core/dev.c:4679
dev_queue_xmit include/linux/netdevice.h:3355 [inline]
hsr_xmit net/hsr/hsr_forward.c:430 [inline]
hsr_forward_do net/hsr/hsr_forward.c:571 [inline]
hsr_forward_skb+0x184c/0x2d20 net/hsr/hsr_forward.c:733
hsr_dev_xmit+0x195/0x210 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5209 [inline]
netdev_start_xmit include/linux/netdevice.h:5218 [inline]
xmit_one net/core/dev.c:3826 [inline]
dev_hard_start_xmit+0x2d9/0x830 net/core/dev.c:3842
__dev_queue_xmit+0x1b80/0x3f60 net/core/dev.c:4679
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x1296/0x1750 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x421/0x840 net/ipv6/ip6_output.c:226
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xb58/0x1560 net/ipv6/ndisc.c:513
addrconf_rs_timer+0x380/0x680 net/ipv6/addrconf.c:4038
call_timer_fn+0x189/0x650 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x66e/0x8e0 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfb/0x220 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:kasan_byte_accessible+0x16/0x20 mm/kasan/generic.c:201
Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df 0f b6 04 07 <3c> 08 0f 92 c0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000b61e9d0 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffff88801da82528 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8c2ebe2e RDI: 1ffff11003b504a5
RBP: ffffffff93670020 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff20bef8f R12: 0000000000000001
R13: 0000000000000000 R14: ffffffff8c2ebe2e R15: ffff88801da82528
__kasan_check_byte+0x14/0x40 mm/kasan/common.c:556
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire+0x89/0x2f0 kernel/locking/lockdep.c:5840
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
class_to_subsys+0x41/0x120 drivers/base/class.c:50
device_add+0x96f/0xbf0 drivers/base/core.c:3680
netdev_register_kobject+0x157/0x2f0 net/core/net-sysfs.c:2336
register_netdevice+0x12b0/0x1b80 net/core/dev.c:11062
veth_newlink+0x4c3/0xb80 drivers/net/veth.c:1818
rtnl_newlink_create+0x39b/0xcb0 net/core/rtnetlink.c:3836
__rtnl_newlink net/core/rtnetlink.c:3953 [inline]
rtnl_newlink+0x18b0/0x1fe0 net/core/rtnetlink.c:4068
rtnetlink_rcv_msg+0x80f/0xd70 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x208/0x480 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f8/0x9a0 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8c3/0xcd0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:727
__sys_sendto+0x365/0x4c0 net/socket.c:2180
__do_sys_sendto net/socket.c:2187 [inline]
__se_sys_sendto net/socket.c:2183 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2183
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f684118effc
Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b
RSP: 002b:00007ffe3457dbe0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f6841ed4620 RCX: 00007f684118effc
RDX: 0000000000000064 RSI: 00007f6841ed4670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffe3457dc34 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f6841ed4670 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 66 0f 1f 00 nopw (%rax)
18: 48 c1 ef 03 shr $0x3,%rdi
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 0f b6 04 07 movzbl (%rdi,%rax,1),%eax
* 2a: 3c 08 cmp $0x8,%al <-- trapping instruction
2c: 0f 92 c0 setb %al
2f: c3 ret
30: cc int3
31: cc int3
32: cc int3
33: cc int3
34: 90 nop
35: 90 nop
36: 90 nop
37: 90 nop
38: 90 nop
39: 90 nop
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop
3f: 90 nop