=============================
WARNING: suspicious RCU usage
5.16.0-rc4-next-20211210-syzkaller #0 Not tainted
-----------------------------
kernel/sched/core.c:9545 Illegal context switch in RCU-bh read-side critical section!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz-executor.1/32423:
 #0: ffff88807b8f71b0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1675 [inline]
 #0: ffff88807b8f71b0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_sendmsg+0x1d/0x40 net/ipv4/tcp.c:1439
 #1: ffffffff8bb818a0 (rcu_read_lock){....}-{1:2}, at: ip6_route_output_flags+0x0/0x320 net/ipv6/route.c:778
 #2: ffffffff8bb818a0 (rcu_read_lock){....}-{1:2}, at: ip6_pol_route+0x156/0x11e0 net/ipv6/route.c:2217
 #3: ffffffff8bb81840 (rcu_read_lock_bh){....}-{1:2}, at: rt6_probe net/ipv6/route.c:632 [inline]
 #3: ffffffff8bb81840 (rcu_read_lock_bh){....}-{1:2}, at: find_match.part.0+0x35a/0xd00 net/ipv6/route.c:752

stack backtrace:
CPU: 0 PID: 32423 Comm: syz-executor.1 Not tainted 5.16.0-rc4-next-20211210-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 __might_resched+0x235/0x2c0 kernel/sched/core.c:9545
 might_alloc include/linux/sched/mm.h:256 [inline]
 slab_pre_alloc_hook mm/slab.h:739 [inline]
 slab_alloc_node mm/slub.c:3145 [inline]
 slab_alloc mm/slub.c:3239 [inline]
 kmem_cache_alloc_trace+0x25d/0x2c0 mm/slub.c:3256
 kmalloc include/linux/slab.h:581 [inline]
 kzalloc include/linux/slab.h:715 [inline]
 ref_tracker_alloc+0xe1/0x430 lib/ref_tracker.c:74
 netdev_tracker_alloc include/linux/netdevice.h:3860 [inline]
 dev_hold_track include/linux/netdevice.h:3877 [inline]
 rt6_probe net/ipv6/route.c:661 [inline]
 find_match.part.0+0xac9/0xd00 net/ipv6/route.c:752
 find_match net/ipv6/route.c:825 [inline]
 __find_rr_leaf+0x17f/0xd20 net/ipv6/route.c:826
 find_rr_leaf net/ipv6/route.c:847 [inline]
 rt6_select net/ipv6/route.c:891 [inline]
 fib6_table_lookup+0x649/0xa20 net/ipv6/route.c:2185
 ip6_pol_route+0x1c5/0x11e0 net/ipv6/route.c:2221
 pol_lookup_func include/net/ip6_fib.h:580 [inline]
 fib6_rule_lookup+0x52a/0x6f0 net/ipv6/fib6_rules.c:120
 ip6_route_output_flags_noref+0x2e2/0x380 net/ipv6/route.c:2629
 ip6_route_output_flags+0x72/0x320 net/ipv6/route.c:2642
 ip6_route_output include/net/ip6_route.h:98 [inline]
 ip6_dst_lookup_tail+0x5ab/0x1620 net/ipv6/ip6_output.c:1070
 ip6_dst_lookup_flow+0x8c/0x1d0 net/ipv6/ip6_output.c:1200
 tcp_v6_connect+0xda3/0x1e00 net/ipv6/tcp_ipv6.c:283
 __inet_stream_connect+0x8cf/0xed0 net/ipv4/af_inet.c:658
 tcp_sendmsg_fastopen net/ipv4/tcp.c:1162 [inline]
 tcp_sendmsg_locked+0x1f3f/0x3190 net/ipv4/tcp.c:1204
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1440
 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:641
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 __sys_sendto+0x21c/0x320 net/socket.c:2036
 __do_sys_sendto net/socket.c:2048 [inline]
 __se_sys_sendto net/socket.c:2044 [inline]
 __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2044
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f69d9ad5e99
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f69d842a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f69d9be9030 RCX: 00007f69d9ad5e99
RDX: 0000000000000047 RSI: 0000000020000180 RDI: 0000000000000006
RBP: 00007f69d9b2fff1 R08: 0000000020b63fe4 R09: 000000000000001c
R10: 00000000200048c4 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc7176e56f R14: 00007f69d842a300 R15: 0000000000022000
 </TASK>
BUG: sleeping function called from invalid context at include/linux/sched/mm.h:256
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32423, name: syz-executor.1
preempt_count: 200, expected: 0
RCU nest depth: 2, expected: 0
4 locks held by syz-executor.1/32423:
 #0: ffff88807b8f71b0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1675 [inline]
 #0: ffff88807b8f71b0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_sendmsg+0x1d/0x40 net/ipv4/tcp.c:1439
 #1: ffffffff8bb818a0 (rcu_read_lock){....}-{1:2}, at: ip6_route_output_flags+0x0/0x320 net/ipv6/route.c:778
 #2: ffffffff8bb818a0 (rcu_read_lock){....}-{1:2}, at: ip6_pol_route+0x156/0x11e0 net/ipv6/route.c:2217
 #3: ffffffff8bb81840 (rcu_read_lock_bh){....}-{1:2}, at: rt6_probe net/ipv6/route.c:632 [inline]
 #3: ffffffff8bb81840 (rcu_read_lock_bh){....}-{1:2}, at: find_match.part.0+0x35a/0xd00 net/ipv6/route.c:752
Preemption disabled at:
[<ffffffff87f62c37>] local_bh_disable include/linux/bottom_half.h:20 [inline]
[<ffffffff87f62c37>] rcu_read_lock_bh include/linux/rcupdate.h:746 [inline]
[<ffffffff87f62c37>] rt6_probe net/ipv6/route.c:633 [inline]
[<ffffffff87f62c37>] find_match.part.0+0x377/0xd00 net/ipv6/route.c:752
CPU: 0 PID: 32423 Comm: syz-executor.1 Not tainted 5.16.0-rc4-next-20211210-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9583
 might_alloc include/linux/sched/mm.h:256 [inline]
 slab_pre_alloc_hook mm/slab.h:739 [inline]
 slab_alloc_node mm/slub.c:3145 [inline]
 slab_alloc mm/slub.c:3239 [inline]
 kmem_cache_alloc_trace+0x25d/0x2c0 mm/slub.c:3256
 kmalloc include/linux/slab.h:581 [inline]
 kzalloc include/linux/slab.h:715 [inline]
 ref_tracker_alloc+0xe1/0x430 lib/ref_tracker.c:74
 netdev_tracker_alloc include/linux/netdevice.h:3860 [inline]
 dev_hold_track include/linux/netdevice.h:3877 [inline]
 rt6_probe net/ipv6/route.c:661 [inline]
 find_match.part.0+0xac9/0xd00 net/ipv6/route.c:752
 find_match net/ipv6/route.c:825 [inline]
 __find_rr_leaf+0x17f/0xd20 net/ipv6/route.c:826
 find_rr_leaf net/ipv6/route.c:847 [inline]
 rt6_select net/ipv6/route.c:891 [inline]
 fib6_table_lookup+0x649/0xa20 net/ipv6/route.c:2185
 ip6_pol_route+0x1c5/0x11e0 net/ipv6/route.c:2221
 pol_lookup_func include/net/ip6_fib.h:580 [inline]
 fib6_rule_lookup+0x52a/0x6f0 net/ipv6/fib6_rules.c:120
 ip6_route_output_flags_noref+0x2e2/0x380 net/ipv6/route.c:2629
 ip6_route_output_flags+0x72/0x320 net/ipv6/route.c:2642
 ip6_route_output include/net/ip6_route.h:98 [inline]
 ip6_dst_lookup_tail+0x5ab/0x1620 net/ipv6/ip6_output.c:1070
 ip6_dst_lookup_flow+0x8c/0x1d0 net/ipv6/ip6_output.c:1200
 tcp_v6_connect+0xda3/0x1e00 net/ipv6/tcp_ipv6.c:283
 __inet_stream_connect+0x8cf/0xed0 net/ipv4/af_inet.c:658
 tcp_sendmsg_fastopen net/ipv4/tcp.c:1162 [inline]
 tcp_sendmsg_locked+0x1f3f/0x3190 net/ipv4/tcp.c:1204
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1440
 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:641
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 __sys_sendto+0x21c/0x320 net/socket.c:2036
 __do_sys_sendto net/socket.c:2048 [inline]
 __se_sys_sendto net/socket.c:2044 [inline]
 __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2044
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f69d9ad5e99
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f69d842a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f69d9be9030 RCX: 00007f69d9ad5e99
RDX: 0000000000000047 RSI: 0000000020000180 RDI: 0000000000000006
RBP: 00007f69d9b2fff1 R08: 0000000020b63fe4 R09: 000000000000001c
R10: 00000000200048c4 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc7176e56f R14: 00007f69d842a300 R15: 0000000000022000
 </TASK>