============================================
WARNING: possible recursive locking detected
6.16.0-rc6-syzkaller-01600-g1b02c861714b #0 Not tainted
--------------------------------------------
syz.4.1014/9109 is trying to acquire lock:
ffff888030974f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888030974f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
but task is already holding lock:
ffff88806daa2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88806daa2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
13 locks held by syz.4.1014/9109:
#0: ffff8880334055f8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x320 fs/file.c:1217
#1: ffff888030c78428 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:3096 [inline]
#1: ffff888030c78428 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x211/0xa90 fs/read_write.c:682
#2: ffff88805891de38 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:869 [inline]
#2: ffff88805891de38 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 mm/shmem.c:3457
#3: ffff888031ffb3e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:431 [inline]
#3: ffff888031ffb3e0 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:188 [inline]
#3: ffff888031ffb3e0 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x32/0x300 mm/mmap_lock.c:248
#4: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#4: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: count_memcg_events_mm include/linux/memcontrol.h:975 [inline]
#4: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: count_memcg_event_mm+0x21/0x260 include/linux/memcontrol.h:985
#5: ffffc90000a08be0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x5f0 kernel/time/timer.c:1744
#6: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#6: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#6: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x20c/0x1440 net/ipv6/ndisc.c:482
#7: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#7: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#7: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x701/0x16a0 net/ipv6/ip6_output.c:126
#8: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#8: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27b/0x3b50 net/core/dev.c:4638
#9: ffff88806daa2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#9: ffff88806daa2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
#10: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#10: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#10: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860 net/hsr/hsr_forward.c:728
#11: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#11: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27b/0x3b50 net/core/dev.c:4638
#12: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#12: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#12: ffffffff8e13f140 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27b/0x3b50 net/core/dev.c:4638
stack backtrace:
CPU: 1 UID: 0 PID: 9109 Comm: syz.4.1014 Not tainted 6.16.0-rc6-syzkaller-01600-g1b02c861714b #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_deadlock_bug+0x28b/0x2a0 kernel/locking/lockdep.c:3044
check_deadlock kernel/locking/lockdep.c:3096 [inline]
validate_chain+0x1a3f/0x2140 kernel/locking/lockdep.c:3898
__lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
__netdev_start_xmit include/linux/netdevice.h:5219 [inline]
netdev_start_xmit include/linux/netdevice.h:5228 [inline]
xmit_one net/core/dev.c:3827 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3843
__dev_queue_xmit+0x1b8d/0x3b50 net/core/dev.c:4713
dev_queue_xmit_accel include/linux/netdevice.h:3364 [inline]
macvlan_queue_xmit drivers/net/macvlan.c:557 [inline]
macvlan_start_xmit+0x46d/0x6e0 drivers/net/macvlan.c:581
__netdev_start_xmit include/linux/netdevice.h:5219 [inline]
netdev_start_xmit include/linux/netdevice.h:5228 [inline]
xmit_one net/core/dev.c:3827 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3843
__dev_queue_xmit+0x1b8d/0x3b50 net/core/dev.c:4713
dev_queue_xmit include/linux/netdevice.h:3358 [inline]
hsr_xmit net/hsr/hsr_forward.c:430 [inline]
hsr_forward_do net/hsr/hsr_forward.c:571 [inline]
hsr_forward_skb+0x158b/0x2860 net/hsr/hsr_forward.c:733
hsr_dev_xmit+0x1a5/0x220 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5219 [inline]
netdev_start_xmit include/linux/netdevice.h:5228 [inline]
xmit_one net/core/dev.c:3827 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3843
__dev_queue_xmit+0x1b8d/0x3b50 net/core/dev.c:4713
neigh_output include/net/neighbour.h:547 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
NF_HOOK include/linux/netfilter.h:317 [inline]
ndisc_send_skb+0xb54/0x1440 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4032
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:css_uses_rstat kernel/cgroup/rstat.c:25 [inline]
RIP: 0010:css_rstat_updated+0xdc/0xca0 kernel/cgroup/rstat.c:145
Code: 74 08 4c 89 e7 e8 44 40 69 00 4c 89 f8 4d 8b 7f 08 48 89 44 24 08 4c 39 e8 74 2a 49 83 c7 38 4c 89 f8 48 c1 e8 03 80 3c 18 00 <74> 08 4c 89 ff e8 1a 40 69 00 49 83 3f 00 0f 84 24 01 00 00 e8 eb
RSP: 0018:ffffc900037576c0 EFLAGS: 00000246
RAX: 1ffffffff1f44ad8 RBX: dffffc0000000000 RCX: 0000000000080000
RDX: ffffc9000dbcf000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc900037577b8 R08: 0000000000000000 R09: ffffffff82099931
R10: dffffc0000000000 R11: ffffed1004d80a25 R12: ffff8880314c8d08
R13: ffff88802fd44000 R14: 1ffff110062991a1 R15: ffffffff8fa256c0
memcg_rstat_updated+0x33/0x230 mm/memcontrol.c:576
count_memcg_events+0xbd/0x270 mm/memcontrol.c:848
count_memcg_events_mm include/linux/memcontrol.h:978 [inline]
count_memcg_event_mm+0x14c/0x260 include/linux/memcontrol.h:985
mm_account_fault mm/memory.c:6246 [inline]
handle_mm_fault+0x50f/0x8e0 mm/memory.c:6407
do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:fault_in_readable+0x8e/0x130 mm/gup.c:2227
Code: a9 00 00 00 0f 01 cb 0f ae e8 4d 85 f6 40 0f 95 c5 4c 89 ff 4c 89 f6 e8 10 40 b9 ff 4d 39 f7 0f 97 c0 40 84 c5 74 43 4d 89 f5 <41> 8a 45 00 88 44 24 07 49 81 e5 00 f0 ff ff 4d 8d a5 00 10 00 00
RSP: 0018:ffffc90003757aa8 EFLAGS: 00050202
RAX: ffffffff8206ec01 RBX: 0000000000001000 RCX: ffff88806c28bc00
RDX: 0000000000000002 RSI: 000020000088c000 RDI: 000020000088d000
RBP: dffffc0000000001 R08: ffff88806c28bc00 R09: 0000000000000002
R10: 0000000000000001 R11: 0000000000000002 R12: 00007ffffffff000
R13: 000020000088c000 R14: 000020000088c000 R15: 000020000088d000
fault_in_iov_iter_readable+0x1b4/0x2f0 lib/iov_iter.c:94
generic_perform_write+0x7cc/0x910 mm/filemap.c:4161
shmem_file_write_iter+0xf8/0x120 mm/shmem.c:3467
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x548/0xa90 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f127178e9a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f12725b0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f12719b6080 RCX: 00007f127178e9a9
RDX: 00000000ffffff6a RSI: 0000200000000000 RDI: 0000000000000005
RBP: 00007f1271810d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f12719b6080 R15: 00007ffccaf8aff8
ip6_tunnel: ip6gretap0: Local routing loop detected!
----------------
Code disassembly (best guess):
0: 74 08 je 0xa
2: 4c 89 e7 mov %r12,%rdi
5: e8 44 40 69 00 call 0x69404e
a: 4c 89 f8 mov %r15,%rax
d: 4d 8b 7f 08 mov 0x8(%r15),%r15
11: 48 89 44 24 08 mov %rax,0x8(%rsp)
16: 4c 39 e8 cmp %r13,%rax
19: 74 2a je 0x45
1b: 49 83 c7 38 add $0x38,%r15
1f: 4c 89 f8 mov %r15,%rax
22: 48 c1 e8 03 shr $0x3,%rax
26: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 ff mov %r15,%rdi
2f: e8 1a 40 69 00 call 0x69404e
34: 49 83 3f 00 cmpq $0x0,(%r15)
38: 0f 84 24 01 00 00 je 0x162
3e: e8 .byte 0xe8
3f: eb .byte 0xeb