------------[ cut here ]------------
Looking for class "&ht->mutex" with key br_mdb_hash_init.__key.56, but found a different class "key" with the same key
WARNING: kernel/locking/lockdep.c:958 at look_up_lock_class+0x8c/0x110 kernel/locking/lockdep.c:955, CPU#0: kworker/0:4/5710
Modules linked in:
CPU: 0 UID: 0 PID: 5710 Comm: kworker/0:4 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:look_up_lock_class+0x9a/0x110 kernel/locking/lockdep.c:955
Code: 00 00 49 3b 46 18 0f 84 82 00 00 00 49 81 3e d0 44 58 94 74 79 48 8d 3d 44 f2 94 04 49 8b 16 49 8b 76 18 48 8b 8b b8 00 00 00 <67> 48 0f b9 3a eb 5d 90 89 f3 e8 67 0a f4 f8 e8 32 5c be f5 48 c7
RSP: 0018:ffffc90000007540 EFLAGS: 00010006
RAX: ffffffff8c6bb940 RBX: ffffffff94469d00 RCX: ffffffff8c6bb940
RDX: ffffffff9af2cfc0 RSI: ffffffff8c6bb900 RDI: ffffffff907ddb20
RBP: 00000000ffffffff R08: 0000000000000100 R09: 0000000000000002
R10: 000000000000dd86 R11: 0000000000000300 R12: 0000000000000246
R13: ffff88807bf58000 R14: ffff888033575838 R15: ffffffff9af2cfc0
FS: 0000000000000000(0000) GS:ffff888124cb7000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc4c1c09000 CR3: 000000007472e000 CR4: 00000000003526f0
Call Trace:
match_held_lock+0x9a/0x120 kernel/locking/lockdep.c:5364
__lock_is_held kernel/locking/lockdep.c:5654 [inline]
lock_is_held_type+0x89/0x150 kernel/locking/lockdep.c:6016
__rhashtable_lookup include/linux/rhashtable.h:623 [inline]
rhashtable_lookup include/linux/rhashtable.h:668 [inline]
br_mdb_ip_get_rcu+0x68/0x650 net/bridge/br_multicast.c:102
br_mdb_entry_skb_get+0x587/0x7c0 net/bridge/br_multicast.c:198
br_dev_xmit+0xd23/0x19d0 net/bridge/br_device.c:103
__netdev_start_xmit include/linux/netdevice.h:5433 [inline]
netdev_start_xmit include/linux/netdevice.h:5442 [inline]
xmit_one net/core/dev.c:3937 [inline]
dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3953
__dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4926
dev_queue_xmit include/linux/netdevice.h:3461 [inline]
mrp_queue_xmit net/802/mrp.c:365 [inline]
mrp_join_timer+0x543/0x7f0 net/802/mrp.c:609
call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x223/0x840 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:preempt_schedule_irq+0x46/0x90 kernel/sched/core.c:7575
Code: 49 be 00 00 00 00 00 fc ff df eb 09 48 f7 03 10 00 00 00 74 53 bf 01 00 00 00 e8 d5 18 ab f5 e8 80 58 e6 f5 fb bf 01 00 00 00 15 a1 ff ff 9c 58 fa a9 00 02 00 00 74 05 e8 46 5a e6 f5 bf 01
RSP: 0018:ffffc90004a2e278 EFLAGS: 00000206
RAX: 000000000016888b RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000006 RSI: ffffffff8e47d8da RDI: 0000000000000001
RBP: 0000000000000000 R08: ffffffff907a9cbf R09: 1ffffffff20f5397
R10: dffffc0000000000 R11: fffffbfff20f5398 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:524 [inline]
irqentry_exit+0x14f/0x910 kernel/entry/common.c:154
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:679
RIP: 0010:memset_orig+0x8a/0xb0 arch/x86/lib/memset_64.S:106
Code: 89 d1 83 e1 38 74 14 c1 e9 03 66 0f 1f 44 00 00 ff c9 48 89 07 48 8d 7f 08 75 f5 83 e2 07 74 0a ff ca 88 07 48 8d 7f 01 75 f6 <4c> 89 d0 c3 cc cc cc cc 48 83 fa 07 76 e3 48 89 07 49 c7 c0 08 00
RSP: 0018:ffffc90004a2e398 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90004a2e498 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90004a2e4a8
RBP: 1ffffffff22b0957 R08: ffffc90004a2e4a7 R09: 0000000000000000
R10: ffffc90004a2e498 R11: fffff52000945c95 R12: dffffc0000000000
R13: ffffffff91584aba R14: ffffc90004a2e448 R15: ffffc90004a2e490
unwind_next_frame+0xd04/0x2550 arch/x86/kernel/unwind_orc.c:621
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2779 [inline]
slab_free mm/slub.c:6544 [inline]
kfree+0x1c5/0x650 mm/slub.c:6837
__drm_atomic_commit_free+0x20f/0x230 drivers/gpu/drm/drm_atomic.c:419
kref_put include/linux/kref.h:65 [inline]
drm_atomic_commit_put include/drm/drm_atomic.h:713 [inline]
drm_client_modeset_commit_atomic+0x6ec/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1110
drm_client_modeset_commit_locked+0xcb/0x4d0 drivers/gpu/drm/drm_client_modeset.c:1207
drm_client_modeset_commit+0x4a/0x70 drivers/gpu/drm/drm_client_modeset.c:1233
drm_fb_helper_single_fb_probe drivers/gpu/drm/drm_fb_helper.c:1539 [inline]
__drm_fb_helper_initial_config_and_unlock+0x169e/0x1b50 drivers/gpu/drm/drm_fb_helper.c:1725
drm_fbdev_client_hotplug+0x16c/0x230 drivers/gpu/drm/clients/drm_fbdev_client.c:66
drm_client_register+0x16e/0x200 drivers/gpu/drm/drm_client.c:143
drm_fbdev_client_setup+0x1a0/0x450 drivers/gpu/drm/clients/drm_fbdev_client.c:168
drm_client_setup+0x107/0x220 drivers/gpu/drm/clients/drm_client_setup.c:46
udl_usb_probe+0x137/0x150 drivers/gpu/drm/udl/udl_drv.c:105
usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c4/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c4/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3776
usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2708
hub_port_connect drivers/usb/core/hub.c:5580 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5720 [inline]
port_event drivers/usb/core/hub.c:5884 [inline]
hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5966
process_one_work kernel/workqueue.c:3407 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3490
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3571
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 49 3b 46 18 cmp 0x18(%r14),%rax
6: 0f 84 82 00 00 00 je 0x8e
c: 49 81 3e d0 44 58 94 cmpq $0xffffffff945844d0,(%r14)
13: 74 79 je 0x8e
15: 48 8d 3d 44 f2 94 04 lea 0x494f244(%rip),%rdi # 0x494f260
1c: 49 8b 16 mov (%r14),%rdx
1f: 49 8b 76 18 mov 0x18(%r14),%rsi
23: 48 8b 8b b8 00 00 00 mov 0xb8(%rbx),%rcx
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: eb 5d jmp 0x8e
31: 90 nop
32: 89 f3 mov %esi,%ebx
34: e8 67 0a f4 f8 call 0xf8f40aa0
39: e8 32 5c be f5 call 0xf5be5c70
3e: 48 rex.W
3f: c7 .byte 0xc7