============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.1.1477/11623 is trying to acquire lock:
ffff888174f14ff0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360

but task is already holding lock:
ffff8881b933cff0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&hsr->seqnr_lock);
  lock(&hsr->seqnr_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

16 locks held by syz.1.1477/11623:
 #0: ffff8881b947bd50 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_order+0xad4/0xe80
 #1: ffffc90000007cc0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0
 #2: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370
 #3: ffff8881b933cff0 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0
 #4: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xbb/0x2a80
 #5: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950
 #6: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: bond_start_xmit+0xb4/0x1900
 #7: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950
 #8: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1990
 #9: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950
 #10: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950
 #11: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: geneve_xmit+0x131/0x3160
 #12: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450
 #13: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3c2/0x1070
 #14: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950
 #15: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360

stack backtrace:
CPU: 0 UID: 0 PID: 11623 Comm: syz.1.1477 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150
 print_deadlock_bug+0x279/0x290
 __lock_acquire+0x253f/0x2cf0
 lock_acquire+0x106/0x350
 _raw_spin_lock_bh+0x36/0x50
 hsr_dev_xmit+0x237/0x360
 dev_hard_start_xmit+0x2cd/0x830
 __dev_queue_xmit+0x14d9/0x3950
 ip_finish_output2+0xca9/0x1070
 ip_output+0x29f/0x450
 iptunnel_xmit+0x621/0xd10
 udp_tunnel_xmit_skb+0x2b8/0x410
 geneve_xmit+0x21d5/0x3160
 dev_hard_start_xmit+0x2cd/0x830
 __dev_queue_xmit+0x14d9/0x3950
 vlan_dev_hard_start_xmit+0x204/0x430
 dev_hard_start_xmit+0x2cd/0x830
 __dev_queue_xmit+0x14d9/0x3950
 br_dev_queue_push_xmit+0x370/0x4b0
 NF_HOOK+0x360/0x3f0
 br_forward_finish+0xd3/0x130
 NF_HOOK+0x360/0x3f0
 __br_forward+0x397/0x540
 br_flood+0x6ee/0xb80
 br_dev_xmit+0x12bd/0x1990
 dev_hard_start_xmit+0x2cd/0x830
 __dev_queue_xmit+0x14d9/0x3950
 bond_start_xmit+0xd5c/0x1900
 dev_hard_start_xmit+0x2cd/0x830
 __dev_queue_xmit+0x14d9/0x3950
 hsr_forward_skb+0x167e/0x2a80
 send_hsr_supervision_frame+0x731/0xcb0
 hsr_announce+0x1db/0x370
 call_timer_fn+0x192/0x5e0
 __run_timer_base+0x652/0x8b0
 run_timer_softirq+0xb7/0x170
 handle_softirqs+0x22a/0x840
 __irq_exit_rcu+0xca/0x220
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:lock_release+0x2d7/0x3c0
Code: 93 97 11 00 00 00 00 eb b5 e8 b5 d2 06 0a f7 c3 00 02 00 00 74 b9 65 48 8b 05 a5 4d 97 11 48 3b 44 24 28 75 44 fb 48 83 c4 30 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 0a c5 09 0a cc 48 8d 3d a2 2f 92
RSP: 0018:ffffc900038aeda0 EFLAGS: 00000286
RAX: 0b3cda762971ac00 RBX: 0000000000000202 RCX: 0000000000000046
RDX: 0000000000000001 RSI: ffffffff8e219d03 RDI: ffffffff8c28ade0
RBP: ffff888022588bb8 R08: ffffc900038aef90 R09: 0000000000000000
R10: ffffc900038aef58 R11: fffff52000715ded R12: 0000000000000001
R13: 0000000000000001 R14: ffffffff8e95cd60 R15: ffff888022588000
 unwind_next_frame+0x1bba/0x2550
 __unwind_start+0x5b8/0x760
 arch_stack_walk+0xe3/0x150
 stack_trace_save+0xa9/0x100
 save_stack+0x122/0x230
 __set_page_owner+0x8d/0x4c0
 post_alloc_hook+0x231/0x280
 get_page_from_freelist+0x24ba/0x2540
 __alloc_frozen_pages_noprof+0x18d/0x380
 alloc_pages_mpol+0x235/0x490
 alloc_pages_noprof+0xac/0x2a0
 folio_alloc_noprof+0x1e/0x30
 filemap_alloc_folio_noprof+0x111/0x470
 page_cache_ra_unbounded+0x393/0xa10
 page_cache_ra_order+0xae4/0xe80
 do_sync_mmap_readahead+0x6ad/0x8e0
 filemap_fault+0x703/0x1300
 __do_fault+0x138/0x2a0
 do_pte_missing+0x2093/0x33f0
 handle_mm_fault+0x1bd7/0x3170
 do_user_addr_fault+0xa73/0x1340
 exc_page_fault+0x6a/0xc0
 asm_exc_page_fault+0x26/0x30
RIP: 0033:0x7f400dd4dad0
Code: 35 15 f6 10 00 31 ed 45 31 db 83 e8 20 48 8d 3d 26 f5 28 00 49 83 c6 01 31 d2 48 98 c6 44 24 1c 20 41 b9 ff ff ff ff 45 31 e4 <0f> b6 04 06 c7 44 24 50 00 00 00 00 45 31 d2 c7 44 24 10 00 00 00
RSP: 002b:00007f400eb9aa00 EFLAGS: 00010246
RAX: 0000000000000055 RBX: 00007f400eb9af30 RCX: 0200000000000000
RDX: 0000000000000000 RSI: 00007f400de5d0c0 RDI: 00007f400dfdcfe0
RBP: 0000000000000000 R08: 00007f400eb9b0f3 R09: 00000000ffffffff
R10: 0000000000000008 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000075 R14: 00007f400de4f0e9 R15: 00007f400eb9aff0
 </TASK>
ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
