=============================
WARNING: suspicious RCU usage
5.15.189-syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
9 locks held by kworker/u4:7/4583:
 #0: ffff8880169cd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
 #1: ffffc9000356fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
 #2: ffffffff8d22a2d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x132/0xb80 net/core/net_namespace.c:589
 #3: ffffc90000dd0be0
 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xbb/0x530 kernel/time/timer.c:1441
 #4: ffffffff8c11c360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
 #5: ffffffff8c11c3c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
 #6: ffff8880612ff108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
 #6: ffff8880612ff108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3911 [inline]
 #6: ffff8880612ff108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xb8a/0x2ed0 net/core/dev.c:4253
 #7: ffff8880612ff148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
 #8: ffffffff8c11c360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311

stack backtrace:
CPU: 1 PID: 4583 Comm: kworker/u4:7 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: netns cleanup_net
Call Trace:
 <IRQ>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
 fq_codel_enqueue+0x101a/0x1590 net/sched/sch_fq_codel.c:243
 qdisc_enqueue include/net/sch_generic.h:832 [inline]
 netem_dequeue+0xd39/0x1400 net/sched/sch_netem.c:737
 dequeue_skb net/sched/sch_generic.c:292 [inline]
 qdisc_restart net/sched/sch_generic.c:397 [inline]
 __qdisc_run+0x237/0x1480 net/sched/sch_generic.c:415
 __dev_xmit_skb net/core/dev.c:3942 [inline]
 __dev_queue_xmit+0xeb9/0x2ed0 net/core/dev.c:4253
 tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
 tipc_bearer_xmit_skb+0x292/0x3c0 net/tipc/bearer.c:577
 tipc_disc_timeout+0x568/0x6b0 net/tipc/discover.c:338
 call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x525/0x7c0 kernel/time/timer.c:1767
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 handle_softirqs+0x328/0x820 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:check_preemption_disabled+0x42/0x110 lib/smp_processor_id.c:55
Code: 65 8b 05 a9 d7 59 76 65 8b 0d 12 32 5a 76 f7 c1 ff ff ff 7f 74 1f 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 08 0f 85 c4 00 00 00 <48> 83 c4 10 5b 41 5e 41 5f 5d c3 48 c7 04 24 00 00 00 00 9c 8f 04
RSP: 0018:ffffc9000356f8a8 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 68c1615ca4407000
RDX: 0000000000000000 RSI: ffffffff8a599320 RDI: ffffffff8a5992e0
RBP: ffffc9000356fa20 R08: dffffc0000000000 R09: fffffbfff1ad2dd6
R10: fffffbfff1ad2dd6 R11: 1ffffffff1ad2dd5 R12: ffffffff8c11c360
R13: 1ffff920006adf2c R14: 0000000000000001 R15: dffffc0000000000
 rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:331 [inline]
 rcu_is_watching+0x11/0xa0 kernel/rcu/tree.c:1123
 trace_lock_acquire include/trace/events/lock.h:13 [inline]
 lock_acquire+0xcd/0x3f0 kernel/locking/lockdep.c:5594
 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:312
 rcu_read_lock include/linux/rcupdate.h:739 [inline]
 inet_twsk_purge+0x119/0x810 net/ipv4/inet_timewait_sock.c:268
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x77b/0xb80 net/core/net_namespace.c:635
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
----------------
Code disassembly (best guess):
   0:	65 8b 05 a9 d7 59 76 	mov    %gs:0x7659d7a9(%rip),%eax        # 0x7659d7b0
   7:	65 8b 0d 12 32 5a 76 	mov    %gs:0x765a3212(%rip),%ecx        # 0x765a3220
   e:	f7 c1 ff ff ff 7f    	test   $0x7fffffff,%ecx
  14:	74 1f                	je     0x35
  16:	65 48 8b 0c 25 28 00 	mov    %gs:0x28,%rcx
  1d:	00 00
  1f:	48 3b 4c 24 08       	cmp    0x8(%rsp),%rcx
  24:	0f 85 c4 00 00 00    	jne    0xee
* 2a:	48 83 c4 10          	add    $0x10,%rsp <-- trapping instruction
  2e:	5b                   	pop    %rbx
  2f:	41 5e                	pop    %r14
  31:	41 5f                	pop    %r15
  33:	5d                   	pop    %rbp
  34:	c3                   	ret
  35:	48 c7 04 24 00 00 00 	movq   $0x0,(%rsp)
  3c:	00
  3d:	9c                   	pushf
  3e:	8f                   	.byte 0x8f
  3f:	04                   	.byte 0x4