=============================
WARNING: suspicious RCU usage
5.15.185-syzkaller #0 Not tainted
-----------------------------
net/sched/sch_api.c:304 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
6 locks held by kworker/u4:4/331:
 #0: ffff0000d3ab6138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x678/0x1140 kernel/workqueue.c:2283
 #1: ffff80001f4c7c00 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work+0x6b8/0x1140 kernel/workqueue.c:2285
 #2: ffff8000143311e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:311
 #3: ffff0000d467f148 (dev->qdisc_running_key ?: &qdisc_running_key){+...}-{0:0}, at: qdisc_run+0x2c/0x1f8 include/net/pkt_sched.h:131
 #4: ffff0000d467f108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
 #4: ffff0000d467f108 (&sch->q.lock){+.-.}-{2:2}, at: sch_direct_xmit+0x1e4/0x3bc net/sched/sch_generic.c:354
 #5: ffff8000143311e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:311

stack backtrace:
CPU: 1 PID: 331 Comm: kworker/u4:4 Not tainted 5.15.185-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: bat_events batadv_nc_worker
Call trace:
 dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 lockdep_rcu_suspicious+0x140/0x198 kernel/locking/lockdep.c:6574
 qdisc_lookup+0xc8/0x64c net/sched/sch_api.c:304
 qdisc_tree_reduce_backlog+0x204/0x4a0 net/sched/sch_api.c:800
 cake_dequeue+0x1800/0x3afc net/sched/sch_cake.c:2189
 qdisc_peek_dequeued+0x78/0x1ec include/net/sch_generic.h:1115
 tbf_dequeue+0x90/0xc5c net/sched/sch_tbf.c:265
 dequeue_skb net/sched/sch_generic.c:292 [inline]
 qdisc_restart net/sched/sch_generic.c:397 [inline]
 __qdisc_run+0x1bc/0x1170 net/sched/sch_generic.c:415
 qdisc_run+0x40/0x1f8 include/net/pkt_sched.h:132
 net_tx_action+0x630/0x81c net/core/dev.c:5128
 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 invoke_softirq kernel/softirq.c:457 [inline]
 __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659
 irq_exit+0x14/0x88 kernel/softirq.c:683
 handle_domain_irq+0x14c/0x1fc kernel/irq/irqdesc.c:711
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline]
 __local_bh_enable_ip+0x200/0x380 kernel/softirq.c:406
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
 _raw_spin_unlock_bh+0xec/0x174 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:408 [inline]
 batadv_nc_purge_paths+0x308/0x390 net/batman-adv/network-coding.c:475
 batadv_nc_worker+0x2d0/0x554 net/batman-adv/network-coding.c:724
 process_one_work+0x79c/0x1140 kernel/workqueue.c:2310
 worker_thread+0x8f4/0x101c kernel/workqueue.c:2457
 kthread+0x374/0x454 kernel/kthread.c:334
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
vkms_vblank_simulate: vblank timer overrun