=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz.6.667/8467:
#0: ffff8880209d4618 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#0: ffff8880209d4618 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pte_range mm/memory.c:1342 [inline]
#0: ffff8880209d4618 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pmd_range mm/memory.c:1505 [inline]
#0: ffff8880209d4618 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_pud_range mm/memory.c:1534 [inline]
#0: ffff8880209d4618 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: zap_p4d_range mm/memory.c:1555 [inline]
#0: ffff8880209d4618 (ptlock_ptr(page)#2){+.+.}-{2:2}, at: unmap_page_range+0x98d/0x2520 mm/memory.c:1576
#1: ffffc90000007c00 ((&q->perturb_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#1: ffffc90000007c00 ((&q->perturb_timer)){+.-.}-{0:0}, at: call_timer_fn+0xbb/0x530 kernel/time/timer.c:1441
#2: ffff8880227b8908 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#2: ffff8880227b8908 (&sch->q.lock){+.-.}-{2:2}, at: sfq_perturbation+0x12e/0x2060 net/sched/sch_sfq.c:610
#3: ffffffff8c11c760 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 8467 Comm: syz.6.667 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:793
sfq_rehash net/sched/sch_sfq.c:598 [inline]
sfq_perturbation+0x1f20/0x2060 net/sched/sch_sfq.c:613
call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451
expire_timers kernel/time/timer.c:1496 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1767
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:_compound_head include/linux/page-flags.h:-1 [inline]
RIP: 0010:PageSwapBacked include/linux/page-flags.h:371 [inline]
RIP: 0010:mm_counter_file include/linux/mm.h:1977 [inline]
RIP: 0010:mm_counter include/linux/mm.h:1986 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1383 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1505 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1534 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1555 [inline]
RIP: 0010:unmap_page_range+0xecd/0x2520 mm/memory.c:1576
Code: 74 08 4c 89 ef e8 e3 81 10 00 4d 8b 65 00 44 89 e6 83 e6 01 31 ff e8 92 1d cc ff 41 f6 c4 01 0f 85 da 0a 00 00 e8 a3 19 cc ff <4d> 89 fc 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 e7 e8 aa
RSP: 0018:ffffc9000337f560 EFLAGS: 00000293
RAX: ffffffff81abb26d RBX: 0000000000000000 RCX: ffff88807e8fd940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000337f6d0 R08: dffffc0000000000 R09: ffffed100fd1fb29
R10: ffffed100fd1fb29 R11: 1ffff1100fd1fb28 R12: 0000000000000000
R13: ffffea000165a908 R14: dffffc0000000000 R15: ffffea000165a900
unmap_vmas+0x11b/0x230 mm/memory.c:1653
exit_mmap+0x38f/0x5f0 mm/mmap.c:3216
__mmput+0x115/0x3b0 kernel/fork.c:1127
exit_mm+0x567/0x6c0 kernel/exit.c:550
do_exit+0x5a1/0x20a0 kernel/exit.c:870
do_group_exit+0x12e/0x300 kernel/exit.c:997
get_signal+0x6ca/0x12c0 kernel/signal.c:2900
arch_do_signal_or_restart+0xc1/0x1300 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fc2cce9d749
Code: Unable to access opcode bytes at RIP 0x7fc2cce9d71f.
RSP: 002b:00007fc2cb0e30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007fc2cd0f4098 RCX: 00007fc2cce9d749
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fc2cd0f409c
RBP: 00007fc2cd0f4090 R08: 0035087cb0229eea R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc2cd0f4128 R14: 00007fffa558c6a0 R15: 00007fffa558c788
----------------
Code disassembly (best guess):
0: 74 08 je 0xa
2: 4c 89 ef mov %r13,%rdi
5: e8 e3 81 10 00 call 0x1081ed
a: 4d 8b 65 00 mov 0x0(%r13),%r12
e: 44 89 e6 mov %r12d,%esi
11: 83 e6 01 and $0x1,%esi
14: 31 ff xor %edi,%edi
16: e8 92 1d cc ff call 0xffcc1dad
1b: 41 f6 c4 01 test $0x1,%r12b
1f: 0f 85 da 0a 00 00 jne 0xaff
25: e8 a3 19 cc ff call 0xffcc19cd
* 2a: 4d 89 fc mov %r15,%r12 <-- trapping instruction
2d: 4c 89 e0 mov %r12,%rax
30: 48 c1 e8 03 shr $0x3,%rax
34: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1)
39: 74 08 je 0x43
3b: 4c 89 e7 mov %r12,%rdi
3e: e8 .byte 0xe8
3f: aa stos %al,%es:(%rdi)