=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
3 locks held by syz.2.243/5237:
#0: ffffc90000007c00 ((&q->perturb_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#0: ffffc90000007c00 ((&q->perturb_timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1441
#1: ffff888022b55908 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#1: ffff888022b55908 (&sch->q.lock){+.-.}-{2:2}, at: sfq_perturbation+0x14d/0x20d0 net/sched/sch_sfq.c:610
#2: ffffffff8c31eaa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 5237 Comm: syz.2.243 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:783
sfq_rehash net/sched/sch_sfq.c:598 [inline]
sfq_perturbation+0x1f5e/0x20d0 net/sched/sch_sfq.c:613
call_timer_fn+0x17b/0x540 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x53a/0x7f0 kernel/time/timer.c:1767
handle_softirqs+0x339/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:202
Code: 00 00 00 66 90 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 4e 2c 98 f7 48 89 df e8 86 04 99 f7 e8 11 f3 b9 f7 fb bf 01 00 00 00 06 0b 8d f7 65 8b 05 87 17 3d 76 85 c0 74 02 5b c3 e8 d4 24 3b
RSP: 0018:ffffc900036678d0 EFLAGS: 00000286
RAX: 24c802bca627e900 RBX: ffff88802b00f348 RCX: 24c802bca627e900
RDX: dffffc0000000000 RSI: ffffffff8a2b2780 RDI: 0000000000000001
RBP: ffffc90003667a40 R08: ffff88802b00f34b R09: 1ffff11005601e69
R10: dffffc0000000000 R11: ffffed1005601e6a R12: ffffc90003667980
R13: 0000000000000001 R14: 0000000000000cc0 R15: ffffea00013973c0
spin_unlock_irq include/linux/spinlock.h:414 [inline]
shmem_add_to_page_cache+0x1009/0x14d0 mm/shmem.c:752
shmem_getpage_gfp+0x1796/0x2d40 mm/shmem.c:1940
shmem_read_mapping_page_gfp+0x96/0x100 mm/shmem.c:4248
shmem_read_mapping_page include/linux/shmem_fs.h:114 [inline]
udmabuf_create+0x895/0x1570 drivers/dma-buf/udmabuf.c:254
udmabuf_ioctl_create drivers/dma-buf/udmabuf.c:314 [inline]
udmabuf_ioctl+0x1f3/0x300 drivers/dma-buf/udmabuf.c:345
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7224047eb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f72222a3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f72242c2fa0 RCX: 00007f7224047eb9
RDX: 0000200000000000 RSI: 0000000040187542 RDI: 0000000000000003
RBP: 00007f72240b5c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f72242c3038 R14: 00007f72242c2fa0 R15: 00007fffe5e736e8
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 66 90 add %ah,-0x70(%rsi)
5: 53 push %rbx
6: 48 89 fb mov %rdi,%rbx
9: 48 83 c7 18 add $0x18,%rdi
d: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
12: e8 4e 2c 98 f7 call 0xf7982c65
17: 48 89 df mov %rbx,%rdi
1a: e8 86 04 99 f7 call 0xf79904a5
1f: e8 11 f3 b9 f7 call 0xf7b9f335
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 06 0b 8d f7 call 0xf78d0b35 <-- trapping instruction
2f: 65 8b 05 87 17 3d 76 mov %gs:0x763d1787(%rip),%eax # 0x763d17bd
36: 85 c0 test %eax,%eax
38: 74 02 je 0x3c
3a: 5b pop %rbx
3b: c3 ret
3c: e8 .byte 0xe8
3d: d4 (bad)
3e: 24 3b and $0x3b,%al