=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
8 locks held by kworker/0:6/4240:
#0: ffff888016870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1: ffffc9000325fd00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffff888060868400 (&nsim_dev->port_list_lock#2){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x56/0xb40 drivers/net/netdevsim/dev.c:757
#3: ffff88805fb360e0 (&nsim_trap_data->trap_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#3: ffff88805fb360e0 (&nsim_trap_data->trap_lock){+.+.}-{2:2}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:707 [inline]
#3: ffff88805fb360e0 (&nsim_trap_data->trap_lock){+.+.}-{2:2}, at: nsim_dev_trap_report_work+0x1af/0xb40 drivers/net/netdevsim/dev.c:762
#4: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
#5: ffff88802354f148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: net_tx_action+0x6bc/0x870 net/core/dev.c:5128
#6: ffff88802354f108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#6: ffff88802354f108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x305/0x4a0 net/sched/sch_generic.c:354
#7: ffffffff8c11c460 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 0 PID: 4240 Comm: kworker/0:6 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: events nsim_dev_trap_report_work
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
cake_dequeue+0x1b8f/0x4aa0 net/sched/sch_cake.c:2199
qdisc_peek_dequeued+0x6e/0x1f0 include/net/sch_generic.h:1115
tbf_dequeue+0x7d/0xce0 net/sched/sch_tbf.c:265
dequeue_skb net/sched/sch_generic.c:292 [inline]
qdisc_restart net/sched/sch_generic.c:397 [inline]
__qdisc_run+0x237/0x1480 net/sched/sch_generic.c:415
qdisc_run+0x103/0x2f0 include/net/pkt_sched.h:132
net_tx_action+0x6bc/0x870 net/core/dev.c:5128
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:_compound_head include/linux/page-flags.h:198 [inline]
RIP: 0010:virt_to_head_page include/linux/mm.h:913 [inline]
RIP: 0010:kfree+0x7e/0x2a0 mm/slub.c:4559
Code: fb 11 0f 82 21 01 00 00 48 89 df e8 3c c9 79 ff 49 89 c7 49 c1 ef 06 49 83 e7 c0 48 b9 00 00 00 00 00 ea ff ff 49 8b 44 0f 08 01 0f 85 21 01 00 00 49 01 cf 49 8b 47 08 4c 89 f9 a8 01 0f 85
RSP: 0018:ffffc9000325fa38 EFLAGS: 00000206
RAX: dead000000000100 RBX: ffff888079540000 RCX: ffffea0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ad31e6
R10: fffffbfff1ad31e6 R11: 1ffffffff1ad31e5 R12: ffff88806331b2fe
R13: dffffc0000000000 R14: ffffffff87cfae8e R15: 0000000001e55000
skb_free_head net/core/skbuff.c:655 [inline]
skb_release_data+0x6fe/0x850 net/core/skbuff.c:677
skb_release_all net/core/skbuff.c:742 [inline]
__kfree_skb net/core/skbuff.c:756 [inline]
consume_skb+0xa2/0x100 net/core/skbuff.c:914
nsim_dev_trap_report drivers/net/netdevsim/dev.c:737 [inline]
nsim_dev_trap_report_work+0x7cb/0xb40 drivers/net/netdevsim/dev.c:762
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 0f 82 21 01 00 00 jb 0x127
6: 48 89 df mov %rbx,%rdi
9: e8 3c c9 79 ff call 0xff79c94a
e: 49 89 c7 mov %rax,%r15
11: 49 c1 ef 06 shr $0x6,%r15
15: 49 83 e7 c0 and $0xffffffffffffffc0,%r15
19: 48 b9 00 00 00 00 00 movabs $0xffffea0000000000,%rcx
20: ea ff ff
23: 49 8b 44 0f 08 mov 0x8(%r15,%rcx,1),%rax
* 28: a8 01 test $0x1,%al <-- trapping instruction
2a: 0f 85 21 01 00 00 jne 0x151
30: 49 01 cf add %rcx,%r15
33: 49 8b 47 08 mov 0x8(%r15),%rax
37: 4c 89 f9 mov %r15,%rcx
3a: a8 01 test $0x1,%al
3c: 0f .byte 0xf
3d: 85 .byte 0x85