============================================
WARNING: possible recursive locking detected
6.8.0-syzkaller-05204-g237bb5f7f7f5 #0 Not tainted
--------------------------------------------
kworker/0:17/22497 is trying to acquire lock:
ffff8880299f13e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff8880299f13e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_ip6_multicast_query net/bridge/br_multicast.c:3523 [inline]
ffff8880299f13e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_ipv6_rcv net/bridge/br_multicast.c:3919 [inline]
ffff8880299f13e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_rcv+0x30e2/0x8180 net/bridge/br_multicast.c:3974
but task is already holding lock:
ffff88805ce093e0 (&br->multicast_lock){+.-.}-{2:2}
, at: spin_lock include/linux/spinlock.h:351 [inline]
, at: br_multicast_port_query_expired+0x64/0x3b0 net/bridge/br_multicast.c:1905
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&br->multicast_lock);
lock(&br->multicast_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
5 locks held by kworker/0:17/22497:
#0: ffffc90000007c00 ((&pmctx->ip6_own_query.timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1789
#1: ffff88805ce093e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#1: ffff88805ce093e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x64/0x3b0 net/bridge/br_multicast.c:1905
#2: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#2: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#2: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4260
#3: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#3: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#3: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4260
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: br_dev_xmit+0x1b9/0x1a10 net/bridge/br_device.c:44
stack backtrace:
CPU: 0 PID: 22497 Comm: kworker/0:17 Not tainted 6.8.0-syzkaller-05204-g237bb5f7f7f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: events nfc_urelease_event_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
check_deadlock kernel/locking/lockdep.c:3062 [inline]
validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
br_ip6_multicast_query net/bridge/br_multicast.c:3523 [inline]
br_multicast_ipv6_rcv net/bridge/br_multicast.c:3919 [inline]
br_multicast_rcv+0x30e2/0x8180 net/bridge/br_multicast.c:3974
br_dev_xmit+0xb17/0x1a10 net/bridge/br_device.c:90
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x26a/0x790 net/core/dev.c:3547
__dev_queue_xmit+0x19f4/0x3b10 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
vlan_dev_hard_start_xmit+0x36c/0x5f0 net/8021q/vlan_dev.c:125
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x26a/0x790 net/core/dev.c:3547
__dev_queue_xmit+0x19f4/0x3b10 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
br_dev_queue_push_xmit+0x701/0x8d0 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:314 [inline]
__br_multicast_send_query+0x2ecb/0x4750 net/bridge/br_multicast.c:1809
br_multicast_send_query+0x4ee/0x6b0 net/bridge/br_multicast.c:1888
br_multicast_port_query_expired+0x2d4/0x3b0 net/bridge/br_multicast.c:1913
call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2408 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
run_timer_base kernel/time/timer.c:2428 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
__do_softirq+0x2bc/0x943 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:process_one_work kernel/workqueue.c:3229 [inline]
RIP: 0010:process_scheduled_works+0x8ec/0x1770 kernel/workqueue.c:3335
Code: 28 00 74 08 4c 89 f7 e8 72 c6 97 00 49 8b 3e b8 48 01 00 00 48 01 c7 48 8d 05 00 00 00 00 31 f6 31 d2 31 c9 41 b8 01 00 00 00 <45> 31 c9 50 e8 fb 2a 11 00 48 83 c4 08 eb 19 e8 00 82 34 00 c7 44
RSP: 0018:ffffc9000a357bc0 EFLAGS: 00000246
RAX: ffffffff81606e50 RBX: ffff888019f464d0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888014c78948
RBP: ffffc9000a357dc0 R08: 0000000000000001 R09: 1ffffffff1f0d5cd
R10: dffffc0000000000 R11: fffffbfff1f0d5ce R12: ffff888019f45a00
R13: dffffc0000000000 R14: ffff888014c98008 R15: ffff888023bb8e80
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
----------------
Code disassembly (best guess):
0: 28 00 sub %al,(%rax)
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 72 c6 97 00 call 0x97c67e
c: 49 8b 3e mov (%r14),%rdi
f: b8 48 01 00 00 mov $0x148,%eax
14: 48 01 c7 add %rax,%rdi
17: 48 8d 05 00 00 00 00 lea 0x0(%rip),%rax # 0x1e
1e: 31 f6 xor %esi,%esi
20: 31 d2 xor %edx,%edx
22: 31 c9 xor %ecx,%ecx
24: 41 b8 01 00 00 00 mov $0x1,%r8d
* 2a: 45 31 c9 xor %r9d,%r9d <-- trapping instruction
2d: 50 push %rax
2e: e8 fb 2a 11 00 call 0x112b2e
33: 48 83 c4 08 add $0x8,%rsp
37: eb 19 jmp 0x52
39: e8 00 82 34 00 call 0x34823e
3e: c7 .byte 0xc7
3f: 44 rex.R