=============================
WARNING: suspicious RCU usage
6.10.0-rc1-syzkaller-00163-gd6301802607b #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
6 locks held by kworker/1:1/45:
#0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc90000b57d00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc90000b57d00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
#2: ffffffff8f658248 (nf_conntrack_mutex){+.+.}-{3:3}, at: nf_ct_iterate_cleanup+0x41/0x4f0 net/netfilter/nf_conntrack_core.c:2403
#3: ffffc90000a18c00 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1789
#4: ffff8880456f4cb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffff8880456f4cb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x50/0x440 net/bridge/br_stp_timer.c:86
#5: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#5: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#5: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: br_mst_set_state+0x171/0x7a0 net/bridge/br_mst.c:105
stack backtrace:
CPU: 1 PID: 45 Comm: kworker/1:1 Not tainted 6.10.0-rc1-syzkaller-00163-gd6301802607b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: events iterate_cleanup_work
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
nbp_vlan_group net/bridge/br_private.h:1599 [inline]
br_mst_set_state+0x29e/0x7a0 net/bridge/br_mst.c:106
br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88
call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2417 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
run_timer_base kernel/time/timer.c:2437 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:nf_ct_iterate_cleanup+0x88/0x4f0 net/netfilter/nf_conntrack_core.c:2404
Code: 00 fc ff df 4d 8d 7c 24 08 49 8d 44 24 10 48 89 44 24 20 49 8d 44 24 14 48 89 44 24 18 89 e8 89 eb 25 ff 03 00 00 48 c1 e0 06 <48> 8d 80 00 4d 06 8e 48 89 44 24 10 48 89 1c 24 48 8d 2c dd 00 00
RSP: 0018:ffffc90000b57a98 EFLAGS: 00000202
RAX: 0000000000001180 RBX: 0000000000000846 RCX: ffff888017e8da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000846 R08: ffffffff89a0e1b0 R09: 1ffffffff25f50c0
R10: dffffc0000000000 R11: fffffbfff25f50c1 R12: ffffc90000b57b20
R13: 1ffff11003c00845 R14: dffffc0000000000 R15: ffffc90000b57b28
iterate_cleanup_work+0x146/0x260 net/netfilter/nf_nat_masquerade.c:87
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
bridge0: port 1(bridge_slave_0) entered learning state
bridge0: port 2(bridge_slave_1) entered learning state
----------------
Code disassembly (best guess), 3 bytes skipped:
0: df 4d 8d fisttps -0x73(%rbp)
3: 7c 24 jl 0x29
5: 08 49 8d or %cl,-0x73(%rcx)
8: 44 24 10 rex.R and $0x10,%al
b: 48 89 44 24 20 mov %rax,0x20(%rsp)
10: 49 8d 44 24 14 lea 0x14(%r12),%rax
15: 48 89 44 24 18 mov %rax,0x18(%rsp)
1a: 89 e8 mov %ebp,%eax
1c: 89 eb mov %ebp,%ebx
1e: 25 ff 03 00 00 and $0x3ff,%eax
23: 48 c1 e0 06 shl $0x6,%rax
* 27: 48 8d 80 00 4d 06 8e lea -0x71f9b300(%rax),%rax <-- trapping instruction
2e: 48 89 44 24 10 mov %rax,0x10(%rsp)
33: 48 89 1c 24 mov %rbx,(%rsp)
37: 48 rex.W
38: 8d .byte 0x8d
39: 2c dd sub $0xdd,%al