linux-kernel - Re: [syzbot] [net?] WARNING in rt_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250712011856.3599-1-hdanton@sina.com>
Date: Sat, 12 Jul 2025 09:18:55 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+97bf275720e06ad75f63@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] WARNING in rt_set_nexthop

> Date: Fri, 11 Jul 2025 17:49:41 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    d7b8f8e20813 Linux 6.16-rc5
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=107f9582580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f6cfc97245100778
> dashboard link: https://syzkaller.appspot.com/bug?extid=97bf275720e06ad75f63
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b6728c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12aac28c580000

#syz test upstream  master

--- x/net/rxrpc/call_accept.c
+++ y/net/rxrpc/call_accept.c
@@ -348,7 +348,7 @@ bool rxrpc_new_incoming_call(struct rxrp
 	if (sp->hdr.type != RXRPC_PACKET_TYPE_DATA)
 		return rxrpc_protocol_error(skb, rxrpc_eproto_no_service_call);
 
-	read_lock_irq(&local->services_lock);
+	read_lock_bh(&local->services_lock);
 
 	/* Weed out packets to services we're not offering.  Packets that would
 	 * begin a call are explicitly rejected and the rest are just
@@ -405,7 +405,7 @@ bool rxrpc_new_incoming_call(struct rxrp
 	spin_unlock(&conn->state_lock);
 
 	spin_unlock(&rx->incoming_lock);
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 
 	if (hlist_unhashed(&call->error_link)) {
 		spin_lock_irq(&call->peer->lock);
@@ -419,20 +419,20 @@ bool rxrpc_new_incoming_call(struct rxrp
 	return true;
 
 unsupported_service:
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered,
 				  RX_INVALID_OPERATION, -EOPNOTSUPP);
 unsupported_security:
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered,
 				  RX_INVALID_OPERATION, -EKEYREJECTED);
 no_call:
 	spin_unlock(&rx->incoming_lock);
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	_leave(" = f [%u]", skb->mark);
 	return false;
 discard:
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	return true;
 }
 
--