=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz-executor/4185:
 #0: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
 #1: ffff888020101148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: net_tx_action+0x6bc/0x870 net/core/dev.c:5128
 #2: ffff888020101108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
 #2: ffff888020101108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x305/0x4a0 net/sched/sch_generic.c:354
 #3: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311

stack backtrace:
CPU: 1 PID: 4185 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <IRQ>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
 cake_dequeue+0x1b8f/0x4aa0 net/sched/sch_cake.c:2199
 qdisc_peek_dequeued+0x6e/0x1f0 include/net/sch_generic.h:1115
 tbf_dequeue+0x7d/0xce0 net/sched/sch_tbf.c:265
 dequeue_skb net/sched/sch_generic.c:292 [inline]
 qdisc_restart net/sched/sch_generic.c:397 [inline]
 __qdisc_run+0x237/0x1480 net/sched/sch_generic.c:415
 qdisc_run+0x103/0x2f0 include/net/pkt_sched.h:132
 net_tx_action+0x6bc/0x870 net/core/dev.c:5128
 handle_softirqs+0x328/0x820 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:stack_trace_consume_entry+0x9/0x270 kernel/stacktrace.c:83
Code: 3b 4c 24 78 75 09 48 8d 65 f0 5b 41 5e 5d c3 e8 9d 75 42 08 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 55 41 57 41 56 41 55 41 54 <53> 48 83 ec 18 48 ba 00 00 00 00 00 fc ff df 4c 8d 47 10 4c 89 c5
RSP: 0018:ffffc90002edf298 EFLAGS: 00000282
RAX: ffffffff89a8b6f8 RBX: ffffc90002edf380 RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff89a8b6f8 RDI: ffffc90002edf380
RBP: ffffc90002edf350 R08: dffffc0000000000 R09: ffffc90002edf318
R10: fffff520005dbe65 R11: 1ffff920005dbe63 R12: ffff88807d243b80
R13: 1ffff920005dbe84 R14: ffffffff816678c0 R15: ffffc90002edf2c8
 arch_stack_walk+0x100/0x140 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
 save_stack+0xf3/0x1e0 mm/page_owner.c:119
 __reset_page_owner+0x51/0x180 mm/page_owner.c:140
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page_list+0x122/0x7e0 mm/page_alloc.c:3433
 release_pages+0x184b/0x1bb0 mm/swap.c:963
 __pagevec_release+0x6d/0xe0 mm/swap.c:983
 pagevec_release include/linux/pagevec.h:81 [inline]
 shmem_undo_range+0x5cb/0x1880 mm/shmem.c:964
 shmem_truncate_range mm/shmem.c:1063 [inline]
 shmem_evict_inode+0x20d/0xa00 mm/shmem.c:1145
 evict+0x485/0x870 fs/inode.c:647
 __dentry_kill+0x431/0x650 fs/dcache.c:586
 dentry_kill+0xb8/0x290 fs/dcache.c:-1
 dput+0xd8/0x1a0 fs/dcache.c:893
 __fput+0x5ee/0x930 fs/file_table.c:319
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fc76519d7ab
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007fffc1492260 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fc76519d7ab
RDX: 0000000000000000 RSI: 0000000000004c01 RDI: 0000000000000003
RBP: 00007fffc14922fc R08: 0000000000000000 R09: 00007fffc1492007
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c
R13: 00000000000927c0 R14: 0000000000015464 R15: 00007fffc1492350
 </TASK>
----------------
Code disassembly (best guess):
   0:	3b 4c 24 78          	cmp    0x78(%rsp),%ecx
   4:	75 09                	jne    0xf
   6:	48 8d 65 f0          	lea    -0x10(%rbp),%rsp
   a:	5b                   	pop    %rbx
   b:	41 5e                	pop    %r14
   d:	5d                   	pop    %rbp
   e:	c3                   	ret
   f:	e8 9d 75 42 08       	call   0x84275b1
  14:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  1b:	00 00 00
  1e:	0f 1f 00             	nopl   (%rax)
  21:	55                   	push   %rbp
  22:	41 57                	push   %r15
  24:	41 56                	push   %r14
  26:	41 55                	push   %r13
  28:	41 54                	push   %r12
* 2a:	53                   	push   %rbx <-- trapping instruction
  2b:	48 83 ec 18          	sub    $0x18,%rsp
  2f:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  36:	fc ff df
  39:	4c 8d 47 10          	lea    0x10(%rdi),%r8
  3d:	4c 89 c5             	mov    %r8,%rbp