=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
4 locks held by syz.8.770/7666:
#0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#1: ffff888024321148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}
, at: net_tx_action+0x6d9/0x880 net/core/dev.c:5155
#2:
ffff888024321108 (
&sch->q.lock
){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
){+.-.}-{2:2}, at: sch_direct_xmit+0x301/0x4a0 net/sched/sch_generic.c:357
#3: ffffffff8d11efa0
(rcu_read_lock
){....}-{1:2}
, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 7666 Comm: syz.8.770 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x640 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x188/0x480 net/sched/sch_api.c:800
codel_dequeue_drop net/sched/sch_codel.c:108 [inline]
codel_peek+0x1dd/0x330 net/sched/sch_codel.c:140
tbf_dequeue+0x7b/0xcf0 net/sched/sch_tbf.c:265
dequeue_skb net/sched/sch_generic.c:295 [inline]
qdisc_restart net/sched/sch_generic.c:400 [inline]
__qdisc_run+0x22f/0x14b0 net/sched/sch_generic.c:418
qdisc_run+0x103/0x2f0 include/net/pkt_sched.h:132
net_tx_action+0x6d9/0x880 net/core/dev.c:5155
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__syscall_enter_from_user_work kernel/entry/common.c:96 [inline]
RIP: 0010:syscall_enter_from_user_mode+0x2a/0x70 kernel/entry/common.c:117
Code: 41 56 53 48 89 f3 49 89 fe 48 8b 7c 24 10 e8 cd f5 ff ff eb 31 eb 35 e8 74 c4 b5 f7 e8 6f c2 b5 f7 fb 65 48 8b 05 b6 d8 38 76 <48> 8b 70 08 40 f6 c6 3f 74 0b 4c 89 f7 5b 41 5e e9 91 b2 9d f7 48
RSP: 0018:ffffc9000349ff08 EFLAGS: 00000286
RAX: ffff88807c320000 RBX: 0000000000000027 RCX: a5c34905938e2700
RDX: dffffc0000000000 RSI: ffffffff8a2b2b60 RDI: ffffffff8a7a5100
RBP: ffffc9000349ff48 R08: ffffffff8e6d322f R09: 1ffffffff1cda645
R10: dffffc0000000000 R11: fffffbfff1cda646 R12: 0000000000000000
R13: 0000000000000000 R14: ffffc9000349ff58 R15: 0000000000000000
do_syscall_64+0x24/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f6a5f75f897
Code: 8d 3d 42 b7 0b 00 e8 58 1d fa ff e8 a3 87 00 00 0f 1f 00 b8 68 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 27 00 00 00 0f 05 0f 1f 84 00 00 00 00 00 b8 6e 00 00 00 0f 05 c3 0f 1f 84 00 00
RSP: 002b:00007ffc1e5d1748 EFLAGS: 00000206 ORIG_RAX: 0000000000000027
RAX: ffffffffffffffda RBX: 00007ffc1e5d18b0 RCX: 00007f6a5f75f897
RDX: 00007ffc1e5d1780 RSI: 00007ffc1e5d18b0 RDI: 0000000000000021
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 000000000003fb91
R13: 00007f6a5f9ebfac R14: 000000000003f8d0 R15: 00007ffc1e5d1e90
----------------
Code disassembly (best guess):
0: 41 56 push %r14
2: 53 push %rbx
3: 48 89 f3 mov %rsi,%rbx
6: 49 89 fe mov %rdi,%r14
9: 48 8b 7c 24 10 mov 0x10(%rsp),%rdi
e: e8 cd f5 ff ff call 0xfffff5e0
13: eb 31 jmp 0x46
15: eb 35 jmp 0x4c
17: e8 74 c4 b5 f7 call 0xf7b5c490
1c: e8 6f c2 b5 f7 call 0xf7b5c290
21: fb sti
22: 65 48 8b 05 b6 d8 38 mov %gs:0x7638d8b6(%rip),%rax # 0x7638d8e0
29: 76
* 2a: 48 8b 70 08 mov 0x8(%rax),%rsi <-- trapping instruction
2e: 40 f6 c6 3f test $0x3f,%sil
32: 74 0b je 0x3f
34: 4c 89 f7 mov %r14,%rdi
37: 5b pop %rbx
38: 41 5e pop %r14
3a: e9 91 b2 9d f7 jmp 0xf79db2d0
3f: 48 rex.W