=============================
WARNING: suspicious RCU usage
5.15.189-syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
6 locks held by ksoftirqd/0/14:
 #0: ffff80001b337a00 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
 #0: ffff80001b337a00 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x858 kernel/time/timer.c:1441
 #1: ffff800014341360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:311
 #2: ffff8000143413c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:311
 #3: ffff0000dc360108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
 #3: ffff0000dc360108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3911 [inline]
 #3: ffff0000dc360108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x840/0x2800 net/core/dev.c:4253
 #4: ffff0000dc360148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: __dev_xmit_skb net/core/dev.c:3937 [inline]
 #4: ffff0000dc360148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: __dev_queue_xmit+0xfcc/0x2800 net/core/dev.c:4253
 #5: ffff800014341360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:311

stack backtrace:
CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
 dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 lockdep_rcu_suspicious+0x140/0x198 kernel/locking/lockdep.c:6574
 qdisc_lookup+0xc8/0x64c net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x188/0x410 net/sched/sch_api.c:793
 sfq_enqueue+0x101c/0x1ca4 net/sched/sch_sfq.c:-1
 qdisc_enqueue include/net/sch_generic.h:832 [inline]
 netem_dequeue+0xa80/0x1048 net/sched/sch_netem.c:737
 dequeue_skb net/sched/sch_generic.c:292 [inline]
 qdisc_restart net/sched/sch_generic.c:397 [inline]
 __qdisc_run+0x1bc/0x1170 net/sched/sch_generic.c:415
 __dev_xmit_skb net/core/dev.c:3942 [inline]
 __dev_queue_xmit+0xfe0/0x2800 net/core/dev.c:4253
 dev_queue_xmit+0x24/0x34 net/core/dev.c:4321
 tipc_l2_send_msg+0x298/0x358 net/tipc/bearer.c:518
 tipc_bearer_xmit_skb+0x244/0x384 net/tipc/bearer.c:577
 tipc_disc_timeout+0x4c8/0x608 net/tipc/discover.c:338
 call_timer_fn+0x19c/0x858 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x46c/0x6c4 kernel/time/timer.c:1767
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780
 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576
 run_ksoftirqd+0x7c/0x2a0 kernel/softirq.c:943
 smpboot_thread_fn+0x4b0/0x920 kernel/smpboot.c:164
 kthread+0x374/0x454 kernel/kthread.c:334
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855