Re: [syzbot] [kernel?] WARNING: ODEBUG bug in smpboot_thread_fn

[Thomas Gleixner <tglx@kernel.org>]

On Wed, May 06 2026 at 18:29, Thomas Gleixner wrote:
> On Mon, May 04 2026 at 05:23, syzbot wrote:
>>
>> ------------[ cut here ]------------
>> ODEBUG: free active (active state 0) object: ffff888033a47278 object type: timer_list hint: br_ip6_multicast_port_query_expired+0x0/0x380 net/bridge/br_multicast.c:-1
>
>                                                                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> An object which contains an active timer is RCU freed....

Unlike the other timer in the same object, the own_query timer is not
shut down in br_multicast_port_ctx_deinit()

Something kike the below.

Thanks,

        tglx
---
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2030,8 +2030,10 @@ void br_multicast_port_ctx_deinit(struct
 
 #if IS_ENABLED(CONFIG_IPV6)
 	timer_delete_sync(&pmctx->ip6_mc_router_timer);
+	timer_delete_sync(&pmctx->ip6_own_query_timer);
 #endif
 	timer_delete_sync(&pmctx->ip4_mc_router_timer);
+	timer_delete_sync(&pmctx->ip4_own_query_timer);
 
 	spin_lock_bh(&br->multicast_lock);
 	del |= br_ip6_multicast_rport_del(pmctx);