[ 42.723697] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.735159] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 42.743234] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.750664] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.760558] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 42.767372] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.781744] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 42.791692] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 332.820176] random: crng init done [ 332.823756] random: 7 urandom warning(s) missed due to ratelimiting [ 458.771677] device bridge_slave_1 left promiscuous mode [ 458.777629] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.813592] device bridge_slave_0 left promiscuous mode [ 458.819120] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.924340] device hsr_slave_1 left promiscuous mode [ 458.963235] device hsr_slave_0 left promiscuous mode [ 459.005233] team0 (unregistering): Port device team_slave_1 removed [ 459.014209] team0 (unregistering): Port device team_slave_0 removed [ 459.024266] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 459.053413] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 459.104178] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.10.37' (ECDSA) to the list of known hosts. [ 463.679601] device bridge_slave_1 left promiscuous mode [ 463.685217] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.730109] device bridge_slave_0 left promiscuous mode [ 463.738426] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.790257] device bridge_slave_1 left promiscuous mode [ 463.795712] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.829841] device bridge_slave_0 left promiscuous mode [ 463.835350] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.890144] device bridge_slave_1 left promiscuous mode [ 463.895814] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.939839] device bridge_slave_0 left promiscuous mode [ 463.945285] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.000611] device bridge_slave_1 left promiscuous mode [ 464.006172] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.060152] device bridge_slave_0 left promiscuous mode [ 464.065711] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.120586] device bridge_slave_1 left promiscuous mode [ 464.126055] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.180075] device bridge_slave_0 left promiscuous mode [ 464.185548] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.350507] device hsr_slave_1 left promiscuous mode [ 464.391229] device hsr_slave_0 left promiscuous mode [ 464.431555] team0 (unregistering): Port device team_slave_1 removed [ 464.441719] team0 (unregistering): Port device team_slave_0 removed [ 464.450806] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 464.492019] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 464.555827] bond0 (unregistering): Released all slaves [ 464.660516] device hsr_slave_1 left promiscuous mode [ 464.702379] device hsr_slave_0 left promiscuous mode [ 464.741574] team0 (unregistering): Port device team_slave_1 removed [ 464.751483] team0 (unregistering): Port device team_slave_0 removed [ 464.760375] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 464.813350] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 464.873954] bond0 (unregistering): Released all slaves [ 464.960447] device hsr_slave_1 left promiscuous mode [ 465.001025] device hsr_slave_0 left promiscuous mode [ 465.042407] team0 (unregistering): Port device team_slave_1 removed [ 465.051979] team0 (unregistering): Port device team_slave_0 removed [ 465.061855] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 465.101928] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 465.163713] bond0 (unregistering): Released all slaves [ 465.270390] device hsr_slave_1 left promiscuous mode [ 465.311034] device hsr_slave_0 left promiscuous mode [ 465.351306] team0 (unregistering): Port device team_slave_1 removed [ 465.360548] team0 (unregistering): Port device team_slave_0 removed [ 465.368765] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 465.403685] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 465.463512] bond0 (unregistering): Released all slaves [ 465.561152] device hsr_slave_1 left promiscuous mode [ 465.611100] device hsr_slave_0 left promiscuous mode [ 465.651413] team0 (unregistering): Port device team_slave_1 removed [ 465.661571] team0 (unregistering): Port device team_slave_0 removed [ 465.670133] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 465.703099] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 465.763682] bond0 (unregistering): Released all slaves [ 470.179180] IPVS: ftp: loaded support on port[0] = 21 [ 470.926931] [ 470.928682] ====================================================== [ 470.934969] WARNING: possible circular locking dependency detected [ 470.941357] 4.14.180-syzkaller #0 Not tainted [ 470.945837] ------------------------------------------------------ [ 470.952149] syz-executor193/15893 is trying to acquire lock: [ 470.957918] (((&q->adapt_timer))){+.-.}, at: [] del_timer_sync+0x76/0x1e0 [ 470.966574] [ 470.966574] but task is already holding lock: [ 470.972538] (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 470.980908] [ 470.980908] which lock already depends on the new lock. [ 470.980908] [ 470.989213] [ 470.989213] the existing dependency chain (in reverse order) is: [ 470.996825] [ 470.996825] -> #1 (&qdisc_rx_lock){+.-.}: [ 471.002443] lock_acquire+0x173/0x400 [ 471.006899] _raw_spin_lock+0x2d/0x40 [ 471.011389] pie_timer+0x6b/0x620 [ 471.015340] call_timer_fn+0x142/0x570 [ 471.019738] run_timer_softirq+0xc99/0x1210 [ 471.024604] __do_softirq+0x246/0x9b0 [ 471.029769] do_softirq_own_stack+0x2a/0x40 [ 471.034616] do_softirq.part.16+0x11a/0x150 [ 471.039523] __local_bh_enable_ip+0x15c/0x180 [ 471.044521] _raw_write_unlock_bh+0x30/0x40 [ 471.049895] neigh_changeaddr+0x31/0x40 [ 471.054416] arp_netdev_event+0x42/0xf0 [ 471.058886] notifier_call_chain+0xd6/0x150 [ 471.063702] raw_notifier_call_chain+0x11/0x20 [ 471.068895] call_netdevice_notifiers_info+0x4b/0x60 [ 471.075180] dev_set_mac_address+0x1b8/0x2f0 [ 471.080129] do_setlink+0x5d9/0x2c50 [ 471.086207] rtnl_newlink+0xe0c/0x1390 [ 471.090604] rtnetlink_rcv_msg+0x34f/0x9d0 [ 471.095496] netlink_rcv_skb+0x133/0x370 [ 471.100614] rtnetlink_rcv+0x10/0x20 [ 471.104826] netlink_unicast+0x40d/0x5f0 [ 471.109394] netlink_sendmsg+0x730/0xbd0 [ 471.114023] sock_sendmsg+0xb5/0xf0 [ 471.118158] SYSC_sendto+0x1e3/0x2c0 [ 471.122400] SyS_sendto+0x9/0x10 [ 471.126445] do_syscall_64+0x1c7/0x5b0 [ 471.130842] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 471.136870] [ 471.136870] -> #0 (((&q->adapt_timer))){+.-.}: [ 471.142922] __lock_acquire+0x2e94/0x4500 [ 471.147575] lock_acquire+0x173/0x400 [ 471.152316] del_timer_sync+0xa2/0x1e0 [ 471.156711] pie_destroy+0x42/0x50 [ 471.160868] qdisc_destroy+0x123/0x2d0 [ 471.165371] sfb_change+0x261/0xa20 [ 471.169591] tc_modify_qdisc+0xb55/0x13eb [ 471.174704] rtnetlink_rcv_msg+0x34f/0x9d0 [ 471.179433] netlink_rcv_skb+0x133/0x370 [ 471.184091] rtnetlink_rcv+0x10/0x20 [ 471.188299] netlink_unicast+0x40d/0x5f0 [ 471.192855] netlink_sendmsg+0x730/0xbd0 [ 471.197703] sock_sendmsg+0xb5/0xf0 [ 471.201845] ___sys_sendmsg+0x625/0x920 [ 471.206596] __sys_sendmsg+0xc1/0x140 [ 471.210903] SyS_sendmsg+0xd/0x20 [ 471.214871] do_syscall_64+0x1c7/0x5b0 [ 471.219263] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 471.225071] [ 471.225071] other info that might help us debug this: [ 471.225071] [ 471.234409] Possible unsafe locking scenario: [ 471.234409] [ 471.240445] CPU0 CPU1 [ 471.245106] ---- ---- [ 471.249840] lock(&qdisc_rx_lock); [ 471.253467] lock(((&q->adapt_timer))); [ 471.260126] lock(&qdisc_rx_lock); [ 471.266266] lock(((&q->adapt_timer))); [ 471.270909] [ 471.270909] *** DEADLOCK *** [ 471.270909] [ 471.276942] 2 locks held by syz-executor193/15893: [ 471.281874] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 471.290439] #1: (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 471.299533] [ 471.299533] stack backtrace: [ 471.304044] CPU: 0 PID: 15893 Comm: syz-executor193 Not tainted 4.14.180-syzkaller #0 [ 471.311991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 471.321476] Call Trace: [ 471.324091] dump_stack+0xf7/0x13b [ 471.327611] print_circular_bug.isra.40.cold.67+0x1bd/0x27d [ 471.334604] ? save_trace+0xe0/0x290 [ 471.338494] __lock_acquire+0x2e94/0x4500 [ 471.343055] ? kfree+0xcc/0x270 [ 471.346990] ? fifo_set_limit+0x187/0x1f0 [ 471.351208] ? fifo_create_dflt+0x72/0xe0 [ 471.355445] ? trace_hardirqs_on+0x10/0x10 [ 471.359659] ? debug_check_no_obj_freed+0x2f0/0x930 [ 471.364934] ? trace_hardirqs_off+0x10/0x10 [ 471.369375] ? mark_held_locks+0xc7/0x130 [ 471.373945] lock_acquire+0x173/0x400 [ 471.378539] ? del_timer_sync+0x76/0x1e0 [ 471.383381] ? __lock_is_held+0xb5/0x140 [ 471.387426] del_timer_sync+0xa2/0x1e0 [ 471.391293] ? del_timer_sync+0x76/0x1e0 [ 471.395550] pie_destroy+0x42/0x50 [ 471.399091] qdisc_destroy+0x123/0x2d0 [ 471.402973] sfb_change+0x261/0xa20 [ 471.406585] ? sfb_graft+0x220/0x220 [ 471.410279] ? nla_strcmp+0x9b/0xe0 [ 471.413910] tc_modify_qdisc+0xb55/0x13eb [ 471.418028] ? qdisc_create+0xcf0/0xcf0 [ 471.421988] rtnetlink_rcv_msg+0x34f/0x9d0 [ 471.426208] ? rtnl_bridge_getlink+0x760/0x760 [ 471.430772] ? find_held_lock+0x36/0x1d0 [ 471.434930] netlink_rcv_skb+0x133/0x370 [ 471.438980] ? rtnl_bridge_getlink+0x760/0x760 [ 471.443546] ? netlink_ack+0xa00/0xa00 [ 471.447430] ? netlink_deliver_tap+0x8e/0x920 [ 471.452380] rtnetlink_rcv+0x10/0x20 [ 471.456069] netlink_unicast+0x40d/0x5f0 [ 471.460287] ? netlink_attachskb+0x6e0/0x6e0 [ 471.464674] netlink_sendmsg+0x730/0xbd0 [ 471.468723] ? netlink_unicast+0x5f0/0x5f0 [ 471.473055] ? selinux_socket_sendmsg+0x31/0x40 [ 471.477702] ? security_socket_sendmsg+0x6a/0xa0 [ 471.482449] ? netlink_unicast+0x5f0/0x5f0 [ 471.486666] sock_sendmsg+0xb5/0xf0 [ 471.490272] ___sys_sendmsg+0x625/0x920 [ 471.494231] ? trace_hardirqs_off+0x10/0x10 [ 471.498535] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 471.503703] ? find_held_lock+0x36/0x1d0 [ 471.507740] ? lock_downgrade+0x7f0/0x7f0 [ 471.511879] ? __fget+0x1ca/0x2f0 [ 471.515303] ? __fget_light+0x166/0x200 [ 471.519247] ? __fdget+0xe/0x10 [ 471.522498] ? sockfd_lookup_light+0x1c/0x150 [ 471.526962] __sys_sendmsg+0xc1/0x140 [ 471.530736] ? SyS_shutdown+0x180/0x180 [ 471.534678] ? do_futex+0x17f0/0x17f0 [ 471.538540] ? SyS_futex+0xf1/0x250 [ 471.542142] ? do_syscall_64+0x4c/0x5b0 [ 471.546083] ? __sys_sendmsg+0x140/0x140 [ 471.550129] SyS_sendmsg+0xd/0x20 [ 471.553575] do_syscall_64+0x1c7/0x5b0 [ 471.557436] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 471.562297] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 471.567477] RIP: 0033:0x446cd9 [ 471.571853] RSP: 002b:00007f6b80b95db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 471.579543] RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 0000000000446cd9 [ 471.586817] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 [ 471.594067] RBP: 00000000006dbc50 R08: 0000000000000028 R09: 0000000000000000 [ 471.601307] R10: 0000000000000002 R11: 0000000000000246 R12: 00000000006dbc5c [ 471.610198] R13: 00007ffe6d23e8ef R14: 00007f6b80b969c0 R15: 0000000000000001