=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
8 locks held by kworker/1:7/4235:
#0: ffff888016872138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1: ffffc900031cfd00 ((work_completion)(&(&ssp->work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffffffff9612c780 (&ssp->srcu_gp_mutex){+.+.}-{3:3}, at: srcu_advance_state kernel/rcu/srcutree.c:1177 [inline]
#2: ffffffff9612c780 (&ssp->srcu_gp_mutex){+.+.}-{3:3}, at: process_srcu+0x2f/0xc10 kernel/rcu/srcutree.c:1325
#3: ffffc90000dd0be0 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#3: ffffc90000dd0be0 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xbb/0x530 kernel/time/timer.c:1441
#4: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
#5: ffffffff8c11c4c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
#6: ffff88807a68f108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#6: ffff88807a68f108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3911 [inline]
#6: ffff88807a68f108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xb8a/0x2ed0 net/core/dev.c:4253
#7: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 1 PID: 4235 Comm: kworker/1:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: rcu_gp process_srcu
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
fq_codel_enqueue+0x101a/0x1590 net/sched/sch_fq_codel.c:243
qdisc_enqueue include/net/sch_generic.h:832 [inline]
sfb_enqueue+0x9e0/0x17d0 net/sched/sch_sfb.c:405
dev_qdisc_enqueue+0x48/0x210 net/core/dev.c:3852
__dev_xmit_skb net/core/dev.c:3936 [inline]
__dev_queue_xmit+0xd7e/0x2ed0 net/core/dev.c:4253
tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
tipc_bearer_xmit_skb+0x292/0x3c0 net/tipc/bearer.c:577
tipc_disc_timeout+0x568/0x6b0 net/tipc/discover.c:338
call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1767
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:debug_smp_processor_id+0x0/0x10 lib/smp_processor_id.c:60
Code: 12 8a e8 43 01 00 00 65 c7 05 e8 55 5a 76 00 00 00 00 48 c7 c7 00 ce 12 8a e8 2c 01 00 00 65 ff 0d d1 55 5a 76 5b c3 00 00 cc <48> c7 c7 e0 a1 59 8a 48 c7 c6 20 a2 59 8a eb 00 55 41 57 41 56 53
RSP: 0018:ffffc900031cfab8 EFLAGS: 00000246
RAX: 1ffff1100453ca0d RBX: 0000000000002af9 RCX: ffffffff960c1f00
RDX: 0000000000000048 RSI: ffffffff8a59a220 RDI: ffffffff84006101
RBP: 0000000000000001 R08: dffffc0000000000 R09: fffff52000639f25
R10: fffff52000639f25 R11: 1ffff92000639f24 R12: dffffc0000000000
R13: ffffffff9612c7c0 R14: 00000048c447867c R15: 0000000000001d62
delay_tsc+0x66/0xc0 arch/x86/lib/delay.c:90
try_check_zero+0x2c7/0x340 kernel/rcu/srcutree.c:702
srcu_advance_state kernel/rcu/srcutree.c:1227 [inline]
process_srcu+0x195/0xc10 kernel/rcu/srcutree.c:1325
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: 12 8a e8 43 01 00 adc 0x143e8(%rdx),%cl
6: 00 65 c7 add %ah,-0x39(%rbp)
9: 05 e8 55 5a 76 add $0x765a55e8,%eax
e: 00 00 add %al,(%rax)
10: 00 00 add %al,(%rax)
12: 48 c7 c7 00 ce 12 8a mov $0xffffffff8a12ce00,%rdi
19: e8 2c 01 00 00 call 0x14a
1e: 65 ff 0d d1 55 5a 76 decl %gs:0x765a55d1(%rip) # 0x765a55f6
25: 5b pop %rbx
26: c3 ret
27: 00 00 add %al,(%rax)
29: cc int3
* 2a: 48 c7 c7 e0 a1 59 8a mov $0xffffffff8a59a1e0,%rdi <-- trapping instruction
31: 48 c7 c6 20 a2 59 8a mov $0xffffffff8a59a220,%rsi
38: eb 00 jmp 0x3a
3a: 55 push %rbp
3b: 41 57 push %r15
3d: 41 56 push %r14
3f: 53 push %rbx