=============================
WARNING: suspicious RCU usage
6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0 Not tainted
-----------------------------
net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
5 locks held by kworker/u8:7/2419:
#0: ffff88802b068148 ((wq_completion)krdsd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
#0: ffff88802b068148 ((wq_completion)krdsd){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
#1: ffffc90009ab7d00 ((work_completion)(&cp->cp_down_w)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
#1: ffffc90009ab7d00 ((work_completion)(&cp->cp_down_w)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
#2: ffffc90000a18c00 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1789
#3: ffff888046708cb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff888046708cb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x50/0x440 net/bridge/br_stp_timer.c:86
#4: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#4: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#4: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: br_mst_set_state+0x171/0x7a0 net/bridge/br_mst.c:105
stack backtrace:
CPU: 1 PID: 2419 Comm: kworker/u8:7 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: krdsd rds_shutdown_worker
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
nbp_vlan_group net/bridge/br_private.h:1599 [inline]
br_mst_set_state+0x29e/0x7a0 net/bridge/br_mst.c:106
br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
br_forward_delay_timer_expired+0x9a/0x440 net/bridge/br_stp_timer.c:92
call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2417 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
run_timer_base kernel/time/timer.c:2437 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:236 [inline]
RIP: 0010:__sanitizer_cov_trace_switch+0xa4/0x120 kernel/kcov.c:341
Code: 8b 00 00 00 4c 8b 4c 24 20 65 4c 8b 1c 25 00 d5 03 00 31 d2 eb 08 48 ff c2 49 39 d2 74 71 4c 8b 74 d6 10 65 8b 05 64 a8 6d 7e 00 01 ff 00 74 11 a9 00 01 00 00 74 de 41 83 bb 1c 16 00 00 00
RSP: 0018:ffffc90009ab75e0 EFLAGS: 00000202
RAX: 0000000080000001 RBX: 0000000000000000 RCX: ffff888029f49e00
RDX: 0000000000000007 RSI: ffffffff8e1a1380 RDI: 0000000000000004
RBP: 0000000000000004 R08: 0000000000000005 R09: ffffffff8140f71e
R10: 0000000000000008 R11: ffff888029f49e00 R12: ffffffff8fbe6858
R13: dffffc0000000000 R14: 0000000000000009 R15: 1ffff92001356edc
unwind_next_frame+0x7be/0x2a00 arch/x86/kernel/unwind_orc.c:515
arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
ref_tracker_free+0x105/0x7e0 lib/ref_tracker.c:239
__netns_tracker_free include/net/net_namespace.h:348 [inline]
put_net_track include/net/net_namespace.h:363 [inline]
__sk_destruct+0x37d/0x5f0 net/core/sock.c:2204
inet_release+0x17d/0x200 net/ipv4/af_inet.c:437
__sock_release net/socket.c:659 [inline]
sock_release+0x82/0x150 net/socket.c:687
rds_tcp_conn_path_shutdown+0x20d/0x2e0 net/rds/tcp_connect.c:220
rds_conn_shutdown+0x3b4/0x890 net/rds/connection.c:398
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
bridge0: port 2(bridge_slave_1) entered forwarding state
----------------
Code disassembly (best guess):
0: 8b 00 mov (%rax),%eax
2: 00 00 add %al,(%rax)
4: 4c 8b 4c 24 20 mov 0x20(%rsp),%r9
9: 65 4c 8b 1c 25 00 d5 mov %gs:0x3d500,%r11
10: 03 00
12: 31 d2 xor %edx,%edx
14: eb 08 jmp 0x1e
16: 48 ff c2 inc %rdx
19: 49 39 d2 cmp %rdx,%r10
1c: 74 71 je 0x8f
1e: 4c 8b 74 d6 10 mov 0x10(%rsi,%rdx,8),%r14
23: 65 8b 05 64 a8 6d 7e mov %gs:0x7e6da864(%rip),%eax # 0x7e6da88e
* 2a: a9 00 01 ff 00 test $0xff0100,%eax <-- trapping instruction
2f: 74 11 je 0x42
31: a9 00 01 00 00 test $0x100,%eax
36: 74 de je 0x16
38: 41 83 bb 1c 16 00 00 cmpl $0x0,0x161c(%r11)
3f: 00