============================================
WARNING: possible recursive locking detected
5.13.0-rc3-syzkaller #0 Not tainted
--------------------------------------------
systemd-udevd/4853 is trying to acquire lock:
ffff88803f794f90 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
ffff88803f794f90 (&br->multicast_lock){+.-.}-{2:2}, at: br_ip6_multicast_query net/bridge/br_multicast.c:2823 [inline]
ffff88803f794f90 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_ipv6_rcv net/bridge/br_multicast.c:3210 [inline]
ffff88803f794f90 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_rcv+0x2c93/0x56e0 net/bridge/br_multicast.c:3242

but task is already holding lock:
ffff88803a468f90 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
ffff88803a468f90 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x40/0x170 net/bridge/br_multicast.c:1528

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&br->multicast_lock);
  lock(&br->multicast_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

6 locks held by systemd-udevd/4853:
 #0: ffffc90000007d70 ((&port->ip6_own_query.timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline]
 #0: ffffc90000007d70 ((&port->ip6_own_query.timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1421
 #1: ffff88803a468f90 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline]
 #1: ffff88803a468f90 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x40/0x170 net/bridge/br_multicast.c:1528
 #2: ffffffff8bf76800 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1da/0x2e30 net/core/dev.c:4179
 #3: ffffffff8bf76860 (rcu_read_lock){....}-{1:2}, at: is_netpoll_tx_blocked include/net/bonding.h:109 [inline]
 #3: ffffffff8bf76860 (rcu_read_lock){....}-{1:2}, at: bond_start_xmit+0x88/0x11f0 drivers/net/bonding/bond_main.c:4744
 #4: ffffffff8bf76800 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1da/0x2e30 net/core/dev.c:4179
 #5: ffffffff8bf76860 (rcu_read_lock){....}-{1:2}, at: br_dev_xmit+0x0/0x1690 net/bridge/br_device.c:305

stack backtrace:
CPU: 0 PID: 4853 Comm: systemd-udevd Not tainted 5.13.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 print_deadlock_bug kernel/locking/lockdep.c:2831 [inline]
 check_deadlock kernel/locking/lockdep.c:2874 [inline]
 validate_chain kernel/locking/lockdep.c:3663 [inline]
 __lock_acquire.cold+0x22f/0x3b4 kernel/locking/lockdep.c:4902
 lock_acquire kernel/locking/lockdep.c:5512 [inline]
 lock_acquire+0x1ab/0x740 kernel/locking/lockdep.c:5477
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:354 [inline]
 br_ip6_multicast_query net/bridge/br_multicast.c:2823 [inline]
 br_multicast_ipv6_rcv net/bridge/br_multicast.c:3210 [inline]
 br_multicast_rcv+0x2c93/0x56e0 net/bridge/br_multicast.c:3242
 br_dev_xmit+0x6fb/0x1690 net/bridge/br_device.c:85
 __netdev_start_xmit include/linux/netdevice.h:4944 [inline]
 netdev_start_xmit include/linux/netdevice.h:4958 [inline]
 xmit_one net/core/dev.c:3654 [inline]
 dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3670
 __dev_queue_xmit+0x209c/0x2e30 net/core/dev.c:4245
 bond_dev_queue_xmit+0xc3/0x170 drivers/net/bonding/bond_main.c:304
 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:4487 [inline]
 __bond_start_xmit drivers/net/bonding/bond_main.c:4721 [inline]
 bond_start_xmit+0x88b/0x11f0 drivers/net/bonding/bond_main.c:4749
 __netdev_start_xmit include/linux/netdevice.h:4944 [inline]
 netdev_start_xmit include/linux/netdevice.h:4958 [inline]
 xmit_one net/core/dev.c:3654 [inline]
 dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3670
 __dev_queue_xmit+0x209c/0x2e30 net/core/dev.c:4245
 br_dev_queue_push_xmit+0x252/0x730 net/bridge/br_forward.c:51
 NF_HOOK include/linux/netfilter.h:301 [inline]
 __br_multicast_send_query+0xf80/0x39e0 net/bridge/br_multicast.c:1467
 br_multicast_send_query+0x27c/0x420 net/bridge/br_multicast.c:1512
 br_multicast_port_query_expired+0x118/0x170 net/bridge/br_multicast.c:1536
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1431
 expire_timers kernel/time/timer.c:1476 [inline]
 __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1745
 __run_timers kernel/time/timer.c:1726 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1758
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:559
 invoke_softirq kernel/softirq.c:433 [inline]
 __irq_exit_rcu+0x136/0x200 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:647
RIP: 0010:kmem_cache_free+0x97/0x200 mm/slab.c:3743
Code: 75 0e 4c 89 ea 4c 89 e6 48 89 df e8 13 bf ff ff 48 85 ed 75 62 9c 58 f6 c4 02 0f 85 03 01 00 00 48 85 ed 74 01 fb 48 8b 4b 58 <48> 8b 74 24 20 0f 1f 44 00 00 65 8b 05 50 3f 49 7e 83 f8 07 0f 87
RSP: 0018:ffffc90001377b30 EFLAGS: 00000206
RAX: 0000000000000006 RBX: ffff8880112a3800 RCX: ffffffff8978cfc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000200 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff817a1e58 R11: 0000000000084087 R12: ffff888080004c00
R13: ffffffff81c7f501 R14: ffff888080004c00 R15: ffffc90001377c10
 putname+0xe1/0x120 fs/namei.c:259
 filename_lookup+0x3c3/0x570 fs/namei.c:2464
 user_path_at include/linux/namei.h:60 [inline]
 vfs_statx+0x142/0x390 fs/stat.c:203
 vfs_fstatat fs/stat.c:225 [inline]
 vfs_lstat include/linux/fs.h:3384 [inline]
 __do_sys_newlstat+0x91/0x110 fs/stat.c:380
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7efedd305335
Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89
RSP: 002b:00007ffe6dda6b38 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 00005574858bce70 RCX: 00007efedd305335
RDX: 00007ffe6dda6b70 RSI: 00007ffe6dda6b70 RDI: 00005574858bbe70
RBP: 00007ffe6dda6c30 R08: 00007efedd5c4178 R09: 0000000000001010
R10: 00007efedd5c3b58 R11: 0000000000000246 R12: 00005574858bbe70
R13: 00005574858bbe95 R14: 00005574858ac654 R15: 00005574858ac655