=============================
WARNING: suspicious RCU usage
6.9.0-rc6-syzkaller-00113-g49a73b1652c5 #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.4/20594:
#0: ffffc90000a08c00 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1790
#1: ffff888069d54cb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#1: ffff888069d54cb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x50/0x440 net/bridge/br_stp_timer.c:86
stack backtrace:
CPU: 1 PID: 20594 Comm: syz-executor.4 Not tainted 6.9.0-rc6-syzkaller-00113-g49a73b1652c5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
nbp_vlan_group net/bridge/br_private.h:1599 [inline]
br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105
br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88
call_timer_fn+0x190/0x650 kernel/time/timer.c:1793
expire_timers kernel/time/timer.c:1844 [inline]
__run_timers kernel/time/timer.c:2418 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429
run_timer_base kernel/time/timer.c:2438 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448
__do_softirq+0x2c8/0x980 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:arch_stack_walk+0x135/0x1b0 arch/x86/kernel/stacktrace.c:27
Code: 89 de e8 de 42 5e 00 85 db 74 4b 4c 8d bd 70 ff ff ff 4c 89 ff e8 7b 7b 09 00 48 89 c3 31 ff 48 89 c6 e8 5e 43 5e 00 48 85 db <74> 31 4c 89 f7 48 89 de 4d 89 eb e8 8b 95 53 0a 84 c0 74 26 4c 89
RSP: 0018:ffffc900046df940 EFLAGS: 00000282
RAX: 0000000000000000 RBX: ffffffff81fa85e6 RCX: ffff888025e50000
RDX: 0000000000000000 RSI: ffffffff81fa85e6 RDI: 0000000000000000
RBP: ffffc900046df9d0 R08: ffffffff8137d242 R09: ffffffff814168df
R10: 0000000000000003 R11: ffff888025e50000 R12: ffff888025e50000
R13: ffffffff8181f000 R14: ffffc900046dfa20 R15: ffffc900046df940
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kmem_cache_free+0x10b/0x2c0 mm/slub.c:4344
do_unlinkat+0x7b0/0x830 fs/namei.c:4422
__do_sys_unlink fs/namei.c:4447 [inline]
__se_sys_unlink fs/namei.c:4445 [inline]
__x64_sys_unlink+0x49/0x60 fs/namei.c:4445
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc3e167d4d7
Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcd50897b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3e167d4d7
RDX: 00007ffcd50897e0 RSI: 00007ffcd5089870 RDI: 00007ffcd5089870
RBP: 00007ffcd5089870 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffcd508a930
R13: 00007fc3e16c93b9 R14: 00000000000ee75d R15: 0000000000000005
vkms_vblank_simulate: vblank timer overrun
bridge0: port 1(bridge_slave_0) entered learning state
bridge0: port 2(bridge_slave_1) entered learning state
----------------
Code disassembly (best guess):
0: 89 de mov %ebx,%esi
2: e8 de 42 5e 00 call 0x5e42e5
7: 85 db test %ebx,%ebx
9: 74 4b je 0x56
b: 4c 8d bd 70 ff ff ff lea -0x90(%rbp),%r15
12: 4c 89 ff mov %r15,%rdi
15: e8 7b 7b 09 00 call 0x97b95
1a: 48 89 c3 mov %rax,%rbx
1d: 31 ff xor %edi,%edi
1f: 48 89 c6 mov %rax,%rsi
22: e8 5e 43 5e 00 call 0x5e4385
27: 48 85 db test %rbx,%rbx
* 2a: 74 31 je 0x5d <-- trapping instruction
2c: 4c 89 f7 mov %r14,%rdi
2f: 48 89 de mov %rbx,%rsi
32: 4d 89 eb mov %r13,%r11
35: e8 8b 95 53 0a call 0xa5395c5
3a: 84 c0 test %al,%al
3c: 74 26 je 0x64
3e: 4c rex.WR
3f: 89 .byte 0x89