=============================
WARNING: suspicious RCU usage
6.10.0-rc2-syzkaller-00022-g32f88d65f01b #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by kswapd0/112:
 #0: ffffffff8dd3a9a0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x166/0x1970 mm/vmscan.c:6798
 #1: ffffc90000007cb0 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11a/0x610 kernel/time/timer.c:1789
 #2: ffff888026970cb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff888026970cb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x4f/0x560 net/bridge/br_stp_timer.c:86
 #3: ffffffff8dbb5160 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
 #3: ffffffff8dbb5160 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
 #3: ffffffff8dbb5160 (rcu_read_lock){....}-{1:2}, at: br_mst_set_state+0x114/0x750 net/bridge/br_mst.c:105

stack backtrace:
CPU: 0 PID: 112 Comm: kswapd0 Not tainted 6.10.0-rc2-syzkaller-00022-g32f88d65f01b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:114
 lockdep_rcu_suspicious+0x20b/0x3b0 kernel/locking/lockdep.c:6712
 nbp_vlan_group net/bridge/br_private.h:1599 [inline]
 br_mst_set_state+0x5c8/0x750 net/bridge/br_mst.c:106
 br_set_state+0x542/0x880 net/bridge/br_stp.c:47
 br_forward_delay_timer_expired+0x312/0x560 net/bridge/br_stp_timer.c:88
 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1843 [inline]
 __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417
 __run_timer_base kernel/time/timer.c:2428 [inline]
 __run_timer_base kernel/time/timer.c:2421 [inline]
 run_timer_base+0x111/0x190 kernel/time/timer.c:2437
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 9a 77 8c f6 48 89 df e8 62 f4 8c f6 e8 1d a8 b5 f6 fb bf 01 00 00 00 <e8> 62 3c 7e f6 65 8b 05 c3 b4 23 75 85 c0 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc90000e87618 EFLAGS: 00000202
RAX: 000000000046be2f RBX: ffff888029817050 RCX: 1ffffffff2840295
RDX: 0000000000000000 RSI: ffffffff8b2cb8c0 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: fffffbfff283f05a
R10: ffffffff941f82d7 R11: 0000000000000002 R12: 0000000000000040
R13: dffffc0000000000 R14: ffff888029817000 R15: 0000000000000000
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 evict_folios+0x632/0x1bf0 mm/vmscan.c:4548
 try_to_shrink_lruvec+0x618/0x9b0 mm/vmscan.c:4749
 shrink_one+0x3f8/0x7c0 mm/vmscan.c:4788
 shrink_many mm/vmscan.c:4851 [inline]
 lru_gen_shrink_node+0x89f/0x1750 mm/vmscan.c:4951
 shrink_node mm/vmscan.c:5910 [inline]
 kswapd_shrink_node mm/vmscan.c:6720 [inline]
 balance_pgdat+0x1105/0x1970 mm/vmscan.c:6911
 kswapd+0x5ea/0xbf0 mm/vmscan.c:7180
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
bridge0: port 1(bridge_slave_0) entered learning state
bridge0: port 2(bridge_slave_1) entered learning state
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	f3 0f 1e fa          	endbr64
   5:	53                   	push   %rbx
   6:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	48 83 c7 18          	add    $0x18,%rdi
  12:	e8 9a 77 8c f6       	call   0xf68c77b1
  17:	48 89 df             	mov    %rbx,%rdi
  1a:	e8 62 f4 8c f6       	call   0xf68cf481
  1f:	e8 1d a8 b5 f6       	call   0xf6b5a841
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 62 3c 7e f6       	call   0xf67e3c91 <-- trapping instruction
  2f:	65 8b 05 c3 b4 23 75 	mov    %gs:0x7523b4c3(%rip),%eax        # 0x7523b4f9
  36:	85 c0                	test   %eax,%eax
  38:	74 06                	je     0x40
  3a:	5b                   	pop    %rbx
  3b:	c3                   	ret
  3c:	cc                   	int3
  3d:	cc                   	int3
  3e:	cc                   	int3
  3f:	cc                   	int3