=============================
WARNING: suspicious RCU usage
5.15.189-syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
6 locks held by syz.0.73/4681:
#0: ffffc90000007be0 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#0: ffffc90000007be0 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xbb/0x530 kernel/time/timer.c:1441
#1: ffffffff8c11c360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
#2: ffffffff8c11c3c0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
#3: ffff888075628108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#3: ffff888075628108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3911 [inline]
#3: ffff888075628108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xb8a/0x2ed0 net/core/dev.c:4253
#4: ffff888075628148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
#5: ffffffff8c11c360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 0 PID: 4681 Comm: syz.0.73 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
sfq_enqueue+0x148e/0x2260 net/sched/sch_sfq.c:-1
qdisc_enqueue include/net/sch_generic.h:832 [inline]
netem_dequeue+0xd39/0x1400 net/sched/sch_netem.c:737
dequeue_skb net/sched/sch_generic.c:292 [inline]
qdisc_restart net/sched/sch_generic.c:397 [inline]
__qdisc_run+0x237/0x1480 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3942 [inline]
__dev_queue_xmit+0xeb9/0x2ed0 net/core/dev.c:4253
tipc_l2_send_msg+0x30a/0x3c0 net/tipc/bearer.c:518
tipc_bearer_xmit_skb+0x292/0x3c0 net/tipc/bearer.c:577
tipc_disc_timeout+0x568/0x6b0 net/tipc/discover.c:338
call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1767
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:171 [inline]
RIP: 0010:unwind_next_frame+0x20a/0x1d90 arch/x86/kernel/unwind_orc.c:448
Code: b6 04 28 84 c0 0f 85 8a 16 00 00 45 8b 07 41 ff c0 4b 8d 04 64 48 8d b4 00 30 3a de 8d 48 81 fe 6c 13 7d 8e 0f 83 bd 14 00 00 <4b> 8d 04 40 48 8d 84 00 30 3a de 8d 48 3d 6c 13 7d 8e 0f 87 a5 14
RSP: 0018:ffffc900039beda8 EFLAGS: 00000297
RAX: 00000000000892c5 RBX: ffffc900039bee68 RCX: ffffffff960bdf00
RDX: 000000000008e07f RSI: ffffffff8def5fba RDI: ffffffff8134790c
RBP: ffffffff81cc3980 R08: 000000000002db98 R09: 0000000000000007
R10: fffff52000737dd9 R11: 1ffff92000737dd7 R12: 000000000002db97
R13: dffffc0000000000 R14: 000000000000cc39 R15: ffffffff8e804454
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
save_stack+0xf3/0x1e0 mm/page_owner.c:119
__reset_page_owner+0x51/0x180 mm/page_owner.c:140
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
free_unref_page_list+0x122/0x7e0 mm/page_alloc.c:3433
release_pages+0x184b/0x1bb0 mm/swap.c:963
__pagevec_release+0x6d/0xe0 mm/swap.c:983
pagevec_release include/linux/pagevec.h:81 [inline]
shmem_undo_range+0x593/0x1840 mm/shmem.c:964
shmem_truncate_range mm/shmem.c:1063 [inline]
shmem_evict_inode+0x20d/0xa00 mm/shmem.c:1145
evict+0x485/0x870 fs/inode.c:647
__dentry_kill+0x431/0x650 fs/dcache.c:586
dentry_kill+0xb8/0x290 fs/dcache.c:-1
dput+0xd8/0x1a0 fs/dcache.c:893
__fput+0x5ee/0x930 fs/file_table.c:319
task_work_run+0x125/0x1a0 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x61e/0x20a0 kernel/exit.c:883
do_group_exit+0x12e/0x300 kernel/exit.c:997
get_signal+0x6ca/0x12c0 kernel/signal.c:2900
arch_do_signal_or_restart+0xc1/0x1300 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f8223381be9
Code: Unable to access opcode bytes at RIP 0x7f8223381bbf.
RSP: 002b:00007f82215c8038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f82235a9090 RCX: 00007f8223381be9
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f8223404e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f82235a9128 R14: 00007f82235a9090 R15: 00007ffef08ec788
----------------
Code disassembly (best guess):
0: b6 04 mov $0x4,%dh
2: 28 84 c0 0f 85 8a 16 sub %al,0x168a850f(%rax,%rax,8)
9: 00 00 add %al,(%rax)
b: 45 8b 07 mov (%r15),%r8d
e: 41 ff c0 inc %r8d
11: 4b 8d 04 64 lea (%r12,%r12,2),%rax
15: 48 8d b4 00 30 3a de lea -0x7221c5d0(%rax,%rax,1),%rsi
1c: 8d
1d: 48 81 fe 6c 13 7d 8e cmp $0xffffffff8e7d136c,%rsi
24: 0f 83 bd 14 00 00 jae 0x14e7
* 2a: 4b 8d 04 40 lea (%r8,%r8,2),%rax <-- trapping instruction
2e: 48 8d 84 00 30 3a de lea -0x7221c5d0(%rax,%rax,1),%rax
35: 8d
36: 48 3d 6c 13 7d 8e cmp $0xffffffff8e7d136c,%rax
3c: 0f .byte 0xf
3d: 87 .byte 0x87
3e: a5 movsl %ds:(%rsi),%es:(%rdi)
3f: 14 .byte 0x14