============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.3.3561/17156 is trying to acquire lock:
ffff88807825cf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:347 [inline]
ffff88807825cf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x208/0x400 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff888034246f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:347 [inline]
ffff888034246f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3a8/0xbc0 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
10 locks held by syz.3.3561/17156:
#0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: find_lock_entries+0x10c/0x1130 mm/filemap.c:2165
#1: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#1: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#1: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: page_ref_add_unless.constprop.0+0x25/0x390 include/linux/page_ref.h:235
#2: ffffc90000a08ca8 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x670 kernel/time/timer.c:1745
#3: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#3: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#3: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x88/0x3e0 net/hsr/hsr_device.c:419
#4: ffff888034246f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:347 [inline]
#4: ffff888034246f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3a8/0xbc0 net/hsr/hsr_device.c:330
#5: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#5: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#5: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xa7/0x28a0 net/hsr/hsr_forward.c:738
#6: ffffffff8e7e9440 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#6: ffffffff8e7e9440 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:903 [inline]
#6: ffffffff8e7e9440 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x4750 net/core/dev.c:4754
#7: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#7: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#7: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x181/0x1880 net/bridge/br_device.c:52
#8: ffffffff8e7e9440 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8e7e9440 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:903 [inline]
#8: ffffffff8e7e9440 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x4750 net/core/dev.c:4754
#9: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#9: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#9: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x39/0x400 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 1 UID: 0 PID: 17156 Comm: syz.3.3561 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_deadlock_bug.cold+0xbd/0xca kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x12bb/0x2630 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:347 [inline]
hsr_dev_xmit+0x208/0x400 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5275 [inline]
netdev_start_xmit include/linux/netdevice.h:5284 [inline]
xmit_one net/core/dev.c:3864 [inline]
dev_hard_start_xmit+0x121/0x7d0 net/core/dev.c:3880
__dev_queue_xmit+0x6dd/0x4750 net/core/dev.c:4829
dev_queue_xmit include/linux/netdevice.h:3384 [inline]
br_dev_queue_push_xmit+0x360/0x550 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
br_forward_finish+0x102/0x4d0 net/bridge/br_forward.c:66
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
__br_forward+0x6b1/0x970 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xf0/0x180 net/bridge/br_forward.c:191
br_flood+0x193/0x650 net/bridge/br_forward.c:238
br_dev_xmit+0x10b0/0x1880 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5275 [inline]
netdev_start_xmit include/linux/netdevice.h:5284 [inline]
xmit_one net/core/dev.c:3864 [inline]
dev_hard_start_xmit+0x121/0x7d0 net/core/dev.c:3880
__dev_queue_xmit+0x6dd/0x4750 net/core/dev.c:4829
dev_queue_xmit include/linux/netdevice.h:3384 [inline]
hsr_xmit net/hsr/hsr_forward.c:440 [inline]
hsr_forward_do net/hsr/hsr_forward.c:581 [inline]
hsr_forward_skb+0xcbc/0x28a0 net/hsr/hsr_forward.c:743
send_hsr_supervision_frame+0x696/0xbc0 net/hsr/hsr_device.c:364
hsr_announce+0x169/0x3e0 net/hsr/hsr_device.c:421
call_timer_fn+0x19a/0x670 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers+0x757/0xb30 kernel/time/timer.c:2373
__run_timer_base kernel/time/timer.c:2385 [inline]
__run_timer_base kernel/time/timer.c:2377 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2394
run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2404
handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xef/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rcu_is_watching+0x0/0xc0 kernel/rcu/tree.c:748
Code: 3a ff ff ff 48 89 df e8 1e d3 86 00 eb 81 e8 47 d3 86 00 e9 49 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 55 53 65 ff 05 93 d4 1f 12 e8 3e e9 9f 09 48 c7 c3 a8
RSP: 0018:ffffc90002f57230 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffffea0001dab680 RCX: ffffffff82412eb6
RDX: ffff88802c570000 RSI: ffffffff824130d1 RDI: ffff88802c570000
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 000000000000000d R14: dffffc0000000000 R15: 000000000000063a
rcu_read_lock include/linux/rcupdate.h:851 [inline]
page_ref_add_unless.constprop.0+0x266/0x390 include/linux/page_ref.h:235
folio_ref_add_unless include/linux/page_ref.h:248 [inline]
folio_try_get include/linux/page_ref.h:264 [inline]
find_get_entry mm/filemap.c:2076 [inline]
find_lock_entries+0x1c5/0x1130 mm/filemap.c:2166
shmem_undo_range+0x212/0x1570 mm/shmem.c:1131
shmem_truncate_range mm/shmem.c:1277 [inline]
shmem_evict_inode+0x39e/0xbd0 mm/shmem.c:1407
evict+0x3c2/0xad0 fs/inode.c:846
iput_final fs/inode.c:1966 [inline]
iput.part.0+0x605/0xf50 fs/inode.c:2015
iput+0x35/0x40 fs/inode.c:1981
dentry_unlink_inode+0x2a1/0x490 fs/dcache.c:467
__dentry_kill+0x1d0/0x600 fs/dcache.c:670
finish_dput+0x76/0x480 fs/dcache.c:879
dput.part.0+0x456/0x570 fs/dcache.c:928
dput+0x1f/0x30 fs/dcache.c:920
__fput+0x519/0xb40 fs/file_table.c:477
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x829/0x2a90 kernel/exit.c:971
do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x67c/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3f61b9bf79
Code: Unable to access opcode bytes at 0x7f3f61b9bf4f.
RSP: 002b:00007f3f62a66028 EFLAGS: 00000246 ORIG_RAX: 000000000000002d
RAX: fffffffffffffe00 RBX: 00007f3f61e16180 RCX: 00007f3f61b9bf79
RDX: fffffffffffffd0b RSI: 0000200000000080 RDI: 0000000000000006
RBP: 00007f3f61c327e0 R08: 0000000000000000 R09: fffffffffffffd25
R10: 00000000c9100120 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3f61e16218 R14: 00007f3f61e16180 R15: 00007ffe6fc22978
----------------
Code disassembly (best guess), 4 bytes skipped:
0: 48 89 df mov %rbx,%rdi
3: e8 1e d3 86 00 call 0x86d326
8: eb 81 jmp 0xffffff8b
a: e8 47 d3 86 00 call 0x86d356
f: e9 49 ff ff ff jmp 0xffffff5d
14: 66 90 xchg %ax,%ax
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
* 26: f3 0f 1e fa endbr64 <-- trapping instruction
2a: 55 push %rbp
2b: 53 push %rbx
2c: 65 ff 05 93 d4 1f 12 incl %gs:0x121fd493(%rip) # 0x121fd4c6
33: e8 3e e9 9f 09 call 0x99fe976
38: 48 rex.W
39: c7 .byte 0xc7
3a: c3 ret
3b: a8 .byte 0xa8