suspicious RCU usage at net/netfilter/ipset/ip_set_core.c:LINE

From: syzbot <hidden>
Date: 2018-01-05 10:58:10
Also in: lkml, netfilter-devel

Hello,

syzkaller hit the following crash on  
e0e99813fb1d25fc20dab946d7bf6156a67dab5f
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+36b06f219f2439fe62e1@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for  
details.
If you forward the report, please keep this part and the footer.


=============================
WARNING: suspicious RCU usage
4.15.0-rc6-next-20180102+ #86 Not tainted
-----------------------------
net/netfilter/ipset/ip_set_core.c:2057 suspicious  
rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
3 locks held by kworker/u4:0/5:
  #0:  ((wq_completion)"%s""netns"){+.+.}, at: [<000000006581c2a2>]  
process_one_work+0x71f/0x14a0 kernel/workqueue.c:2083
  #1:  (net_cleanup_work){+.+.}, at: [<0000000032ed8df0>]  
process_one_work+0x757/0x14a0 kernel/workqueue.c:2087
  #2:  (net_mutex){+.+.}, at: [<000000004beb14d8>] cleanup_net+0x139/0x8b0  
net/core/net_namespace.c:450

stack backtrace:
CPU: 0 PID: 5 Comm: kworker/u4:0 Not tainted 4.15.0-rc6-next-20180102+ #86
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x137/0x198 lib/dump_stack.c:53
  lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4585
  ip_set_net_exit+0x2c6/0x480 net/netfilter/ipset/ip_set_core.c:2057
  ops_exit_list.isra.6+0xae/0x150 net/core/net_namespace.c:142
  cleanup_net+0x3f3/0x8b0 net/core/net_namespace.c:484
  process_one_work+0x801/0x14a0 kernel/workqueue.c:2112
  worker_thread+0xe0/0x1010 kernel/workqueue.c:2246
  kthread+0x33c/0x400 kernel/kthread.c:238
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:524


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is  
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line in the email body.

Attachments

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help