Re: [syzbot] [net?] WARNING: suspicious RCU usage in fib6_del (3)

[Kuniyuki Iwashima <kuniyu@amazon.com>]

From: syzbot <syzbot+2d1f030088fa84f9d163@syzkaller.appspotmail.com>
Date: Thu, 01 May 2025 04:17:30 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    7a13c14ee59d Merge tag 'for-6.15-rc4-tag' of git://git.ker..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16e871b3980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=541aa584278da96c
> dashboard link: https://syzkaller.appspot.com/bug?extid=2d1f030088fa84f9d163
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-7a13c14e.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/db407f64de23/vmlinux-7a13c14e.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/a423a8694742/bzImage-7a13c14e.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2d1f030088fa84f9d163@syzkaller.appspotmail.com
> 
> bridge_slave_0: left allmulticast mode
> bridge_slave_0: left promiscuous mode
> bridge0: port 1(bridge_slave_0) entered disabled state
> =============================
> WARNING: suspicious RCU usage
> 6.15.0-rc4-syzkaller-00051-g7a13c14ee59d #0 Not tainted
> -----------------------------
> net/ipv6/ip6_fib.c:2023 suspicious rcu_dereference_protected() usage!
> 
> other info that might help us debug this:
> 
> 
> rcu_scheduler_active = 2, debug_locks = 1
> 6 locks held by kworker/u32:8/16847:
>  #0: ffff88801c68d148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
>  #1: ffffc90003bd7d18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
>  #2: ffffffff9010e510 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xc9/0xb30 net/core/net_namespace.c:608
>  #3: ffffffff901243a8 (rtnl_mutex){+.+.}-{4:4}, at: cleanup_net+0x50d/0xb30 net/core/net_namespace.c:644
>  #4: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
>  #4: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
>  #4: ffffffff8e3bf5c0 (rcu_read_lock){....}-{1:3}, at: __fib6_clean_all+0x3a/0x2d0 net/ipv6/ip6_fib.c:2263
>  #5: ffff88802b926830 (&tb->tb6_lock){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
>  #5: ffff88802b926830 (&tb->tb6_lock){+.-.}-{3:3}, at: __fib6_clean_all+0xeb/0x2d0 net/ipv6/ip6_fib.c:2267
> 
> stack backtrace:
> CPU: 3 UID: 0 PID: 16847 Comm: kworker/u32:8 Not tainted 6.15.0-rc4-syzkaller-00051-g7a13c14ee59d #0 PREEMPT(full) 
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: netns cleanup_net
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:94 [inline]
>  dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
>  lockdep_rcu_suspicious+0x166/0x260 kernel/locking/lockdep.c:6865
>  fib6_del+0xcf2/0x1770 net/ipv6/ip6_fib.c:2023
>  fib6_clean_node+0x424/0x5b0 net/ipv6/ip6_fib.c:2202
>  fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2124
>  fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2172
>  fib6_clean_tree+0xd4/0x110 net/ipv6/ip6_fib.c:2252
>  __fib6_clean_all+0x107/0x2d0 net/ipv6/ip6_fib.c:2268

#syz dup: [syzbot] [net?] WARNING: suspicious RCU usage in __fib6_update_sernum_upto_root