=============================
WARNING: suspicious RCU usage
6.8.0-rc2-syzkaller-00199-g021533194476 #0 Not tainted
-----------------------------
net/netfilter/ipset/ip_set_hash_gen.h:455 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
3 locks held by syz-fuzzer/5068:
#0: ffff888023133230 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1691 [inline]
#0: ffff888023133230 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x22/0x50 net/ipv4/tcp.c:1340
#1: ffffffff8e217820 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:303 [inline]
#1: ffffffff8e217820 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:3761 [inline]
#1: ffffffff8e217820 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:3842 [inline]
#1: ffffffff8e217820 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node+0x4f/0x380 mm/slub.c:3903
#2: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#2: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2184 [inline]
#2: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xcfc/0x1810 kernel/rcu/tree.c:2465
stack backtrace:
CPU: 0 PID: 5068 Comm: syz-fuzzer Not tainted 6.8.0-rc2-syzkaller-00199-g021533194476 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x220/0x340 kernel/locking/lockdep.c:6712
hash_netportnet6_destroy+0xf0/0x2c0 net/netfilter/ipset/ip_set_hash_gen.h:455
ip_set_destroy_set net/netfilter/ipset/ip_set_core.c:1180 [inline]
ip_set_destroy_set_rcu+0x6a/0xe0 net/netfilter/ipset/ip_set_core.c:1190
rcu_do_batch kernel/rcu/tree.c:2190 [inline]
rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465
__do_softirq+0x2bb/0x942 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1c0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x30 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:lock_acquire+0x25a/0x530 kernel/locking/lockdep.c:5758
Code: 2b 00 74 08 4c 89 f7 e8 54 21 81 00 f6 44 24 61 02 0f 85 8e 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc900043874c0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92000870ea4 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff8baac6e0 RDI: ffffffff8bfd9420
RBP: ffffc90004387610 R08: ffffffff92c52437 R09: 1ffffffff258a486
R10: dffffc0000000000 R11: fffffbfff258a487 R12: 1ffff92000870ea0
R13: dffffc0000000000 R14: ffffc90004387520 R15: 0000000000000246
__fs_reclaim_acquire mm/page_alloc.c:3692 [inline]
fs_reclaim_acquire+0x87/0x130 mm/page_alloc.c:3706
might_alloc include/linux/sched/mm.h:303 [inline]
slab_pre_alloc_hook mm/slub.c:3761 [inline]
slab_alloc_node mm/slub.c:3842 [inline]
kmem_cache_alloc_node+0x4f/0x380 mm/slub.c:3903
kmalloc_reserve+0x8a/0x260 net/core/skbuff.c:560
__alloc_skb+0x1b1/0x420 net/core/skbuff.c:651
alloc_skb_fclone include/linux/skbuff.h:1346 [inline]
tcp_stream_alloc_skb+0x3d/0x310 net/ipv4/tcp.c:872
tcp_sendmsg_locked+0xd8e/0x4d20 net/ipv4/tcp.c:1154
tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1341
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x1a6/0x270 net/socket.c:745
sock_write_iter+0x2dd/0x400 net/socket.c:1160
call_write_iter include/linux/fs.h:2085 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa81/0xcb0 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x40720e
Code: 48 83 ec 38 e8 13 00 00 00 48 83 c4 38 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 49 89 f2 48 89 fa 48 89 ce 48 89 df 0f 05 <48> 3d 01 f0 ff ff 76 15 48 f7 d8 48 89 c1 48 c7 c0 ff ff ff ff 48
RSP: 002b:000000c00b5e1660 EFLAGS: 00000212 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000040720e
RDX: 00000000000000f0 RSI: 000000c0003ea5c0 RDI: 0000000000000007
RBP: 000000c00b5e16a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 000000c00b5e17e0
R13: 0000000000000001 R14: 000000c004a54b60 R15: 000000000000000c
----------------
Code disassembly (best guess):
0: 2b 00 sub (%rax),%eax
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 54 21 81 00 call 0x812160
c: f6 44 24 61 02 testb $0x2,0x61(%rsp)
11: 0f 85 8e 01 00 00 jne 0x1a5
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1)
3a: 00 00
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 25 .byte 0x25