syzbot


inconsistent lock state in valid_state (3)

Status: upstream: reported C repro on 2026/04/20 22:51
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+c8eb6060abf5a2a7b274@syzkaller.appspotmail.com
First crash: 51d, last: 18d
Bug presence (1)
Date Name Commit Repro Result
2026/04/22 upstream (ToT) 6596a02b2078 C [report] inconsistent lock state in __sk_receive_skb
Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 inconsistent lock state in valid_state (2) missing-backport 4 C done 208 602d 820d 0/3 auto-obsoleted due to no activity on 2024/12/26 10:49
linux-6.6 inconsistent lock state in valid_state origin:upstream 4 C 19 14d 54d 0/2 upstream: reported C repro on 2026/04/18 18:50
upstream inconsistent lock state in valid_state (6) kernfs comedi 4 2 236d 235d 0/29 auto-obsoleted due to no activity on 2026/01/26 19:03
upstream inconsistent lock state in valid_state kernel 4 1 1204d 1200d 0/29 auto-obsoleted due to no activity on 2023/06/23 05:39
upstream inconsistent lock state in valid_state (4) linux1394 ppp 4 C error 72 486d 661d 0/29 auto-obsoleted due to no activity on 2025/04/21 16:31
linux-5.15 inconsistent lock state in valid_state 4 2 1093d 1172d 0/3 auto-obsoleted due to no activity on 2023/09/22 20:18
linux-6.1 inconsistent lock state in valid_state (2) origin:upstream missing-backport 4 C done 344 17d 992d 0/3 upstream: reported C repro on 2023/09/22 23:56
upstream inconsistent lock state in valid_state (5) net 4 515 281d 285d 0/29 closed as invalid on 2025/09/16 17:45
upstream inconsistent lock state in valid_state (2) sound 4 C inconclusive 57405 731d 855d 25/29 fixed on 2024/06/11 03:41
upstream inconsistent lock state in valid_state (3) mm 4 C error 376 678d 727d 27/29 fixed on 2024/08/14 03:44
linux-6.1 inconsistent lock state in valid_state 4 1 1173d 1173d 0/3 auto-obsoleted due to no activity on 2023/07/24 01:34
Last patch testing requests (10)
Created Duration User Patch Repo Result
2026/06/10 06:45 22m retest repro linux-5.15.y OK log
2026/06/10 06:45 22m retest repro linux-5.15.y OK log
2026/06/10 06:45 23m retest repro linux-5.15.y OK log
2026/06/10 06:45 23m retest repro linux-5.15.y OK log
2026/06/10 06:45 36m retest repro linux-5.15.y OK log
2026/06/09 16:45 24m retest repro linux-5.15.y OK log
2026/06/09 16:45 24m retest repro linux-5.15.y OK log
2026/06/09 16:45 43m retest repro linux-5.15.y OK log
2026/06/09 16:45 35m retest repro linux-5.15.y OK log
2026/06/09 16:45 29m retest repro linux-5.15.y OK log

Sample crash report:
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/0/14 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff88807d8ea620 (slock-AF_PHONET/1){+.?.}-{2:2}, at: __sk_receive_skb+0x17b/0x980 net/core/sock.c:517
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
  _raw_spin_lock_nested+0x2e/0x40 kernel/locking/spinlock.c:368
  __sk_receive_skb+0x17b/0x980 net/core/sock.c:517
  sk_backlog_rcv include/net/sock.h:1080 [inline]
  __release_sock+0x1e1/0x450 net/core/sock.c:2731
  release_sock+0x5b/0x1b0 net/core/sock.c:3274
  pep_sock_accept+0xc73/0x1190 net/phonet/pep.c:878
  pn_socket_accept+0x126/0x360 net/phonet/socket.c:304
  do_accept+0x509/0x6f0 net/socket.c:1809
  __sys_accept4_file net/socket.c:1852 [inline]
  __sys_accept4+0x103/0x170 net/socket.c:1882
  __do_sys_accept4 net/socket.c:1894 [inline]
  __se_sys_accept4 net/socket.c:1891 [inline]
  __x64_sys_accept4+0x96/0xb0 net/socket.c:1891
  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
  do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
  entry_SYSCALL_64_after_hwframe+0x66/0xd0
irq event stamp: 193772
hardirqs last  enabled at (193772): [<ffffffff87e65964>] process_backlog+0x644/0x790 net/core/dev.c:6568
hardirqs last disabled at (193771): [<ffffffff87e657a6>] process_backlog+0x486/0x790 net/core/dev.c:6550
softirqs last  enabled at (193738): [<ffffffff814978f4>] run_ksoftirqd+0xa4/0x100 kernel/softirq.c:943
softirqs last disabled at (193743): [<ffffffff814978f4>] run_ksoftirqd+0xa4/0x100 kernel/softirq.c:943

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(slock-AF_PHONET/1);
  <Interrupt>
    lock(slock-AF_PHONET/1);

 *** DEADLOCK ***

3 locks held by ksoftirqd/0/14:
 #0: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
 #1: ffff88807f244560 (slock-AF_PHONET){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
 #1: ffff88807f244560 (slock-AF_PHONET){+.-.}-{2:2}, at: __sk_receive_skb+0x18a/0x980 net/core/sock.c:519
 #2: ffff88807f2445e0 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: sk_receive_skb include/net/sock.h:2001 [inline]
 #2: ffff88807f2445e0 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: phonet_rcv+0x7e4/0xc70 net/phonet/af_phonet.c:405

stack backtrace:
CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3932
 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4135
 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4591
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0xc64/0x7d10 kernel/locking/lockdep.c:4966
 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
 _raw_spin_lock_nested+0x2e/0x40 kernel/locking/spinlock.c:368
 __sk_receive_skb+0x17b/0x980 net/core/sock.c:517
 sk_backlog_rcv include/net/sock.h:1080 [inline]
 __sk_receive_skb+0x42c/0x980 net/core/sock.c:526
 sk_receive_skb include/net/sock.h:2001 [inline]
 phonet_rcv+0x7e4/0xc70 net/phonet/af_phonet.c:405
 __netif_receive_skb_one_core net/core/dev.c:5551 [inline]
 __netif_receive_skb+0xcc/0x290 net/core/dev.c:5665
 process_backlog+0x370/0x790 net/core/dev.c:6542
 __napi_poll+0xc0/0x430 net/core/dev.c:7101
 napi_poll net/core/dev.c:7168 [inline]
 net_rx_action+0x4d4/0xa10 net/core/dev.c:7258
 handle_softirqs+0x339/0x830 kernel/softirq.c:576
 run_ksoftirqd+0xa4/0x100 kernel/softirq.c:943
 smpboot_thread_fn+0x4f6/0x970 kernel/smpboot.c:164
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (30):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/24 11:43 linux-5.15.y 241d66fa280c c69befb3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/24 10:33 linux-5.15.y 241d66fa280c c69befb3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/24 09:18 linux-5.15.y 241d66fa280c c69befb3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/24 08:01 linux-5.15.y 241d66fa280c c69befb3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/24 04:32 linux-5.15.y 241d66fa280c c69befb3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/24 02:41 linux-5.15.y 241d66fa280c c69befb3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/22 22:15 linux-5.15.y 93741761e5e3 5f091fcc .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/22 09:11 linux-5.15.y 93741761e5e3 70ae9b03 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/13 20:51 linux-5.15.y de8dfb3f0278 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/13 20:40 linux-5.15.y de8dfb3f0278 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/13 16:08 linux-5.15.y de8dfb3f0278 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/13 16:06 linux-5.15.y de8dfb3f0278 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/13 15:56 linux-5.15.y de8dfb3f0278 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/13 15:55 linux-5.15.y de8dfb3f0278 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/07 07:21 linux-5.15.y ef251c45f1cd f250db59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/05 06:42 linux-5.15.y ef251c45f1cd a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/05 04:10 linux-5.15.y ef251c45f1cd a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/05 04:04 linux-5.15.y ef251c45f1cd a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/05 04:00 linux-5.15.y ef251c45f1cd a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/04 17:57 linux-5.15.y ef251c45f1cd 85f1bcf2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/05/03 16:07 linux-5.15.y ef251c45f1cd a0d91488 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/28 01:34 linux-5.15.y b9d57c40a767 ce741359 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/25 04:27 linux-5.15.y b9d57c40a767 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/23 23:19 linux-5.15.y b9d57c40a767 4c3406dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/23 23:12 linux-5.15.y b9d57c40a767 4c3406dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/23 18:28 linux-5.15.y b9d57c40a767 4c3406dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/23 18:28 linux-5.15.y b9d57c40a767 4c3406dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/23 18:22 linux-5.15.y b9d57c40a767 4c3406dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/21 03:00 linux-5.15.y b9d57c40a767 e65da4ee .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
2026/04/20 22:50 linux-5.15.y b9d57c40a767 e65da4ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan inconsistent lock state in valid_state
* Struck through repros no longer work on HEAD.