Re: [syzbot] [net?] WARNING in rt_set_nexthop

[Hillf Danton <hdanton@sina.com>]

> Date: Fri, 11 Jul 2025 17:49:41 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    d7b8f8e20813 Linux 6.16-rc5
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=107f9582580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f6cfc97245100778
> dashboard link: https://syzkaller.appspot.com/bug?extid=97bf275720e06ad75f63
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b6728c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12aac28c580000

#syz test upstream  master

--- x/net/rxrpc/call_accept.c
+++ y/net/rxrpc/call_accept.c
@@ -348,7 +348,7 @@ bool rxrpc_new_incoming_call(struct rxrp
 	if (sp->hdr.type != RXRPC_PACKET_TYPE_DATA)
 		return rxrpc_protocol_error(skb, rxrpc_eproto_no_service_call);
 
-	read_lock_irq(&local->services_lock);
+	read_lock_bh(&local->services_lock);
 
 	/* Weed out packets to services we're not offering.  Packets that would
 	 * begin a call are explicitly rejected and the rest are just
@@ -405,7 +405,7 @@ bool rxrpc_new_incoming_call(struct rxrp
 	spin_unlock(&conn->state_lock);
 
 	spin_unlock(&rx->incoming_lock);
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 
 	if (hlist_unhashed(&call->error_link)) {
 		spin_lock_irq(&call->peer->lock);
@@ -419,20 +419,20 @@ bool rxrpc_new_incoming_call(struct rxrp
 	return true;
 
 unsupported_service:
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered,
 				  RX_INVALID_OPERATION, -EOPNOTSUPP);
 unsupported_security:
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered,
 				  RX_INVALID_OPERATION, -EKEYREJECTED);
 no_call:
 	spin_unlock(&rx->incoming_lock);
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	_leave(" = f [%u]", skb->mark);
 	return false;
 discard:
-	read_unlock_irq(&local->services_lock);
+	read_unlock_bh(&local->services_lock);
 	return true;
 }
 
--