For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] WARNING: suspicious RCU usage in expect_iter_name
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 15071f2a1263e82150c77eeb1e94dbfc31950a8e

Reported-by: syzbot+4bd730aede2791e40bdf@syzkaller.appspotmail.com

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9b4e29557..2449df2e9 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3390,7 +3390,13 @@ static bool expect_iter_name(struct nf_conntrack_expect *exp, void *data)
 	struct nf_conntrack_helper *helper;
 	const char *name = data;
 
-	helper = rcu_dereference(exp->helper);
+	/* This iterator runs under nf_conntrack_expect_lock (see
+	 * nf_ct_expect_iterate_net()), which serializes changes to exp->helper.
+	 * Use the protected accessor to document that lock-based protection and
+	 * avoid a bogus RCU lockdep splat.
+	 */
+	helper = rcu_dereference_protected(exp->helper,
+					   lockdep_is_held(&nf_conntrack_expect_lock));
 	if (!helper)
 		return false;