============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz-executor/5638 is trying to acquire lock:
ffff888053ff10b0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
ffff888053ff10b0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
but task is already holding lock:
ffff888053ff10b0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
ffff888053ff10b0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x1fb/0x8b0 net/hsr/hsr_device.c:401
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hsr->seqnr_lock);
lock(&hsr->seqnr_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
locks held by syz-executor/5638: 18, last CPU#1:
#0: ffffffff9003a4f0 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1541 [inline]
#0: ffffffff9003a4f0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10a/0x470 kernel/fork.c:1594
#1: ffff888036255900 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:550 [inline]
#1: ffff888036255900 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x18a/0x1e10 mm/mmap.c:1716
#2: ffff8880761ba800 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:540 [inline]
#2: ffff8880761ba800 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x277/0x1e10 mm/mmap.c:1723
#3: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302
#4: ffff88802ac12eb8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
#4: ffff88802ac12eb8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:423
#5: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#5: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#5: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302
#6: ffff888062b41438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1317 [inline]
#6: ffff888062b41438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x6fb/0x5c00 mm/memory.c:1453
#7: ffffc90000a08ce0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1746
#8: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#8: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#8: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 net/hsr/hsr_device.c:446
#9: ffff888053ff10b0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:353 [inline]
#9: ffff888053ff10b0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x1fb/0x8b0 net/hsr/hsr_device.c:401
#10: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#10: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#10: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb9/0x2b70 net/hsr/hsr_forward.c:772
#11: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#11: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
#11: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:5000
#12: ffff88802affa228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#4){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:359 [inline]
#12: ffff88802affa228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#4){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:206 [inline]
#12: ffff88802affa228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#4){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4392 [inline]
#12: ffff88802affa228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#4){+...}-{3:3}, at: __dev_queue_xmit+0x114e/0x3920 net/core/dev.c:5044
#13: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#13: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#13: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 net/ipv6/ip6_output.c:236
#14: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#14: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#14: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x203/0x1650 net/ipv6/ndisc.c:483
#15: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#15: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#15: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 net/ipv6/ip6_output.c:236
#16: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#16: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
#16: ffffffff8ff5a380 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3920 net/core/dev.c:5000
#17: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#17: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#17: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 net/hsr/hsr_device.c:229
stack backtrace:
CPU: 1 UID: 0 PID: 5638 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_deadlock_bug+0x27a/0x290 kernel/locking/lockdep.c:3085
check_deadlock kernel/locking/lockdep.c:3137 [inline]
validate_chain kernel/locking/lockdep.c:3939 [inline]
__lock_acquire+0x25db/0x2de0 kernel/locking/lockdep.c:5288
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
_raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:205
spin_lock_bh include/linux/spinlock.h:353 [inline]
hsr_dev_xmit+0x237/0x360 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5457 [inline]
netdev_start_xmit include/linux/netdevice.h:5466 [inline]
xmit_one net/core/dev.c:4068 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4084
__dev_queue_xmit+0x14d1/0x3920 net/core/dev.c:5086
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:248
dst_output include/net/dst.h:472 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
ndisc_send_skb+0xcb2/0x1650 net/ipv6/ndisc.c:513
ndisc_send_ns net/ipv6/ndisc.c:672 [inline]
ndisc_solicit+0x374/0x670 net/ipv6/ndisc.c:763
neigh_probe net/core/neighbour.c:1096 [inline]
__neigh_event_send+0xf0c/0x1510 net/core/neighbour.c:1276
neigh_event_send_probe include/net/neighbour.h:474 [inline]
neigh_event_send include/net/neighbour.h:480 [inline]
neigh_resolve_output+0x1a1/0x720 net/core/neighbour.c:1618
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:248
ip6tunnel_xmit+0x200/0x620 include/net/ip6_tunnel.h:175
ip6_tnl_xmit+0x2039/0x27f0 net/ipv6/ip6_tunnel.c:1285
__gre6_xmit+0xa68/0xd90 net/ipv6/ip6_gre.c:784
ip6gre_xmit_other net/ipv6/ip6_gre.c:875 [inline]
ip6gre_tunnel_xmit+0xa52/0x1010 net/ipv6/ip6_gre.c:906
__netdev_start_xmit include/linux/netdevice.h:5457 [inline]
netdev_start_xmit include/linux/netdevice.h:5466 [inline]
xmit_one net/core/dev.c:4068 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:4084
sch_direct_xmit+0x257/0x4c0 net/sched/sch_generic.c:380
__dev_xmit_skb net/core/dev.c:4405 [inline]
__dev_queue_xmit+0x179a/0x3920 net/core/dev.c:5044
dev_queue_xmit include/linux/netdevice.h:3485 [inline]
hsr_xmit net/hsr/hsr_forward.c:440 [inline]
hsr_forward_do net/hsr/hsr_forward.c:603 [inline]
hsr_forward_skb+0x1701/0x2b70 net/hsr/hsr_forward.c:777
send_prp_supervision_frame+0x49a/0x8b0 net/hsr/hsr_device.c:432
hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:448
call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1749
expire_timers kernel/time/timer.c:1800 [inline]
__run_timers kernel/time/timer.c:2375 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2387
run_timer_base kernel/time/timer.c:2396 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2406
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:202 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:232 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:vma_flags_test include/linux/mm.h:1144 [inline]
RIP: 0010:vma_flags_is_cow_mapping include/linux/mm.h:2457 [inline]
RIP: 0010:vma_is_cow_mapping include/linux/mm.h:2470 [inline]
RIP: 0010:__copy_present_ptes mm/memory.c:1153 [inline]
RIP: 0010:copy_present_ptes mm/memory.c:1242 [inline]
RIP: 0010:copy_pte_range mm/memory.c:1365 [inline]
RIP: 0010:copy_pmd_range+0x2248/0x5c00 mm/memory.c:1453
Code: 89 f6 48 83 e6 20 31 ff e8 85 5f a2 ff 49 83 e6 20 75 0a e8 aa 59 a2 ff e9 45 01 00 00 4c 89 ef be 08 00 00 00 e8 98 39 19 00 <48> b8 00 00 00 00 00 fc ff df 41 80 3c 07 00 74 08 4c 89 ef e8 0f
RSP: 0018:ffffc90003a0f2c0 EFLAGS: 00000256
RAX: ffffffff8226bc01 RBX: 8000000060c38007 RCX: ffffffff8226bc38
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88805bb53160
RBP: ffffc90003a0f550 R08: ffff88805bb53167 R09: 1ffff1100b76a62c
R10: dffffc0000000000 R11: ffffed100b76a62d R12: ffff88804ac9fdd0
R13: ffff88805bb53160 R14: 0000000000000020 R15: 1ffff1100b76a62c
copy_pud_range mm/memory.c:1490 [inline]
copy_p4d_range mm/memory.c:1514 [inline]
copy_page_range+0xcc2/0x12b0 mm/memory.c:1600
dup_mmap+0xf70/0x1e10 mm/mmap.c:1819
dup_mm kernel/fork.c:1542 [inline]
copy_mm+0x115/0x470 kernel/fork.c:1594
copy_process+0x1ecc/0x44b0 kernel/fork.c:2320
kernel_clone+0x2d7/0x940 kernel/fork.c:2784
__do_sys_clone kernel/fork.c:2926 [inline]
__se_sys_clone kernel/fork.c:2910 [inline]
__x64_sys_clone+0x1b6/0x230 kernel/fork.c:2910
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff679dc7fd2
Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffd72137de0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffd72137de0 RCX: 00007ff679dc7fd2
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffd72137f6c R08: 0000000000000000 R09: 0000000000000001
R10: 0000555572eae7d0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 000000000005316d R15: 00007ffd72137fc0
----------------
Code disassembly (best guess):
0: 89 f6 mov %esi,%esi
2: 48 83 e6 20 and $0x20,%rsi
6: 31 ff xor %edi,%edi
8: e8 85 5f a2 ff call 0xffa25f92
d: 49 83 e6 20 and $0x20,%r14
11: 75 0a jne 0x1d
13: e8 aa 59 a2 ff call 0xffa259c2
18: e9 45 01 00 00 jmp 0x162
1d: 4c 89 ef mov %r13,%rdi
20: be 08 00 00 00 mov $0x8,%esi
25: e8 98 39 19 00 call 0x1939c2
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 41 80 3c 07 00 cmpb $0x0,(%r15,%rax,1)
39: 74 08 je 0x43
3b: 4c 89 ef mov %r13,%rdi
3e: e8 .byte 0xe8
3f: 0f .byte 0xf