[v5.15] WARNING: suspicious RCU usage in rhltable_lookup

Hello,

syzbot found the following issue on:

HEAD commit: 003148680b79 Linux 5.15.177
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=179cb918580000
kernel config: https://syzkaller.appspot.com/x/.config?x=27ad1047990e0f7e
dashboard link: https://syzkaller.appspot.com/bug?extid=3b9b5f6a4cc6433864e0
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c8625d198744/disk-00314868.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/94b56bdfa2ae/vmlinux-00314868.xz
kernel image: https://storage.googleapis.com/syzbot-assets/640b14c1ba43/Image-00314868.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

=============================
WARNING: suspicious RCU usage
5.15.177-syzkaller #0 Not tainted
-----------------------------
include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.0.246/5207:
#0: ffff800016cb4b68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:72

stack backtrace:
CPU: 0 PID: 5207 Comm: syz.0.246 Not tainted 5.15.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
lockdep_rcu_suspicious+0x188/0x1e0 kernel/locking/lockdep.c:6571
__rhashtable_lookup include/linux/rhashtable.h:594 [inline]
rhltable_lookup+0x6a0/0x6a8 include/linux/rhashtable.h:688
mr_mfc_find_any_parent+0xe8/0x20c net/ipv4/ipmr_base.c:83
ip_mr_forward+0x214/0xe10 net/ipv4/ipmr.c:1949
ipmr_cache_resolve net/ipv4/ipmr.c:1003 [inline]
ipmr_mfc_add+0x1ea0/0x28a0 net/ipv4/ipmr.c:1262
ip_mroute_setsockopt+0xaf8/0xe94 net/ipv4/ipmr.c:1459
do_ip_setsockopt net/ipv4/ip_sockglue.c:947 [inline]
ip_setsockopt+0x618/0x32cc net/ipv4/ip_sockglue.c:1430
raw_setsockopt+0x104/0x2b8 net/ipv4/raw.c:863
sock_common_setsockopt+0xb0/0xcc net/core/sock.c:3448
__sys_setsockopt+0x3a8/0x6b4 net/socket.c:2203
__do_sys_setsockopt net/socket.c:2214 [inline]
__se_sys_setsockopt net/socket.c:2211 [inline]
__arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2211
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

=============================
WARNING: suspicious RCU usage
5.15.177-syzkaller #0 Not tainted
-----------------------------
include/linux/rhashtable.h:369 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.0.246/5207:
#0: ffff800016cb4b68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:72

stack backtrace:
CPU: 0 PID: 5207 Comm: syz.0.246 Not tainted 5.15.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
lockdep_rcu_suspicious+0x188/0x1e0 kernel/locking/lockdep.c:6571
rht_ptr_rcu include/linux/rhashtable.h:369 [inline]
__rhashtable_lookup include/linux/rhashtable.h:599 [inline]
rhltable_lookup+0x45c/0x6a8 include/linux/rhashtable.h:688
mr_mfc_find_any_parent+0xe8/0x20c net/ipv4/ipmr_base.c:83
ip_mr_forward+0x214/0xe10 net/ipv4/ipmr.c:1949
ipmr_cache_resolve net/ipv4/ipmr.c:1003 [inline]
ipmr_mfc_add+0x1ea0/0x28a0 net/ipv4/ipmr.c:1262
ip_mroute_setsockopt+0xaf8/0xe94 net/ipv4/ipmr.c:1459
do_ip_setsockopt net/ipv4/ip_sockglue.c:947 [inline]
ip_setsockopt+0x618/0x32cc net/ipv4/ip_sockglue.c:1430
raw_setsockopt+0x104/0x2b8 net/ipv4/raw.c:863
sock_common_setsockopt+0xb0/0xcc net/core/sock.c:3448
__sys_setsockopt+0x3a8/0x6b4 net/socket.c:2203
__do_sys_setsockopt net/socket.c:2214 [inline]
__se_sys_setsockopt net/socket.c:2211 [inline]
__arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2211
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

=============================
WARNING: suspicious RCU usage
5.15.177-syzkaller #0 Not tainted
-----------------------------
include/linux/rhashtable.h:614 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.0.246/5207:
#0: ffff800016cb4b68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:72

stack backtrace:
CPU: 0 PID: 5207 Comm: syz.0.246 Not tainted 5.15.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
lockdep_rcu_suspicious+0x188/0x1e0 kernel/locking/lockdep.c:6571
__rhashtable_lookup include/linux/rhashtable.h:614 [inline]
rhltable_lookup+0x554/0x6a8 include/linux/rhashtable.h:688
mr_mfc_find_any_parent+0xe8/0x20c net/ipv4/ipmr_base.c:83
ip_mr_forward+0x214/0xe10 net/ipv4/ipmr.c:1949
ipmr_cache_resolve net/ipv4/ipmr.c:1003 [inline]
ipmr_mfc_add+0x1ea0/0x28a0 net/ipv4/ipmr.c:1262
ip_mroute_setsockopt+0xaf8/0xe94 net/ipv4/ipmr.c:1459
do_ip_setsockopt net/ipv4/ip_sockglue.c:947 [inline]
ip_setsockopt+0x618/0x32cc net/ipv4/ip_sockglue.c:1430
raw_setsockopt+0x104/0x2b8 net/ipv4/raw.c:863
sock_common_setsockopt+0xb0/0xcc net/core/sock.c:3448
__sys_setsockopt+0x3a8/0x6b4 net/socket.c:2203
__do_sys_setsockopt net/socket.c:2214 [inline]
__se_sys_setsockopt net/socket.c:2211 [inline]
__arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2211
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot has found a reproducer for the following issue on:
console output: https://syzkaller.appspot.com/x/log.txt?x=113456b0580000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1251d364580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=153456b0580000
1 lock held by syz-executor254/4020:
CPU: 0 PID: 4020 Comm: syz-executor254 Not tainted 5.15.177-syzkaller #0
1 lock held by syz-executor254/4020:
CPU: 0 PID: 4020 Comm: syz-executor254 Not tainted 5.15.177-syzkaller #0
1 lock held by syz-executor254/4020:
CPU: 0 PID: 4020 Comm: syz-executor254 Not tainted 5.15.177-syzkaller #0
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.