============================================
WARNING: possible recursive locking detected
6.8.0-syzkaller-05204-g237bb5f7f7f5 #0 Not tainted
--------------------------------------------
kworker/u8:6/30560 is trying to acquire lock:
ffff88801f1893e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff88801f1893e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_ip4_multicast_query net/bridge/br_multicast.c:3440 [inline]
ffff88801f1893e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_ipv4_rcv net/bridge/br_multicast.c:3854 [inline]
ffff88801f1893e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_rcv+0x2d06/0x8180 net/bridge/br_multicast.c:3970
but task is already holding lock:
ffff8880647a93e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff8880647a93e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x64/0x3b0 net/bridge/br_multicast.c:1905
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&br->multicast_lock);
lock(&br->multicast_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
7 locks held by kworker/u8:6/30560:
#0: ffffffff8e21eac0 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:303 [inline]
#0: ffffffff8e21eac0 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:3761 [inline]
#0: ffffffff8e21eac0 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:3842 [inline]
#0: ffffffff8e21eac0 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc+0x48/0x350 mm/slub.c:3867
#1: ffffffff8e230700 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: fs_reclaim_acquire+0x93/0x130 mm/page_alloc.c:3709
#2: ffffc90000007c00 ((&pmctx->ip4_own_query.timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1789
#3: ffff8880647a93e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff8880647a93e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x64/0x3b0 net/bridge/br_multicast.c:1905
#4: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#4: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#4: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4260
#5: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#5: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#5: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4260
#6: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#6: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#6: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: br_dev_xmit+0x1b9/0x1a10 net/bridge/br_device.c:44
stack backtrace:
CPU: 0 PID: 30560 Comm: kworker/u8:6 Not tainted 6.8.0-syzkaller-05204-g237bb5f7f7f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
check_deadlock kernel/locking/lockdep.c:3062 [inline]
validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
br_ip4_multicast_query net/bridge/br_multicast.c:3440 [inline]
br_multicast_ipv4_rcv net/bridge/br_multicast.c:3854 [inline]
br_multicast_rcv+0x2d06/0x8180 net/bridge/br_multicast.c:3970
br_dev_xmit+0xb17/0x1a10 net/bridge/br_device.c:90
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x26a/0x790 net/core/dev.c:3547
__dev_queue_xmit+0x19f4/0x3b10 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
vlan_dev_hard_start_xmit+0x36c/0x5f0 net/8021q/vlan_dev.c:125
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x26a/0x790 net/core/dev.c:3547
__dev_queue_xmit+0x19f4/0x3b10 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
br_dev_queue_push_xmit+0x701/0x8d0 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:314 [inline]
__br_multicast_send_query+0x2ecb/0x4750 net/bridge/br_multicast.c:1809
br_multicast_send_query+0x4ee/0x6b0 net/bridge/br_multicast.c:1888
br_multicast_port_query_expired+0x2d4/0x3b0 net/bridge/br_multicast.c:1913
call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2408 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
run_timer_base kernel/time/timer.c:2428 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
__do_softirq+0x2bc/0x943 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:lock_acquire+0x25b/0x530 kernel/locking/lockdep.c:5758
Code: 2b 00 74 08 4c 89 f7 e8 13 99 86 00 f6 44 24 61 02 0f 85 8e 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc90004e5fbe0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff920009cbf88 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff8baad3a0 RDI: ffffffff8bfec660
RBP: ffffc90004e5fd30 R08: ffffffff92cc7517 R09: 1ffffffff2598ea2
R10: dffffc0000000000 R11: fffffbfff2598ea3 R12: 1ffff920009cbf84
R13: dffffc0000000000 R14: ffffc90004e5fc40 R15: 0000000000000246
fs_reclaim_acquire+0xaf/0x130 mm/page_alloc.c:3709
might_alloc include/linux/sched/mm.h:303 [inline]
slab_pre_alloc_hook mm/slub.c:3761 [inline]
slab_alloc_node mm/slub.c:3842 [inline]
kmem_cache_alloc+0x48/0x350 mm/slub.c:3867
vma_lock_alloc kernel/fork.c:441 [inline]
vm_area_alloc+0x10e/0x1d0 kernel/fork.c:472
__bprm_mm_init fs/exec.c:260 [inline]
bprm_mm_init fs/exec.c:384 [inline]
alloc_bprm+0x3b1/0xa00 fs/exec.c:1579
kernel_execve+0x99/0xa10 fs/exec.c:2003
call_usermodehelper_exec_async+0x237/0x380 kernel/umh.c:110
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
----------------
Code disassembly (best guess):
0: 2b 00 sub (%rax),%eax
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 13 99 86 00 call 0x86991f
c: f6 44 24 61 02 testb $0x2,0x61(%rsp)
11: 0f 85 8e 01 00 00 jne 0x1a5
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1)
3a: 00 00
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 25 .byte 0x25