=============================
WARNING: suspicious RCU usage
6.8.0-rc2-syzkaller-00224-g3871aa01e1a7 #0 Not tainted
-----------------------------
net/netfilter/ipset/ip_set_hash_gen.h:455 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz-executor.0/14371:
#0: ffffffff8e1d56b0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:635 [inline]
#0: ffffffff8e1d56b0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1685 [inline]
#0: ffffffff8e1d56b0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x271/0x21b0 kernel/fork.c:1734
#1: ffff88806cf15720 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:124 [inline]
#1: ffff88806cf15720 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:636 [inline]
#1: ffff88806cf15720 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1685 [inline]
#1: ffff88806cf15720 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x291/0x21b0 kernel/fork.c:1734
#2: ffff88802cc25720 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:115 [inline]
#2: ffff88802cc25720 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:645 [inline]
#2: ffff88802cc25720 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm kernel/fork.c:1685 [inline]
#2: ffff88802cc25720 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3cb/0x21b0 kernel/fork.c:1734
#3: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#3: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2184 [inline]
#3: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xcfc/0x1810 kernel/rcu/tree.c:2465
stack backtrace:
CPU: 1 PID: 14371 Comm: syz-executor.0 Not tainted 6.8.0-rc2-syzkaller-00224-g3871aa01e1a7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x220/0x340 kernel/locking/lockdep.c:6712
hash_netportnet6_destroy+0xf0/0x2c0 net/netfilter/ipset/ip_set_hash_gen.h:455
ip_set_destroy_set net/netfilter/ipset/ip_set_core.c:1180 [inline]
ip_set_destroy_set_rcu+0x6a/0xe0 net/netfilter/ipset/ip_set_core.c:1190
rcu_do_batch kernel/rcu/tree.c:2190 [inline]
rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465
__do_softirq+0x2bb/0x942 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1c0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x30 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:lock_release+0x626/0x9d0 kernel/locking/lockdep.c:5778
Code: 3c 3b 00 74 08 4c 89 f7 e8 a7 44 84 00 f6 84 24 91 00 00 00 02 75 77 41 f7 c5 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 27 00 00 00 00 4b c7 44 27 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc9000362f640 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff920006c5eda RCX: ffffc9000362f603
RDX: 0000000000000003 RSI: ffffffff8baac6e0 RDI: ffffffff8bfe67e0
RBP: ffffc9000362f770 R08: ffffffff8f85556f R09: 1ffffffff1f0aaad
R10: dffffc0000000000 R11: fffffbfff1f0aaae R12: 1ffff920006c5ed4
R13: 0000000000000246 R14: ffffc9000362f6d0 R15: dffffc0000000000
up_write+0x79/0x580 kernel/locking/rwsem.c:1631
vma_start_write include/linux/mm.h:724 [inline]
dup_userfaultfd+0x270/0x820 fs/userfaultfd.c:700
dup_mmap kernel/fork.c:702 [inline]
dup_mm kernel/fork.c:1685 [inline]
copy_mm+0xe08/0x21b0 kernel/fork.c:1734
copy_process+0x1d73/0x3fc0 kernel/fork.c:2497
kernel_clone+0x21d/0x8d0 kernel/fork.c:2902
__do_sys_clone kernel/fork.c:3045 [inline]
__se_sys_clone kernel/fork.c:3029 [inline]
__x64_sys_clone+0x258/0x2a0 kernel/fork.c:3029
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f2cb3e7add3
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffe96039028 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2cb3e7add3
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 00005555556c1750 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
----------------
Code disassembly (best guess):
0: 3c 3b cmp $0x3b,%al
2: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
6: 89 f7 mov %esi,%edi
8: e8 a7 44 84 00 call 0x8444b4
d: f6 84 24 91 00 00 00 testb $0x2,0x91(%rsp)
14: 02
15: 75 77 jne 0x8e
17: 41 f7 c5 00 02 00 00 test $0x200,%r13d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp)
28: e0 45
* 2a: 4b c7 04 27 00 00 00 movq $0x0,(%r15,%r12,1) <-- trapping instruction
31: 00
32: 4b c7 44 27 08 00 00 movq $0x0,0x8(%r15,%r12,1)
39: 00 00
3b: 65 gs
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 04 25 add $0x25,%al