=============================
WARNING: suspicious RCU usage
6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
7 locks held by kworker/u8:9/2486:
#0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc90008f07d00 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc90008f07d00 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
#2: ffff888062a08768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5966 [inline]
#2: ffff888062a08768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x35/0x260 net/wireless/core.c:424
#3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: ieee80211_update_sta_info net/mac80211/ibss.c:984 [inline]
#3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: ieee80211_rx_bss_info net/mac80211/ibss.c:1097 [inline]
#3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1578 [inline]
#3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: ieee80211_ibss_rx_queued_mgmt+0xf7e/0x2d70 net/mac80211/ibss.c:1605
#4: ffffc90000007c00 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1789
#5: ffff888063b04cb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#5: ffff888063b04cb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x50/0x440 net/bridge/br_stp_timer.c:86
#6: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#6: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#6: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: br_mst_set_state+0x171/0x7a0 net/bridge/br_mst.c:105
stack backtrace:
CPU: 0 PID: 2486 Comm: kworker/u8:9 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
nbp_vlan_group net/bridge/br_private.h:1599 [inline]
br_mst_set_state+0x29e/0x7a0 net/bridge/br_mst.c:106
br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88
call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2417 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
run_timer_base kernel/time/timer.c:2437 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:ieee80211_sta_get_rates+0x317/0x660 net/mac80211/util.c:1552
Code: fc ff df 45 31 ff 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 67 32 f8 f6 49 63 c7 4d 8b 36 4c 8d 2c 40 4b 8d 1c ae <48> 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84
RSP: 0018:ffffc90008f07798 EFLAGS: 00000246
RAX: 000000000000000a RBX: ffff888062a0dc90 RCX: ffff888029941e00
RDX: 0000000000000000 RSI: 0000000000000168 RDI: 00000000000000f0
RBP: 00000000000000f0 R08: ffffffff8b03b6fc R09: 1ffffffff1f5aa15
R10: dffffc0000000000 R11: fffffbfff1f5aa16 R12: dffffc0000000000
R13: 000000000000001e R14: ffff888062a0dc18 R15: 000000000000000a
ieee80211_update_sta_info net/mac80211/ibss.c:988 [inline]
ieee80211_rx_bss_info net/mac80211/ibss.c:1097 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1578 [inline]
ieee80211_ibss_rx_queued_mgmt+0x11e1/0x2d70 net/mac80211/ibss.c:1605
ieee80211_iface_process_skb net/mac80211/iface.c:1605 [inline]
ieee80211_iface_work+0x8a3/0xf10 net/mac80211/iface.c:1659
cfg80211_wiphy_work+0x221/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
bridge0: port 2(bridge_slave_1) entered learning state
----------------
Code disassembly (best guess), 2 bytes skipped:
0: df 45 31 filds 0x31(%rbp)
3: ff 4c 89 f0 decl -0x10(%rcx,%rcx,4)
7: 48 c1 e8 03 shr $0x3,%rax
b: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
10: 74 08 je 0x1a
12: 4c 89 f7 mov %r14,%rdi
15: e8 67 32 f8 f6 call 0xf6f83281
1a: 49 63 c7 movslq %r15d,%rax
1d: 4d 8b 36 mov (%r14),%r14
20: 4c 8d 2c 40 lea (%rax,%rax,2),%r13
24: 4b 8d 1c ae lea (%r14,%r13,4),%rbx
* 28: 48 89 d8 mov %rbx,%rax <-- trapping instruction
2b: 48 c1 e8 03 shr $0x3,%rax
2f: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
36: fc ff df
39: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax
3d: 84 .byte 0x84