=============================
WARNING: suspicious RCU usage
5.15.185-syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz.4.351/5677:
 #0: ffffffff8c11bfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
 #1: ffff88801ff2c148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: net_tx_action+0x6bc/0x870 net/core/dev.c:5128
 #2: ffff88801ff2c108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
 #2: ffff88801ff2c108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x305/0x4a0 net/sched/sch_generic.c:354
 #3: ffffffff8c11bfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311

stack backtrace:
CPU: 0 PID: 5677 Comm: syz.4.351 Not tainted 5.15.185-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x213/0x4e0 net/sched/sch_api.c:800
 cake_dequeue+0x1b8f/0x4aa0 net/sched/sch_cake.c:2189
 qdisc_peek_dequeued+0x6e/0x1f0 include/net/sch_generic.h:1115
 tbf_dequeue+0x7d/0xce0 net/sched/sch_tbf.c:265
 dequeue_skb net/sched/sch_generic.c:292 [inline]
 qdisc_restart net/sched/sch_generic.c:397 [inline]
 __qdisc_run+0x237/0x1480 net/sched/sch_generic.c:415
 qdisc_run+0x103/0x2f0 include/net/pkt_sched.h:132
 net_tx_action+0x6bc/0x870 net/core/dev.c:5128
 handle_softirqs+0x328/0x820 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1108
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0033:0x7fcd8e7ca9f0
Code: 74 28 48 85 c9 74 29 45 38 1c 10 75 23 83 c0 01 44 39 d0 75 dc 48 89 f0 25 ff 1f 00 00 49 89 34 c1 41 88 3c 00 31 c0 c3 66 90 <41> 38 3c 10 74 0b 41 88 3c 10 31 c0 49 89 34 d1 c3 b8 01 00 00 00
RSP: 002b:00007ffdfc806c38 EFLAGS: 00000246
RAX: 0000000081c4e6d4 RBX: 00007fcd8f662720 RCX: ffffffff81c4e6d4
RDX: 00000000000006d4 RSI: ffffffff81c4e6d4 RDI: 0000000000000004
RBP: ffffffff81c4e6d4 R08: 00007fcd8eb1d000 R09: 00007fcd8eb1f000
R10: 0000000081c4e6d8 R11: 0000000000000004 R12: 0000000000000004
R13: 0000000000000000 R14: ffffffff81c4e368 R15: 0000000000043941
 </TASK>