vcan0: j1939_xtp_rx_abort_one: 0xffff8881bd8b9800: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session.
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
udevd/5595 is trying to acquire lock:
ffff8881add15070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360

but task is already holding lock:
ffff8881add15070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x1fb/0x8b0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&hsr->seqnr_lock);
  lock(&hsr->seqnr_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

locks held by udevd/5595: 13, last CPU#1:
 #0: ffffffff8f4ef978 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560
 #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550
 #2: ffffc90000a18cc0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0
 #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370
 #4: ffff8881add15070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_prp_supervision_frame+0x1fb/0x8b0
 #5: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb9/0x2b70
 #6: ffffffff8ed5c740 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3820
 #7: ffff888174252228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#4){+...}-{3:3}, at: __dev_queue_xmit+0x1143/0x3820
 #8: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540
 #9: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x203/0x1650
 #10: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540
 #11: ffffffff8ed5c740 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3820
 #12: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360

stack backtrace:
CPU: 1 UID: 0 PID: 5595 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150
 print_deadlock_bug+0x27a/0x290
 __lock_acquire+0x261c/0x2e50
 lock_acquire+0x115/0x350
 _raw_spin_lock_bh+0x36/0x50
 hsr_dev_xmit+0x237/0x360
 dev_hard_start_xmit+0x2cd/0x830
 __dev_queue_xmit+0x14c0/0x3820
 ip6_output+0x337/0x540
 ndisc_send_skb+0xcb2/0x1650
 ndisc_solicit+0x374/0x670
 __neigh_event_send+0xf0c/0x1510
 neigh_resolve_output+0x1a1/0x720
 ip6_output+0x337/0x540
 ip6tunnel_xmit+0x200/0x620
 ip6_tnl_xmit+0x2034/0x27e0
 __gre6_xmit+0xa5c/0xd80
 ip6gre_tunnel_xmit+0xa0d/0xf70
 dev_hard_start_xmit+0x2cd/0x830
 sch_direct_xmit+0x257/0x4c0
 __dev_queue_xmit+0x177f/0x3820
 hsr_forward_skb+0x1701/0x2b70
 send_prp_supervision_frame+0x49a/0x8b0
 hsr_announce+0x1db/0x370
 call_timer_fn+0x18d/0x5f0
 __run_timer_base+0x652/0x8b0
 run_timer_softirq+0xb7/0x170
 handle_softirqs+0x226/0x860
 __irq_exit_rcu+0xcb/0x220
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:lock_acquire+0x232/0x350
Code: ff ff ff e8 20 59 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 72 64 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 5c 44 0a cc 48 8d 3d f7 30 da
RSP: 0018:ffffc90004adf3e0 EFLAGS: 00000292
RAX: c11de0956a9e6e00 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 00000000f234a143 RSI: ffffffff8e6fcd61 RDI: ffffffff8c6d9480
RBP: ffff88816d9bda00 R08: c900000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8ed5c6e0 R12: ffffffff8ed5c6e0
R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246
 unwind_next_frame+0xac/0x2550
 arch_stack_walk+0x11b/0x150
 stack_trace_save+0xa9/0x100
 kasan_save_track+0x3e/0x80
 kasan_save_free_info+0x40/0x50
 __kasan_slab_free+0x5c/0x80
 kfree+0x1c5/0x650
 tomoyo_realpath_from_path+0x605/0x640
 tomoyo_path_perm+0x283/0x560
 security_inode_getattr+0x12b/0x310
 vfs_getattr+0x23/0x70
 vfs_statx_path+0x2b/0x230
 vfs_statx+0x12e/0x200
 vfs_fstatat+0x11b/0x170
 __x64_sys_newfstatat+0x151/0x200
 do_syscall_64+0x166/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6cabb165f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007fff32b8e918 EFLAGS: 00000202 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007fff32b8e9b8 RCX: 00007f6cabb165f4
RDX: 00007fff32b8e928 RSI: 00007fff32b8f2d8 RDI: 00000000ffffff9c
RBP: 00007fff32b8f2d8 R08: 0000000000000000 R09: 00007fff32b8eb98
R10: 0000000000000100 R11: 0000000000000202 R12: 0000000000000005
R13: 000055dc2ef66b10 R14: 000055dc2ef36780 R15: 00007fff32b8f2e6
 </TASK>
