=============================
WARNING: suspicious RCU usage
6.8.0-rc2-syzkaller-00397-g56897d51886f #0 Not tainted
-----------------------------
net/netfilter/ipset/ip_set_hash_gen.h:455 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz-executor.1/14506:
#0: ffff888036a8ea20 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:146 [inline]
#0: ffff888036a8ea20 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x1be/0xd40 mm/mmap.c:3263
#1: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#1: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#1: ffffffff8e130ae0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x82/0x380 mm/pgtable-generic.c:285
#2: ffff88802c802ac8 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#2: ffff88802c802ac8 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x1ba/0x300 mm/pgtable-generic.c:373
#3: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#3: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2184 [inline]
#3: ffffffff8e130ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xcfc/0x1810 kernel/rcu/tree.c:2465
stack backtrace:
CPU: 1 PID: 14506 Comm: syz-executor.1 Not tainted 6.8.0-rc2-syzkaller-00397-g56897d51886f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x220/0x340 kernel/locking/lockdep.c:6712
hash_netportnet6_destroy+0xf0/0x2c0 net/netfilter/ipset/ip_set_hash_gen.h:455
ip_set_destroy_set net/netfilter/ipset/ip_set_core.c:1180 [inline]
ip_set_destroy_set_rcu+0x6a/0xe0 net/netfilter/ipset/ip_set_core.c:1190
rcu_do_batch kernel/rcu/tree.c:2190 [inline]
rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465
__do_softirq+0x2bb/0x942 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1c0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x30 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__tlb_remove_page_size+0x0/0x460 mm/mmu_gather.c:120
Code: 8c 1b fe ff ff 48 89 ef e8 dd 84 12 00 e9 0e fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 10 48 89 74 24
RSP: 0018:ffffc90014d5f398 EFLAGS: 00000286
RAX: ffffffff81da6722 RBX: ffffc90014d5f580 RCX: ffff88802b6f3b80
RDX: 0000000000001000 RSI: ffffea00013a9000 RDI: ffffc90014d5f840
RBP: ffffc90014d5f630 R08: ffffffff81da6714 R09: 1ffffd4000275200
R10: dffffc0000000000 R11: fffff94000275201 R12: ffff88801c7ff968
R13: ffff888036a8e880 R14: 00007fa0c092d000 R15: dffffc0000000000
__tlb_remove_page include/asm-generic/tlb.h:471 [inline]
zap_pte_range mm/memory.c:1482 [inline]
zap_pmd_range mm/memory.c:1597 [inline]
zap_pud_range mm/memory.c:1626 [inline]
zap_p4d_range mm/memory.c:1647 [inline]
unmap_page_range+0x19a7/0x3600 mm/memory.c:1668
unmap_vmas+0x3cc/0x5f0 mm/memory.c:1758
exit_mmap+0x2c6/0xd40 mm/mmap.c:3279
__mmput+0x115/0x3c0 kernel/fork.c:1343
exit_mm+0x21f/0x310 kernel/exit.c:569
do_exit+0x9af/0x2740 kernel/exit.c:858
do_group_exit+0x206/0x2c0 kernel/exit.c:1020
get_signal+0x176d/0x1850 kernel/signal.c:2893
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:105 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]
syscall_exit_to_user_mode+0xc8/0x370 kernel/entry/common.c:212
do_syscall_64+0x108/0x240 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7fa0c0e7dda9
Code: Unable to access opcode bytes at 0x7fa0c0e7dd7f.
RSP: 002b:00007fa0c1b6d178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa0c0fabf88 RCX: 00007fa0c0e7dda9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0c0fabf88
RBP: 00007fa0c0fabf80 R08: 00007fa0c1b6d6c0 R09: 00007fa0c1b6d6c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa0c0fabf8c
R13: 000000000000000b R14: 00007ffee6594de0 R15: 00007ffee6594ec8
----------------
Code disassembly (best guess), 4 bytes skipped:
0: ff 48 89 decl -0x77(%rax)
3: ef out %eax,(%dx)
4: e8 dd 84 12 00 call 0x1284e6
9: e9 0e fe ff ff jmp 0xfffffe1c
e: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
15: 00
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
* 26: 66 0f 1f 00 nopw (%rax) <-- trapping instruction
2a: 55 push %rbp
2b: 41 57 push %r15
2d: 41 56 push %r14
2f: 41 55 push %r13
31: 41 54 push %r12
33: 53 push %rbx
34: 48 83 ec 10 sub $0x10,%rsp
38: 48 rex.W
39: 89 .byte 0x89
3a: 74 24 je 0x60