program: socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x5a0, 0x270, 0x190, 0x0, 0x190, 0x0, 0x660, 0x660, 0x660, 0x660, 0x660, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {}, 0x21}, 0x0, 0x138, 0x160, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x600) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900030073797a31000000000900010073797a300000000070000000060a010400000000000000000100000008000b40000000000900010073797a300000000048000480200001800700010072740000140002800800014000000015080002400000000024000180090001006861736800000000140002800800024000000017080007"], 0xe4}, 0x1, 0x0, 0x0, 0x8004}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$netlink(0x10, 0x3, 0x8000000004) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b2, 0x0, 0x2, 0x283}, 0x0, 0x0, 0x0) socket(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x6c, 0x6, 0x0, 0x0, 0x0, 0x8, 0x22, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc093, 0x7, @perf_config_ext={0x1000, 0x8}, 0x1a1ed, 0x0, 0x11000, 0x2, 0x4, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x9) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="500100001000010000000000000000007f0000010000edffffff0000000000007f00000100000000000000000000000000000000000000000200202000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f00000100000000000000000000000000be3412320000007f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000000000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200"], 0x150}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0) listen(0xffffffffffffffff, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, 0x0, 0x0) setsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f0000000100)={0x0, 0xea60}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) syz_open_dev$tty1(0xc, 0x4, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) r4 = socket(0x1e, 0x1, 0x0) shutdown(r4, 0x2) [ 153.850273][ T5278] Bluetooth: hci0: command tx timeout [ 154.177547][ T5317] [ 154.178764][ T5317] ============================= [ 154.180645][ T5317] WARNING: suspicious RCU usage [ 154.182486][ T5317] syzkaller #0 Not tainted [ 154.184716][ T5317] ----------------------------- [ 154.187075][ T5317] net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage! [ 154.190453][ T5317] [ 154.190453][ T5317] other info that might help us debug this: [ 154.190453][ T5317] [ 154.194574][ T5317] [ 154.194574][ T5317] rcu_scheduler_active = 2, debug_locks = 1 [ 154.197654][ T5317] locks held by syz.0.0/5317: 1, last CPU#0: [ 154.200183][ T5317] #0: ffff8880128d1c90 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{4:4}, at: xfrm_netlink_rcv+0x6a/0x90 [ 154.204498][ T5317] [ 154.204498][ T5317] stack backtrace: [ 154.206946][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 154.210636][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 154.214610][ T5317] Call Trace: [ 154.215957][ T5317] [ 154.217148][ T5317] dump_stack_lvl+0xe8/0x150 [ 154.219056][ T5317] lockdep_rcu_suspicious+0x140/0x1d0 [ 154.221226][ T5317] xfrm_nlmsg_multicast+0x1d8/0x1f0 [ 154.223411][ T5317] xfrm_send_migrate_state+0x870/0xae0 [ 154.225719][ T5317] ? __pfx_xfrm_send_migrate_state+0x10/0x10 [ 154.228335][ T5317] ? xfrm_state_migrate_install+0x192/0x630 [ 154.230936][ T5317] xfrm_do_migrate_state+0x1703/0x1e50 [ 154.233250][ T5317] ? __pfx_xfrm_do_migrate_state+0x10/0x10 [ 154.235800][ T5317] ? rcu_is_watching+0x16/0xb0 [ 154.237802][ T5317] ? apparmor_capable+0x126/0x170 [ 154.240206][ T5317] ? __nla_parse+0x40/0x60 [ 154.242583][ T5317] xfrm_user_rcv_msg+0x7a8/0xf30 [ 154.245010][ T5317] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 154.247434][ T5317] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 154.249858][ T5317] netlink_rcv_skb+0x226/0x4a0 [ 154.251844][ T5317] ? __mutex_lock+0x5d4/0x1550 [ 154.253752][ T5317] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 154.256101][ T5317] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 154.258439][ T5317] ? netlink_deliver_tap+0x2e/0x1b0 [ 154.260661][ T5317] ? netlink_deliver_tap+0x2e/0x1b0 [ 154.262910][ T5317] xfrm_netlink_rcv+0x79/0x90 [ 154.264938][ T5317] netlink_unicast+0x7bd/0x940 [ 154.267072][ T5317] netlink_sendmsg+0x813/0xb40 [ 154.269102][ T5317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 154.271305][ T5317] ? apparmor_socket_sendmsg+0x98/0x360 [ 154.273649][ T5317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 154.275790][ T5317] sock_sendmsg_nosec+0x13a/0x180 [ 154.277746][ T5317] ____sys_sendmsg+0x54e/0x850 [ 154.279768][ T5317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 154.282112][ T5317] ? import_iovec+0x73/0xa0 [ 154.284116][ T5317] ___sys_sendmsg+0x2a5/0x360 [ 154.286037][ T5317] ? __lock_acquire+0x6df/0x2e50 [ 154.288262][ T5317] ? __pfx____sys_sendmsg+0x10/0x10 [ 154.290533][ T5317] ? futex_wait+0x2a2/0x390 [ 154.292491][ T5317] ? __fget_files+0x2a/0x420 [ 154.294549][ T5317] ? __fget_files+0x3a2/0x420 [ 154.296598][ T5317] __x64_sys_sendmsg+0x1b1/0x290 [ 154.298757][ T5317] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 154.301080][ T5317] do_syscall_64+0x166/0x520 [ 154.303020][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.305543][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 154.307572][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.310042][ T5317] RIP: 0033:0x7fd6d199e159 [ 154.311993][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.320734][ T5317] RSP: 002b:00007fd6d2828fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 154.324253][ T5317] RAX: ffffffffffffffda RBX: 00007fd6d1c26090 RCX: 00007fd6d199e159 [ 154.327515][ T5317] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000010 [ 154.330816][ T5317] RBP: 00007fd6d1a35024 R08: 0000000000000000 R09: 0000000000000000 [ 154.334081][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 154.337423][ T5317] R13: 00007fd6d1c26128 R14: 00007fd6d1c26090 R15: 00007ffdf561f508 [ 154.341094][ T5317] [ 154.431296][ T5316] file system registered