================================ WARNING: inconsistent lock state syzkaller #0 Tainted: G L -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. kworker/u8:11/1308 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88803587c260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] ffff88803587c260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908 lock_sock_nested+0x41/0x100 net/core/sock.c:3827 lock_sock include/net/sock.h:1713 [inline] x25_release+0xa0/0x3d0 net/x25/af_x25.c:632 __sock_release+0xa0/0x1f0 net/socket.c:735 sock_close+0x1c/0x30 net/socket.c:1526 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x73a/0x2360 kernel/exit.c:1008 do_group_exit+0x22d/0x2f0 kernel/exit.c:1151 get_signal+0x121b/0x12c0 kernel/signal.c:3039 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop kernel/entry/common.c:101 [inline] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline] irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline] irqentry_exit+0x2ba/0x910 kernel/entry/common.c:165 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 irq event stamp: 7939380 hardirqs last enabled at (7939380): [] __local_bh_enable_ip+0xd6/0x140 kernel/softirq.c:478 hardirqs last disabled at (7939379): [] __local_bh_enable_ip+0x72/0x140 kernel/softirq.c:455 softirqs last enabled at (7939304): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last enabled at (7939304): [] rcu_read_lock_bh include/linux/rcupdate.h:902 [inline] softirqs last enabled at (7939304): [] __dev_queue_xmit+0x29b/0x3820 net/core/dev.c:4844 softirqs last disabled at (7939305): [] do_softirq+0x77/0xd0 kernel/softirq.c:546 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** locks held by kworker/u8:11/1308: 3, last CPU#0: #0: ffff8880325e5140 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880325e5140 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880325e5140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880325e5140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900057afc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900057afc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900057afc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900057afc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff8ed5ca60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8ed5ca60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8ed5ca60 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x33/0x2b0 net/core/dev.c:6288 stack backtrace: CPU: 0 UID: 0 PID: 1308 Comm: kworker/u8:11 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_usage_bug+0x28c/0x2e0 kernel/locking/lockdep.c:4058 valid_state+0xbe/0xf0 kernel/locking/lockdep.c:4072 mark_lock_irq+0x36/0x380 kernel/locking/lockdep.c:4283 mark_lock+0x117/0x190 kernel/locking/lockdep.c:4769 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0x6b7/0x2e50 kernel/locking/lockdep.c:5208 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908 lock_sock_nested+0x41/0x100 net/core/sock.c:3827 lock_sock include/net/sock.h:1713 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:6264 [inline] netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6289 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100 __napi_poll+0xaa/0x330 net/core/dev.c:7787 napi_poll net/core/dev.c:7850 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8007 handle_softirqs+0x226/0x860 kernel/softirq.c:645 do_softirq+0x77/0xd0 kernel/softirq.c:546 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline] __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4961 dev_queue_xmit include/linux/netdevice.h:3461 [inline] batadv_send_skb_packet+0x3ff/0x650 net/batman-adv/send.c:100 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:466 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:491 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x590/0x740 net/batman-adv/bat_iv_ogm.c:1912 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 BUG: sleeping function called from invalid context at net/core/sock.c:3829 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1308, name: kworker/u8:11 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] local_bh_disable include/linux/bottom_half.h:20 [inline] [] rcu_read_lock_bh include/linux/rcupdate.h:902 [inline] [] __dev_queue_xmit+0x2a8/0x3820 net/core/dev.c:4844 CPU: 0 UID: 0 PID: 1308 Comm: kworker/u8:11 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9236 lock_sock_nested+0x56/0x100 net/core/sock.c:3829 lock_sock include/net/sock.h:1713 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:6264 [inline] netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6289 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100 __napi_poll+0xaa/0x330 net/core/dev.c:7787 napi_poll net/core/dev.c:7850 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8007 handle_softirqs+0x226/0x860 kernel/softirq.c:645 do_softirq+0x77/0xd0 kernel/softirq.c:546 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline] __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4961 dev_queue_xmit include/linux/netdevice.h:3461 [inline] batadv_send_skb_packet+0x3ff/0x650 net/batman-adv/send.c:100 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:466 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:491 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x590/0x740 net/batman-adv/bat_iv_ogm.c:1912 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245