=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
6 locks held by kworker/u4:2/154:
#0: ffff88814c302138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1: ffffc90001ff7d00 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffffffff8c11c760 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#3: ffff888076e92148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: net_tx_action+0x6bc/0x870 net/core/dev.c:5128
#4: ffff888076e92108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#4: ffff888076e92108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x305/0x4a0 net/sched/sch_generic.c:354
#5: ffffffff8c11c760 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 154 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: bat_events batadv_tt_purge
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
cake_dequeue+0x1b8f/0x4aa0 net/sched/sch_cake.c:2199
qdisc_peek_dequeued+0x6e/0x1f0 include/net/sch_generic.h:1115
tbf_dequeue+0x7d/0xce0 net/sched/sch_tbf.c:265
dequeue_skb net/sched/sch_generic.c:292 [inline]
qdisc_restart net/sched/sch_generic.c:397 [inline]
__qdisc_run+0x237/0x1480 net/sched/sch_generic.c:415
qdisc_run+0x103/0x2f0 include/net/pkt_sched.h:132
net_tx_action+0x6bc/0x870 net/core/dev.c:5128
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:103 [inline]
RIP: 0010:__local_bh_enable_ip+0x132/0x1b0 kernel/softirq.c:408
Code: 8a e8 92 0b 61 08 65 66 8b 05 8a 25 bb 7e 66 85 c0 75 54 bf 01 00 00 00 e8 ab fe 08 00 e8 66 76 35 00 fb 65 8b 05 36 fc b9 7e <85> c0 75 05 e8 e5 06 b8 ff 48 c7 04 24 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc90001ff7a80 EFLAGS: 00000282
RAX: 0000000080000000 RBX: 0000000000000201 RCX: f592de447a16d500
RDX: dffffc0000000000 RSI: ffffffff8a0b1c60 RDI: ffffffff8a59e580
RBP: ffffc90001ff7b18 R08: dffffc0000000000 R09: fffffbfff1ff7c3a
R10: fffffbfff1ff7c3a R11: 1ffffffff1ff7c39 R12: ffffffff8981b687
R13: dffffc0000000000 R14: dffffc0000000000 R15: 1ffff920003fef50
spin_unlock_bh include/linux/spinlock.h:409 [inline]
batadv_tt_local_purge+0x2a7/0x340 net/batman-adv/translation-table.c:1371
batadv_tt_purge+0x31/0x9f0 net/batman-adv/translation-table.c:3582
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: 8a e8 mov %al,%ch
2: 92 xchg %eax,%edx
3: 0b 61 08 or 0x8(%rcx),%esp
6: 65 66 8b 05 8a 25 bb mov %gs:0x7ebb258a(%rip),%ax # 0x7ebb2598
d: 7e
e: 66 85 c0 test %ax,%ax
11: 75 54 jne 0x67
13: bf 01 00 00 00 mov $0x1,%edi
18: e8 ab fe 08 00 call 0x8fec8
1d: e8 66 76 35 00 call 0x357688
22: fb sti
23: 65 8b 05 36 fc b9 7e mov %gs:0x7eb9fc36(%rip),%eax # 0x7eb9fc60
* 2a: 85 c0 test %eax,%eax <-- trapping instruction
2c: 75 05 jne 0x33
2e: e8 e5 06 b8 ff call 0xffb80718
33: 48 c7 04 24 0e 36 e0 movq $0x45e0360e,(%rsp)
3a: 45
3b: 4b rex.WXB
3c: c7 .byte 0xc7
3d: 04 37 add $0x37,%al