=============================
WARNING: suspicious RCU usage
5.15.173-syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
6 locks held by kworker/1:8/6148:
#0: ffff888017070938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc90003277d20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
#2: ffffffff8c91fc60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:312
#3: ffff888075e72148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: net_tx_action+0x73a/0x8e0 net/core/dev.c:5096
#4: ffff888075e72108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#4: ffff888075e72108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x370/0x5e0 net/sched/sch_generic.c:354
#5: ffffffff8c91fc60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:311
stack backtrace:
CPU: 1 PID: 6148 Comm: kworker/1:8 Not tainted 5.15.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Workqueue: events pwq_unbound_release_workfn
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
qdisc_lookup+0xa8/0x630 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x212/0x4f0 net/sched/sch_api.c:800
codel_qdisc_dequeue+0x1546/0x21d0 net/sched/sch_codel.c:102
qdisc_peek_dequeued+0x6f/0x220 include/net/sch_generic.h:1100
tbf_dequeue+0x80/0xd60 net/sched/sch_tbf.c:259
dequeue_skb net/sched/sch_generic.c:292 [inline]
qdisc_restart net/sched/sch_generic.c:397 [inline]
__qdisc_run+0x253/0x1e90 net/sched/sch_generic.c:415
qdisc_run+0x10d/0x320 include/net/pkt_sched.h:132
net_tx_action+0x73a/0x8e0 net/core/dev.c:5096
handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
__do_softirq kernel/softirq.c:592 [inline]
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:lockdep_unregister_key+0x54e/0x5c0 kernel/locking/lockdep.c:6331
Code: 00 00 00 0f 85 8b 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 ef 61 d1 08 41 f7 c4 00 02 00 00 74 86 fb 45 84 f6 <75> 85 eb 96 0f 0b 45 31 f6 e9 1a ff ff ff 0f 0b e9 5a fe ff ff 0f
RSP: 0018:ffffc90003277b40 EFLAGS: 00000202
RAX: dffffc0000000000 RBX: 1ffff9200064ef70 RCX: ffffffff9686af03
RDX: 0000000000000001 RSI: ffffffff8a8b3880 RDI: ffffffff8ad90540
RBP: ffffc90003277c08 R08: dffffc0000000000 R09: fffffbfff20e6c17
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000203
R13: 1ffff9200064ef6c R14: ffff88807b8d5901 R15: ffffc90003277b80
wq_unregister_lockdep kernel/workqueue.c:3518 [inline]
pwq_unbound_release_workfn+0x23d/0x290 kernel/workqueue.c:3756
process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 0f add %cl,(%rdi)
4: 85 8b 00 00 00 48 test %ecx,0x48000000(%rbx)
a: 8d 65 d8 lea -0x28(%rbp),%esp
d: 5b pop %rbx
e: 41 5c pop %r12
10: 41 5d pop %r13
12: 41 5e pop %r14
14: 41 5f pop %r15
16: 5d pop %rbp
17: c3 ret
18: e8 ef 61 d1 08 call 0x8d1620c
1d: 41 f7 c4 00 02 00 00 test $0x200,%r12d
24: 74 86 je 0xffffffac
26: fb sti
27: 45 84 f6 test %r14b,%r14b
* 2a: 75 85 jne 0xffffffb1 <-- trapping instruction
2c: eb 96 jmp 0xffffffc4
2e: 0f 0b ud2
30: 45 31 f6 xor %r14d,%r14d
33: e9 1a ff ff ff jmp 0xffffff52
38: 0f 0b ud2
3a: e9 5a fe ff ff jmp 0xfffffe99
3f: 0f .byte 0xf