=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
9 locks held by kworker/1:0/21:
#0: ffff88801b9c7d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
#1: ffffc90000db7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
#2: ffff888148241220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
#2: ffff888148241220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1a7/0x5560 drivers/usb/core/hub.c:5827
#3: ffff8881482445c0
(&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3168 [inline]
(&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x6c3/0x5560 drivers/usb/core/hub.c:5880
#4: ffff888148243098 (&hub->status_mutex){+.+.}-{3:3}, at: hub_ext_port_status+0x54/0x6d0 drivers/usb/core/hub.c:612
#5: ffffffff8c11c720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#6: ffff888074952148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: net_tx_action+0x6bc/0x870 net/core/dev.c:5128
#7: ffff888074952108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#7: ffff888074952108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x305/0x4a0 net/sched/sch_generic.c:357
#8: ffffffff8c11c720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:783
cake_dequeue+0x1b8f/0x4aa0 net/sched/sch_cake.c:2199
qdisc_peek_dequeued+0x6e/0x1f0 include/net/sch_generic.h:1115
tbf_dequeue+0x7d/0xce0 net/sched/sch_tbf.c:265
dequeue_skb net/sched/sch_generic.c:295 [inline]
qdisc_restart net/sched/sch_generic.c:400 [inline]
__qdisc_run+0x23f/0x14a0 net/sched/sch_generic.c:418
qdisc_run+0x103/0x2f0 include/net/pkt_sched.h:131
net_tx_action+0x6bc/0x870 net/core/dev.c:5128
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:202
Code: f6 ff 0f 1f 00 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 be 2b b1 f7 48 89 df e8 86 00 b2 f7 e8 21 9a d2 f7 fb bf 01 00 00 00 56 22 a6 f7 65 8b 05 e7 1f 57 76 85 c0 74 02 5b c3 e8 f4 2a 55
RSP: 0018:ffffc90000db7688 EFLAGS: 00000282
RAX: 904f83f738b97d00 RBX: ffffffff8cb9d940 RCX: 904f83f738b97d00
RDX: dffffc0000000000 RSI: ffffffff8a0b1be0 RDI: 0000000000000001
RBP: dffffc0000000000 R08: dffffc0000000000 R09: fffffbfff1ff5427
R10: fffffbfff1ff5427 R11: 1ffffffff1ff5426 R12: ffff888148241070
R13: ffff88802a0a5500 R14: ffff88802a0a5518 R15: 0000000000000000
spin_unlock_irq include/linux/spinlock.h:414 [inline]
rh_call_control drivers/usb/core/hcd.c:739 [inline]
rh_urb_enqueue drivers/usb/core/hcd.c:848 [inline]
usb_hcd_submit_urb+0x144b/0x19c0 drivers/usb/core/hcd.c:1555
usb_start_wait_urb+0x111/0x4b0 drivers/usb/core/message.c:58
usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
usb_control_msg+0x22f/0x3e0 drivers/usb/core/message.c:153
get_port_status drivers/usb/core/hub.c:596 [inline]
hub_ext_port_status+0x103/0x6d0 drivers/usb/core/hub.c:613
hub_port_status drivers/usb/core/hub.c:635 [inline]
port_event drivers/usb/core/hub.c:5693 [inline]
hub_event+0x7fc/0x5560 drivers/usb/core/hub.c:5881
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
process_scheduled_works kernel/workqueue.c:2373 [inline]
worker_thread+0xdca/0x12a0 kernel/workqueue.c:2459
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: f6 ff idiv %bh
2: 0f 1f 00 nopl (%rax)
5: 53 push %rbx
6: 48 89 fb mov %rdi,%rbx
9: 48 83 c7 18 add $0x18,%rdi
d: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
12: e8 be 2b b1 f7 call 0xf7b12bd5
17: 48 89 df mov %rbx,%rdi
1a: e8 86 00 b2 f7 call 0xf7b200a5
1f: e8 21 9a d2 f7 call 0xf7d29a45
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 56 22 a6 f7 call 0xf7a62285 <-- trapping instruction
2f: 65 8b 05 e7 1f 57 76 mov %gs:0x76571fe7(%rip),%eax # 0x7657201d
36: 85 c0 test %eax,%eax
38: 74 02 je 0x3c
3a: 5b pop %rbx
3b: c3 ret
3c: e8 .byte 0xe8
3d: f4 hlt
3e: 2a .byte 0x2a
3f: 55 push %rbp