=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
9 locks held by kworker/0:12/4557:
#0: ffff888016870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1: ffffc90003b27d00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffffffff8d29db28 (nf_conntrack_mutex){+.+.}-{3:3}, at: nf_ct_iterate_cleanup+0x47/0x3c0 net/netfilter/nf_conntrack_core.c:2380
#3: ffffc90000007be0 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#3: ffffc90000007be0 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xbb/0x530 kernel/time/timer.c:1441
#4: ffffffff8c11c720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8c11c780 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#6: ffff88802b1b9108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#6: ffff88802b1b9108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3911 [inline]
#6: ffff88802b1b9108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xb8a/0x2ed0 net/core/dev.c:4253
#7: ffff88802b1b9148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
#8: ffffffff8c11c720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 4557 Comm: kworker/0:12 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events iterate_cleanup_work
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
sfq_enqueue+0x148e/0x2260 net/sched/sch_sfq.c:-1
qdisc_enqueue include/net/sch_generic.h:832 [inline]
netem_dequeue+0xd39/0x1400 net/sched/sch_netem.c:737
dequeue_skb net/sched/sch_generic.c:292 [inline]
qdisc_restart net/sched/sch_generic.c:397 [inline]
__qdisc_run+0x237/0x1480 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3942 [inline]
__dev_queue_xmit+0xeb9/0x2ed0 net/core/dev.c:4253
tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
tipc_bearer_xmit_skb+0x292/0x3c0 net/tipc/bearer.c:577
tipc_disc_timeout+0x568/0x6b0 net/tipc/discover.c:338
call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1767
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:get_next_corpse net/netfilter/nf_conntrack_core.c:-1 [inline]
RIP: 0010:nf_ct_iterate_cleanup+0x73/0x3c0 net/netfilter/nf_conntrack_core.c:2381
Code: b7 61 53 05 31 ff 89 de e8 ea f9 60 f9 85 db 0f 84 27 03 00 00 49 bc 00 00 00 00 00 fc ff df 31 db 89 d8 89 d9 25 ff 03 00 00 e0 06 48 8d 80 80 4a e6 8b 48 89 44 24 08 48 89 0c 24 48 8d 04
RSP: 0018:ffffc90003b27ac8 EFLAGS: 00000206
RAX: 00000000000002f0 RBX: 0000000000021af0 RCX: 0000000000021af0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 1ffff11005561aef R08: dffffc0000000000 R09: fffffbfff1ff7a2b
R10: fffffbfff1ff7a2b R11: 1ffffffff1ff7a2a R12: dffffc0000000000
R13: 0000000000000001 R14: ffffc90003b27b60 R15: ffffffff8816d770
nf_ct_iterate_cleanup_net+0x10f/0x180 net/netfilter/nf_conntrack_core.c:2465
iterate_cleanup_work+0x66/0x120 net/netfilter/nf_nat_masquerade.c:83
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: b7 61 mov $0x61,%bh
2: 53 push %rbx
3: 05 31 ff 89 de add $0xde89ff31,%eax
8: e8 ea f9 60 f9 call 0xf960f9f7
d: 85 db test %ebx,%ebx
f: 0f 84 27 03 00 00 je 0x33c
15: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12
1c: fc ff df
1f: 31 db xor %ebx,%ebx
21: 89 d8 mov %ebx,%eax
23: 89 d9 mov %ebx,%ecx
25: 25 ff 03 00 00 and $0x3ff,%eax
* 2a: c1 e0 06 shl $0x6,%eax <-- trapping instruction
2d: 48 8d 80 80 4a e6 8b lea -0x7419b580(%rax),%rax
34: 48 89 44 24 08 mov %rax,0x8(%rsp)
39: 48 89 0c 24 mov %rcx,(%rsp)
3d: 48 rex.W
3e: 8d .byte 0x8d
3f: 04 .byte 0x4