inconsistent lock state in lock_sock_nested

Status: upstream: reported C repro on 2026/08/03 18:17
Reported-by: syzbot+b929c6f31f99858c2633@syzkaller.appspotmail.com
First crash: 4d23h, last: 10h10m
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream inconsistent lock state in lock_sock_nested net 4 syz, C 392 162d 183d 0/29 closed as invalid on 2026/03/04 12:20

Sample crash report:
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000ccb80130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
ffff0000ccb80130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
  lock_sock_nested+0x70/0x130 net/core/sock.c:3505
  lock_sock include/net/sock.h:1805 [inline]
  x25_bind+0x1b4/0x3d4 net/x25/af_x25.c:698
  __sys_bind+0x1f8/0x2a4 net/socket.c:1811
  __do_sys_bind net/socket.c:1822 [inline]
  __se_sys_bind net/socket.c:1820 [inline]
  __arm64_sys_bind+0x7c/0x94 net/socket.c:1820
  __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
  invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
  el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
  do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
  el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
  el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
  el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 771096
hardirqs last  enabled at (771096): [<ffff8000081ad57c>] __local_bh_enable_ip+0x1f8/0x37c kernel/softirq.c:426
hardirqs last disabled at (771095): [<ffff8000081ad4fc>] __local_bh_enable_ip+0x178/0x37c kernel/softirq.c:403
softirqs last  enabled at (770762): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (770762): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (770823): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_X25);
  <Interrupt>
    lock(sk_lock-AF_X25);

 *** DEADLOCK ***

1 lock held by swapper/0/0:
 #0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349

stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_usage_bug+0x4c0/0x6dc kernel/locking/lockdep.c:3962
 valid_state kernel/locking/lockdep.c:3974 [inline]
 mark_lock_irq+0x858/0xab8 kernel/locking/lockdep.c:-1
 mark_lock+0x224/0x320 kernel/locking/lockdep.c:4633
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0xa88/0x6634 kernel/locking/lockdep.c:5017
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
 lock_sock_nested+0x70/0x130 net/core/sock.c:3505
 lock_sock include/net/sock.h:1805 [inline]
 x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
 x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
 x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
 __netif_receive_skb_one_core net/core/dev.c:5619 [inline]
 netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
 lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
 __napi_poll+0xb8/0x3f4 net/core/dev.c:6628
 napi_poll net/core/dev.c:6695 [inline]
 net_rx_action+0x52c/0xb5c net/core/dev.c:6809
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0x68/0xd8 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x368/0x600 kernel/sched/idle.c:323
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:422
 rest_init+0x2d4/0x2f0 init/main.c:745
 start_kernel+0x0/0x534 init/main.c:904
 start_kernel+0x488/0x534 init/main.c:1151
 __primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468
BUG: sleeping function called from invalid context at net/core/sock.c:3507
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff800011c64be4>] schedule_preempt_disabled+0x20/0x2c kernel/sched/core.c:6699
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 __might_resched+0x354/0x4e0 kernel/sched/core.c:9970
 __might_sleep+0x94/0x110 kernel/sched/core.c:9899
 lock_sock_nested+0x80/0x130 net/core/sock.c:3507
 lock_sock include/net/sock.h:1805 [inline]
 x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
 x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
 x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
 __netif_receive_skb_one_core net/core/dev.c:5619 [inline]
 netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
 lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
 __napi_poll+0xb8/0x3f4 net/core/dev.c:6628
 napi_poll net/core/dev.c:6695 [inline]
 net_rx_action+0x52c/0xb5c net/core/dev.c:6809
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
 default_idle_call+0x68/0xd8 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x368/0x600 kernel/sched/idle.c:323
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:422
 rest_init+0x2d4/0x2f0 init/main.c:745
 start_kernel+0x0/0x534 init/main.c:904
 start_kernel+0x488/0x534 init/main.c:1151
 __primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468

Crashes (26):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/05 15:22 linux-6.1.y fb28aa725e05 52aa2820 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/08 07:38 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/08 07:36 linux-6.1.y e4f7d8be268e 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/07 13:59 linux-6.1.y e4f7d8be268e e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/07 13:58 linux-6.1.y e4f7d8be268e e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/07 13:58 linux-6.1.y e4f7d8be268e e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 23:04 linux-6.1.y 03f3a99e8e93 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 23:04 linux-6.1.y 03f3a99e8e93 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 09:29 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 07:47 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 02:35 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 01:04 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 01:01 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 01:01 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 01:01 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/06 01:00 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/05 23:06 linux-6.1.y fb28aa725e05 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/05 16:06 linux-6.1.y fb28aa725e05 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/05 08:19 linux-6.1.y fb28aa725e05 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/04 22:25 linux-6.1.y fb28aa725e05 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/04 22:25 linux-6.1.y fb28aa725e05 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/04 22:23 linux-6.1.y fb28aa725e05 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/04 22:23 linux-6.1.y fb28aa725e05 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/04 22:21 linux-6.1.y fb28aa725e05 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/03 18:19 linux-6.1.y fb28aa725e05 6b7c9f71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
2026/08/03 18:17 linux-6.1.y fb28aa725e05 6b7c9f71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 inconsistent lock state in lock_sock_nested
* Struck through repros no longer work on HEAD.