[ 462.416402] device bridge_slave_1 left promiscuous mode [ 462.422346] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.487155] device bridge_slave_0 left promiscuous mode [ 462.492648] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.606462] device hsr_slave_1 left promiscuous mode [ 462.647055] device hsr_slave_0 left promiscuous mode [ 462.688257] team0 (unregistering): Port device team_slave_1 removed [ 462.698588] team0 (unregistering): Port device team_slave_0 removed [ 462.708461] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 462.749933] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 462.811178] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.0.30' (ECDSA) to the list of known hosts. [ 467.464737] device bridge_slave_1 left promiscuous mode [ 467.470233] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.514452] device bridge_slave_0 left promiscuous mode [ 467.519926] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.555170] device bridge_slave_1 left promiscuous mode [ 467.560759] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.614448] device bridge_slave_0 left promiscuous mode [ 467.619946] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.675019] device bridge_slave_1 left promiscuous mode [ 467.680491] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.714416] device bridge_slave_0 left promiscuous mode [ 467.719866] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.764794] device bridge_slave_1 left promiscuous mode [ 467.770259] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.805460] device bridge_slave_0 left promiscuous mode [ 467.810918] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.855322] device bridge_slave_1 left promiscuous mode [ 467.860797] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.914466] device bridge_slave_0 left promiscuous mode [ 467.919945] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.125272] device hsr_slave_1 left promiscuous mode [ 468.165838] device hsr_slave_0 left promiscuous mode [ 468.206065] team0 (unregistering): Port device team_slave_1 removed [ 468.215462] team0 (unregistering): Port device team_slave_0 removed [ 468.223831] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.266645] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.329947] bond0 (unregistering): Released all slaves [ 468.415358] device hsr_slave_1 left promiscuous mode [ 468.455703] device hsr_slave_0 left promiscuous mode [ 468.495990] team0 (unregistering): Port device team_slave_1 removed [ 468.506722] team0 (unregistering): Port device team_slave_0 removed [ 468.515659] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.556907] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.609983] bond0 (unregistering): Released all slaves [ 468.704999] device hsr_slave_1 left promiscuous mode [ 468.756957] device hsr_slave_0 left promiscuous mode [ 468.797449] team0 (unregistering): Port device team_slave_1 removed [ 468.806108] team0 (unregistering): Port device team_slave_0 removed [ 468.816628] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.866974] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.928742] bond0 (unregistering): Released all slaves [ 469.014970] device hsr_slave_1 left promiscuous mode [ 469.056155] device hsr_slave_0 left promiscuous mode [ 469.095944] team0 (unregistering): Port device team_slave_1 removed [ 469.105765] team0 (unregistering): Port device team_slave_0 removed [ 469.114748] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 469.157526] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 469.218334] bond0 (unregistering): Released all slaves [ 469.325001] device hsr_slave_1 left promiscuous mode [ 469.365604] device hsr_slave_0 left promiscuous mode [ 469.416842] team0 (unregistering): Port device team_slave_1 removed [ 469.425801] team0 (unregistering): Port device team_slave_0 removed [ 469.436920] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 469.485959] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 469.549412] bond0 (unregistering): Released all slaves [ 473.913805] IPVS: ftp: loaded support on port[0] = 21 [ 474.651162] [ 474.652802] ====================================================== [ 474.659192] WARNING: possible circular locking dependency detected [ 474.665486] 4.14.175-syzkaller #0 Not tainted [ 474.669950] ------------------------------------------------------ [ 474.676241] syz-executor155/17524 is trying to acquire lock: [ 474.682007] (((&q->adapt_timer))){+.-.}, at: [] del_timer_sync+0x76/0x1e0 [ 474.690563] [ 474.690563] but task is already holding lock: [ 474.696512] (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 474.704416] [ 474.704416] which lock already depends on the new lock. [ 474.704416] [ 474.712720] [ 474.712720] the existing dependency chain (in reverse order) is: [ 474.720314] [ 474.720314] -> #1 (&qdisc_rx_lock){+.-.}: [ 474.725922] lock_acquire+0x173/0x400 [ 474.730232] _raw_spin_lock+0x2d/0x40 [ 474.734542] pie_timer+0x6b/0x620 [ 474.738500] call_timer_fn+0x142/0x570 [ 474.742887] run_timer_softirq+0xc99/0x1210 [ 474.747711] __do_softirq+0x246/0x9b0 [ 474.752010] irq_exit+0x15f/0x1a0 [ 474.755978] smp_apic_timer_interrupt+0x149/0x5d0 [ 474.761321] apic_timer_interrupt+0x96/0xa0 [ 474.766155] native_safe_halt+0x12/0x20 [ 474.770638] default_idle+0x4f/0x370 [ 474.774847] arch_cpu_idle+0xa/0x10 [ 474.778972] default_idle_call+0x6d/0x90 [ 474.783528] do_idle+0x311/0x3d0 [ 474.787390] cpu_startup_entry+0x18/0x20 [ 474.791947] start_secondary+0x355/0x490 [ 474.796504] secondary_startup_64+0xa5/0xb0 [ 474.801319] [ 474.801319] -> #0 (((&q->adapt_timer))){+.-.}: [ 474.807382] __lock_acquire+0x2e94/0x4500 [ 474.812030] lock_acquire+0x173/0x400 [ 474.816326] del_timer_sync+0xa2/0x1e0 [ 474.820707] pie_destroy+0x42/0x50 [ 474.824742] qdisc_destroy+0x123/0x2d0 [ 474.829121] sfb_change+0x261/0xa20 [ 474.833244] tc_modify_qdisc+0xb55/0x13eb [ 474.837898] rtnetlink_rcv_msg+0x34f/0x9d0 [ 474.842715] netlink_rcv_skb+0x133/0x370 [ 474.847274] rtnetlink_rcv+0x10/0x20 [ 474.851484] netlink_unicast+0x40d/0x5f0 [ 474.856039] netlink_sendmsg+0x730/0xbd0 [ 474.860597] sock_sendmsg+0xb5/0xf0 [ 474.864718] ___sys_sendmsg+0x625/0x920 [ 474.869186] __sys_sendmsg+0xc1/0x140 [ 474.873484] SyS_sendmsg+0xd/0x20 [ 474.877510] do_syscall_64+0x1c7/0x5b0 [ 474.881933] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 474.887632] [ 474.887632] other info that might help us debug this: [ 474.887632] [ 474.895752] Possible unsafe locking scenario: [ 474.895752] [ 474.901786] CPU0 CPU1 [ 474.906432] ---- ---- [ 474.911076] lock(&qdisc_rx_lock); [ 474.914679] lock(((&q->adapt_timer))); [ 474.921246] lock(&qdisc_rx_lock); [ 474.927399] lock(((&q->adapt_timer))); [ 474.931442] [ 474.931442] *** DEADLOCK *** [ 474.931442] [ 474.937492] 2 locks held by syz-executor155/17524: [ 474.942395] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 474.950966] #1: (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 474.959288] [ 474.959288] stack backtrace: [ 474.963766] CPU: 0 PID: 17524 Comm: syz-executor155 Not tainted 4.14.175-syzkaller #0 [ 474.971706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 474.981038] Call Trace: [ 474.983613] dump_stack+0xf7/0x13b [ 474.987133] print_circular_bug.isra.40.cold.67+0x1bd/0x27d [ 474.992828] ? save_trace+0xe0/0x290 [ 474.996520] __lock_acquire+0x2e94/0x4500 [ 475.000641] ? kfree+0xcc/0x270 [ 475.003896] ? fifo_set_limit+0x187/0x1f0 [ 475.008020] ? fifo_create_dflt+0x72/0xe0 [ 475.012152] ? trace_hardirqs_on+0x10/0x10 [ 475.016371] ? debug_check_no_obj_freed+0x2f0/0x930 [ 475.021382] ? trace_hardirqs_off+0x10/0x10 [ 475.025694] ? mark_held_locks+0xc7/0x130 [ 475.029814] lock_acquire+0x173/0x400 [ 475.033591] ? del_timer_sync+0x76/0x1e0 [ 475.037625] ? __lock_is_held+0xb5/0x140 [ 475.041657] del_timer_sync+0xa2/0x1e0 [ 475.045517] ? del_timer_sync+0x76/0x1e0 [ 475.049553] pie_destroy+0x42/0x50 [ 475.053069] qdisc_destroy+0x123/0x2d0 [ 475.056932] sfb_change+0x261/0xa20 [ 475.060533] ? sfb_graft+0x220/0x220 [ 475.064223] ? nla_strcmp+0x9b/0xe0 [ 475.067832] tc_modify_qdisc+0xb55/0x13eb [ 475.071956] ? qdisc_create+0xcf0/0xcf0 [ 475.075909] rtnetlink_rcv_msg+0x34f/0x9d0 [ 475.080131] ? rtnl_bridge_getlink+0x760/0x760 [ 475.084703] ? find_held_lock+0x36/0x1d0 [ 475.088747] netlink_rcv_skb+0x133/0x370 [ 475.092794] ? rtnl_bridge_getlink+0x760/0x760 [ 475.097411] ? netlink_ack+0xa00/0xa00 [ 475.101279] ? netlink_deliver_tap+0x8e/0x920 [ 475.105780] rtnetlink_rcv+0x10/0x20 [ 475.109505] netlink_unicast+0x40d/0x5f0 [ 475.113550] ? netlink_attachskb+0x6e0/0x6e0 [ 475.117937] netlink_sendmsg+0x730/0xbd0 [ 475.121976] ? netlink_unicast+0x5f0/0x5f0 [ 475.126204] ? selinux_socket_sendmsg+0x31/0x40 [ 475.130847] ? security_socket_sendmsg+0x6a/0xa0 [ 475.135576] ? netlink_unicast+0x5f0/0x5f0 [ 475.139786] sock_sendmsg+0xb5/0xf0 [ 475.143389] ___sys_sendmsg+0x625/0x920 [ 475.147339] ? trace_hardirqs_off+0x10/0x10 [ 475.151647] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 475.156375] ? find_held_lock+0x36/0x1d0 [ 475.160411] ? lock_downgrade+0x7f0/0x7f0 [ 475.164536] ? __fget+0x1ca/0x2f0 [ 475.167964] ? __fget_light+0x166/0x200 [ 475.171911] ? __fdget+0xe/0x10 [ 475.175166] ? sockfd_lookup_light+0x1c/0x150 [ 475.179650] __sys_sendmsg+0xc1/0x140 [ 475.183426] ? SyS_shutdown+0x180/0x180 [ 475.187391] ? do_futex+0x17f0/0x17f0 [ 475.191164] ? SyS_futex+0xf1/0x250 [ 475.194766] ? do_syscall_64+0x4c/0x5b0 [ 475.198724] ? __sys_sendmsg+0x140/0x140 [ 475.202769] SyS_sendmsg+0xd/0x20 [ 475.206218] do_syscall_64+0x1c7/0x5b0 [ 475.210098] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 475.214924] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 475.220100] RIP: 0033:0x446cd9 [ 475.223273] RSP: 002b:00007fa30da3adb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 475.230967] RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 0000000000446cd9 [ 475.238265] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 [ 475.245519] RBP: 00000000006dbc50 R08: 0000000000000028 R09: 0000000000000000 [ 475.252764] R10: 0000000000000002 R11: 0000000000000246 R12: 00000000006dbc5c [ 475.260009] R13: 00007ffe73fcdaef R14: 00007fa30da3b9c0 R15: 0000000000000001