=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
5 locks held by syz.7.1384/8701:
#0: ffff888025aac460 (sb_writers#3){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 fs/namespace.c:386
#1: ffff88807a9d4d18 (&type->i_mutex_dir_key#3/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:822 [inline]
#1: ffff88807a9d4d18 (&type->i_mutex_dir_key#3/1){+.+.}-{3:3}, at: filename_create+0x208/0x470 fs/namei.c:3843
#2: ffffc90000dd0c00 ((&q->perturb_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#2: ffffc90000dd0c00 ((&q->perturb_timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1441
#3: ffff88805f620908 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#3: ffff88805f620908 (&sch->q.lock){+.-.}-{2:2}, at: sfq_perturbation+0x14d/0x20d0 net/sched/sch_sfq.c:610
#4: ffffffff8c31eaa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 1 PID: 8701 Comm: syz.7.1384 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:783
sfq_rehash net/sched/sch_sfq.c:598 [inline]
sfq_perturbation+0x1f5e/0x20d0 net/sched/sch_sfq.c:613
call_timer_fn+0x17b/0x540 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x53a/0x7f0 kernel/time/timer.c:1767
handle_softirqs+0x339/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:seqcount_lockdep_reader_access+0x196/0x1d0 include/linux/seqlock.h:106
Code: 00 4d 85 e4 75 16 e8 b9 f7 0f 00 eb 15 e8 b2 f7 0f 00 e8 dd c0 52 08 4d 85 e4 74 ea e8 a3 f7 0f 00 fb 48 c7 04 24 0e 36 e0 45 <4b> c7 04 3e 00 00 00 00 43 c7 44 3e 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc90002d9fba0 EFLAGS: 00000283
RAX: ffffffff816927fd RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc90014d6c000 RSI: 0000000000000625 RDI: 0000000000000626
RBP: ffffc90002d9fc48 R08: ffffffff901d1177 R09: 1ffffffff203a22e
R10: dffffc0000000000 R11: fffffbfff203a22f R12: 0000000000000200
R13: dffffc0000000000 R14: 1ffff920005b3f74 R15: dffffc0000000000
ktime_get_coarse_real_ts64+0x36/0x120 kernel/time/timekeeping.c:2244
current_time+0x8e/0x2c0 fs/inode.c:2391
shmem_mknod+0x102/0x1b0 mm/shmem.c:2863
shmem_mkdir+0x27/0x60 mm/shmem.c:2903
vfs_mkdir+0x387/0x570 fs/namei.c:4073
do_mkdirat+0x1df/0x5b0 fs/namei.c:4098
__do_sys_mkdirat fs/namei.c:4113 [inline]
__se_sys_mkdirat fs/namei.c:4111 [inline]
__x64_sys_mkdirat+0x85/0x90 fs/namei.c:4111
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd0a1554eb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd09f7b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fd0a17cffa0 RCX: 00007fd0a1554eb9
RDX: 00000000000001c0 RSI: 0000200000000540 RDI: ffffffffffffff9c
RBP: 00007fd0a15c2c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd0a17d0038 R14: 00007fd0a17cffa0 R15: 00007fffd83b5a28
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 4d 85 e4 test %r12,%r12
3: 75 16 jne 0x1b
5: e8 b9 f7 0f 00 call 0xff7c3
a: eb 15 jmp 0x21
c: e8 b2 f7 0f 00 call 0xff7c3
11: e8 dd c0 52 08 call 0x852c0f3
16: 4d 85 e4 test %r12,%r12
19: 74 ea je 0x5
1b: e8 a3 f7 0f 00 call 0xff7c3
20: fb sti
21: 48 c7 04 24 0e 36 e0 movq $0x45e0360e,(%rsp)
28: 45
* 29: 4b c7 04 3e 00 00 00 movq $0x0,(%r14,%r15,1) <-- trapping instruction
30: 00
31: 43 c7 44 3e 08 00 00 movl $0x0,0x8(%r14,%r15,1)
38: 00 00
3a: 65 gs
3b: 48 rex.W
3c: 8b .byte 0x8b
3d: 04 25 add $0x25,%al