============================================ WARNING: possible recursive locking detected 6.12.0-syzkaller-05480-gfcc79e1714e8 #0 Not tainted -------------------------------------------- syz.4.780/8824 is trying to acquire lock: ffff8880121eef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff8880121eef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234 but task is already holding lock: ffff88805b5cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff88805b5cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x27c/0xcc0 net/hsr/hsr_device.c:317 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&hsr->seqnr_lock); lock(&hsr->seqnr_lock); *** DEADLOCK *** May be due to missing lock nesting notation 7 locks held by syz.4.780/8824: #0: ffffc90000007c00 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1790 #1: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #1: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0xaa/0x3a0 net/hsr/hsr_device.c:406 #2: ffff88805b5cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #2: ffff88805b5cef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x27c/0xcc0 net/hsr/hsr_device.c:317 #3: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #3: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb6/0x2ac0 net/hsr/hsr_forward.c:723 #4: ffffffff8eb3c8c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #4: ffffffff8eb3c8c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline] #4: ffffffff8eb3c8c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f4/0x3f50 net/core/dev.c:4359 #5: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #5: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #5: ffffffff8eb3c860 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x21d/0x1b40 net/bridge/br_device.c:50 #6: ffffffff8eb3c8c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #6: ffffffff8eb3c8c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:901 [inline] #6: ffffffff8eb3c8c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2f4/0x3f50 net/core/dev.c:4359 stack backtrace: CPU: 0 UID: 0 PID: 8824 Comm: syz.4.780 Not tainted 6.12.0-syzkaller-05480-gfcc79e1714e8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037 check_deadlock kernel/locking/lockdep.c:3089 [inline] validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] hsr_dev_xmit+0x18a/0x210 net/hsr/hsr_device.c:234 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7e0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434 dev_queue_xmit include/linux/netdevice.h:3168 [inline] br_dev_queue_push_xmit+0x726/0x900 net/bridge/br_forward.c:53 NF_HOOK+0x3a7/0x460 include/linux/netfilter.h:314 br_forward_finish+0xd8/0x130 net/bridge/br_forward.c:66 NF_HOOK+0x3a7/0x460 include/linux/netfilter.h:314 __br_forward+0x489/0x660 net/bridge/br_forward.c:115 deliver_clone net/bridge/br_forward.c:131 [inline] maybe_deliver+0xb3/0x150 net/bridge/br_forward.c:190 br_flood+0x2e4/0x660 net/bridge/br_forward.c:236 br_dev_xmit+0x1202/0x1b40 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7e0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434 dev_queue_xmit include/linux/netdevice.h:3168 [inline] hsr_xmit net/hsr/hsr_forward.c:430 [inline] hsr_forward_do net/hsr/hsr_forward.c:571 [inline] hsr_forward_skb+0x171c/0x2ac0 net/hsr/hsr_forward.c:728 send_hsr_supervision_frame+0x63b/0xcc0 net/hsr/hsr_device.c:351 hsr_announce+0x1f8/0x3a0 net/hsr/hsr_device.c:408 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655 irq_exit_rcu+0x9/0x30 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202 Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 1a 13 8d f5 48 89 df e8 52 5a 8e f5 e8 5d 2b b9 f5 fb bf 01 00 00 00 72 c4 7f f5 65 8b 05 d3 35 20 74 85 c0 74 06 5b c3 cc cc cc cc RSP: 0018:ffffc9000f5efc70 EFLAGS: 00000282 RAX: ebcb6df0f7d52100 RBX: ffff888028d1ca00 RCX: ffffffff9a64d903 RDX: dffffc0000000000 RSI: ffffffff8c2ad300 RDI: 0000000000000001 RBP: ffffc9000f5efdb0 R08: ffffffff903f3877 R09: 1ffffffff207e70e R10: dffffc0000000000 R11: fffffbfff207e70f R12: 0000000000000021 R13: 1ffff110051a39d3 R14: ffff888028d1ce98 R15: ffff888028d1ca00 spin_unlock_irq include/linux/spinlock.h:401 [inline] get_signal+0x14ee/0x1750 kernel/signal.c:3019 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d2ea40430 Code: 10 83 e0 01 83 e2 01 88 15 ba 52 e3 00 88 05 b7 52 e3 00 c3 50 48 8d 35 16 35 1b 00 48 8d 3d 1c 35 1b 00 31 c0 e8 a0 f9 ff ff <53> 89 fb 48 83 ec 10 64 8b 04 25 94 ff ff ff 85 c0 74 2a 89 fe 31 RSP: 002b:00007f8d2f98c238 EFLAGS: 00000283 RAX: 0000000000000000 RBX: 00007f8d2f98cd50 RCX: 00007f8d2ed01140 RDX: 00007f8d2f98c240 RSI: 00007f8d2f98c370 RDI: 000000000000000b RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000073 R13: 00007f8d2f98ced0 R14: 9999999999999999 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: 90 nop 1: f3 0f 1e fa endbr64 5: 53 push %rbx 6: 48 89 fb mov %rdi,%rbx 9: 48 83 c7 18 add $0x18,%rdi d: 48 8b 74 24 08 mov 0x8(%rsp),%rsi 12: e8 1a 13 8d f5 call 0xf58d1331 17: 48 89 df mov %rbx,%rdi 1a: e8 52 5a 8e f5 call 0xf58e5a71 1f: e8 5d 2b b9 f5 call 0xf5b92b81 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 72 c4 7f f5 call 0xf57fc4a1 <-- trapping instruction 2f: 65 8b 05 d3 35 20 74 mov %gs:0x742035d3(%rip),%eax # 0x74203609 36: 85 c0 test %eax,%eax 38: 74 06 je 0x40 3a: 5b pop %rbx 3b: c3 ret 3c: cc int3 3d: cc int3 3e: cc int3 3f: cc int3