============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.0.1728/11669 is trying to acquire lock:
ffff88805c2fef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88805c2fef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff888058d2ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888058d2ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
11 locks held by syz.0.1728/11669:
#0: ffff888026d1b7a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:330 [inline]
#0: ffff888026d1b7a0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x211/0x4d0 mm/util.c:579
#1: ffff88814df98420 (sb_writers#4){.+.+}-{0:0}, at: file_accessed include/linux/fs.h:2673 [inline]
#1: ffff88814df98420 (sb_writers#4){.+.+}-{0:0}, at: ext4_file_mmap_prepare+0x24d/0x440 fs/ext4/file.c:828
#2: ffffffff8e05e468 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#2: ffffffff8e05e468 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:253
#3: ffffc90000a08be0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x5f0 kernel/time/timer.c:1744
#4: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x83/0x360 net/hsr/hsr_device.c:419
#5: ffff888058d2ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#5: ffff888058d2ef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 net/hsr/hsr_device.c:330
#6: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#6: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#6: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860 net/hsr/hsr_forward.c:736
#7: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#7: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#7: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x284/0x3740 net/core/dev.c:4736
#8: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#8: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#8: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x185/0x1840 net/bridge/br_device.c:52
#9: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#9: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#9: ffffffff8df3d700 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x284/0x3740 net/core/dev.c:4736
#10: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#10: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#10: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 1 UID: 0 PID: 11669 Comm: syz.0.1728 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_deadlock_bug+0x28b/0x2a0 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain+0x1a3f/0x2140 kernel/locking/lockdep.c:3895
__lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5259 [inline]
netdev_start_xmit include/linux/netdevice.h:5268 [inline]
xmit_one net/core/dev.c:3853 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3869
__dev_queue_xmit+0x172a/0x3740 net/core/dev.c:4811
dev_queue_xmit include/linux/netdevice.h:3368 [inline]
br_dev_queue_push_xmit+0x6c5/0x890 net/bridge/br_forward.c:53
NF_HOOK+0x320/0x3c0 include/linux/netfilter.h:318
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x320/0x3c0 include/linux/netfilter.h:318
__br_forward+0x41e/0x600 net/bridge/br_forward.c:115
br_dev_xmit+0x11b3/0x1840 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5259 [inline]
netdev_start_xmit include/linux/netdevice.h:5268 [inline]
xmit_one net/core/dev.c:3853 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3869
__dev_queue_xmit+0x172a/0x3740 net/core/dev.c:4811
dev_queue_xmit include/linux/netdevice.h:3368 [inline]
hsr_xmit net/hsr/hsr_forward.c:438 [inline]
hsr_forward_do net/hsr/hsr_forward.c:579 [inline]
hsr_forward_skb+0x158b/0x2860 net/hsr/hsr_forward.c:741
send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364
hsr_announce+0x1d5/0x360 net/hsr/hsr_device.c:421
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x286/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:put_cpu_partial+0x234/0x2e0 mm/slub.c:3950
Code: 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 90 0f 0b 90 e9 e7 fe ff ff e8 89 da 2b 09 41 f7 c5 00 02 00 00 74 b2 fb 4d 85 ff <75> b1 eb ba e8 73 da 2b 09 e9 4f fe ff ff 90 0f 0b 90 e9 66 ff ff
RSP: 0018:ffffc90019e873a0 EFLAGS: 00000246
RAX: 5267c7927084d000 RBX: ffff8881416a28c0 RCX: 5267c7927084d000
RDX: 0000000000000007 RSI: ffffffff8d7102d8 RDI: ffffffff8bbf0760
RBP: 0000000000000001 R08: ffffffff8f7cfd77 R09: 1ffffffff1ef9fae
R10: dffffc0000000000 R11: fffffbfff1ef9faf R12: 0000000000000001
R13: 0000000000000286 R14: ffff8880b8942a80 R15: 0000000000000000
__slab_free+0x2b9/0x390 mm/slub.c:5929
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4978 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5295
new_handle fs/jbd2/transaction.c:457 [inline]
jbd2__journal_start+0x146/0x5b0 fs/jbd2/transaction.c:484
__ext4_journal_start_sb+0x227/0x5c0 fs/ext4/ext4_jbd2.c:115
__ext4_journal_start fs/ext4/ext4_jbd2.h:242 [inline]
ext4_dirty_inode+0x93/0x110 fs/ext4/inode.c:6514
__mark_inode_dirty+0x2ec/0xe10 fs/fs-writeback.c:2566
generic_update_time fs/inode.c:2105 [inline]
inode_update_time fs/inode.c:2118 [inline]
touch_atime+0x59b/0x6d0 fs/inode.c:2190
file_accessed include/linux/fs.h:2673 [inline]
ext4_file_mmap_prepare+0x24d/0x440 fs/ext4/file.c:828
vfs_mmap_prepare include/linux/fs.h:2410 [inline]
call_mmap_prepare mm/vma.c:2586 [inline]
__mmap_region mm/vma.c:2654 [inline]
mmap_region+0xb47/0x2110 mm/vma.c:2740
do_mmap+0xc45/0x10d0 mm/mmap.c:558
vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:581
ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb0e4d8f703
Code: f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ca 41 f7 c1 ff 0f 00 00 75 14 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 25 c3 0f 1f 40 00 48 c7 c0 a8 ff ff ff 64 c7
RSP: 002b:00007ffde4213cd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000001b30464000 RCX: 00007fb0e4d8f703
RDX: 0000000000000003 RSI: 00000000005c0000 RDI: 0000001b30464000
RBP: 0000000000600000 R08: 0000000000000004 R09: 0000000000040000
R10: 0000000000100001 R11: 0000000000000246 R12: 0000000000000176
R13: 00000000000927c0 R14: 0000000000043aeb R15: 00007ffde4213fc0
----------------
Code disassembly (best guess):
0: 41 5c pop %r12
2: 41 5d pop %r13
4: 41 5e pop %r14
6: 41 5f pop %r15
8: 5d pop %rbp
9: c3 ret
a: cc int3
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: 90 nop
10: 0f 0b ud2
12: 90 nop
13: e9 e7 fe ff ff jmp 0xfffffeff
18: e8 89 da 2b 09 call 0x92bdaa6
1d: 41 f7 c5 00 02 00 00 test $0x200,%r13d
24: 74 b2 je 0xffffffd8
26: fb sti
27: 4d 85 ff test %r15,%r15
* 2a: 75 b1 jne 0xffffffdd <-- trapping instruction
2c: eb ba jmp 0xffffffe8
2e: e8 73 da 2b 09 call 0x92bdaa6
33: e9 4f fe ff ff jmp 0xfffffe87
38: 90 nop
39: 0f 0b ud2
3b: 90 nop
3c: e9 .byte 0xe9
3d: 66 ff data16 (bad)
3f: ff .byte 0xff