============================================
WARNING: possible recursive locking detected
6.16.0-rc5-syzkaller-01402-gb06c4311711c #0 Not tainted
--------------------------------------------
syz.2.1664/11476 is trying to acquire lock:
ffff88806d60cf30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88806d60cf30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
but task is already holding lock:
ffff888023c84f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff888023c84f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
14 locks held by syz.2.1664/11476:
#0: ffff8880115b6fe0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline]
#0: ffff8880115b6fe0 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x16f/0x380 mm/gup.c:2008
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: do_fault_around mm/memory.c:5547 [inline]
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: do_read_fault mm/memory.c:5581 [inline]
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: do_fault mm/memory.c:5724 [inline]
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: do_pte_missing mm/memory.c:4251 [inline]
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: handle_pte_fault mm/memory.c:6069 [inline]
#1: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: __handle_mm_fault+0x296f/0x5620 mm/memory.c:6212
#2: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#2: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#2: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: filemap_map_pages+0x14b/0x1740 mm/filemap.c:3713
#3: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#3: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#3: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x29/0x2c0 mm/pgtable-generic.c:287
#4: ffff888078893cd8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffff888078893cd8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x13e/0x210 mm/pgtable-generic.c:402
#5: ffffc90000007be0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x5f0 kernel/time/timer.c:1744
#6: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#6: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#6: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x20c/0x1440 net/ipv6/ndisc.c:482
#7: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#7: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#7: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x701/0x16a0 net/ipv6/ip6_output.c:126
#8: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#8: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#8: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27b/0x3b50 net/core/dev.c:4637
#9: ffff888023c84f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#9: ffff888023c84f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
#10: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#10: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#10: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860 net/hsr/hsr_forward.c:728
#11: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#11: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27b/0x3b50 net/core/dev.c:4637
#12: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#12: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#12: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x185/0x1840 net/bridge/br_device.c:52
#13: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#13: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#13: ffffffff8e13f1c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27b/0x3b50 net/core/dev.c:4637
stack backtrace:
CPU: 0 UID: 0 PID: 11476 Comm: syz.2.1664 Not tainted 6.16.0-rc5-syzkaller-01402-gb06c4311711c #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_deadlock_bug+0x28b/0x2a0 kernel/locking/lockdep.c:3044
check_deadlock kernel/locking/lockdep.c:3096 [inline]
validate_chain+0x1a3f/0x2140 kernel/locking/lockdep.c:3898
__lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
__netdev_start_xmit include/linux/netdevice.h:5217 [inline]
netdev_start_xmit include/linux/netdevice.h:5226 [inline]
xmit_one net/core/dev.c:3826 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3842
__dev_queue_xmit+0x1b8d/0x3b50 net/core/dev.c:4712
dev_queue_xmit include/linux/netdevice.h:3358 [inline]
br_dev_queue_push_xmit+0x6c5/0x890 net/bridge/br_forward.c:53
NF_HOOK+0x31d/0x3c0 include/linux/netfilter.h:317
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x31d/0x3c0 include/linux/netfilter.h:317
__br_forward+0x41e/0x600 net/bridge/br_forward.c:115
br_dev_xmit+0x11b3/0x1840 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5217 [inline]
netdev_start_xmit include/linux/netdevice.h:5226 [inline]
xmit_one net/core/dev.c:3826 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3842
__dev_queue_xmit+0x1b8d/0x3b50 net/core/dev.c:4712
dev_queue_xmit include/linux/netdevice.h:3358 [inline]
hsr_xmit net/hsr/hsr_forward.c:430 [inline]
hsr_forward_do net/hsr/hsr_forward.c:571 [inline]
hsr_forward_skb+0x158b/0x2860 net/hsr/hsr_forward.c:733
hsr_dev_xmit+0x1a5/0x220 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5217 [inline]
netdev_start_xmit include/linux/netdevice.h:5226 [inline]
xmit_one net/core/dev.c:3826 [inline]
dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3842
__dev_queue_xmit+0x1b8d/0x3b50 net/core/dev.c:4712
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
NF_HOOK include/linux/netfilter.h:317 [inline]
ndisc_send_skb+0xb54/0x1440 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4032
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_is_held_type+0x137/0x190 kernel/locking/lockdep.c:5948
Code: 01 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 4c 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 05 19 13 30 07 <48> 3b 44 24 08 75 43 89 d8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffffc9000f0d74c8 EFLAGS: 00000206
RAX: 487a2580722d7d00 RBX: 0000000000000000 RCX: 487a2580722d7d00
RDX: ffff88801e751e00 RSI: ffffffff8db8e292 RDI: ffffffff8be29e00
RBP: 00000000ffffffff R08: ffffea00010a8837 R09: 1ffffd4000215106
R10: dffffc0000000000 R11: fffff94000215107 R12: 0000000000000246
R13: ffff88801e751e00 R14: ffff88806d899758 R15: 0000000000000005
lock_is_held include/linux/lockdep.h:249 [inline]
xa_entry include/linux/xarray.h:1226 [inline]
xas_next_entry+0x1de/0x3d0 include/linux/xarray.h:1731
next_uptodate_folio+0x32/0x5d0 mm/filemap.c:3562
filemap_map_pages+0x1025/0x1740 mm/filemap.c:3755
do_fault_around mm/memory.c:5548 [inline]
do_read_fault mm/memory.c:5581 [inline]
do_fault mm/memory.c:5724 [inline]
do_pte_missing mm/memory.c:4251 [inline]
handle_pte_fault mm/memory.c:6069 [inline]
__handle_mm_fault+0x368a/0x5620 mm/memory.c:6212
handle_mm_fault+0x40a/0x8e0 mm/memory.c:6381
faultin_page mm/gup.c:1186 [inline]
__get_user_pages+0x1af4/0x30b0 mm/gup.c:1488
populate_vma_page_range+0x26b/0x340 mm/gup.c:1926
__mm_populate+0x24c/0x380 mm/gup.c:2029
mm_populate include/linux/mm.h:3348 [inline]
vm_mmap_pgoff+0x3f0/0x4c0 mm/util.c:584
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa612f8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa613e8b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fa6131b6080 RCX: 00007fa612f8e929
RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000200000000000
RBP: 00007fa613010b39 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa6131b6080 R15: 00007fff0b19d9a8
----------------
Code disassembly (best guess):
0: 01 75 44 add %esi,0x44(%rbp)
3: 48 c7 04 24 00 00 00 movq $0x0,(%rsp)
a: 00
b: 9c pushf
c: 8f 04 24 pop (%rsp)
f: f7 04 24 00 02 00 00 testl $0x200,(%rsp)
16: 75 4c jne 0x64
18: 41 f7 c4 00 02 00 00 test $0x200,%r12d
1f: 74 01 je 0x22
21: fb sti
22: 65 48 8b 05 19 13 30 mov %gs:0x7301319(%rip),%rax # 0x7301343
29: 07
* 2a: 48 3b 44 24 08 cmp 0x8(%rsp),%rax <-- trapping instruction
2f: 75 43 jne 0x74
31: 89 d8 mov %ebx,%eax
33: 48 83 c4 10 add $0x10,%rsp
37: 5b pop %rbx
38: 41 5c pop %r12
3a: 41 5d pop %r13
3c: 41 5e pop %r14
3e: 41 5f pop %r15