------------[ cut here ]------------
Looking for class "&ht->mutex" with key br_mdb_hash_init.__key.56, but found a different class "key" with the same key
WARNING: kernel/locking/lockdep.c:958 at look_up_lock_class+0x8c/0x110 kernel/locking/lockdep.c:955, CPU#1: kworker/1:4/5734
Modules linked in:
CPU: 1 UID: 0 PID: 5734 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:look_up_lock_class+0x9a/0x110 kernel/locking/lockdep.c:955
Code: 00 00 49 3b 46 18 0f 84 82 00 00 00 49 81 3e d0 44 58 94 74 79 48 8d 3d 44 f2 94 04 49 8b 16 49 8b 76 18 48 8b 8b b8 00 00 00 <67> 48 0f b9 3a eb 5d 90 89 f3 e8 67 0a f4 f8 e8 32 5c be f5 48 c7
RSP: 0018:ffffc90000a38260 EFLAGS: 00010006
RAX: ffffffff8c6bb940 RBX: ffffffff9446dd10 RCX: ffffffff8c6bb940
RDX: ffffffff9af2cfc0 RSI: ffffffff8c6bb900 RDI: ffffffff907ddb20
RBP: 00000000ffffffff R08: 0000000000000100 R09: 0200000000000000
R10: 00000000000002ff R11: 0200000000000000 R12: 0000000000000246
R13: ffff888021bb8000 R14: ffff888035759838 R15: ffffffff9af2cfc0
FS:  0000000000000000(0000) GS:ffff888124db7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5f92ff0078 CR3: 0000000074c30000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 match_held_lock+0x9a/0x120 kernel/locking/lockdep.c:5364
 __lock_is_held kernel/locking/lockdep.c:5654 [inline]
 lock_is_held_type+0x89/0x150 kernel/locking/lockdep.c:6016
 __rhashtable_lookup include/linux/rhashtable.h:623 [inline]
 rhashtable_lookup include/linux/rhashtable.h:668 [inline]
 br_mdb_ip_get_rcu+0x68/0x650 net/bridge/br_multicast.c:102
 br_mdb_entry_skb_get+0x587/0x7c0 net/bridge/br_multicast.c:198
 br_dev_xmit+0xd23/0x19d0 net/bridge/br_device.c:103
 __netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 netdev_start_xmit include/linux/netdevice.h:5442 [inline]
 xmit_one net/core/dev.c:3937 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3953
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4926
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip6_output+0x337/0x540 net/ipv6/ip6_output.c:248
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK include/linux/netfilter.h:325 [inline]
 ndisc_send_skb+0xcb2/0x1650 net/ipv6/ndisc.c:513
 addrconf_rs_timer+0x2d2/0x6c0 net/ipv6/addrconf.c:4078
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x223/0x840 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 5d 82 b8 f5 f7 c3 00 02 00 00 74 05 e8 f0 d2 e4 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 74 94 a9 f5 65 48 8b 05 2c e9 aa 07 48 85 c0 74 18 5b 41 5e c3
RSP: 0018:ffffc9000400e008 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001
RDX: 0000000000000007 RSI: ffffffff8e47d8da RDI: 0000000000000001
RBP: ffffc9000400e0c0 R08: ffffffff907a9cbf R09: 1ffffffff20f5397
R10: dffffc0000000000 R11: fffffbfff20f5398 R12: ffff88801da9fb40
R13: 0000000000000000 R14: ffff88801da9fb40 R15: 0000000000000000
 spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
 __slab_free+0x222/0x2c0 mm/slub.c:-1
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4714 [inline]
 slab_alloc_node mm/slub.c:5027 [inline]
 __kmalloc_cache_noprof+0x29a/0x600 mm/slub.c:5595
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 usb_control_msg+0x73/0x3e0 drivers/usb/core/message.c:157
 gud_usb_control_msg drivers/gpu/drm/gud/gud_drv.c:75 [inline]
 gud_usb_transfer+0x274/0x760 drivers/gpu/drm/gud/gud_drv.c:167
 gud_usb_set+0x71/0xd0 drivers/gpu/drm/gud/gud_drv.c:216
 gud_connector_detect+0xfa/0x2c0 drivers/gpu/drm/gud/gud_connector.c:162
 detect_connector_status drivers/gpu/drm/drm_probe_helper.c:349 [inline]
 drm_helper_probe_detect drivers/gpu/drm/drm_probe_helper.c:411 [inline]
 drm_helper_probe_single_connector_modes+0x4fa/0x1880 drivers/gpu/drm/drm_probe_helper.c:598
 drm_client_modeset_probe+0x4e8/0x60c0 drivers/gpu/drm/drm_client_modeset.c:869
 __drm_fb_helper_initial_config_and_unlock+0x10e/0x1b50 drivers/gpu/drm/drm_fb_helper.c:1717
 drm_fbdev_client_hotplug+0x16c/0x230 drivers/gpu/drm/clients/drm_fbdev_client.c:66
 drm_client_register+0x16e/0x200 drivers/gpu/drm/drm_client.c:143
 drm_fbdev_client_setup+0x1a0/0x450 drivers/gpu/drm/clients/drm_fbdev_client.c:168
 drm_client_setup+0x107/0x220 drivers/gpu/drm/clients/drm_client_setup.c:46
 gud_probe+0x11b9/0x13b0 drivers/gpu/drm/gud/gud_drv.c:655
 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708
 hub_port_connect drivers/usb/core/hub.c:5580 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
 port_event drivers/usb/core/hub.c:5884 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3407 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3490
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3571
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	49 3b 46 18          	cmp    0x18(%r14),%rax
   6:	0f 84 82 00 00 00    	je     0x8e
   c:	49 81 3e d0 44 58 94 	cmpq   $0xffffffff945844d0,(%r14)
  13:	74 79                	je     0x8e
  15:	48 8d 3d 44 f2 94 04 	lea    0x494f244(%rip),%rdi        # 0x494f260
  1c:	49 8b 16             	mov    (%r14),%rdx
  1f:	49 8b 76 18          	mov    0x18(%r14),%rsi
  23:	48 8b 8b b8 00 00 00 	mov    0xb8(%rbx),%rcx
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	eb 5d                	jmp    0x8e
  31:	90                   	nop
  32:	89 f3                	mov    %esi,%ebx
  34:	e8 67 0a f4 f8       	call   0xf8f40aa0
  39:	e8 32 5c be f5       	call   0xf5be5c70
  3e:	48                   	rex.W
  3f:	c7                   	.byte 0xc7