[syzbot] [net?] WARNING: suspicious RCU usage in dev_deactivate

[syzbot <syzbot+8a65ac5be396817eefb3@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    2d5404caa8c7 Linux 6.12-rc7
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1219335f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=327b6119dd928cbc
dashboard link: https://syzkaller.appspot.com/bug?extid=8a65ac5be396817eefb3
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-2d5404ca.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1bbbfa50cb5f/vmlinux-2d5404ca.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5bcdede1c8a/bzImage-2d5404ca.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8a65ac5be396817eefb3@syzkaller.appspotmail.com

=============================
WARNING: suspicious RCU usage
6.12.0-rc7-syzkaller #0 Not tainted
-----------------------------
net/sched/sch_generic.c:1290 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
3 locks held by kworker/u32:18/10870:
 #0: ffff888046b42148 ((wq_completion)bond0#22){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204
 #1: ffffc90004557d80 ((work_completion)(&(&bond->mii_work)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
 #2: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #2: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: bond_mii_monitor+0x140/0x2d90 drivers/net/bonding/bond_main.c:2937
stack backtrace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x210/0x3c0 kernel/locking/lockdep.c:6821
 dev_deactivate_queue+0x167/0x190 net/sched/sch_generic.c:1290
 netdev_for_each_tx_queue include/linux/netdevice.h:2504 [inline]
 dev_deactivate_many+0xe7/0xb20 net/sched/sch_generic.c:1363
 dev_deactivate+0xf9/0x1c0 net/sched/sch_generic.c:1403
 bond_miimon_inspect drivers/net/bonding/bond_main.c:2717 [inline]
 bond_mii_monitor+0x3c1/0x2d90 drivers/net/bonding/bond_main.c:2939
-----------------------------
include/linux/rtnetlink.h:100 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1

stack backtrace:
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 dev_deactivate+0xf9/0x1c0 net/sched/sch_generic.c:1403
 bond_check_dev_link+0x197/0x490 drivers/net/bonding/bond_main.c:873
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 </TASK>
RCU nest depth: 1, expected: 0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 dev_deactivate_many+0x2a1/0xb20 net/sched/sch_generic.c:1377

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
3 locks held by kworker/u32:18/10870:
 #0: ffff888046b42148 ((wq_completion)bond0#22){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204

stack backtrace:
Tainted: [W]=WARN
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x210/0x3c0 kernel/locking/lockdep.c:6821
 dev_deactivate+0xf9/0x1c0 net/sched/sch_generic.c:1403
 ethtool_op_get_link+0x1d/0x70 net/ethtool/ioctl.c:62
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
6.12.0-rc7-syzkaller #0 Tainted: G        W         
-----------------------------
other info that might help us debug this:
context-{4:4}
stack backtrace:
Workqueue: bond0 bond_mii_monitor
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
 synchronize_rcu_expedited+0x290/0x450 kernel/rcu/tree_exp.h:976
 synchronize_net+0x3e/0x60 net/core/dev.c:11286
 ethtool_op_get_link+0x1d/0x70 net/ethtool/ioctl.c:62
 bond_check_dev_link+0x197/0x490 drivers/net/bonding/bond_main.c:873
 bond_miimon_inspect drivers/net/bonding/bond_main.c:2717 [inline]
 bond_mii_monitor+0x3c1/0x2d90 drivers/net/bonding/bond_main.c:2939
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
------------[ cut here ]------------
WARNING: CPU: 2 PID: 10870 at kernel/rcu/tree_plugin.h:331 rcu_note_context_switch+0xc5c/0x1ae0 kernel/rcu/tree_plugin.h:331
Tainted: [W]=WARN
RSP: 0018:ffffc900045573b0 EFLAGS: 00010086
RDX: ffff888026c3c880 RSI: ffffffff814e6e86 RDI: 0000000000000001
R10: 0000000000000000 R11: 000000002d2d2d2d R12: ffff888026c3c880
CR2: 00007fd5d2467d60 CR3: 0000000030df0000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 mutex_optimistic_spin kernel/locking/mutex.c:510 [inline]
 __mutex_lock_common kernel/locking/mutex.c:612 [inline]
 __mutex_lock+0x81e/0x9c0 kernel/locking/mutex.c:752
 synchronize_rcu_expedited+0x290/0x450 kernel/rcu/tree_exp.h:976
 dev_deactivate_many+0x2a1/0xb20 net/sched/sch_generic.c:1377
 linkwatch_sync_dev+0x181/0x210 net/core/link_watch.c:263
 ethtool_op_get_link+0x1d/0x70 net/ethtool/ioctl.c:62
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup