============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.1.21781/19777 is trying to acquire lock:
ffff888057cb6f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888057cb6f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x207/0x400 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff888022a10f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888022a10f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x365/0xc10 net/hsr/hsr_device.c:330
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
13 locks held by syz.1.21781/19777:
#0: ffff888038ca2220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:368 [inline]
#0: ffff888038ca2220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x103/0xb90 mm/mmap.c:1265
#1: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#1: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#1: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x33/0x4f0 mm/pgtable-generic.c:286
#2: ffff88803f9988b8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#2: ffff88803f9988b8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x10f/0x310 mm/pgtable-generic.c:401
#3: ffffc900006f8ca8 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0x117/0x620 kernel/time/timer.c:1744
#4: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x88/0x3e0 net/hsr/hsr_device.c:419
#5: ffff888022a10f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#5: ffff888022a10f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x365/0xc10 net/hsr/hsr_device.c:330
#6: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#6: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#6: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xa6/0x2910 net/hsr/hsr_forward.c:736
#7: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#7: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#7: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x276/0x4490 net/core/dev.c:4688
#8: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#8: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#8: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: bond_start_xmit+0xb7/0x10d0 drivers/net/bonding/bond_main.c:5577
#9: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#9: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#9: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x276/0x4490 net/core/dev.c:4688
#10: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#10: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#10: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x18d/0x1880 net/bridge/br_device.c:52
#11: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:918 [inline]
#11: ffffffff8e3c4700 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x276/0x4490 net/core/dev.c:4688
#12: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#12: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#12: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x35/0x400 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 3 UID: 0 PID: 19777 Comm: syz.1.21781 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_deadlock_bug+0x1e9/0x240 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x1106/0x1c90 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x207/0x400 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5248 [inline]
netdev_start_xmit include/linux/netdevice.h:5257 [inline]
xmit_one net/core/dev.c:3845 [inline]
dev_hard_start_xmit+0x97/0x740 net/core/dev.c:3861
__dev_queue_xmit+0xa46/0x4490 net/core/dev.c:4763
dev_queue_xmit include/linux/netdevice.h:3365 [inline]
br_dev_queue_push_xmit+0x272/0x8a0 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
br_forward_finish+0xf5/0x130 net/bridge/br_forward.c:66
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
__br_forward+0x1e5/0x5b0 net/bridge/br_forward.c:115
br_flood+0x4c4/0x650 net/bridge/br_forward.c:252
br_dev_xmit+0xf70/0x1880 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5248 [inline]
netdev_start_xmit include/linux/netdevice.h:5257 [inline]
xmit_one net/core/dev.c:3845 [inline]
dev_hard_start_xmit+0x97/0x740 net/core/dev.c:3861
__dev_queue_xmit+0xa46/0x4490 net/core/dev.c:4763
dev_queue_xmit include/linux/netdevice.h:3365 [inline]
bond_dev_queue_xmit+0xc9/0x180 drivers/net/bonding/bond_main.c:311
bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5284 [inline]
__bond_start_xmit drivers/net/bonding/bond_main.c:5551 [inline]
bond_start_xmit+0x3ba/0x10d0 drivers/net/bonding/bond_main.c:5579
__netdev_start_xmit include/linux/netdevice.h:5248 [inline]
netdev_start_xmit include/linux/netdevice.h:5257 [inline]
xmit_one net/core/dev.c:3845 [inline]
dev_hard_start_xmit+0x97/0x740 net/core/dev.c:3861
__dev_queue_xmit+0xa46/0x4490 net/core/dev.c:4763
dev_queue_xmit include/linux/netdevice.h:3365 [inline]
hsr_xmit net/hsr/hsr_forward.c:438 [inline]
hsr_forward_do net/hsr/hsr_forward.c:579 [inline]
hsr_forward_skb+0xcd3/0x2910 net/hsr/hsr_forward.c:741
send_hsr_supervision_frame+0x653/0xc10 net/hsr/hsr_device.c:364
hsr_announce+0x169/0x3e0 net/hsr/hsr_device.c:421
call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1264 [inline]
RIP: 0010:get_and_clear_full_ptes include/linux/pgtable.h:725 [inline]
RIP: 0010:zap_present_folio_ptes mm/memory.c:1628 [inline]
RIP: 0010:zap_present_ptes mm/memory.c:1710 [inline]
RIP: 0010:do_zap_pte_range mm/memory.c:1811 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1855 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1947 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1976 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1997 [inline]
RIP: 0010:unmap_page_range+0x134c/0x41b0 mm/memory.c:2018
Code: 40 20 89 c3 88 84 24 90 00 00 00 83 e3 01 e8 4b ce b2 ff 45 84 ff 0f 85 ae 06 00 00 e8 5d d3 b2 ff 31 ff 89 de e8 34 ce b2 ff <84> db 0f 84 c3 0a 00 00 e8 47 d3 b2 ff 4c 89 e8 48 c1 e8 03 42 80
RSP: 0018:ffffc90007cef5f8 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff820a155c
RDX: ffff8880313a8000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff888038ca2040 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 00007f8954cc1000
R13: ffff888013210608 R14: dffffc0000000000 R15: 0000000000000000
unmap_single_vma.constprop.0+0x153/0x240 mm/memory.c:2061
unmap_vmas+0x218/0x470 mm/memory.c:2105
exit_mmap+0x1b2/0xb90 mm/mmap.c:1280
__mmput+0x12a/0x410 kernel/fork.c:1133
mmput+0x62/0x70 kernel/fork.c:1156
exit_mm kernel/exit.c:582 [inline]
do_exit+0x7c7/0x2bf0 kernel/exit.c:954
do_group_exit+0xd3/0x2a0 kernel/exit.c:1107
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7c0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x85/0x130 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x426/0xfa0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8955f8f6c9
Code: Unable to access opcode bytes at 0x7f8955f8f69f.
RSP: 002b:00007f8956ef30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f89561e5fa8 RCX: 00007f8955f8f6c9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f89561e5fa8
RBP: 00007f89561e5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f89561e6038 R14: 00007ffe3cfbf690 R15: 00007ffe3cfbf778
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 89 c3 mov %eax,%ebx
2: 88 84 24 90 00 00 00 mov %al,0x90(%rsp)
9: 83 e3 01 and $0x1,%ebx
c: e8 4b ce b2 ff call 0xffb2ce5c
11: 45 84 ff test %r15b,%r15b
14: 0f 85 ae 06 00 00 jne 0x6c8
1a: e8 5d d3 b2 ff call 0xffb2d37c
1f: 31 ff xor %edi,%edi
21: 89 de mov %ebx,%esi
23: e8 34 ce b2 ff call 0xffb2ce5c
* 28: 84 db test %bl,%bl <-- trapping instruction
2a: 0f 84 c3 0a 00 00 je 0xaf3
30: e8 47 d3 b2 ff call 0xffb2d37c
35: 4c 89 e8 mov %r13,%rax
38: 48 c1 e8 03 shr $0x3,%rax
3c: 42 rex.X
3d: 80 .byte 0x80