======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc3-syzkaller-00159-g223e2288f4b8 #0 Not tainted
------------------------------------------------------
syz.2.1977/14255 is trying to acquire lock:
ffff888021508958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x153/0x4b0

but task is already holding lock:
ffff88810f804f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x195/0x6c0

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&hsr->seqnr_lock){+.-.}-{3:3}:
       lock_acquire+0x120/0x360
       _raw_spin_lock_bh+0x36/0x50
       hsr_dev_xmit+0x19a/0x220
       dev_hard_start_xmit+0x2d7/0x830
       __dev_queue_xmit+0x1adf/0x3a70
       NF_HOOK+0x310/0x3a0
       arp_xmit+0x16c/0x270
       arp_solicit+0xc1d/0xe60
       __neigh_event_send+0xf70/0x1560
       neigh_resolve_output+0x198/0x750
       ip_finish_output2+0xd40/0x1160
       iptunnel_xmit+0x571/0xa00
       ip_tunnel_xmit+0x1c3c/0x2380
       gre_tap_xmit+0x590/0x7a0
       dev_hard_start_xmit+0x2d7/0x830
       sch_direct_xmit+0x241/0x4b0
       __dev_queue_xmit+0x17b6/0x3a70
       alb_send_lp_vid+0x324/0x510
       alb_send_learning_packets+0x10d/0x2c0
       bond_alb_monitor+0x3e4/0x1800
       process_scheduled_works+0xae1/0x17b0
       worker_thread+0x8a0/0xda0
       kthread+0x711/0x8a0
       ret_from_fork+0x3fc/0x770
       ret_from_fork_asm+0x1a/0x30

-> #0 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}:
       validate_chain+0xb9b/0x2140
       __lock_acquire+0xab9/0xd20
       lock_acquire+0x120/0x360
       _raw_spin_lock+0x2e/0x40
       sch_direct_xmit+0x153/0x4b0
       __dev_queue_xmit+0x17b6/0x3a70
       hsr_forward_skb+0x158b/0x2860
       send_prp_supervision_frame+0x35b/0x6c0
       hsr_announce+0x1d5/0x360
       call_timer_fn+0x17e/0x5f0
       __run_timer_base+0x61a/0x860
       run_timer_softirq+0xb7/0x180
       handle_softirqs+0x286/0x870
       __irq_exit_rcu+0xca/0x1f0
       irq_exit_rcu+0x9/0x30
       sysvec_apic_timer_interrupt+0xa6/0xc0
       asm_sysvec_apic_timer_interrupt+0x1a/0x20
       unwind_get_return_address+0x67/0x90
       arch_stack_walk+0xfc/0x150
       stack_trace_save+0x9c/0xe0
       kasan_save_track+0x3e/0x80
       __kasan_kmalloc+0x93/0xb0
       __kmalloc_cache_noprof+0x230/0x3d0
       kmem_cache_free+0x166/0x400
       exit_mmap+0x53f/0xb50
       __mmput+0x118/0x420
       exit_mm+0x1da/0x2c0
       do_exit+0x648/0x22e0
       do_group_exit+0x21c/0x2d0
       get_signal+0x1286/0x1340
       arch_do_signal_or_restart+0x9a/0x750
       exit_to_user_mode_loop+0x75/0x110
       do_syscall_64+0x2bd/0x3b0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&hsr->seqnr_lock);
                               lock(&qdisc_xmit_lock_key#4);
                               lock(&hsr->seqnr_lock);
  lock(&qdisc_xmit_lock_key#4);

 *** DEADLOCK ***

7 locks held by syz.2.1977/14255:
 #0: ffff88803ef1c260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28e/0xb50
 #1: ffffc900001e0be0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x5f0
 #2: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x83/0x360
 #3: ffff88810f804f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x195/0x6c0
 #4: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860
 #5: ffffffff8e13eec0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70
 #6: ffff888030c77258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{3:3}, at: __dev_queue_xmit+0x1300/0x3a70

stack backtrace:
CPU: 1 UID: 0 PID: 14255 Comm: syz.2.1977 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <IRQ>
 dump_stack_lvl+0x189/0x250
 print_circular_bug+0x2ee/0x310
 check_noncircular+0x134/0x160
 validate_chain+0xb9b/0x2140
 __lock_acquire+0xab9/0xd20
 lock_acquire+0x120/0x360
 _raw_spin_lock+0x2e/0x40
 sch_direct_xmit+0x153/0x4b0
 __dev_queue_xmit+0x17b6/0x3a70
 hsr_forward_skb+0x158b/0x2860
 send_prp_supervision_frame+0x35b/0x6c0
 hsr_announce+0x1d5/0x360
 call_timer_fn+0x17e/0x5f0
 __run_timer_base+0x61a/0x860
 run_timer_softirq+0xb7/0x180
 handle_softirqs+0x286/0x870
 __irq_exit_rcu+0xca/0x1f0
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:unwind_get_return_address+0x67/0x90
Code: 48 89 df e8 eb 48 b1 00 48 8b 3b e8 43 a4 1a 00 85 c0 74 14 43 80 3c 37 00 74 08 48 89 df e8 d0 48 b1 00 48 8b 03 eb 02 31 c0 <5b> 41 5e 41 5f c3 cc cc cc cc cc 89 d9 80 e1 07 80 c1 03 38 c1 7c
RSP: 0018:ffffc90002d6f388 EFLAGS: 00000246
RAX: ffffffff8223a96e RBX: ffffc90002d6f3f0 RCX: e81b3edefcc17700
RDX: 0000000000000001 RSI: ffffffff8db84532 RDI: ffffffff8223a96e
RBP: ffffc90002d6f430 R08: ffffc90002d6f4e0 R09: 0000000000000000
R10: ffffc90002d6f3f8 R11: fffff520005ade81 R12: ffff88801ece1cc0
R13: ffff88810ad12380 R14: dffffc0000000000 R15: 1ffff920005ade7e
 arch_stack_walk+0xfc/0x150
 stack_trace_save+0x9c/0xe0
 kasan_save_track+0x3e/0x80
 __kasan_kmalloc+0x93/0xb0
 __kmalloc_cache_noprof+0x230/0x3d0
 kmem_cache_free+0x166/0x400
 exit_mmap+0x53f/0xb50
 __mmput+0x118/0x420
 exit_mm+0x1da/0x2c0
 do_exit+0x648/0x22e0
 do_group_exit+0x21c/0x2d0
 get_signal+0x1286/0x1340
 arch_do_signal_or_restart+0x9a/0x750
 exit_to_user_mode_loop+0x75/0x110
 do_syscall_64+0x2bd/0x3b0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7eff9878e929
Code: Unable to access opcode bytes at 0x7eff9878e8ff.
RSP: 002b:00007eff995a30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 00007eff989b5fa8 RCX: 00007eff9878e929
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007eff989b5fa8
RBP: 00007eff989b5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007eff989b5fac
R13: 0000000000000000 R14: 00007ffda0cf8110 R15: 00007ffda0cf81f8
 </TASK>
ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
