=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
7 locks held by klogd/3549:
#0: ffffffff8d113908 (syslog_lock){+.+.}-{3:3}, at: syslog_print+0x73a/0x8d0 kernel/printk/printk.c:1578
#1: ffffc90000dd0bc0 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#1: ffffc90000dd0bc0 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1638
#2: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#3: ffffffff8d11f000 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#4: ffff888060ebb108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#4: ffff888060ebb108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3925 [inline]
#4: ffff888060ebb108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2b/0x2e50 net/core/dev.c:4267
#5: ffff888060ebb148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: tipc_l2_send_msg+0x2eb/0x3a0 net/tipc/bearer.c:519
#6: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 1 PID: 3549 Comm: klogd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x640 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x188/0x480 net/sched/sch_api.c:800
cake_dequeue+0x1ddf/0x4a50 net/sched/sch_cake.c:2201
netem_dequeue+0x12d3/0x1410 net/sched/sch_netem.c:766
dequeue_skb net/sched/sch_generic.c:295 [inline]
qdisc_restart net/sched/sch_generic.c:400 [inline]
__qdisc_run+0x22f/0x14b0 net/sched/sch_generic.c:418
__dev_xmit_skb net/core/dev.c:3956 [inline]
__dev_queue_xmit+0xdce/0x2e50 net/core/dev.c:4267
tipc_l2_send_msg+0x2eb/0x3a0 net/tipc/bearer.c:519
tipc_bearer_xmit_skb+0x292/0x3c0 net/tipc/bearer.c:578
tipc_disc_timeout+0x5e1/0x740 net/tipc/discover.c:340
call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
expire_timers kernel/time/timer.c:1699 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:1970
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:check_kcov_mode kernel/kcov.c:182 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:226 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x32/0x80 kernel/kcov.c:292
Code: c4 3e 89 7e 65 8b 15 c5 3e 89 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 5b 83 b9 34 16 00 00 00 74 52 8b 91 10 16 00 00 <83> fa 03 75 47 48 8b 91 18 16 00 00 44 8b 89 14 16 00 00 49 c1 e1
RSP: 0018:ffffc90002d7f7b8 EFLAGS: 00000246
RAX: ffffffff840ce122 RBX: 00000000ffff0a00 RCX: ffff88807d813b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002d7f8e0 R08: ffffc90002d7f857 R09: ffffc90002d7f840
R10: dffffc0000000000 R11: fffff520005aff0b R12: 0000000000000002
R13: dffffc0000000000 R14: ffffc90002d7fbc7 R15: 0000000000000002
number+0x7d2/0xef0 lib/vsprintf.c:542
vsnprintf+0x12d3/0x1c20 lib/vsprintf.c:2877
sprintf+0xe4/0x140 lib/vsprintf.c:3013
print_time kernel/printk/printk.c:1274 [inline]
info_print_prefix+0x168/0x360 kernel/printk/printk.c:1300
record_print_text kernel/printk/printk.c:1349 [inline]
syslog_print+0x44e/0x8d0 kernel/printk/printk.c:1560
do_syslog+0x83f/0x930 kernel/printk/printk.c:1679
__do_sys_syslog kernel/printk/printk.c:1771 [inline]
__se_sys_syslog kernel/printk/printk.c:1769 [inline]
__x64_sys_syslog+0x78/0x90 kernel/printk/printk.c:1769
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fe88f3d7a37
Code: 73 01 c3 48 8b 0d c1 f3 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 67 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 f3 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe32683058 EFLAGS: 00000206 ORIG_RAX: 0000000000000067
RAX: ffffffffffffffda RBX: 00007fe88f577490 RCX: 00007fe88f3d7a37
RDX: 00000000000003ff RSI: 00007fe88f577490 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000206 R12: 00007fe88f577490
R13: 00007fe88f554dfe R14: 00007fe88f57787c R15: 00007fe88f57787c
net_ratelimit: 98 callbacks suppressed
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 3e 89 7e 65 ds mov %edi,0x65(%rsi)
4: 8b 15 c5 3e 89 7e mov 0x7e893ec5(%rip),%edx # 0x7e893ecf
a: 81 e2 00 01 ff 00 and $0xff0100,%edx
10: 74 11 je 0x23
12: 81 fa 00 01 00 00 cmp $0x100,%edx
18: 75 5b jne 0x75
1a: 83 b9 34 16 00 00 00 cmpl $0x0,0x1634(%rcx)
21: 74 52 je 0x75
23: 8b 91 10 16 00 00 mov 0x1610(%rcx),%edx
* 29: 83 fa 03 cmp $0x3,%edx <-- trapping instruction
2c: 75 47 jne 0x75
2e: 48 8b 91 18 16 00 00 mov 0x1618(%rcx),%rdx
35: 44 8b 89 14 16 00 00 mov 0x1614(%rcx),%r9d
3c: 49 rex.WB
3d: c1 .byte 0xc1
3e: e1 .byte 0xe1