================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
dhcpcd/5705 is leaving the kernel with locks still held!
1 lock held by dhcpcd/5705:
#0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:323
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5705, name: dhcpcd
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
CPU: 3 UID: 0 PID: 5705 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
__might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9162
might_alloc include/linux/sched/mm.h:323 [inline]
prepare_alloc_pages+0x44a/0x5f0 mm/page_alloc.c:4995
__alloc_frozen_pages_noprof+0x19a/0x2bc0 mm/page_alloc.c:5215
alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490
folio_alloc_mpol_noprof+0x36/0x260 mm/mempolicy.c:2509
vma_alloc_folio_noprof+0xed/0x1d0 mm/mempolicy.c:2544
folio_prealloc mm/memory.c:1193 [inline]
wp_page_copy mm/memory.c:3859 [inline]
do_wp_page+0x1ee1/0x4350 mm/memory.c:4320
handle_pte_fault mm/memory.c:6427 [inline]
__handle_mm_fault+0x1ab6/0x2a00 mm/memory.c:6549
handle_mm_fault+0x36d/0xa20 mm/memory.c:6718
do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1334
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fac86df4265
Code: 80 00 00 00 00 31 c0 48 83 3d ce 2d 00 00 00 0f 95 c0 c3 66 90 48 83 ec 08 48 8b 3d bd 2d 00 00 48 85 ff 74 10 e8 cb fe ff ff <48> c7 05 a8 2d 00 00 00 00 00 00 48 8b 3d a9 2d 00 00 48 85 ff 74
RSP: 002b:00007ffd8cd284c0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00007ffd8cd48900 RCX: 000055f18798f00b
RDX: 000055f4d8d32010 RSI: 0000000000000001 RDI: 000055f4d8d5bce0
RBP: 00007ffd8cd48900 R08: 0000000000000210 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: 000055f4d7beeac0
------------[ cut here ]------------
Voluntary context switch within RCU read-side critical section!
WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332, CPU#3: dhcpcd/5705
Modules linked in:
CPU: 3 UID: 0 PID: 5705 Comm: dhcpcd Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332
Code: c1 ea 03 80 3c 02 00 0f 85 9b 0b 00 00 48 8b 53 28 b9 01 00 00 00 4c 89 ef e8 a3 cf fe ff e9 1d f9 ff ff 48 8d 3d 37 ad ed 0e <67> 48 0f b9 3a e9 99 f8 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc9000428f738 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff88802b53c3c0 RCX: ffffffff81ed2401
RDX: 0000000000000000 RSI: ffffffff8c1c2080 RDI: ffffffff90db4560
RBP: ffff888028c40000 R08: 0000000000000000 R09: fffffbfff21af64a
R10: ffffffff90d7b257 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888028c404c4 R14: ffff88802b53b380 R15: ffffffff90d7e5c4
FS: 00007fac86df8780(0000) GS:ffff888097480000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd8cd49f52 CR3: 000000002a735000 CR4: 0000000000352ef0
Call Trace:
__schedule+0x276/0x6820 kernel/sched/core.c:7043
__schedule_loop kernel/sched/core.c:7267 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7282
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0xced/0x1b10 kernel/locking/mutex.c:820
exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
synchronize_rcu_expedited+0x298/0x450 kernel/rcu/tree_exp.h:961
synchronize_net+0x84/0xa0 net/core/dev.c:12249
__unregister_prot_hook+0x4a9/0x5a0 net/packet/af_packet.c:380
packet_do_bind+0x9be/0xf50 net/packet/af_packet.c:3240
packet_bind+0x105/0x150 net/packet/af_packet.c:3325
__sys_bind_socket net/socket.c:1933 [inline]
__sys_bind_socket net/socket.c:1925 [inline]
__sys_bind+0x1a9/0x260 net/socket.c:1964
__do_sys_bind net/socket.c:1969 [inline]
__se_sys_bind net/socket.c:1967 [inline]
__x64_sys_bind+0x72/0xb0 net/socket.c:1967
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fac86efd2d7
Code: 44 00 00 48 83 ec 10 48 63 c9 48 63 ff 45 31 c9 68 20 01 00 00 45 31 c0 e8 56 51 f8 ff 48 83 c4 18 c3 90 b8 31 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f1 ea 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd8cd283d8 EFLAGS: 00000213 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 000055f4d8d514c0 RCX: 00007fac86efd2d7
RDX: 0000000000000014 RSI: 00007ffd8cd283f0 RDI: 0000000000000003
RBP: 000055f4d7bd94b0 R08: 00007fac86fccac0 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000213 R12: 0000000000000000
R13: 000055f4d8d51960 R14: 0000000000000000 R15: 000055f4d7beeac0
----------------
Code disassembly (best guess):
0: c1 ea 03 shr $0x3,%edx
3: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
7: 0f 85 9b 0b 00 00 jne 0xba8
d: 48 8b 53 28 mov 0x28(%rbx),%rdx
11: b9 01 00 00 00 mov $0x1,%ecx
16: 4c 89 ef mov %r13,%rdi
19: e8 a3 cf fe ff call 0xfffecfc1
1e: e9 1d f9 ff ff jmp 0xfffff940
23: 48 8d 3d 37 ad ed 0e lea 0xeedad37(%rip),%rdi # 0xeedad61
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e9 99 f8 ff ff jmp 0xfffff8cd
34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3b: fc ff df
3e: 48 rex.W
3f: 8d .byte 0x8d