=============================
WARNING: suspicious RCU usage
6.9.0-rc7-syzkaller-00056-g45db3ab70092 #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
3 locks held by syz-executor.2/15305:
 #0: ffffffff8d7b0e20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
 #0: ffffffff8d7b0e20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
 #0: ffffffff8d7b0e20 (rcu_read_lock){....}-{1:2}, at: bpf_test_timer_enter+0x30/0x180 net/bpf/test_run.c:40
 #1: ffffc90000a08cb0 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11a/0x610 kernel/time/timer.c:1790
 #2: ffff88807882ccb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff88807882ccb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x4f/0x560 net/bridge/br_stp_timer.c:86

stack backtrace:
CPU: 1 PID: 15305 Comm: syz-executor.2 Not tainted 6.9.0-rc7-syzkaller-00056-g45db3ab70092 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:114
 lockdep_rcu_suspicious+0x20b/0x3b0 kernel/locking/lockdep.c:6712
 nbp_vlan_group net/bridge/br_private.h:1599 [inline]
 br_mst_set_state+0x4cd/0x5e0 net/bridge/br_mst.c:105
 br_set_state+0x542/0x880 net/bridge/br_stp.c:47
 br_forward_delay_timer_expired+0x311/0x560 net/bridge/br_stp_timer.c:88
 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1793
 expire_timers kernel/time/timer.c:1844 [inline]
 __run_timers+0x74b/0xaf0 kernel/time/timer.c:2418
 __run_timer_base kernel/time/timer.c:2429 [inline]
 __run_timer_base kernel/time/timer.c:2422 [inline]
 run_timer_base+0x111/0x190 kernel/time/timer.c:2438
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2448
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x33/0x60 kernel/kcov.c:207
Code: 0a 76 7e 65 8b 05 85 0a 76 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74 35 8b 82 14 16 00 00 85 c0 74 2b 8b 82 f0 15 00 00 <83> f8 02 75 20 48 8b 8a f8 15 00 00 8b 92 f4 15 00 00 48 8b 01 48
RSP: 0000:ffffc90003b5f728 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffc90002fd8048 RCX: ffffc9000c8bf000
RDX: ffff8880603b9e00 RSI: ffffffff819c4a64 RDI: ffffffff8d250f58
RBP: dffffc0000000000 R08: 000000000000000e R09: 0000000000000000
R10: ffffc90003b5fc18 R11: 0000000000000001 R12: ffffc90003b5f7a8
R13: 00000000000000b7 R14: ffffc90003b5fbd8 R15: 00000000000000b7
 ___bpf_prog_run+0x2824/0xabd0 kernel/bpf/core.c:1823
 __bpf_prog_run512+0xb7/0x100 kernel/bpf/core.c:2238
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 bpf_prog_run_pin_on_cpu include/linux/filter.h:681 [inline]
 bpf_flow_dissect+0x16d/0x3b0 net/core/flow_dissector.c:991
 bpf_prog_test_run_flow_dissector+0x444/0x700 net/bpf/test_run.c:1361
 bpf_prog_test_run kernel/bpf/syscall.c:4269 [inline]
 __sys_bpf+0xd56/0x4b40 kernel/bpf/syscall.c:5678
 __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5765
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faf7267dd69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faf733230c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007faf727abf80 RCX: 00007faf7267dd69
RDX: 0000000000000050 RSI: 00000000200008c0 RDI: 000000000000000a
RBP: 00007faf726ca49e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007faf727abf80 R15: 00007ffcb755d568
 </TASK>
bridge0: port 1(bridge_slave_0) entered learning state
bridge0: port 2(bridge_slave_1) entered learning state
----------------
Code disassembly (best guess):
   0:	0a 76 7e             	or     0x7e(%rsi),%dh
   3:	65 8b 05 85 0a 76 7e 	mov    %gs:0x7e760a85(%rip),%eax        # 0x7e760a8f
   a:	a9 00 01 ff 00       	test   $0xff0100,%eax
   f:	48 8b 34 24          	mov    (%rsp),%rsi
  13:	74 0f                	je     0x24
  15:	f6 c4 01             	test   $0x1,%ah
  18:	74 35                	je     0x4f
  1a:	8b 82 14 16 00 00    	mov    0x1614(%rdx),%eax
  20:	85 c0                	test   %eax,%eax
  22:	74 2b                	je     0x4f
  24:	8b 82 f0 15 00 00    	mov    0x15f0(%rdx),%eax
* 2a:	83 f8 02             	cmp    $0x2,%eax <-- trapping instruction
  2d:	75 20                	jne    0x4f
  2f:	48 8b 8a f8 15 00 00 	mov    0x15f8(%rdx),%rcx
  36:	8b 92 f4 15 00 00    	mov    0x15f4(%rdx),%edx
  3c:	48 8b 01             	mov    (%rcx),%rax
  3f:	48                   	rex.W