=============================
WARNING: suspicious RCU usage
6.10.0-rc1-syzkaller-00163-gd6301802607b #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
8 locks held by modprobe/10407:
#0: ffff88807efe84a8 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:678 [inline]
#0: ffff88807efe84a8 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x2f9/0x6e0 mm/memory.c:5844
#1: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#1: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#1: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: do_fault_around mm/memory.c:4883 [inline]
#1: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: do_read_fault mm/memory.c:4917 [inline]
#1: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: do_fault mm/memory.c:5056 [inline]
#1: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: do_pte_missing mm/memory.c:3903 [inline]
#1: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: handle_pte_fault+0x2bf5/0x7130 mm/memory.c:5380
#2: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#2: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#2: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: filemap_map_pages+0x24f/0x1e70 mm/filemap.c:3614
#3: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#3: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#3: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x82/0x380 mm/pgtable-generic.c:287
#4: ffff88807e3549d8 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffff88807e3549d8 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x1ba/0x300 mm/pgtable-generic.c:375
#5: ffffc90000a18c00 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1789
#6: ffff888022ab4cb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#6: ffff888022ab4cb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x50/0x440 net/bridge/br_stp_timer.c:86
#7: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#7: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#7: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: br_mst_set_state+0x171/0x7a0 net/bridge/br_mst.c:105
stack backtrace:
CPU: 1 PID: 10407 Comm: modprobe Not tainted 6.10.0-rc1-syzkaller-00163-gd6301802607b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
nbp_vlan_group net/bridge/br_private.h:1599 [inline]
br_mst_set_state+0x29e/0x7a0 net/bridge/br_mst.c:106
br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88
call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2417 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
run_timer_base kernel/time/timer.c:2437 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:236 [inline]
RIP: 0010:__sanitizer_cov_trace_switch+0xc3/0x120 kernel/kcov.c:341
Code: 8b 74 d6 10 65 8b 05 64 b8 6d 7e a9 00 01 ff 00 74 11 a9 00 01 00 00 74 de 41 83 bb 1c 16 00 00 00 74 d4 41 8b 83 f8 15 00 00 <83> f8 03 75 c8 49 8b 8b 00 16 00 00 45 8b bb fc 15 00 00 49 c1 e7
RSP: 0000:ffffc90002d1f698 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffea00015cfb00 RCX: ffff88806d469e00
RDX: 0000000000000001 RSI: ffffffff8e3e4ac0 RDI: ffffea00015cfb00
RBP: ffffc90002d1f950 R08: 0000000000000007 R09: ffffffff81cd66e3
R10: 0000000000000002 R11: ffff88806d469e00 R12: ffffc90002d1f8a0
R13: dffffc0000000000 R14: 0000000000000406 R15: ffffc90002d1f8b8
xas_retry include/linux/xarray.h:1528 [inline]
next_uptodate_folio+0x73/0xb10 mm/filemap.c:3469
filemap_map_pages+0x1338/0x1e70 mm/filemap.c:3652
do_fault_around mm/memory.c:4884 [inline]
do_read_fault mm/memory.c:4917 [inline]
do_fault mm/memory.c:5056 [inline]
do_pte_missing mm/memory.c:3903 [inline]
handle_pte_fault+0x3c13/0x7130 mm/memory.c:5380
__handle_mm_fault mm/memory.c:5523 [inline]
handle_mm_fault+0x10df/0x1ba0 mm/memory.c:5688
do_user_addr_fault arch/x86/mm/fault.c:1338 [inline]
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f27aa800439
Code: fe 7f 5c 17 e1 e9 cf fe ff ff 0f 1f 80 00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 27 01 00 00 fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 e9 30 01 00 00 66
RSP: 002b:00007ffe01f826b8 EFLAGS: 00010287
RAX: 0000000000000770 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00007f27aa94a770 RSI: 00007f27aa94a770 RDI: 00007f27aa94a770
RBP: 00007ffe01f82c60 R08: 000055de4ae51910 R09: 00007f27aa96ab5d
R10: 00000000000000a9 R11: 0000000000000000 R12: 00007ffe01f82c70
R13: 00007ffe01f82ff0 R14: 00007f27aa94a7ed R15: 00007f27aa994a80
bridge0: port 1(bridge_slave_0) entered learning state
bridge0: port 2(bridge_slave_1) entered learning state
----------------
Code disassembly (best guess):
0: 8b 74 d6 10 mov 0x10(%rsi,%rdx,8),%esi
4: 65 8b 05 64 b8 6d 7e mov %gs:0x7e6db864(%rip),%eax # 0x7e6db86f
b: a9 00 01 ff 00 test $0xff0100,%eax
10: 74 11 je 0x23
12: a9 00 01 00 00 test $0x100,%eax
17: 74 de je 0xfffffff7
19: 41 83 bb 1c 16 00 00 cmpl $0x0,0x161c(%r11)
20: 00
21: 74 d4 je 0xfffffff7
23: 41 8b 83 f8 15 00 00 mov 0x15f8(%r11),%eax
* 2a: 83 f8 03 cmp $0x3,%eax <-- trapping instruction
2d: 75 c8 jne 0xfffffff7
2f: 49 8b 8b 00 16 00 00 mov 0x1600(%r11),%rcx
36: 45 8b bb fc 15 00 00 mov 0x15fc(%r11),%r15d
3d: 49 rex.WB
3e: c1 .byte 0xc1
3f: e7 .byte 0xe7