=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
6 locks held by syz.4.231/5174:
 #0: ffff888028dee460 (sb_writers#3){.+.+}-{0:0}, at: do_coredump+0x1492/0x2ac0 fs/coredump.c:893
 #1: ffff88807e8388b0 (&sb->s_type->i_mutex_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
 #1: ffff88807e8388b0 (&sb->s_type->i_mutex_key#8){+.+.}-{3:3}, at: generic_file_write_iter+0x7e/0x1b0 mm/filemap.c:3941
 #2: ffffffff8c31eb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
 #3: ffff888022a05148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: net_tx_action+0x6d9/0x880 net/core/dev.c:5154
 #4: ffff888022a05108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
 #4: ffff888022a05108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x311/0x4b0 net/sched/sch_generic.c:357
 #5: ffffffff8c31eb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312

stack backtrace:
CPU: 1 PID: 5174 Comm: syz.4.231 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 qdisc_lookup+0xa6/0x650 net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x190/0x430 net/sched/sch_api.c:783
 cake_dequeue+0x1bd6/0x4b10 net/sched/sch_cake.c:2205
 qdisc_peek_dequeued+0x6e/0x1f0 include/net/sch_generic.h:1125
 tbf_dequeue+0x7d/0xce0 net/sched/sch_tbf.c:265
 dequeue_skb net/sched/sch_generic.c:295 [inline]
 qdisc_restart net/sched/sch_generic.c:400 [inline]
 __qdisc_run+0x236/0x1490 net/sched/sch_generic.c:418
 qdisc_run+0x103/0x2f0 include/net/pkt_sched.h:131
 net_tx_action+0x6d9/0x880 net/core/dev.c:5154
 handle_softirqs+0x339/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:kasan_check_range+0x1b0/0x290 mm/kasan/generic.c:-1
Code: f3 4d 01 f3 49 89 df 49 8d 5f 07 4d 85 ff 49 0f 49 df 48 83 e3 f8 49 29 df 74 0e 41 80 3b 00 75 69 49 ff c3 49 ff cf 75 f2 5b <41> 5c 41 5e 41 5f 5d c3 45 84 ff 0f 85 91 00 00 00 41 f7 c7 00 ff
RSP: 0018:ffffc900035a6d18 EFLAGS: 00000256
RAX: 0000000000000001 RBX: ffffea00017a3180 RCX: ffffffff81a6ae4b
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea00017a3180
RBP: ffffc900035a6ea0 R08: ffffea00017a3187 R09: 1ffffd40002f4630
R10: dffffc0000000000 R11: fffff940002f4631 R12: dffffc0000000001
R13: dffffc0000000000 R14: 1ffffd40002f4630 R15: 0000000000000001
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
 PageHead include/linux/page-flags.h:590 [inline]
 compound_order include/linux/mm.h:959 [inline]
 shmem_add_to_page_cache+0x45b/0x14d0 mm/shmem.c:702
 shmem_getpage_gfp+0x1796/0x2d40 mm/shmem.c:1940
 shmem_getpage mm/shmem.c:151 [inline]
 shmem_write_begin+0xcd/0x1a0 mm/shmem.c:2474
 generic_perform_write+0x2b6/0x550 mm/filemap.c:3785
 __generic_file_write_iter+0x25f/0x4e0 mm/filemap.c:3912
 generic_file_write_iter+0xa6/0x1b0 mm/filemap.c:3944
 __kernel_write+0x51c/0x970 fs/read_write.c:539
 __dump_emit+0x249/0x370 fs/coredump.c:943
 dump_user_range+0x84/0x340 fs/coredump.c:1017
 elf_core_dump+0x2fbd/0x3500 fs/binfmt_elf.c:2285
 do_coredump+0x14c7/0x2ac0 fs/coredump.c:894
 get_signal+0x40a/0x12c0 kernel/signal.c:2886
 arch_do_signal_or_restart+0xe7/0x12c0 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:320
 exc_page_fault+0x88/0x100 arch/x86/mm/fault.c:1499
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606
RIP: 0033:0x7f4e09852877
Code: e8 8e fa ff ff 89 f2 48 8d 3d 0d 40 1b 00 48 8d 35 c4 fa 1d 00 31 c0 e8 e7 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8
RSP: 002b:00007f4e07bd7120 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f4e0999cdd9
RDX: 00007f4e07bd7140 RSI: 00007f4e07bd7270 RDI: 000000000000000b
RBP: 00007f4e09a32d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f4e09c16038 R14: 00007f4e09c15fa0 R15: 00007fffffd819e8
 </TASK>
----------------
Code disassembly (best guess):
   0:	f3 4d 01 f3          	repz add %r14,%r11
   4:	49 89 df             	mov    %rbx,%r15
   7:	49 8d 5f 07          	lea    0x7(%r15),%rbx
   b:	4d 85 ff             	test   %r15,%r15
   e:	49 0f 49 df          	cmovns %r15,%rbx
  12:	48 83 e3 f8          	and    $0xfffffffffffffff8,%rbx
  16:	49 29 df             	sub    %rbx,%r15
  19:	74 0e                	je     0x29
  1b:	41 80 3b 00          	cmpb   $0x0,(%r11)
  1f:	75 69                	jne    0x8a
  21:	49 ff c3             	inc    %r11
  24:	49 ff cf             	dec    %r15
  27:	75 f2                	jne    0x1b
  29:	5b                   	pop    %rbx
* 2a:	41 5c                	pop    %r12 <-- trapping instruction
  2c:	41 5e                	pop    %r14
  2e:	41 5f                	pop    %r15
  30:	5d                   	pop    %rbp
  31:	c3                   	ret
  32:	45 84 ff             	test   %r15b,%r15b
  35:	0f 85 91 00 00 00    	jne    0xcc
  3b:	41                   	rex.B
  3c:	f7                   	.byte 0xf7
  3d:	c7                   	.byte 0xc7
  3e:	00 ff                	add    %bh,%bh