=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
6 locks held by kworker/u4:9/5570:
#0: ffff88802be36138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc9000382fd00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffffffff8c31ef20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#3: ffffc90000007be0 ((&q->perturb_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#3: ffffc90000007be0 ((&q->perturb_timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1638
#4: ffff8880741cb108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#4: ffff8880741cb108 (&sch->q.lock){+.-.}-{2:2}, at: sfq_perturbation+0x14d/0x2090 net/sched/sch_sfq.c:610
#5: ffffffff8c31ef20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 5570 Comm: kworker/u4:9 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: bat_events batadv_nc_worker
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x640 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x188/0x480 net/sched/sch_api.c:783
sfq_rehash net/sched/sch_sfq.c:598 [inline]
sfq_perturbation+0x1f26/0x2090 net/sched/sch_sfq.c:613
call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
expire_timers kernel/time/timer.c:1699 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:1970
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x60 kernel/kcov.c:205
Code: 00 00 00 00 00 90 53 48 89 fb e8 17 00 00 00 48 8b 3d 80 fa 11 0c 48 89 de 5b e9 07 56 44 00 00 00 cc cc 00 00 cc 48 8b 04 24 <65> 48 8b 0d 14 7d 89 7e 65 8b 15 15 7d 89 7e 81 e2 00 01 ff 00 74
RSP: 0018:ffffc9000382fbd8 EFLAGS: 00000202
RAX: ffffffff8993b51f RBX: dffffc0000000000 RCX: f42d56a93880b800
RDX: 0000000000000000 RSI: ffffffff8a7a2a20 RDI: ffffffff8a7a29e0
RBP: 0000000000000001 R08: dffffc0000000000 R09: 1ffffffff203d218
R10: dffffc0000000000 R11: fffffbfff203d219 R12: 0000000000000204
R13: 0000000000000000 R14: ffff8880622fcc80 R15: ffff888062224710
rcu_read_unlock include/linux/rcupdate.h:769 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:416 [inline]
batadv_nc_worker+0x1df/0x5c0 net/batman-adv/network-coding.c:723
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 00 90 53 48 89 fb add %dl,-0x476b7ad(%rax)
a: e8 17 00 00 00 call 0x26
f: 48 8b 3d 80 fa 11 0c mov 0xc11fa80(%rip),%rdi # 0xc11fa96
16: 48 89 de mov %rbx,%rsi
19: 5b pop %rbx
1a: e9 07 56 44 00 jmp 0x445626
1f: 00 00 add %al,(%rax)
21: cc int3
22: cc int3
23: 00 00 add %al,(%rax)
25: cc int3
26: 48 8b 04 24 mov (%rsp),%rax
* 2a: 65 48 8b 0d 14 7d 89 mov %gs:0x7e897d14(%rip),%rcx # 0x7e897d46 <-- trapping instruction
31: 7e
32: 65 8b 15 15 7d 89 7e mov %gs:0x7e897d15(%rip),%edx # 0x7e897d4e
39: 81 e2 00 01 ff 00 and $0xff0100,%edx
3f: 74 .byte 0x74