============================================ WARNING: possible recursive locking detected 6.9.0-rc6-syzkaller-01461-g5829614a7b3b #0 Not tainted -------------------------------------------- swapper/1/0 is trying to acquire lock: ffff888075082e00 (&hsr->seqnr_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff888075082e00 (&hsr->seqnr_lock){+.-.}-{2:2}, at: hsr_dev_xmit+0x13e/0x1d0 net/hsr/hsr_device.c:231 but task is already holding lock: ffff8880116d0e00 (&hsr->seqnr_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] ffff8880116d0e00 (&hsr->seqnr_lock){+.-.}-{2:2}, at: send_hsr_supervision_frame+0x27a/0xce0 net/hsr/hsr_device.c:313 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&hsr->seqnr_lock); lock(&hsr->seqnr_lock); *** DEADLOCK *** May be due to missing lock nesting notation 7 locks held by swapper/1/0: #0: ffffc90000a08c00 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1790 #1: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #1: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #1: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: hsr_announce+0xa3/0x370 net/hsr/hsr_device.c:400 #2: ffff8880116d0e00 (&hsr->seqnr_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #2: ffff8880116d0e00 (&hsr->seqnr_lock){+.-.}-{2:2}, at: send_hsr_supervision_frame+0x27a/0xce0 net/hsr/hsr_device.c:313 #3: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #3: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #3: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: hsr_forward_skb+0xae/0x2680 net/hsr/hsr_forward.c:681 #4: ffffffff8e334f00 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #4: ffffffff8e334f00 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:833 [inline] #4: ffffffff8e334f00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2d2/0x3d30 net/core/dev.c:4319 #5: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #5: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #5: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: br_dev_xmit+0x1b9/0x1a10 net/bridge/br_device.c:44 #6: ffffffff8e334f00 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #6: ffffffff8e334f00 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:833 [inline] #6: ffffffff8e334f00 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2d2/0x3d30 net/core/dev.c:4319 stack backtrace: CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.9.0-rc6-syzkaller-01461-g5829614a7b3b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_deadlock kernel/locking/lockdep.c:3062 [inline] validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline] _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:356 [inline] hsr_dev_xmit+0x13e/0x1d0 net/hsr/hsr_device.c:231 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3579 [inline] dev_hard_start_xmit+0x27a/0x7e0 net/core/dev.c:3595 __dev_queue_xmit+0x1b0e/0x3d30 net/core/dev.c:4394 dev_queue_xmit include/linux/netdevice.h:3094 [inline] br_dev_queue_push_xmit+0x701/0x8d0 net/bridge/br_forward.c:53 NF_HOOK+0x3a7/0x460 include/linux/netfilter.h:314 br_forward_finish+0xe5/0x140 net/bridge/br_forward.c:66 NF_HOOK+0x3a7/0x460 include/linux/netfilter.h:314 __br_forward+0x489/0x660 net/bridge/br_forward.c:115 deliver_clone net/bridge/br_forward.c:131 [inline] maybe_deliver+0xb3/0x150 net/bridge/br_forward.c:190 br_flood+0x2e4/0x660 net/bridge/br_forward.c:236 br_dev_xmit+0x118c/0x1a10 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3579 [inline] dev_hard_start_xmit+0x27a/0x7e0 net/core/dev.c:3595 __dev_queue_xmit+0x1b0e/0x3d30 net/core/dev.c:4394 dev_queue_xmit include/linux/netdevice.h:3094 [inline] hsr_xmit net/hsr/hsr_forward.c:389 [inline] hsr_forward_do net/hsr/hsr_forward.c:529 [inline] hsr_forward_skb+0x170d/0x2680 net/hsr/hsr_forward.c:686 send_hsr_supervision_frame+0x660/0xce0 net/hsr/hsr_device.c:346 hsr_announce+0x1a9/0x370 net/hsr/hsr_device.c:402 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:72 [inline] RIP: 0010:acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:113 Code: 90 90 90 90 90 90 90 90 90 65 48 8b 04 25 c0 d3 03 00 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d c5 ac a6 00 f3 0f 1e fa fb f4 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffc90000197d08 EFLAGS: 00000246 RAX: ffff8880172c5a00 RBX: ffff888017aeb864 RCX: 000000000001f6f1 RDX: 0000000000000001 RSI: ffff888017aeb800 RDI: ffff888017aeb864 RBP: 000000000003a478 R08: ffff8880b9537ccb R09: 1ffff110172a6f99 R10: dffffc0000000000 R11: ffffffff8b82a030 R12: ffff88801af17000 R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8eac4160 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707 cpuidle_enter_state+0x112/0x480 drivers/cpuidle/cpuidle.c:267 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:388 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x375/0x5d0 kernel/sched/idle.c:332 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:430 start_secondary+0x100/0x100 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x147 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 65 48 8b 04 25 c0 d3 mov %gs:0x3d3c0,%rax 10: 03 00 12: 48 f7 00 08 00 00 00 testq $0x8,(%rax) 19: 75 10 jne 0x2b 1b: 66 90 xchg %ax,%ax 1d: 0f 00 2d c5 ac a6 00 verw 0xa6acc5(%rip) # 0xa6ace9 24: f3 0f 1e fa endbr64 28: fb sti 29: f4 hlt * 2a: fa cli <-- trapping instruction 2b: c3 ret 2c: cc int3 2d: cc int3 2e: cc int3 2f: cc int3 30: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) 37: 00 00 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop