============================================ WARNING: possible recursive locking detected 6.15.0-rc1-syzkaller-00368-gbbfc077d4572 #0 Not tainted -------------------------------------------- swapper/1/0 is trying to acquire lock: ffff88805ce88f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff88805ce88f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234 but task is already holding lock: ffff8880340d4f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff8880340d4f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&hsr->seqnr_lock); lock(&hsr->seqnr_lock); *** DEADLOCK *** May be due to missing lock nesting notation 9 locks held by swapper/1/0: #0: ffffc90000a08bc0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc2/0x650 kernel/time/timer.c:1786 #1: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #1: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #1: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x1ef/0x1560 net/ipv6/ndisc.c:484 #2: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #2: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x701/0x1750 net/ipv6/ip6_output.c:126 #3: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #3: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline] #3: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f9/0x3f60 net/core/dev.c:4604 #4: ffff8880340d4f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #4: ffff8880340d4f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234 #5: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #5: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #5: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb8/0x2d20 net/hsr/hsr_forward.c:728 #6: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #6: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline] #6: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f9/0x3f60 net/core/dev.c:4604 #7: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #7: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #7: ffffffff8ed3dfe0 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x220/0x1c00 net/bridge/br_device.c:52 #8: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #8: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline] #8: ffffffff8ed3e040 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f9/0x3f60 net/core/dev.c:4604 stack backtrace: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.15.0-rc1-syzkaller-00368-gbbfc077d4572 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_deadlock_bug+0x2be/0x2d0 kernel/locking/lockdep.c:3042 check_deadlock kernel/locking/lockdep.c:3094 [inline] validate_chain+0x928/0x24e0 kernel/locking/lockdep.c:3896 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234 __netdev_start_xmit include/linux/netdevice.h:5203 [inline] netdev_start_xmit include/linux/netdevice.h:5212 [inline] xmit_one net/core/dev.c:3826 [inline] dev_hard_start_xmit+0x2d9/0x830 net/core/dev.c:3842 __dev_queue_xmit+0x1b80/0x3f60 net/core/dev.c:4679 dev_queue_xmit include/linux/netdevice.h:3349 [inline] br_dev_queue_push_xmit+0x771/0x950 net/bridge/br_forward.c:53 NF_HOOK+0x3ac/0x460 include/linux/netfilter.h:314 br_forward_finish+0xd8/0x130 net/bridge/br_forward.c:66 NF_HOOK+0x3ac/0x460 include/linux/netfilter.h:314 __br_forward+0x46a/0x640 net/bridge/br_forward.c:115 deliver_clone net/bridge/br_forward.c:131 [inline] maybe_deliver+0xb3/0x150 net/bridge/br_forward.c:190 br_flood+0x2e4/0x680 net/bridge/br_forward.c:237 br_dev_xmit+0x12ac/0x1c00 net/bridge/br_device.c:-1 __netdev_start_xmit include/linux/netdevice.h:5203 [inline] netdev_start_xmit include/linux/netdevice.h:5212 [inline] xmit_one net/core/dev.c:3826 [inline] dev_hard_start_xmit+0x2d9/0x830 net/core/dev.c:3842 __dev_queue_xmit+0x1b80/0x3f60 net/core/dev.c:4679 dev_queue_xmit include/linux/netdevice.h:3349 [inline] hsr_xmit net/hsr/hsr_forward.c:430 [inline] hsr_forward_do net/hsr/hsr_forward.c:571 [inline] hsr_forward_skb+0x184c/0x2d20 net/hsr/hsr_forward.c:733 hsr_dev_xmit+0x195/0x210 net/hsr/hsr_device.c:235 __netdev_start_xmit include/linux/netdevice.h:5203 [inline] netdev_start_xmit include/linux/netdevice.h:5212 [inline] xmit_one net/core/dev.c:3826 [inline] dev_hard_start_xmit+0x2d9/0x830 net/core/dev.c:3842 __dev_queue_xmit+0x1b80/0x3f60 net/core/dev.c:4679 neigh_output include/net/neighbour.h:539 [inline] ip6_finish_output2+0x1296/0x1750 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x421/0x840 net/ipv6/ip6_output.c:226 NF_HOOK include/linux/netfilter.h:314 [inline] ndisc_send_skb+0xb58/0x1560 net/ipv6/ndisc.c:513 addrconf_rs_timer+0x380/0x680 net/ipv6/addrconf.c:4038 call_timer_fn+0x189/0x650 kernel/time/timer.c:1789 expire_timers kernel/time/timer.c:1840 [inline] __run_timers kernel/time/timer.c:2414 [inline] __run_timer_base+0x66e/0x8e0 kernel/time/timer.c:2426 run_timer_base kernel/time/timer.c:2435 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445 handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xfb/0x220 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:81 Code: cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 91 1a 00 f3 0f 1e fa fb f4 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90000197dc0 EFLAGS: 000002c6 RAX: 38040f4748eeaa00 RBX: ffffffff8197af7e RCX: ffffffff8c2da95c RDX: 0000000000000001 RSI: ffffffff8e699951 RDI: ffffffff8ca1c6c0 RBP: ffffc90000197f20 R08: ffff8880b8732b5b R09: 1ffff110170e656b R10: dffffc0000000000 R11: ffffed10170e656c R12: 1ffff92000032fd2 R13: 1ffff11003ad9b40 R14: 0000000000000001 R15: dffffc0000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline] default_idle+0x13/0x20 arch/x86/kernel/process.c:748 default_idle_call+0x74/0xb0 kernel/sched/idle.c:117 cpuidle_idle_call kernel/sched/idle.c:185 [inline] do_idle+0x22e/0x5d0 kernel/sched/idle.c:325 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:423 start_secondary+0xfe/0x100 arch/x86/kernel/smpboot.c:315 common_startup_64+0x13e/0x147 ---------------- Code disassembly (best guess): 0: cc int3 1: cc int3 2: cc int3 3: cc int3 4: 0f 1f 00 nopl (%rax) 7: 90 nop 8: 90 nop 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: f3 0f 1e fa endbr64 1b: 66 90 xchg %ax,%ax 1d: 0f 00 2d 13 91 1a 00 verw 0x1a9113(%rip) # 0x1a9137 24: f3 0f 1e fa endbr64 28: fb sti 29: f4 hlt * 2a: c3 ret <-- trapping instruction 2b: cc int3 2c: cc int3 2d: cc int3 2e: cc int3 2f: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 36: 00 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop