=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
13 locks held by syz.6.1889/12152:
#0: ffff88805e132460 (sb_writers#3){.+.+}-{0:0}, at: do_coredump+0x1492/0x2ac0 fs/coredump.c:893
#1: ffff88807db54e28 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:126 [inline]
#1: ffff88807db54e28 (&mm->mmap_lock){++++}-{3:3}, at: get_dump_page+0xe7/0x680 mm/gup.c:1836
#2: ffffffff8c31eb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#3: ffff888022ad78b8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#3: ffff888022ad78b8 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: filemap_map_pages+0xba0/0x13b0 mm/filemap.c:3324
#4: ffffffff8c31eb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
#5: ffffc90000dd0be0 ((&icsk->icsk_retransmit_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#5: ffffc90000dd0be0 ((&icsk->icsk_retransmit_timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1638
#6: ffff88807442eca0 (slock-AF_INET){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#6: ffff88807442eca0 (slock-AF_INET){+.-.}-{2:2}, at: tcp_write_timer+0x29/0x280 net/ipv4/tcp_timer.c:673
#7: ffffffff8c31eb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#8: ffffffff8c31eb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#9: ffffffff8c31eb80 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#10: ffffffff8c31eb80 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#11: ffff888022114908 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#11: ffff888022114908 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3924 [inline]
#11: ffff888022114908 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2a/0x2f80 net/core/dev.c:4266
#12: ffffffff8c31eb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 1 PID: 12152 Comm: syz.6.1889 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:783
pfifo_tail_enqueue+0x372/0x4d0 net/sched/sch_fifo.c:54
qdisc_enqueue include/net/sch_generic.h:842 [inline]
tbf_enqueue+0x224/0x6e0 net/sched/sch_tbf.c:243
dev_qdisc_enqueue+0x48/0x210 net/core/dev.c:3865
__dev_xmit_skb net/core/dev.c:3949 [inline]
__dev_queue_xmit+0xc25/0x2f80 net/core/dev.c:4266
neigh_hh_output include/net/neighbour.h:493 [inline]
neigh_output include/net/neighbour.h:507 [inline]
ip_finish_output2+0xc87/0x10a0 net/ipv4/ip_output.c:228
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0x2c0/0x3e0 net/ipv4/ip_output.c:434
dst_output include/net/dst.h:452 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0x11c1/0x1c00 net/ipv4/ip_output.c:538
__tcp_transmit_skb+0x1d11/0x3200 net/ipv4/tcp_output.c:1404
tcp_transmit_skb net/ipv4/tcp_output.c:1422 [inline]
__tcp_retransmit_skb+0x92c/0x1290 net/ipv4/tcp_output.c:3278
tcp_retransmit_skb+0x2e/0x350 net/ipv4/tcp_output.c:3301
tcp_retransmit_timer+0x144b/0x2540 net/ipv4/tcp_timer.c:570
tcp_write_timer_handler+0x205/0x9a0 net/ipv4/tcp_timer.c:655
tcp_write_timer+0x126/0x280 net/ipv4/tcp_timer.c:675
call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
expire_timers kernel/time/timer.c:1699 [inline]
__run_timers+0x53e/0x800 kernel/time/timer.c:1970
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983
handle_softirqs+0x339/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:instrument_atomic_read include/linux/instrumented.h:71 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
RIP: 0010:lock_page_memcg+0x23d/0x440 mm/memcontrol.c:2062
Code: 00 00 9c 8f 44 24 40 f7 44 24 40 00 02 00 00 c6 44 01 04 f8 0f 85 f9 00 00 00 f7 c3 00 02 00 00 74 01 fb 4d 8d af 80 10 00 00 <4c> 89 ef be 04 00 00 00 e8 36 8f fb ff 4c 89 e8 48 c1 e8 03 48 b9
RSP: 0000:ffffc90003e4ed80 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 1ffff920007c9db4
RDX: dffffc0000000000 RSI: ffffffff8a2b2800 RDI: ffffffff8a79fe00
RBP: ffffc90003e4ee50 R08: ffffffff901d50c7 R09: 1ffffffff203aa18
R10: dffffc0000000000 R11: fffffbfff203aa19 R12: ffff888076dec670
R13: ffff888076ded080 R14: ffffea00015f3d78 R15: ffff888076dec000
page_add_file_rmap+0x185/0x940 mm/rmap.c:1219
do_set_pte+0x3c9/0x530 mm/memory.c:4069
filemap_map_pages+0xea1/0x13b0 mm/filemap.c:3344
do_fault_around mm/memory.c:4243 [inline]
do_read_fault mm/memory.c:4258 [inline]
do_fault mm/memory.c:4392 [inline]
handle_pte_fault mm/memory.c:4650 [inline]
__handle_mm_fault mm/memory.c:4785 [inline]
handle_mm_fault+0x25bc/0x4410 mm/memory.c:4883
faultin_page mm/gup.c:976 [inline]
__get_user_pages+0x94b/0x11e0 mm/gup.c:1197
__get_user_pages_locked mm/gup.c:1382 [inline]
get_dump_page+0x190/0x680 mm/gup.c:1838
dump_user_range+0x54/0x340 fs/coredump.c:1013
elf_core_dump+0x2fbd/0x3500 fs/binfmt_elf.c:2285
do_coredump+0x14c7/0x2ac0 fs/coredump.c:894
get_signal+0x40a/0x12c0 kernel/signal.c:2886
arch_do_signal_or_restart+0xe7/0x12c0 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:320
exc_page_fault+0x88/0x100 arch/x86/mm/fault.c:1499
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606
RIP: 0033:0x7f7c1f9e1de1
Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f7c1fc5afa0 RCX: 00007f7c1f9e1dd9
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007f7c1fa77d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f7c1fc5b038 R14: 00007f7c1fc5afa0 R15: 00007ffff6b03bd8
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 9c pushf
3: 8f 44 24 40 pop 0x40(%rsp)
7: f7 44 24 40 00 02 00 testl $0x200,0x40(%rsp)
e: 00
f: c6 44 01 04 f8 movb $0xf8,0x4(%rcx,%rax,1)
14: 0f 85 f9 00 00 00 jne 0x113
1a: f7 c3 00 02 00 00 test $0x200,%ebx
20: 74 01 je 0x23
22: fb sti
23: 4d 8d af 80 10 00 00 lea 0x1080(%r15),%r13
* 2a: 4c 89 ef mov %r13,%rdi <-- trapping instruction
2d: be 04 00 00 00 mov $0x4,%esi
32: e8 36 8f fb ff call 0xfffb8f6d
37: 4c 89 e8 mov %r13,%rax
3a: 48 c1 e8 03 shr $0x3,%rax
3e: 48 rex.W
3f: b9 .byte 0xb9