[ 462.126908] device bridge_slave_1 left promiscuous mode [ 462.132886] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.167194] device bridge_slave_0 left promiscuous mode [ 462.172783] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.270189] device hsr_slave_1 left promiscuous mode [ 462.319400] device hsr_slave_0 left promiscuous mode [ 462.369025] team0 (unregistering): Port device team_slave_1 removed [ 462.377883] team0 (unregistering): Port device team_slave_0 removed [ 462.387949] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 462.438298] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 462.490859] bond0 (unregistering): Released all slaves [ 466.864480] device bridge_slave_1 left promiscuous mode [ 466.870081] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.924945] device bridge_slave_0 left promiscuous mode [ 466.930629] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.985075] device bridge_slave_1 left promiscuous mode [ 466.990540] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.044793] device bridge_slave_0 left promiscuous mode [ 467.050251] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.105424] device bridge_slave_1 left promiscuous mode [ 467.111035] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.165034] device bridge_slave_0 left promiscuous mode [ 467.170611] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.205546] device bridge_slave_1 left promiscuous mode [ 467.211124] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.254938] device bridge_slave_0 left promiscuous mode [ 467.260422] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.305379] device bridge_slave_1 left promiscuous mode [ 467.310883] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.365278] device bridge_slave_0 left promiscuous mode [ 467.370897] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.555714] device hsr_slave_1 left promiscuous mode [ 467.597359] device hsr_slave_0 left promiscuous mode [ 467.636429] team0 (unregistering): Port device team_slave_1 removed [ 467.645721] team0 (unregistering): Port device team_slave_0 removed [ 467.655167] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 467.698873] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 467.760307] bond0 (unregistering): Released all slaves [ 467.845514] device hsr_slave_1 left promiscuous mode [ 467.897492] device hsr_slave_0 left promiscuous mode [ 467.936580] team0 (unregistering): Port device team_slave_1 removed [ 467.946383] team0 (unregistering): Port device team_slave_0 removed [ 467.955243] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 467.996718] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.058993] bond0 (unregistering): Released all slaves [ 468.156318] device hsr_slave_1 left promiscuous mode [ 468.197113] device hsr_slave_0 left promiscuous mode [ 468.237555] team0 (unregistering): Port device team_slave_1 removed [ 468.246300] team0 (unregistering): Port device team_slave_0 removed [ 468.255285] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.297687] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.359415] bond0 (unregistering): Released all slaves [ 468.445312] device hsr_slave_1 left promiscuous mode [ 468.485942] device hsr_slave_0 left promiscuous mode [ 468.526214] team0 (unregistering): Port device team_slave_1 removed [ 468.536346] team0 (unregistering): Port device team_slave_0 removed [ 468.545311] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.587449] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.649180] bond0 (unregistering): Released all slaves [ 468.755307] device hsr_slave_1 left promiscuous mode [ 468.795947] device hsr_slave_0 left promiscuous mode [ 468.836094] team0 (unregistering): Port device team_slave_1 removed [ 468.846269] team0 (unregistering): Port device team_slave_0 removed [ 468.855110] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.896818] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.989616] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.15.200' (ECDSA) to the list of known hosts. [ 473.574039] IPVS: ftp: loaded support on port[0] = 21 [ 474.312879] [ 474.314651] ====================================================== [ 474.321280] WARNING: possible circular locking dependency detected [ 474.327623] 4.14.183-syzkaller #0 Not tainted [ 474.332092] ------------------------------------------------------ [ 474.338397] syz-executor659/17587 is trying to acquire lock: [ 474.344189] (((&q->adapt_timer))){+.-.}, at: [] del_timer_sync+0x76/0x1e0 [ 474.352872] [ 474.352872] but task is already holding lock: [ 474.358813] (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 474.366744] [ 474.366744] which lock already depends on the new lock. [ 474.366744] [ 474.375031] [ 474.375031] the existing dependency chain (in reverse order) is: [ 474.382636] [ 474.382636] -> #1 (&qdisc_rx_lock){+.-.}: [ 474.388261] lock_acquire+0x173/0x400 [ 474.392614] _raw_spin_lock+0x2d/0x40 [ 474.396950] pie_timer+0x6b/0x620 [ 474.400911] call_timer_fn+0x142/0x570 [ 474.405303] run_timer_softirq+0xc99/0x1210 [ 474.410133] __do_softirq+0x246/0x9b0 [ 474.414443] irq_exit+0x15f/0x1a0 [ 474.418402] smp_apic_timer_interrupt+0x149/0x5d0 [ 474.423752] apic_timer_interrupt+0x9a/0xa0 [ 474.428564] console_unlock+0x90d/0xe30 [ 474.433030] vprintk_emit+0x1b4/0x4e0 [ 474.437409] vprintk_default+0x1a/0x20 [ 474.441800] vprintk_func+0x49/0x12c [ 474.446043] printk+0x91/0xab [ 474.449728] addrconf_notify+0x174/0x1b10 [ 474.454377] notifier_call_chain+0xd6/0x150 [ 474.459206] raw_notifier_call_chain+0x11/0x20 [ 474.464297] call_netdevice_notifiers_info+0x4b/0x60 [ 474.469934] __dev_notify_flags+0xca/0x210 [ 474.474663] dev_change_flags+0xe6/0x150 [ 474.479252] do_setlink+0x96f/0x2c50 [ 474.483481] rtnl_newlink+0xe0c/0x1390 [ 474.487860] rtnetlink_rcv_msg+0x34f/0x9d0 [ 474.492642] netlink_rcv_skb+0x133/0x370 [ 474.497196] rtnetlink_rcv+0x10/0x20 [ 474.501414] netlink_unicast+0x40d/0x5f0 [ 474.505977] netlink_sendmsg+0x730/0xbd0 [ 474.510590] sock_sendmsg+0xb5/0xf0 [ 474.514726] SYSC_sendto+0x1e3/0x2c0 [ 474.518942] SyS_sendto+0x9/0x10 [ 474.522802] do_syscall_64+0x1c7/0x5b0 [ 474.527188] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 474.532872] [ 474.532872] -> #0 (((&q->adapt_timer))){+.-.}: [ 474.538913] __lock_acquire+0x2e94/0x4500 [ 474.543552] lock_acquire+0x173/0x400 [ 474.547869] del_timer_sync+0xa2/0x1e0 [ 474.552263] pie_destroy+0x42/0x50 [ 474.556355] qdisc_destroy+0x123/0x2d0 [ 474.560735] sfb_change+0x261/0xa20 [ 474.564868] tc_modify_qdisc+0xb55/0x13eb [ 474.569506] rtnetlink_rcv_msg+0x34f/0x9d0 [ 474.574249] netlink_rcv_skb+0x133/0x370 [ 474.578816] rtnetlink_rcv+0x10/0x20 [ 474.583036] netlink_unicast+0x40d/0x5f0 [ 474.587586] netlink_sendmsg+0x730/0xbd0 [ 474.592138] sock_sendmsg+0xb5/0xf0 [ 474.596270] ___sys_sendmsg+0x625/0x920 [ 474.600748] __sys_sendmsg+0xc1/0x140 [ 474.605052] SyS_sendmsg+0xd/0x20 [ 474.608995] do_syscall_64+0x1c7/0x5b0 [ 474.613391] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 474.619081] [ 474.619081] other info that might help us debug this: [ 474.619081] [ 474.627218] Possible unsafe locking scenario: [ 474.627218] [ 474.633248] CPU0 CPU1 [ 474.637947] ---- ---- [ 474.642603] lock(&qdisc_rx_lock); [ 474.646262] lock(((&q->adapt_timer))); [ 474.652821] lock(&qdisc_rx_lock); [ 474.658955] lock(((&q->adapt_timer))); [ 474.662989] [ 474.662989] *** DEADLOCK *** [ 474.662989] [ 474.669017] 2 locks held by syz-executor659/17587: [ 474.673926] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 474.682481] #1: (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 474.690784] [ 474.690784] stack backtrace: [ 474.695281] CPU: 1 PID: 17587 Comm: syz-executor659 Not tainted 4.14.183-syzkaller #0 [ 474.703237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 474.712629] Call Trace: [ 474.715224] dump_stack+0xf7/0x13b [ 474.718738] print_circular_bug.isra.40.cold.67+0x1bd/0x27d [ 474.726521] ? save_trace+0xe0/0x290 [ 474.730207] __lock_acquire+0x2e94/0x4500 [ 474.734332] ? kfree+0xcc/0x270 [ 474.737599] ? fifo_set_limit+0x187/0x1f0 [ 474.741732] ? fifo_create_dflt+0x72/0xe0 [ 474.745868] ? trace_hardirqs_on+0x10/0x10 [ 474.750075] ? debug_check_no_obj_freed+0x2f0/0x930 [ 474.755079] ? trace_hardirqs_off+0x10/0x10 [ 474.759384] ? mark_held_locks+0xc7/0x130 [ 474.763502] lock_acquire+0x173/0x400 [ 474.767273] ? del_timer_sync+0x76/0x1e0 [ 474.771303] ? __lock_is_held+0xb5/0x140 [ 474.775350] del_timer_sync+0xa2/0x1e0 [ 474.779207] ? del_timer_sync+0x76/0x1e0 [ 474.783240] pie_destroy+0x42/0x50 [ 474.786773] qdisc_destroy+0x123/0x2d0 [ 474.790631] sfb_change+0x261/0xa20 [ 474.794234] ? sfb_graft+0x220/0x220 [ 474.797936] ? nla_strcmp+0x9b/0xe0 [ 474.801535] tc_modify_qdisc+0xb55/0x13eb [ 474.805652] ? qdisc_create+0xcf0/0xcf0 [ 474.809612] rtnetlink_rcv_msg+0x34f/0x9d0 [ 474.814788] ? rtnl_bridge_getlink+0x760/0x760 [ 474.819357] ? find_held_lock+0x36/0x1d0 [ 474.823389] netlink_rcv_skb+0x133/0x370 [ 474.827419] ? rtnl_bridge_getlink+0x760/0x760 [ 474.832086] ? netlink_ack+0xa00/0xa00 [ 474.836007] ? netlink_deliver_tap+0x8e/0x920 [ 474.840533] rtnetlink_rcv+0x10/0x20 [ 474.844221] netlink_unicast+0x40d/0x5f0 [ 474.848254] ? netlink_attachskb+0x6e0/0x6e0 [ 474.852637] netlink_sendmsg+0x730/0xbd0 [ 474.856688] ? netlink_unicast+0x5f0/0x5f0 [ 474.860896] ? selinux_socket_sendmsg+0x31/0x40 [ 474.865536] ? security_socket_sendmsg+0x6a/0xa0 [ 474.870279] ? netlink_unicast+0x5f0/0x5f0 [ 474.874504] sock_sendmsg+0xb5/0xf0 [ 474.878102] ___sys_sendmsg+0x625/0x920 [ 474.882048] ? trace_hardirqs_off+0x10/0x10 [ 474.886339] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 474.891091] ? find_held_lock+0x36/0x1d0 [ 474.895139] ? lock_downgrade+0x7f0/0x7f0 [ 474.899276] ? __fget+0x1ca/0x2f0 [ 474.902709] ? __fget_light+0x166/0x200 [ 474.906668] ? __fdget+0xe/0x10 [ 474.909918] ? sockfd_lookup_light+0x1c/0x150 [ 474.914403] __sys_sendmsg+0xc1/0x140 [ 474.918185] ? SyS_shutdown+0x180/0x180 [ 474.922147] ? do_futex+0x17f0/0x17f0 [ 474.925932] ? SyS_futex+0xf1/0x250 [ 474.929538] ? do_syscall_64+0x4c/0x5b0 [ 474.933511] ? __sys_sendmsg+0x140/0x140 [ 474.937551] SyS_sendmsg+0xd/0x20 [ 474.940995] do_syscall_64+0x1c7/0x5b0 [ 474.944865] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 474.949709] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 474.954890] RIP: 0033:0x446cd9 [ 474.958052] RSP: 002b:00007f5352904db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 474.965729] RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 0000000000446cd9 [ 474.972986] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 [ 474.980290] RBP: 00000000006dbc50 R08: 0000000000000028 R09: 0000000000000000 [ 474.987540] R10: 0000000000000002 R11: 0000000000000246 R12: 00000000006dbc5c [ 474.994809] R13: 00007ffe4fd54d5f R14: 00007f53529059c0 R15: 0000000000000001