====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u32:3/5804 is trying to acquire lock: ffff8880257ad070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline] ffff8880257ad070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x208/0x400 net/hsr/hsr_device.c:235 but task is already holding lock: ffff888027975958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline] ffff888027975958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4806 [inline] ffff888027975958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x3b5/0xc70 net/sched/sch_generic.c:370 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158 spin_lock include/linux/spinlock.h:342 [inline] __netif_tx_lock include/linux/netdevice.h:4806 [inline] sch_direct_xmit+0x3b5/0xc70 net/sched/sch_generic.c:370 __dev_xmit_skb net/core/dev.c:4214 [inline] __dev_queue_xmit+0x27ac/0x4970 net/core/dev.c:4836 dev_queue_xmit include/linux/netdevice.h:3448 [inline] hsr_xmit net/hsr/hsr_forward.c:440 [inline] hsr_forward_do net/hsr/hsr_forward.c:581 [inline] hsr_forward_skb+0xdd3/0x28d0 net/hsr/hsr_forward.c:743 send_hsr_supervision_frame+0x696/0xbc0 net/hsr/hsr_device.c:364 hsr_announce+0x169/0x3e0 net/hsr/hsr_device.c:421 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270 console_flush_all kernel/printk/printk.c:3343 [inline] __console_flush_and_unlock kernel/printk/printk.c:3373 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3413 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479 _printk+0xcf/0x110 kernel/printk/printk.c:2504 __netdev_printk+0x25c/0x290 net/core/dev.c:12978 netdev_info+0xef/0x127 net/core/dev.c:13025 netif_set_allmulti.cold+0x5b/0x1b7 net/core/dev.c:9683 __dev_change_flags+0x543/0x850 net/core/dev.c:9786 netif_change_flags+0x8d/0x160 net/core/dev.c:9827 do_setlink.isra.0+0x1ac4/0x3e60 net/core/rtnetlink.c:3215 rtnl_group_changelink net/core/rtnetlink.c:3863 [inline] __rtnl_newlink net/core/rtnetlink.c:4031 [inline] rtnl_newlink+0x1b7e/0x2380 net/core/rtnetlink.c:4159 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7076 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg net/socket.c:790 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2684 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2738 __sys_sendmsg+0x160/0x210 net/socket.c:2770 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> #0 (&hsr->seqnr_lock){+.-.}-{3:3}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3165 check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x136c/0x1a40 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:182 spin_lock_bh include/linux/spinlock.h:348 [inline] hsr_dev_xmit+0x208/0x400 net/hsr/hsr_device.c:235 __netdev_start_xmit include/linux/netdevice.h:5397 [inline] netdev_start_xmit include/linux/netdevice.h:5406 [inline] xmit_one net/core/dev.c:3889 [inline] dev_hard_start_xmit+0x121/0x760 net/core/dev.c:3905 __dev_queue_xmit+0x1bbf/0x4970 net/core/dev.c:4878 dev_queue_xmit include/linux/netdevice.h:3448 [inline] arp_xmit_finish net/ipv4/arp.c:655 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] arp_xmit+0x106/0x2e0 net/ipv4/arp.c:665 arp_send_dst net/ipv4/arp.c:320 [inline] arp_send_dst+0x200/0x280 net/ipv4/arp.c:301 arp_solicit+0x672/0x1070 net/ipv4/arp.c:392 neigh_probe+0xce/0x110 net/core/neighbour.c:1093 __neigh_event_send+0xabe/0x13d0 net/core/neighbour.c:1273 neigh_event_send_probe include/net/neighbour.h:480 [inline] neigh_event_send include/net/neighbour.h:486 [inline] neigh_event_send include/net/neighbour.h:484 [inline] neigh_resolve_output+0x550/0x8f0 net/core/neighbour.c:1600 neigh_output include/net/neighbour.h:560 [inline] ip_finish_output2+0x851/0x2400 net/ipv4/ip_output.c:236 __ip_finish_output.part.0+0x444/0x6f0 net/ipv4/ip_output.c:314 __ip_finish_output net/ipv4/ip_output.c:302 [inline] ip_finish_output net/ipv4/ip_output.c:324 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x39b/0xc10 net/ipv4/ip_output.c:437 dst_output include/net/dst.h:470 [inline] ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131 iptunnel_xmit+0x722/0xd20 net/ipv4/ip_tunnel_core.c:97 ip_tunnel_xmit+0x1b91/0x3210 net/ipv4/ip_tunnel.c:848 __gre_xmit+0x820/0xb20 net/ipv4/ip_gre.c:491 erspan_xmit+0x55a/0x1ec0 net/ipv4/ip_gre.c:750 __netdev_start_xmit include/linux/netdevice.h:5397 [inline] netdev_start_xmit include/linux/netdevice.h:5406 [inline] xmit_one net/core/dev.c:3889 [inline] dev_hard_start_xmit+0x121/0x760 net/core/dev.c:3905 sch_direct_xmit+0x1b2/0xc70 net/sched/sch_generic.c:372 __dev_xmit_skb net/core/dev.c:4214 [inline] __dev_queue_xmit+0x27ac/0x4970 net/core/dev.c:4836 dev_queue_xmit include/linux/netdevice.h:3448 [inline] alb_send_lp_vid+0x31e/0x540 drivers/net/bonding/bond_alb.c:949 alb_send_learning_packets+0xe0/0x2f0 drivers/net/bonding/bond_alb.c:1012 bond_alb_monitor+0x997/0x1750 drivers/net/bonding/bond_alb.c:1563 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&qdisc_xmit_lock_key#4); lock(&hsr->seqnr_lock); lock(&qdisc_xmit_lock_key#4); lock(&hsr->seqnr_lock); *** DEADLOCK *** 11 locks held by kworker/u32:3/5804: #0: ffff88801e8db940 ((wq_completion)bond5#2){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc90004767d08 ((work_completion)(&(&bond->alb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #2: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #2: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: bond_alb_monitor+0xec/0x1750 drivers/net/bonding/bond_alb.c:1546 #3: ffffffff8ebe7fa0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #3: ffffffff8ebe7fa0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:893 [inline] #3: ffffffff8ebe7fa0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x296/0x4970 net/core/dev.c:4796 #4: ffff888053dd5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:354 [inline] #4: ffff888053dd5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:206 [inline] #4: ffff888053dd5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4201 [inline] #4: ffff888053dd5228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x2504/0x4970 net/core/dev.c:4836 #5: ffff888027975958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline] #5: ffff888027975958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4806 [inline] #5: ffff888027975958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x3b5/0xc70 net/sched/sch_generic.c:370 #6: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #6: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #6: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: ip_output+0xb3/0xc10 net/ipv4/ip_output.c:432 #7: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #7: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #7: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x356/0x2400 net/ipv4/ip_output.c:229 #8: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #8: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #8: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x26/0x2e0 net/ipv4/arp.c:663 #9: ffffffff8ebe7fa0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #9: ffffffff8ebe7fa0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:893 [inline] #9: ffffffff8ebe7fa0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x296/0x4970 net/core/dev.c:4796 #10: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #10: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #10: ffffffff8ebe8000 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x39/0x400 net/hsr/hsr_device.c:229 stack backtrace: CPU: 2 UID: 0 PID: 5804 Comm: kworker/u32:3 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: bond5 bond_alb_monitor Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1c7 kernel/locking/lockdep.c:2043 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3165 check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x136c/0x1a40 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:150 [inline] _raw_spin_lock_bh+0x33/0x40 kernel/locking/spinlock.c:182 spin_lock_bh include/linux/spinlock.h:348 [inline] hsr_dev_xmit+0x208/0x400 net/hsr/hsr_device.c:235 __netdev_start_xmit include/linux/netdevice.h:5397 [inline] netdev_start_xmit include/linux/netdevice.h:5406 [inline] xmit_one net/core/dev.c:3889 [inline] dev_hard_start_xmit+0x121/0x760 net/core/dev.c:3905 __dev_queue_xmit+0x1bbf/0x4970 net/core/dev.c:4878 dev_queue_xmit include/linux/netdevice.h:3448 [inline] arp_xmit_finish net/ipv4/arp.c:655 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] arp_xmit+0x106/0x2e0 net/ipv4/arp.c:665 arp_send_dst net/ipv4/arp.c:320 [inline] arp_send_dst+0x200/0x280 net/ipv4/arp.c:301 arp_solicit+0x672/0x1070 net/ipv4/arp.c:392 neigh_probe+0xce/0x110 net/core/neighbour.c:1093 __neigh_event_send+0xabe/0x13d0 net/core/neighbour.c:1273 neigh_event_send_probe include/net/neighbour.h:480 [inline] neigh_event_send include/net/neighbour.h:486 [inline] neigh_event_send include/net/neighbour.h:484 [inline] neigh_resolve_output+0x550/0x8f0 net/core/neighbour.c:1600 neigh_output include/net/neighbour.h:560 [inline] ip_finish_output2+0x851/0x2400 net/ipv4/ip_output.c:236 __ip_finish_output.part.0+0x444/0x6f0 net/ipv4/ip_output.c:314 __ip_finish_output net/ipv4/ip_output.c:302 [inline] ip_finish_output net/ipv4/ip_output.c:324 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x39b/0xc10 net/ipv4/ip_output.c:437 dst_output include/net/dst.h:470 [inline] ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131 iptunnel_xmit+0x722/0xd20 net/ipv4/ip_tunnel_core.c:97 ip_tunnel_xmit+0x1b91/0x3210 net/ipv4/ip_tunnel.c:848 __gre_xmit+0x820/0xb20 net/ipv4/ip_gre.c:491 erspan_xmit+0x55a/0x1ec0 net/ipv4/ip_gre.c:750 __netdev_start_xmit include/linux/netdevice.h:5397 [inline] netdev_start_xmit include/linux/netdevice.h:5406 [inline] xmit_one net/core/dev.c:3889 [inline] dev_hard_start_xmit+0x121/0x760 net/core/dev.c:3905 sch_direct_xmit+0x1b2/0xc70 net/sched/sch_generic.c:372 __dev_xmit_skb net/core/dev.c:4214 [inline] __dev_queue_xmit+0x27ac/0x4970 net/core/dev.c:4836 dev_queue_xmit include/linux/netdevice.h:3448 [inline] alb_send_lp_vid+0x31e/0x540 drivers/net/bonding/bond_alb.c:949 alb_send_learning_packets+0xe0/0x2f0 drivers/net/bonding/bond_alb.c:1012 bond_alb_monitor+0x997/0x1750 drivers/net/bonding/bond_alb.c:1563 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245