=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
6 locks held by swapper/0/0:
 #0: ffffc90000007be0 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
 #0: ffffc90000007be0 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1638
 #1: ffffffff8c31f360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #2: ffffffff8c31f3c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
 #3: ffff88807b46f108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
 #3: ffff88807b46f108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3924 [inline]
 #3: ffff88807b46f108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2a/0x2f80 net/core/dev.c:4266
 #4: ffff88807b46f148 (dev->qdisc_running_key ?: &qdisc_running_key){+..-}-{0:0}, at: tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
 #5: ffffffff8c31f360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312

stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:783
 cake_dequeue+0x1bd6/0x4b10 net/sched/sch_cake.c:2205
 netem_dequeue+0x12d2/0x1410 net/sched/sch_netem.c:766
 dequeue_skb net/sched/sch_generic.c:295 [inline]
 qdisc_restart net/sched/sch_generic.c:400 [inline]
 __qdisc_run+0x236/0x1490 net/sched/sch_generic.c:418
 __dev_xmit_skb net/core/dev.c:3955 [inline]
 __dev_queue_xmit+0xe3d/0x2f80 net/core/dev.c:4266
 tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
 tipc_bearer_xmit_skb+0x292/0x3c0 net/tipc/bearer.c:577
 tipc_disc_timeout+0x57d/0x6d0 net/tipc/discover.c:338
 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
 expire_timers kernel/time/timer.c:1699 [inline]
 __run_timers+0x53e/0x800 kernel/time/timer.c:1970
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983
 handle_softirqs+0x339/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:finish_lock_switch+0x134/0x280 kernel/sched/core.c:4804
Code: be ff ff ff ff e8 4c ee 68 08 85 c0 74 4a 4d 85 ff 75 66 e9 fe 00 00 00 48 89 df e8 f6 59 72 08 e8 f1 e6 2a 00 fb 48 83 c4 08 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 48 89 df e8 c9 09 fe ff 43 80 3c
RSP: 0018:ffffffff8c007b48 EFLAGS: 00000286
RAX: ae700d39f922dd00 RBX: ffff8880b903a340 RCX: ae700d39f922dd00
RDX: dffffc0000000000 RSI: ffffffff8a2b3180 RDI: ffffffff8a7a09c0
RBP: 1ffff11017207613 R08: ffff8880b903a343 R09: 1ffff11017207468
R10: dffffc0000000000 R11: ffffed1017207469 R12: ffff8880b903b088
R13: dffffc0000000000 R14: ffff8880b903ae08 R15: 0000000000000000
 finish_task_switch+0x12f/0x640 kernel/sched/core.c:4921
 context_switch kernel/sched/core.c:5052 [inline]
 __schedule+0x11f7/0x43c0 kernel/sched/core.c:6395
 schedule_idle+0x4a/0x90 kernel/sched/core.c:6506
 do_idle+0x606/0x650 kernel/sched/idle.c:355
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:424
 start_kernel+0x489/0x540 init/main.c:1154
 secondary_startup_64_no_verify+0xb1/0xbb
 </TASK>
ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
----------------
Code disassembly (best guess):
   0:	be ff ff ff ff       	mov    $0xffffffff,%esi
   5:	e8 4c ee 68 08       	call   0x868ee56
   a:	85 c0                	test   %eax,%eax
   c:	74 4a                	je     0x58
   e:	4d 85 ff             	test   %r15,%r15
  11:	75 66                	jne    0x79
  13:	e9 fe 00 00 00       	jmp    0x116
  18:	48 89 df             	mov    %rbx,%rdi
  1b:	e8 f6 59 72 08       	call   0x8725a16
  20:	e8 f1 e6 2a 00       	call   0x2ae716
  25:	fb                   	sti
  26:	48 83 c4 08          	add    $0x8,%rsp
* 2a:	5b                   	pop    %rbx <-- trapping instruction
  2b:	41 5c                	pop    %r12
  2d:	41 5d                	pop    %r13
  2f:	41 5e                	pop    %r14
  31:	41 5f                	pop    %r15
  33:	5d                   	pop    %rbp
  34:	c3                   	ret
  35:	48 89 df             	mov    %rbx,%rdi
  38:	e8 c9 09 fe ff       	call   0xfffe0a06
  3d:	43                   	rex.XB
  3e:	80                   	.byte 0x80
  3f:	3c                   	.byte 0x3c