======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.2908/16851 is trying to acquire lock:
ffff88803db5ad58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
ffff88803db5ad58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4840 [inline]
ffff88803db5ad58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370

but task is already holding lock:
ffff888046051070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
ffff888046051070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3cd/0xcf0 net/hsr/hsr_device.c:330

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&hsr->seqnr_lock){+.-.}-{3:3}:
       __raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
       _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
       spin_lock_bh include/linux/spinlock.h:353 [inline]
       hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
       __netdev_start_xmit include/linux/netdevice.h:5430 [inline]
       netdev_start_xmit include/linux/netdevice.h:5439 [inline]
       xmit_one net/core/dev.c:3972 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3988
       __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4961
       NF_HOOK+0x33a/0x3c0 include/linux/netfilter.h:-1
       arp_xmit+0x16c/0x270 net/ipv4/arp.c:668
       arp_solicit+0xbdc/0xe40 net/ipv4/arp.c:395
       neigh_probe net/core/neighbour.c:1087 [inline]
       __neigh_event_send+0xf0c/0x1510 net/core/neighbour.c:1267
       neigh_event_send_probe include/net/neighbour.h:474 [inline]
       neigh_event_send include/net/neighbour.h:480 [inline]
       neigh_resolve_output+0x1a1/0x720 net/core/neighbour.c:1604
       neigh_output include/net/neighbour.h:554 [inline]
       ip_finish_output2+0xc4b/0x10b0 net/ipv4/ip_output.c:236
       NF_HOOK_COND include/linux/netfilter.h:314 [inline]
       ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
       iptunnel_xmit+0x626/0xd10 net/ipv4/ip_tunnel_core.c:97
       ip_tunnel_xmit+0x195b/0x2040 net/ipv4/ip_tunnel.c:852
       erspan_xmit+0xb6a/0x1620 net/ipv4/ip_gre.c:752
       __netdev_start_xmit include/linux/netdevice.h:5430 [inline]
       netdev_start_xmit include/linux/netdevice.h:5439 [inline]
       xmit_one net/core/dev.c:3972 [inline]
       dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3988
       sch_direct_xmit+0x257/0x4c0 net/sched/sch_generic.c:372
       __dev_xmit_skb net/core/dev.c:4297 [inline]
       __dev_queue_xmit+0x177f/0x3820 net/core/dev.c:4919
       dev_queue_xmit include/linux/netdevice.h:3459 [inline]
       alb_send_lp_vid+0x348/0x550 drivers/net/bonding/bond_alb.c:968
       alb_send_learning_packets+0x12c/0x300 drivers/net/bonding/bond_alb.c:1031
       bond_alb_monitor+0x3da/0x1840 drivers/net/bonding/bond_alb.c:1611
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x480 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #0 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3209 [inline]
       check_prevs_add kernel/locking/lockdep.c:3328 [inline]
       validate_chain kernel/locking/lockdep.c:3952 [inline]
       __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
       __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
       spin_lock include/linux/spinlock.h:347 [inline]
       __netif_tx_lock include/linux/netdevice.h:4840 [inline]
       sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
       __dev_xmit_skb net/core/dev.c:4297 [inline]
       __dev_queue_xmit+0x177f/0x3820 net/core/dev.c:4919
       dev_queue_xmit include/linux/netdevice.h:3459 [inline]
       hsr_xmit net/hsr/hsr_forward.c:440 [inline]
       hsr_forward_do net/hsr/hsr_forward.c:603 [inline]
       hsr_forward_skb+0x1701/0x2b70 net/hsr/hsr_forward.c:777
       send_hsr_supervision_frame+0x733/0xcf0 net/hsr/hsr_device.c:364
       hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:448
       call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
       expire_timers kernel/time/timer.c:1799 [inline]
       __run_timers kernel/time/timer.c:2374 [inline]
       __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
       run_timer_base kernel/time/timer.c:2395 [inline]
       run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
       handle_softirqs+0x226/0x860 kernel/softirq.c:645
       do_softirq+0x77/0xd0 kernel/softirq.c:546
       __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
       local_bh_enable include/linux/bottom_half.h:33 [inline]
       rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
       __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4996
       dev_queue_xmit include/linux/netdevice.h:3459 [inline]
       neigh_hh_output include/net/neighbour.h:538 [inline]
       neigh_output include/net/neighbour.h:552 [inline]
       ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
       NF_HOOK_COND include/linux/netfilter.h:314 [inline]
       ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
       __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533
       l2tp_ip_sendmsg+0x68d/0x1630 net/l2tp/l2tp_ip.c:520
       sock_sendmsg_nosec+0x10f/0x190 net/socket.c:801
       __sock_sendmsg net/socket.c:818 [inline]
       ____sys_sendmsg+0x54e/0x850 net/socket.c:2715
       ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769
       __sys_sendmmsg+0x273/0x4d0 net/socket.c:2858
       __do_sys_sendmmsg net/socket.c:2885 [inline]
       __se_sys_sendmmsg net/socket.c:2882 [inline]
       __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2882
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&hsr->seqnr_lock);
                               lock(&qdisc_xmit_lock_key#4);
                               lock(&hsr->seqnr_lock);
  lock(&qdisc_xmit_lock_key#4);

 *** DEADLOCK ***

locks held by syz.0.2908/16851: 11, last CPU#1:
 #0: ffff888057673360 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff888057673360 (sk_lock-AF_INET){+.+.}-{0:0}, at: l2tp_ip_sendmsg+0x34/0x1630 net/l2tp/l2tp_ip.c:433
 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: l2tp_ip_sendmsg+0x435/0x1630 net/l2tp/l2tp_ip.c:488
 #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x65/0x1b10 net/ipv4/ip_output.c:476
 #3: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 net/ipv4/ip_output.c:432
 #4: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #4: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #4: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x10b0 net/ipv4/ip_output.c:229
 #5: ffffc90000a18d00 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
 #6: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #6: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #6: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 net/hsr/hsr_device.c:446
 #7: ffff888046051070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
 #7: ffff888046051070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3cd/0xcf0 net/hsr/hsr_device.c:330
 #8: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #8: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #8: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb9/0x2b70 net/hsr/hsr_forward.c:772
 #9: ffffffff8ed5c980 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #9: ffffffff8ed5c980 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
 #9: ffffffff8ed5c980 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3820 net/core/dev.c:4879
 #10: ffff88801f6f5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:359 [inline]
 #10: ffff88801f6f5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:206 [inline]
 #10: ffff88801f6f5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4284 [inline]
 #10: ffff88801f6f5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x1143/0x3820 net/core/dev.c:4919

stack backtrace:
CPU: 1 UID: 0 PID: 16851 Comm: syz.0.2908 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
 check_prev_add kernel/locking/lockdep.c:3209 [inline]
 check_prevs_add kernel/locking/lockdep.c:3328 [inline]
 validate_chain kernel/locking/lockdep.c:3952 [inline]
 __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
 spin_lock include/linux/spinlock.h:347 [inline]
 __netif_tx_lock include/linux/netdevice.h:4840 [inline]
 sch_direct_xmit+0x15f/0x4c0 net/sched/sch_generic.c:370
 __dev_xmit_skb net/core/dev.c:4297 [inline]
 __dev_queue_xmit+0x177f/0x3820 net/core/dev.c:4919
 dev_queue_xmit include/linux/netdevice.h:3459 [inline]
 hsr_xmit net/hsr/hsr_forward.c:440 [inline]
 hsr_forward_do net/hsr/hsr_forward.c:603 [inline]
 hsr_forward_skb+0x1701/0x2b70 net/hsr/hsr_forward.c:777
 send_hsr_supervision_frame+0x733/0xcf0 net/hsr/hsr_device.c:364
 hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:448
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4996
 dev_queue_xmit include/linux/netdevice.h:3459 [inline]
 neigh_hh_output include/net/neighbour.h:538 [inline]
 neigh_output include/net/neighbour.h:552 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533
 l2tp_ip_sendmsg+0x68d/0x1630 net/l2tp/l2tp_ip.c:520
 sock_sendmsg_nosec+0x10f/0x190 net/socket.c:801
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2715
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769
 __sys_sendmmsg+0x273/0x4d0 net/socket.c:2858
 __do_sys_sendmmsg net/socket.c:2885 [inline]
 __se_sys_sendmmsg net/socket.c:2882 [inline]
 __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2882
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fde8c39e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fde8a5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007fde8c626090 RCX: 00007fde8c39e159
RDX: 00000000040000cf RSI: 0000200000000900 RDI: 0000000000000007
RBP: 00007fde8c43506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fde8c626128 R14: 00007fde8c626090 R15: 00007ffcd90a35a8
 </TASK>