============================================
WARNING: possible recursive locking detected
6.15.0-rc4-syzkaller-00808-ga7371be8c8f5 #0 Not tainted
--------------------------------------------
syz.1.1002/9453 is trying to acquire lock:
ffff88805cf66f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88805cf66f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
but task is already holding lock:
ffff88805825cf30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
ffff88805825cf30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
12 locks held by syz.1.1002/9453:
#0: ffff888059a73208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:867 [inline]
#0: ffff888059a73208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release net/socket.c:646 [inline]
#0: ffff888059a73208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 net/socket.c:1391
#1: ffff888058186258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1651 [inline]
#1: ffff888058186258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_release+0x798/0xce0 net/packet/af_packet.c:3203
#2: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#2: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#2: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
#2: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa5/0x2390 arch/x86/kernel/unwind_orc.c:479
#3: ffffc90000007be0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x5f0 kernel/time/timer.c:1786
#4: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#4: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x208/0x1400 net/ipv6/ndisc.c:484
#5: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#5: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#5: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x701/0x16a0 net/ipv6/ip6_output.c:126
#6: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#6: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#6: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70 net/core/dev.c:4606
#7: ffff88805825cf30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#7: ffff88805825cf30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
#8: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#8: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#8: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860 net/hsr/hsr_forward.c:728
#9: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#9: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#9: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70 net/core/dev.c:4606
#10: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#10: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#10: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x185/0x1840 net/bridge/br_device.c:52
#11: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#11: ffffffff8df3b8c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70 net/core/dev.c:4606
stack backtrace:
CPU: 0 UID: 0 PID: 9453 Comm: syz.1.1002 Not tainted 6.15.0-rc4-syzkaller-00808-ga7371be8c8f5 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_deadlock_bug+0x28b/0x2a0 kernel/locking/lockdep.c:3042
check_deadlock kernel/locking/lockdep.c:3094 [inline]
validate_chain+0x1a3f/0x2140 kernel/locking/lockdep.c:3896
__lock_acquire+0xaac/0xd20 kernel/locking/lockdep.c:5235
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5866
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
hsr_dev_xmit+0x19a/0x220 net/hsr/hsr_device.c:234
__netdev_start_xmit include/linux/netdevice.h:5203 [inline]
netdev_start_xmit include/linux/netdevice.h:5212 [inline]
xmit_one net/core/dev.c:3828 [inline]
dev_hard_start_xmit+0x2d4/0x830 net/core/dev.c:3844
__dev_queue_xmit+0x1adf/0x3a70 net/core/dev.c:4681
dev_queue_xmit include/linux/netdevice.h:3349 [inline]
br_dev_queue_push_xmit+0x6c5/0x890 net/bridge/br_forward.c:53
NF_HOOK+0x31d/0x3c0 include/linux/netfilter.h:314
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
NF_HOOK+0x31d/0x3c0 include/linux/netfilter.h:314
__br_forward+0x41e/0x600 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xb5/0x160 net/bridge/br_forward.c:190
br_flood+0x31a/0x6a0 net/bridge/br_forward.c:237
br_dev_xmit+0x11b3/0x1840 net/bridge/br_device.c:108
__netdev_start_xmit include/linux/netdevice.h:5203 [inline]
netdev_start_xmit include/linux/netdevice.h:5212 [inline]
xmit_one net/core/dev.c:3828 [inline]
dev_hard_start_xmit+0x2d4/0x830 net/core/dev.c:3844
__dev_queue_xmit+0x1adf/0x3a70 net/core/dev.c:4681
dev_queue_xmit include/linux/netdevice.h:3349 [inline]
hsr_xmit net/hsr/hsr_forward.c:430 [inline]
hsr_forward_do net/hsr/hsr_forward.c:571 [inline]
hsr_forward_skb+0x158b/0x2860 net/hsr/hsr_forward.c:733
hsr_dev_xmit+0x1a5/0x220 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5203 [inline]
netdev_start_xmit include/linux/netdevice.h:5212 [inline]
xmit_one net/core/dev.c:3828 [inline]
dev_hard_start_xmit+0x2d4/0x830 net/core/dev.c:3844
__dev_queue_xmit+0x1adf/0x3a70 net/core/dev.c:4681
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xb47/0x1400 net/ipv6/ndisc.c:513
addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4038
call_timer_fn+0x17b/0x5f0 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2445
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:55 [inline]
RIP: 0010:stack_access_ok arch/x86/kernel/unwind_orc.c:393 [inline]
RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:403 [inline]
RIP: 0010:unwind_next_frame+0xabc/0x2390 arch/x86/kernel/unwind_orc.c:585
Code: 76 01 83 e6 07 83 fe 04 4c 89 64 24 10 0f 84 49 04 00 00 83 fe 03 0f 84 f3 01 00 00 83 fe 02 0f 85 a1 07 00 00 4c 89 7c 24 28 <4d> 8d 7e 08 4c 89 fd 48 c1 ed 03 48 b8 00 00 00 00 00 fc ff df 80
RSP: 0018:ffffc9001af17618 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff909fa905 RCX: ffffffff8ff42020
RDX: ffffffff909fa900 RSI: 0000000000000002 RDI: ffffffff8bc1cfc0
RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff817199f5 R12: ffffc9001af17d28
R13: ffffc9001af17738 R14: ffffc9001af176e8 R15: 1ffffffff213f520
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
save_stack+0xf7/0x1f0 mm/page_owner.c:156
__reset_page_owner+0x71/0x1f0 mm/page_owner.c:308
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1258 [inline]
__free_frozen_pages+0xb14/0xce0 mm/page_alloc.c:2721
free_pg_vec net/packet/af_packet.c:4396 [inline]
packet_set_ring+0x1899/0x2380 net/packet/af_packet.c:4615
packet_release+0x83e/0xce0 net/packet/af_packet.c:3211
__sock_release net/socket.c:647 [inline]
sock_close+0xc0/0x240 net/socket.c:1391
__fput+0x449/0xa70 fs/file_table.c:465
task_work_run+0x1d1/0x260 kernel/task_work.c:227
resume_user_mode_work+0x5e/0x80 include/linux/resume_user_mode.h:50
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x9a/0x120 kernel/entry/common.c:218
do_syscall_64+0x103/0x210 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f919998e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd866cb6b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f9199bb7ba0 RCX: 00007f919998e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f9199bb7ba0 R08: 0000000000000200 R09: 0000001d866cb9af
R10: 00000000003ffbdc R11: 0000000000000246 R12: 000000000004d9b8
R13: 00007f9199bb6160 R14: ffffffffffffffff R15: 00007ffd866cb7d0
----------------
Code disassembly (best guess):
0: 76 01 jbe 0x3
2: 83 e6 07 and $0x7,%esi
5: 83 fe 04 cmp $0x4,%esi
8: 4c 89 64 24 10 mov %r12,0x10(%rsp)
d: 0f 84 49 04 00 00 je 0x45c
13: 83 fe 03 cmp $0x3,%esi
16: 0f 84 f3 01 00 00 je 0x20f
1c: 83 fe 02 cmp $0x2,%esi
1f: 0f 85 a1 07 00 00 jne 0x7c6
25: 4c 89 7c 24 28 mov %r15,0x28(%rsp)
* 2a: 4d 8d 7e 08 lea 0x8(%r14),%r15 <-- trapping instruction
2e: 4c 89 fd mov %r15,%rbp
31: 48 c1 ed 03 shr $0x3,%rbp
35: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3c: fc ff df
3f: 80 .byte 0x80