============================================
WARNING: possible recursive locking detected
6.8.0-syzkaller-05204-g237bb5f7f7f5 #0 Not tainted
--------------------------------------------
klogd/4510 is trying to acquire lock:
ffff88805d6993e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff88805d6993e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_ip6_multicast_query net/bridge/br_multicast.c:3523 [inline]
ffff88805d6993e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_ipv6_rcv net/bridge/br_multicast.c:3919 [inline]
ffff88805d6993e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_rcv+0x30e2/0x8180 net/bridge/br_multicast.c:3974
but task is already holding lock:
ffff88806a4e53e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff88806a4e53e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x64/0x3b0 net/bridge/br_multicast.c:1905
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&br->multicast_lock);
lock(&br->multicast_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
5 locks held by klogd/4510:
#0: ffffc90000007c00 ((&pmctx->ip6_own_query.timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1789
#1: ffff88806a4e53e0 (&br->multicast_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#1: ffff88806a4e53e0 (&br->multicast_lock){+.-.}-{2:2}, at: br_multicast_port_query_expired+0x64/0x3b0 net/bridge/br_multicast.c:1905
#2: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#2: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#2: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4260
#3: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#3: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline]
#3: ffffffff8e131980 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4260
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#4: ffffffff8e131920 (rcu_read_lock){....}-{1:2}, at: br_dev_xmit+0x1b9/0x1a10 net/bridge/br_device.c:44
stack backtrace:
CPU: 0 PID: 4510 Comm: klogd Not tainted 6.8.0-syzkaller-05204-g237bb5f7f7f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
check_deadlock kernel/locking/lockdep.c:3062 [inline]
validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
br_ip6_multicast_query net/bridge/br_multicast.c:3523 [inline]
br_multicast_ipv6_rcv net/bridge/br_multicast.c:3919 [inline]
br_multicast_rcv+0x30e2/0x8180 net/bridge/br_multicast.c:3974
br_dev_xmit+0xb17/0x1a10 net/bridge/br_device.c:90
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x26a/0x790 net/core/dev.c:3547
__dev_queue_xmit+0x19f4/0x3b10 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
vlan_dev_hard_start_xmit+0x36c/0x5f0 net/8021q/vlan_dev.c:125
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x26a/0x790 net/core/dev.c:3547
__dev_queue_xmit+0x19f4/0x3b10 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
br_dev_queue_push_xmit+0x701/0x8d0 net/bridge/br_forward.c:53
NF_HOOK include/linux/netfilter.h:314 [inline]
__br_multicast_send_query+0x2ecb/0x4750 net/bridge/br_multicast.c:1809
br_multicast_send_query+0x4ee/0x6b0 net/bridge/br_multicast.c:1888
br_multicast_port_query_expired+0x2d4/0x3b0 net/bridge/br_multicast.c:1913
call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2408 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
run_timer_base kernel/time/timer.c:2428 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
__do_softirq+0x2bc/0x943 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:finish_task_switch+0x1ea/0x870 kernel/sched/core.c:5283
Code: c9 50 e8 19 ae 0b 00 48 83 c4 08 4c 89 f7 e8 1d 38 00 00 0f 1f 44 00 00 4c 89 f7 e8 b0 cb 14 0a e8 ab 34 36 00 fb 48 8b 5d c0 <48> 8d bb f0 15 00 00 48 89 f8 48 c1 e8 03 49 be 00 00 00 00 00 fc
RSP: 0018:ffffc9000319f808 EFLAGS: 00000286
RAX: 0f7396137a8b1200 RBX: ffff88807cb65a00 RCX: ffffffff944bf403
RDX: dffffc0000000000 RSI: ffffffff8baac220 RDI: ffffffff8bfec660
RBP: ffffc9000319f850 R08: ffffffff8f86ae6f R09: 1ffffffff1f0d5cd
R10: dffffc0000000000 R11: fffffbfff1f0d5ce R12: 1ffff11017287dd7
R13: dffffc0000000000 R14: ffff8880b943e140 R15: ffff8880b943eeb8
context_switch kernel/sched/core.c:5412 [inline]
__schedule+0x17db/0x4a20 kernel/sched/core.c:6736
__schedule_loop kernel/sched/core.c:6813 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6828
syslog_print+0x2a3/0x9c0 kernel/printk/printk.c:1565
do_syslog+0x3bb/0x810 kernel/printk/printk.c:1717
__do_sys_syslog kernel/printk/printk.c:1809 [inline]
__se_sys_syslog kernel/printk/printk.c:1807 [inline]
__x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1807
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7fb71c1cafa7
Code: 73 01 c3 48 8b 0d 81 ce 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 67 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 51 ce 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffdb320a8d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000067
RAX: ffffffffffffffda RBX: 00007fb71c3694a0 RCX: 00007fb71c1cafa7
RDX: 00000000000003ff RSI: 00007fb71c3694a0 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000007 R09: de8d0105f0ac6e85
R10: 0000000000004000 R11: 0000000000000206 R12: 00007fb71c3694a0
R13: 00007fb71c359212 R14: 00007fb71c369516 R15: 00007fb71c369516
----------------
Code disassembly (best guess):
0: c9 leave
1: 50 push %rax
2: e8 19 ae 0b 00 call 0xbae20
7: 48 83 c4 08 add $0x8,%rsp
b: 4c 89 f7 mov %r14,%rdi
e: e8 1d 38 00 00 call 0x3830
13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
18: 4c 89 f7 mov %r14,%rdi
1b: e8 b0 cb 14 0a call 0xa14cbd0
20: e8 ab 34 36 00 call 0x3634d0
25: fb sti
26: 48 8b 5d c0 mov -0x40(%rbp),%rbx
* 2a: 48 8d bb f0 15 00 00 lea 0x15f0(%rbx),%rdi <-- trapping instruction
31: 48 89 f8 mov %rdi,%rax
34: 48 c1 e8 03 shr $0x3,%rax
38: 49 rex.WB
39: be 00 00 00 00 mov $0x0,%esi
3e: 00 fc add %bh,%ah