[ 468.432236] device bridge_slave_1 left promiscuous mode [ 468.438146] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.493927] device bridge_slave_0 left promiscuous mode [ 468.499592] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.621823] device hsr_slave_1 left promiscuous mode [ 468.662620] device hsr_slave_0 left promiscuous mode [ 468.705130] team0 (unregistering): Port device team_slave_1 removed [ 468.715149] team0 (unregistering): Port device team_slave_0 removed [ 468.725707] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.772955] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.827548] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.10.58' (ECDSA) to the list of known hosts. [ 473.270962] device bridge_slave_1 left promiscuous mode [ 473.276523] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.330776] device bridge_slave_0 left promiscuous mode [ 473.336308] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.371088] device bridge_slave_1 left promiscuous mode [ 473.376575] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.421055] device bridge_slave_0 left promiscuous mode [ 473.426561] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.461694] device bridge_slave_1 left promiscuous mode [ 473.467181] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.522469] device bridge_slave_0 left promiscuous mode [ 473.528052] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.581157] device bridge_slave_1 left promiscuous mode [ 473.586635] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.630729] device bridge_slave_0 left promiscuous mode [ 473.636215] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.681525] device bridge_slave_1 left promiscuous mode [ 473.687260] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.721008] device bridge_slave_0 left promiscuous mode [ 473.726532] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.913672] device hsr_slave_1 left promiscuous mode [ 473.952484] device hsr_slave_0 left promiscuous mode [ 473.994863] team0 (unregistering): Port device team_slave_1 removed [ 474.003745] team0 (unregistering): Port device team_slave_0 removed [ 474.013533] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 474.062661] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 474.134872] bond0 (unregistering): Released all slaves [ 474.242640] device hsr_slave_1 left promiscuous mode [ 474.312397] device hsr_slave_0 left promiscuous mode [ 474.363637] team0 (unregistering): Port device team_slave_1 removed [ 474.372220] team0 (unregistering): Port device team_slave_0 removed [ 474.381044] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 474.412894] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 474.475933] bond0 (unregistering): Released all slaves [ 474.581497] device hsr_slave_1 left promiscuous mode [ 474.642220] device hsr_slave_0 left promiscuous mode [ 474.682348] team0 (unregistering): Port device team_slave_1 removed [ 474.692054] team0 (unregistering): Port device team_slave_0 removed [ 474.700624] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 474.742793] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 474.815349] bond0 (unregistering): Released all slaves [ 474.911987] device hsr_slave_1 left promiscuous mode [ 474.952663] device hsr_slave_0 left promiscuous mode [ 474.993436] team0 (unregistering): Port device team_slave_1 removed [ 475.003645] team0 (unregistering): Port device team_slave_0 removed [ 475.012274] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 475.062977] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 475.134696] bond0 (unregistering): Released all slaves [ 475.232186] device hsr_slave_1 left promiscuous mode [ 475.273974] device hsr_slave_0 left promiscuous mode [ 475.342595] team0 (unregistering): Port device team_slave_1 removed [ 475.352104] team0 (unregistering): Port device team_slave_0 removed [ 475.362135] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 475.422809] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 475.485656] bond0 (unregistering): Released all slaves [ 480.211258] IPVS: ftp: loaded support on port[0] = 21 [ 480.955375] [ 480.957931] ====================================================== [ 480.964375] WARNING: possible circular locking dependency detected [ 480.971285] 4.14.170-syzkaller #0 Not tainted [ 480.975763] ------------------------------------------------------ [ 480.982059] syz-executor710/20816 is trying to acquire lock: [ 480.987950] (((&q->adapt_timer))){+.-.}, at: [] del_timer_sync+0x76/0x1e0 [ 480.996722] [ 480.996722] but task is already holding lock: [ 481.002675] (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 481.010647] [ 481.010647] which lock already depends on the new lock. [ 481.010647] [ 481.018941] [ 481.018941] the existing dependency chain (in reverse order) is: [ 481.026689] [ 481.026689] -> #1 (&qdisc_rx_lock){+.-.}: [ 481.032303] lock_acquire+0x173/0x400 [ 481.036666] _raw_spin_lock+0x2d/0x40 [ 481.041002] pie_timer+0x6b/0x620 [ 481.045023] call_timer_fn+0x142/0x570 [ 481.049515] run_timer_softirq+0xc99/0x1210 [ 481.054653] __do_softirq+0x246/0x9b0 [ 481.058954] irq_exit+0x15f/0x1a0 [ 481.062990] smp_apic_timer_interrupt+0x149/0x5d0 [ 481.068337] apic_timer_interrupt+0x96/0xa0 [ 481.073162] console_unlock+0x90d/0xe30 [ 481.077745] vprintk_emit+0x1b4/0x4e0 [ 481.082308] vprintk_default+0x1a/0x20 [ 481.086715] vprintk_func+0x49/0x12c [ 481.090926] printk+0x91/0xab [ 481.094810] vlan_device_event.cold.13+0x16/0x2a [ 481.100271] notifier_call_chain+0xd6/0x150 [ 481.105616] raw_notifier_call_chain+0x11/0x20 [ 481.110884] call_netdevice_notifiers_info+0x4b/0x60 [ 481.116691] __dev_notify_flags+0xca/0x210 [ 481.121571] dev_change_flags+0xe6/0x150 [ 481.126224] do_setlink+0x96f/0x2c50 [ 481.130712] rtnl_newlink+0xe0c/0x1390 [ 481.135109] rtnetlink_rcv_msg+0x34f/0x9d0 [ 481.139908] netlink_rcv_skb+0x133/0x370 [ 481.144476] rtnetlink_rcv+0x10/0x20 [ 481.148712] netlink_unicast+0x40d/0x5f0 [ 481.153377] netlink_sendmsg+0x730/0xbd0 [ 481.157992] sock_sendmsg+0xb5/0xf0 [ 481.162132] SYSC_sendto+0x1e3/0x2c0 [ 481.166553] SyS_sendto+0x9/0x10 [ 481.170423] do_syscall_64+0x1c7/0x5b0 [ 481.174936] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 481.181361] [ 481.181361] -> #0 (((&q->adapt_timer))){+.-.}: [ 481.187749] __lock_acquire+0x2e94/0x4500 [ 481.192416] lock_acquire+0x173/0x400 [ 481.196719] del_timer_sync+0xa2/0x1e0 [ 481.201763] pie_destroy+0x42/0x50 [ 481.205896] qdisc_destroy+0x123/0x2d0 [ 481.210290] sfb_change+0x261/0xa20 [ 481.214430] tc_modify_qdisc+0xb55/0x13eb [ 481.219353] rtnetlink_rcv_msg+0x34f/0x9d0 [ 481.224100] netlink_rcv_skb+0x133/0x370 [ 481.228691] rtnetlink_rcv+0x10/0x20 [ 481.232912] netlink_unicast+0x40d/0x5f0 [ 481.237469] netlink_sendmsg+0x730/0xbd0 [ 481.242085] sock_sendmsg+0xb5/0xf0 [ 481.246368] ___sys_sendmsg+0x625/0x920 [ 481.250850] __sys_sendmsg+0xc1/0x140 [ 481.255316] SyS_sendmsg+0xd/0x20 [ 481.259752] do_syscall_64+0x1c7/0x5b0 [ 481.264195] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 481.270147] [ 481.270147] other info that might help us debug this: [ 481.270147] [ 481.278323] Possible unsafe locking scenario: [ 481.278323] [ 481.284368] CPU0 CPU1 [ 481.289032] ---- ---- [ 481.293682] lock(&qdisc_rx_lock); [ 481.297287] lock(((&q->adapt_timer))); [ 481.303849] lock(&qdisc_rx_lock); [ 481.309995] lock(((&q->adapt_timer))); [ 481.314049] [ 481.314049] *** DEADLOCK *** [ 481.314049] [ 481.320092] 2 locks held by syz-executor710/20816: [ 481.325015] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c1/0x9d0 [ 481.333821] #1: (&qdisc_rx_lock){+.-.}, at: [] sfb_change+0x1a3/0xa20 [ 481.342241] [ 481.342241] stack backtrace: [ 481.346736] CPU: 1 PID: 20816 Comm: syz-executor710 Not tainted 4.14.170-syzkaller #0 [ 481.354743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 481.364311] Call Trace: [ 481.366951] dump_stack+0xf7/0x13b [ 481.370502] print_circular_bug.isra.40.cold.67+0x1bd/0x27d [ 481.376220] ? save_trace+0xe0/0x290 [ 481.380321] __lock_acquire+0x2e94/0x4500 [ 481.384457] ? kfree+0xcc/0x270 [ 481.387717] ? fifo_set_limit+0x187/0x1f0 [ 481.391929] ? fifo_create_dflt+0x72/0xe0 [ 481.396075] ? trace_hardirqs_on+0x10/0x10 [ 481.400447] ? debug_check_no_obj_freed+0x2f0/0x930 [ 481.405456] ? trace_hardirqs_off+0x10/0x10 [ 481.409871] ? mark_held_locks+0xc7/0x130 [ 481.414121] lock_acquire+0x173/0x400 [ 481.418078] ? del_timer_sync+0x76/0x1e0 [ 481.422278] ? __lock_is_held+0xb5/0x140 [ 481.426384] del_timer_sync+0xa2/0x1e0 [ 481.430259] ? del_timer_sync+0x76/0x1e0 [ 481.434315] pie_destroy+0x42/0x50 [ 481.437838] qdisc_destroy+0x123/0x2d0 [ 481.441743] sfb_change+0x261/0xa20 [ 481.445478] ? sfb_graft+0x220/0x220 [ 481.449179] ? nla_strcmp+0x9b/0xe0 [ 481.452923] tc_modify_qdisc+0xb55/0x13eb [ 481.457078] ? qdisc_create+0xcf0/0xcf0 [ 481.461130] rtnetlink_rcv_msg+0x34f/0x9d0 [ 481.465501] ? rtnl_bridge_getlink+0x760/0x760 [ 481.470171] ? find_held_lock+0x36/0x1d0 [ 481.474227] netlink_rcv_skb+0x133/0x370 [ 481.478288] ? rtnl_bridge_getlink+0x760/0x760 [ 481.482861] ? netlink_ack+0xa00/0xa00 [ 481.486803] ? netlink_deliver_tap+0x8e/0x920 [ 481.491297] rtnetlink_rcv+0x10/0x20 [ 481.495009] netlink_unicast+0x40d/0x5f0 [ 481.499052] ? netlink_attachskb+0x6e0/0x6e0 [ 481.503452] netlink_sendmsg+0x730/0xbd0 [ 481.507712] ? netlink_unicast+0x5f0/0x5f0 [ 481.511960] ? selinux_socket_sendmsg+0x31/0x40 [ 481.516609] ? security_socket_sendmsg+0x6a/0xa0 [ 481.521671] ? netlink_unicast+0x5f0/0x5f0 [ 481.525999] sock_sendmsg+0xb5/0xf0 [ 481.529630] ___sys_sendmsg+0x625/0x920 [ 481.533811] ? trace_hardirqs_off+0x10/0x10 [ 481.538137] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 481.542985] ? find_held_lock+0x36/0x1d0 [ 481.547266] ? lock_downgrade+0x7f0/0x7f0 [ 481.551415] ? __fget+0x1ca/0x2f0 [ 481.554858] ? __fget_light+0x166/0x200 [ 481.558814] ? __fdget+0xe/0x10 [ 481.562289] ? sockfd_lookup_light+0x1c/0x150 [ 481.567060] __sys_sendmsg+0xc1/0x140 [ 481.570849] ? SyS_shutdown+0x180/0x180 [ 481.574807] ? do_futex+0x1760/0x1760 [ 481.578609] ? SyS_futex+0xf1/0x250 [ 481.582226] ? do_syscall_64+0x4c/0x5b0 [ 481.586181] ? __sys_sendmsg+0x140/0x140 [ 481.590260] SyS_sendmsg+0xd/0x20 [ 481.593709] do_syscall_64+0x1c7/0x5b0 [ 481.597630] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 481.602463] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 481.607750] RIP: 0033:0x446cd9 [ 481.610920] RSP: 002b:00007f68cbd29db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 481.618620] RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 0000000000446cd9 [ 481.625881] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 [ 481.633254] RBP: 00000000006dbc50 R08: 0000000000000028 R09: 0000000000000000 [ 481.641056] R10: 0000000000000002 R11: 0000000000000246 R12: 00000000006dbc5c [ 481.648321] R13: 00007ffd10e9b76f R14: 00007f68cbd2a9c0 R15: 0000000000000001