=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
8 locks held by kworker/0:1/13:
#0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000d27d00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffffffff8d4b1f68 (nf_conntrack_mutex){+.+.}-{3:3}, at: nf_ct_iterate_cleanup+0x47/0x3c0 net/netfilter/nf_conntrack_core.c:2394
#3: ffffc90000007bc0 ((&d->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline]
#3: ffffc90000007bc0 ((&d->timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1638
#4: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
#6: ffff888057df1108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#6: ffff888057df1108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3924 [inline]
#6: ffff888057df1108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2b/0x2e50 net/core/dev.c:4266
#7: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
stack backtrace:
CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events iterate_cleanup_work
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
qdisc_lookup+0xa6/0x640 net/sched/sch_api.c:304
qdisc_tree_reduce_backlog+0x188/0x480 net/sched/sch_api.c:797
cake_enqueue+0x5021/0x8270 net/sched/sch_cake.c:1956
cbs_child_enqueue net/sched/sch_cbs.c:95 [inline]
cbs_enqueue_soft+0x16b/0x240 net/sched/sch_cbs.c:128
dev_qdisc_enqueue+0x48/0x210 net/core/dev.c:3865
__dev_xmit_skb net/core/dev.c:3949 [inline]
__dev_queue_xmit+0xbde/0x2e50 net/core/dev.c:4266
tipc_l2_send_msg+0x2eb/0x3a0 net/tipc/bearer.c:519
tipc_bearer_xmit_skb+0x292/0x3c0 net/tipc/bearer.c:578
tipc_disc_timeout+0x5e1/0x740 net/tipc/discover.c:340
call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
expire_timers kernel/time/timer.c:1699 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:1970
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:172 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xc/0x60 kernel/kcov.c:206
Code: 89 fb e8 17 00 00 00 48 8b 3d 00 10 12 0c 48 89 de 5b e9 67 60 44 00 00 00 cc cc 00 00 cc 48 8b 04 24 65 48 8b 0d 14 70 89 7e <65> 8b 15 15 70 89 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75
RSP: 0018:ffffc90000d27ac0 EFLAGS: 00000202
RAX: ffffffff882814fc RBX: ffff88802b718b58 RCX: ffff88813fe20000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 1ffff110056e316b R08: ffffffff901ef157 R09: 1ffffffff203de2a
R10: dffffc0000000000 R11: fffffbfff203de2b R12: dffffc0000000000
R13: 0000000000000001 R14: ffffc90000d27b60 R15: ffffffff88281540
get_next_corpse net/netfilter/nf_conntrack_core.c:2349 [inline]
nf_ct_iterate_cleanup+0x37c/0x3c0 net/netfilter/nf_conntrack_core.c:2395
nf_ct_iterate_cleanup_net+0x11d/0x190 net/netfilter/nf_conntrack_core.c:2479
iterate_cleanup_work+0x66/0x120 net/netfilter/nf_nat_masquerade.c:83
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: 89 fb mov %edi,%ebx
2: e8 17 00 00 00 call 0x1e
7: 48 8b 3d 00 10 12 0c mov 0xc121000(%rip),%rdi # 0xc12100e
e: 48 89 de mov %rbx,%rsi
11: 5b pop %rbx
12: e9 67 60 44 00 jmp 0x44607e
17: 00 00 add %al,(%rax)
19: cc int3
1a: cc int3
1b: 00 00 add %al,(%rax)
1d: cc int3
1e: 48 8b 04 24 mov (%rsp),%rax
22: 65 48 8b 0d 14 70 89 mov %gs:0x7e897014(%rip),%rcx # 0x7e89703e
29: 7e
* 2a: 65 8b 15 15 70 89 7e mov %gs:0x7e897015(%rip),%edx # 0x7e897046 <-- trapping instruction
31: 81 e2 00 01 ff 00 and $0xff0100,%edx
37: 74 11 je 0x4a
39: 81 fa 00 01 00 00 cmp $0x100,%edx
3f: 75 .byte 0x75