=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz-executor/4181:
 #0: 
ffff88802b30cd88
 (
&xt[i].mutex
){+.+.}-{3:3}
, at: xt_find_table_lock+0x5e/0x360 net/netfilter/x_tables.c:1242
 #1: 
ffffc90000007c00
 (
(&q->perturb_timer)
){+.-.}-{0:0}
, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
, at: call_timer_fn+0xbb/0x530 kernel/time/timer.c:1441
 #2: 
ffff888022693908
 (
&sch->q.lock
){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
){+.-.}-{2:2}, at: sfq_perturbation+0x12e/0x2060 net/sched/sch_sfq.c:610
 #3: ffffffff8c11c720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312

stack backtrace:
CPU: 0 PID: 4181 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <IRQ>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
 sfq_rehash net/sched/sch_sfq.c:598 [inline]
 sfq_perturbation+0x1f20/0x2060 net/sched/sch_sfq.c:613
 call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x525/0x7c0 kernel/time/timer.c:1767
 handle_softirqs+0x328/0x820 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:should_fail+0x144/0x4c0 lib/fault-inject.c:108
Code: 37 eb 4a 65 4c 8b 3d 0b 97 0b 7c 49 81 c7 d4 15 00 00 4d 89 fd 49 c1 ed 03 43 0f b6 44 25 00 84 c0 0f 85 6b 02 00 00 41 8b 2f <85> ed 0f 84 e4 fe ff ff ff cd 43 0f b6 44 25 00 84 c0 0f 85 8c 02
RSP: 0018:ffffc90002eef458 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff8c72de00 RCX: ffff88807b14d940
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff8c72de00
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ad334e
R10: fffffbfff1ad334e R11: 1ffffffff1ad334d R12: dffffc0000000000
R13: 1ffff1100f629de2 R14: 0000000000000001 R15: ffff88807b14ef14
 _copy_to_user+0x2e/0x130 lib/usercopy.c:36
 copy_to_user include/linux/uaccess.h:200 [inline]
 copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:853 [inline]
 get_entries net/ipv6/netfilter/ip6_tables.c:1041 [inline]
 do_ip6t_get_ctl+0xb65/0x1090 net/ipv6/netfilter/ip6_tables.c:1679
 nf_getsockopt+0x25e/0x280 net/netfilter/nf_sockopt.c:116
 ipv6_getsockopt+0x442/0x2000 net/ipv6/ipv6_sockglue.c:1492
 tcp_getsockopt+0x1e3/0x2390 net/ipv4/tcp.c:4319
 __sys_getsockopt+0x1b0/0x230 net/socket.c:2247
 __do_sys_getsockopt net/socket.c:2262 [inline]
 __se_sys_getsockopt net/socket.c:2259 [inline]
 __x64_sys_getsockopt+0xb1/0xc0 net/socket.c:2259
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f13d533cd0a
Code: ff c3 66 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb b8 0f 1f 44 00 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7
RSP: 002b:00007ffc4b0b7298 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffc4b0b7320 RCX: 00007f13d533cd0a
RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007ffc4b0b72bc R09: 0079746972756365
R10: 00007ffc4b0b7320 R11: 0000000000000212 R12: 00007f13d55607a0
R13: 00007ffc4b0b72bc R14: 0000000000000000 R15: 00007f13d5560e60
 </TASK>
vkms_vblank_simulate: vblank timer overrun
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	eb 4a                	jmp    0x4c
   2:	65 4c 8b 3d 0b 97 0b 	mov    %gs:0x7c0b970b(%rip),%r15        # 0x7c0b9715
   9:	7c
   a:	49 81 c7 d4 15 00 00 	add    $0x15d4,%r15
  11:	4d 89 fd             	mov    %r15,%r13
  14:	49 c1 ed 03          	shr    $0x3,%r13
  18:	43 0f b6 44 25 00    	movzbl 0x0(%r13,%r12,1),%eax
  1e:	84 c0                	test   %al,%al
  20:	0f 85 6b 02 00 00    	jne    0x291
  26:	41 8b 2f             	mov    (%r15),%ebp
* 29:	85 ed                	test   %ebp,%ebp <-- trapping instruction
  2b:	0f 84 e4 fe ff ff    	je     0xffffff15
  31:	ff cd                	dec    %ebp
  33:	43 0f b6 44 25 00    	movzbl 0x0(%r13,%r12,1),%eax
  39:	84 c0                	test   %al,%al
  3b:	0f                   	.byte 0xf
  3c:	85                   	.byte 0x85
  3d:	8c 02                	mov    %es,(%rdx)