=============================
WARNING: suspicious RCU usage
6.8.0-rc2-syzkaller-00251-g6897cea71837 #0 Not tainted
-----------------------------
net/netfilter/ipset/ip_set_hash_gen.h:455 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
8 locks held by syz-executor.4/5092:
#0: ffffffff8e1d56b0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:635 [inline]
#0: ffffffff8e1d56b0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1685 [inline]
#0: ffffffff8e1d56b0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x271/0x21b0 kernel/fork.c:1734
#1: ffff88802f865720 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:124 [inline]
#1: ffff88802f865720 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:636 [inline]
#1: ffff88802f865720 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1685 [inline]
#1: ffff88802f865720 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x291/0x21b0 kernel/fork.c:1734
#2: ffff8880354e14a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:115 [inline]
#2: ffff8880354e14a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:645 [inline]
#2: ffff8880354e14a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm kernel/fork.c:1685 [inline]
#2: ffff8880354e14a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3cb/0x21b0 kernel/fork.c:1734
#3: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#3: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#3: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x82/0x380 mm/pgtable-generic.c:285
#4: ffff888022eae258 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#4: ffff888022eae258 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x1ba/0x300 mm/pgtable-generic.c:373
#5: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#5: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#5: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x82/0x380 mm/pgtable-generic.c:285
#6: ffff88802d648f48 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_pte_range mm/memory.c:1059 [inline]
#6: ffff88802d648f48 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_pmd_range mm/memory.c:1187 [inline]
#6: ffff88802d648f48 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_pud_range mm/memory.c:1224 [inline]
#6: ffff88802d648f48 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_p4d_range mm/memory.c:1248 [inline]
#6: ffff88802d648f48 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0x108a/0x4240 mm/memory.c:1346
#7: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#7: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2184 [inline]
#7: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xcfc/0x1810 kernel/rcu/tree.c:2465
stack backtrace:
CPU: 0 PID: 5092 Comm: syz-executor.4 Not tainted 6.8.0-rc2-syzkaller-00251-g6897cea71837 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x220/0x340 kernel/locking/lockdep.c:6712
hash_netportnet6_destroy+0xf0/0x2c0 net/netfilter/ipset/ip_set_hash_gen.h:455
ip_set_destroy_set net/netfilter/ipset/ip_set_core.c:1180 [inline]
ip_set_destroy_set_rcu+0x6a/0xe0 net/netfilter/ipset/ip_set_core.c:1190
rcu_do_batch kernel/rcu/tree.c:2190 [inline]
rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465
__do_softirq+0x2bb/0x942 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1c0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x30 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x80/0x90 kernel/kcov.c:306
Code: 8d 42 28 4c 39 c8 77 22 89 f8 89 f6 49 ff c2 4c 89 11 48 c7 44 0a 08 05 00 00 00 48 89 44 0a 10 48 89 74 0a 18 4c 89 44 0a 20 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90
RSP: 0018:ffffc90003b9f338 EFLAGS: 00000293
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88802ab18000
RDX: ffff88802ab18000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003b9f3f0 R08: ffffffff81fde8c3 R09: 1ffffd4000259320
R10: dffffc0000000000 R11: fffff94000259321 R12: 0000000000000001
R13: ffff888078123100 R14: ffff8880354e1300 R15: 1ffff92000773e6c
__page_table_check_ptes_set+0x93/0x280 mm/page_table_check.c:193
page_table_check_ptes_set include/linux/page_table_check.h:74 [inline]
set_ptes include/linux/pgtable.h:241 [inline]
copy_present_pte mm/memory.c:993 [inline]
copy_pte_range mm/memory.c:1102 [inline]
copy_pmd_range mm/memory.c:1187 [inline]
copy_pud_range mm/memory.c:1224 [inline]
copy_p4d_range mm/memory.c:1248 [inline]
copy_page_range+0x2c7e/0x4240 mm/memory.c:1346
dup_mmap kernel/fork.c:745 [inline]
dup_mm kernel/fork.c:1685 [inline]
copy_mm+0x12f4/0x21b0 kernel/fork.c:1734
copy_process+0x1d73/0x3fc0 kernel/fork.c:2497
kernel_clone+0x222/0x840 kernel/fork.c:2902
__do_sys_clone kernel/fork.c:3045 [inline]
__se_sys_clone kernel/fork.c:3029 [inline]
__x64_sys_clone+0x258/0x2a0 kernel/fork.c:3029
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7fb8dca7add3
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffe0884c888 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb8dca7add3
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 0000555556034750 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
----------------
Code disassembly (best guess):
0: 8d 42 28 lea 0x28(%rdx),%eax
3: 4c 39 c8 cmp %r9,%rax
6: 77 22 ja 0x2a
8: 89 f8 mov %edi,%eax
a: 89 f6 mov %esi,%esi
c: 49 ff c2 inc %r10
f: 4c 89 11 mov %r10,(%rcx)
12: 48 c7 44 0a 08 05 00 movq $0x5,0x8(%rdx,%rcx,1)
19: 00 00
1b: 48 89 44 0a 10 mov %rax,0x10(%rdx,%rcx,1)
20: 48 89 74 0a 18 mov %rsi,0x18(%rdx,%rcx,1)
25: 4c 89 44 0a 20 mov %r8,0x20(%rdx,%rcx,1)
* 2a: c3 ret <-- trapping instruction
2b: cc int3
2c: cc int3
2d: cc int3
2e: cc int3
2f: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
36: 00 00 00
39: 90 nop
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop
3f: 90 nop