------------[ cut here ]------------ WARNING: CPU: 1 PID: 4473 at kernel/softirq.c:376 __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:376 Modules linked in: CPU: 1 PID: 4473 Comm: syz.1.30 Not tainted 6.1.106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:376 lr : local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 sp : ffff80001e466d40 x29: ffff80001e466d50 x28: ffff0000d8056bb0 x27: ffff0000d3491000 x26: dfff800000000000 x25: ffff800015928240 x24: 0000000000000000 x23: 1fffe00019d4b001 x22: dfff800000000000 x21: ffff80001056ec9c x20: 0000000000000200 x19: ffff0000cea58008 x18: ffff80001e4665a0 x17: ffff800018a97000 x16: ffff8000081c6f2c x15: ffff800008a9108c x14: ffff8000104e590c x13: ffff8000122862c4 x12: 0000000000040000 x11: 000000000001aa0b x10: ffff80001eb6a000 x9 : 0000000000000000 x8 : 0000000100000201 x7 : ffff800008061c64 x6 : ffff800008061e74 x5 : ffff0000c32d7638 x4 : ffff80001e466a40 x3 : ffff80000831e450 x2 : 0000000000000001 x1 : 0000000000000200 x0 : ffff80001056ec9c Call trace: __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:376 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline] __dev_queue_xmit+0x1a68/0x38d8 net/core/dev.c:4320 dev_queue_xmit include/linux/netdevice.h:3021 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] __netlink_deliver_tap+0x464/0x6e4 net/netlink/af_netlink.c:325 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1270 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1403 [inline] do_one_broadcast net/netlink/af_netlink.c:1481 [inline] netlink_broadcast+0x9bc/0xff4 net/netlink/af_netlink.c:1521 nlmsg_multicast include/net/netlink.h:1071 [inline] genlmsg_multicast_netns+0xa8/0xf0 include/net/genetlink.h:333 nl80211_frame_tx_status+0x7c8/0xe54 net/wireless/nl80211.c:18624 cfg80211_mgmt_tx_status_ext+0x38/0x4c net/wireless/nl80211.c:18651 ieee80211_report_ack_skb net/mac80211/status.c:680 [inline] ieee80211_report_used_skb+0x1258/0x17b4 net/mac80211/status.c:763 ieee80211_free_txskb+0x30/0x4c net/mac80211/status.c:1284 ieee80211_do_stop+0xe88/0x1994 net/mac80211/iface.c:646 ieee80211_runtime_change_iftype net/mac80211/iface.c:1905 [inline] ieee80211_if_change_type+0x478/0xcf4 net/mac80211/iface.c:1943 ieee80211_change_iface+0x6c/0x418 net/mac80211/cfg.c:217 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x758/0x100c net/wireless/util.c:1084 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1599 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x858 net/socket.c:1255 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 2913 hardirqs last enabled at (2911): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (2911): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (2912): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2912): [] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162 softirqs last enabled at (2866): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (2866): [] netif_addr_unlock_bh include/linux/netdevice.h:4467 [inline] softirqs last enabled at (2866): [] ieee80211_do_stop+0x504/0x1994 net/mac80211/iface.c:521 softirqs last disabled at (2913): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- ================================ WARNING: inconsistent lock state 6.1.106-syzkaller #0 Tainted: G W -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. syz.1.30/4473 [HC0[0]:SC0[0]:HE0:SE1] takes: ffff0000f2f694f8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xcf0/0x1994 net/mac80211/iface.c:640 {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162 ieee80211_tx_frags+0x138/0x700 net/mac80211/tx.c:1721 __ieee80211_tx+0x1b0/0x40c net/mac80211/tx.c:1820 ieee80211_tx+0x2c4/0x400 net/mac80211/tx.c:2000 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2092 __ieee80211_subif_start_xmit+0xc88/0x2af8 net/mac80211/tx.c:4265 ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4457 __netdev_start_xmit include/linux/netdevice.h:4853 [inline] netdev_start_xmit include/linux/netdevice.h:4867 [inline] xmit_one net/core/dev.c:3627 [inline] dev_hard_start_xmit+0x25c/0x9a4 net/core/dev.c:3643 sch_direct_xmit+0x234/0x548 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3854 [inline] __dev_queue_xmit+0x1658/0x38d8 net/core/dev.c:4259 dev_queue_xmit include/linux/netdevice.h:3021 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0xd8c/0x1aa8 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:201 [inline] ip6_finish_output+0x5a4/0x940 net/ipv6/ip6_output.c:212 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0x274/0x594 net/ipv6/ip6_output.c:233 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] ndisc_send_skb+0xc38/0x179c net/ipv6/ndisc.c:511 ndisc_send_rs+0x47c/0x5d4 net/ipv6/ndisc.c:721 addrconf_rs_timer+0x300/0x58c net/ipv6/addrconf.c:3963 call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1504 expire_timers kernel/time/timer.c:1549 [inline] __run_timers+0x554/0x718 kernel/time/timer.c:1820 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1833 handle_softirqs+0x318/0xd58 kernel/softirq.c:571 __do_softirq+0x14/0x20 kernel/softirq.c:605 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:893 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:654 irq_exit_rcu+0x14/0x84 kernel/softirq.c:666 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] usb_hcd_poll_rh_status+0x350/0x55c drivers/usb/core/hcd.c:789 vhci_hub_control+0xd34/0x29b4 drivers/usb/usbip/vhci_hcd.c:658 rh_call_control drivers/usb/core/hcd.c:683 [inline] rh_urb_enqueue drivers/usb/core/hcd.c:848 [inline] usb_hcd_submit_urb+0xeb4/0x1a9c drivers/usb/core/hcd.c:1556 usb_submit_urb+0xe94/0x1588 drivers/usb/core/urb.c:596 proc_do_submiturb+0x2060/0x2e38 drivers/usb/core/devio.c:1969 proc_submiturb_compat drivers/usb/core/devio.c:2207 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2724 [inline] usbdev_ioctl+0x3cd0/0x66e8 drivers/usb/core/devio.c:2817 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 2914 hardirqs last enabled at (2911): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (2911): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (2912): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2912): [] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162 softirqs last enabled at (2914): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (2913): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&local->queue_stop_reason_lock); lock(&local->queue_stop_reason_lock); *** DEADLOCK *** 5 locks held by syz.1.30/4473: #0: ffff800017fe4888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 #1: ffff0000f2f687c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5639 [inline] #1: ffff0000f2f687c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wext_siwmode net/wireless/wext-compat.c:65 [inline] #1: ffff0000f2f687c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: __cfg80211_wext_siwmode+0x170/0x240 net/wireless/wext-compat.c:1599 #2: ffff0000f2f694f8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xcf0/0x1994 net/mac80211/iface.c:640 #3: ffff800015b94ee0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #4: ffff800015b94ee0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 stack backtrace: CPU: 1 PID: 4473 Comm: syz.1.30 Tainted: G W 6.1.106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_usage_bug+0x654/0x9b0 kernel/locking/lockdep.c:3957 mark_lock_irq+0x980/0xd2c mark_lock+0x258/0x360 kernel/locking/lockdep.c:4628 mark_held_locks kernel/locking/lockdep.c:4230 [inline] __trace_hardirqs_on_caller kernel/locking/lockdep.c:4256 [inline] lockdep_hardirqs_on_prepare+0x3e8/0x874 kernel/locking/lockdep.c:4315 trace_hardirqs_on+0x184/0x2d4 kernel/trace/trace_preemptirq.c:49 __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:401 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline] __dev_queue_xmit+0x1a68/0x38d8 net/core/dev.c:4320 dev_queue_xmit include/linux/netdevice.h:3021 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] __netlink_deliver_tap+0x464/0x6e4 net/netlink/af_netlink.c:325 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1270 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1403 [inline] do_one_broadcast net/netlink/af_netlink.c:1481 [inline] netlink_broadcast+0x9bc/0xff4 net/netlink/af_netlink.c:1521 nlmsg_multicast include/net/netlink.h:1071 [inline] genlmsg_multicast_netns+0xa8/0xf0 include/net/genetlink.h:333 nl80211_frame_tx_status+0x7c8/0xe54 net/wireless/nl80211.c:18624 cfg80211_mgmt_tx_status_ext+0x38/0x4c net/wireless/nl80211.c:18651 ieee80211_report_ack_skb net/mac80211/status.c:680 [inline] ieee80211_report_used_skb+0x1258/0x17b4 net/mac80211/status.c:763 ieee80211_free_txskb+0x30/0x4c net/mac80211/status.c:1284 ieee80211_do_stop+0xe88/0x1994 net/mac80211/iface.c:646 ieee80211_runtime_change_iftype net/mac80211/iface.c:1905 [inline] ieee80211_if_change_type+0x478/0xcf4 net/mac80211/iface.c:1943 ieee80211_change_iface+0x6c/0x418 net/mac80211/cfg.c:217 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x758/0x100c net/wireless/util.c:1084 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1599 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x858 net/socket.c:1255 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 4473 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 1 PID: 4473 Comm: syz.1.30 Tainted: G W 6.1.106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 lr : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 sp : ffff80001e467590 x29: ffff80001e467590 x28: ffff0000f2f6a060 x27: dfff800000000000 x26: 0000000000000058 x25: 000000000000000f x24: 0000000000000010 x23: ffff0000f2ed2798 x22: 000000000000000f x21: 000000000000000f x20: ffff0000f2f694e0 x19: 0000000000000000 x18: ffff80001e4665a0 x17: 0000000000000000 x16: ffff8000121d8240 x15: 0000000000000002 x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000040000 x11: 000000000003ffff x10: ffff80001eb6a000 x9 : 2028246fa33b4a00 x8 : 2028246fa33b4a00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001e466e78 x4 : ffff800015aa2d40 x3 : ffff80000834e200 x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000 Call trace: warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0xa0/0xac kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] ieee80211_do_stop+0xfac/0x1994 net/mac80211/iface.c:650 ieee80211_runtime_change_iftype net/mac80211/iface.c:1905 [inline] ieee80211_if_change_type+0x478/0xcf4 net/mac80211/iface.c:1943 ieee80211_change_iface+0x6c/0x418 net/mac80211/cfg.c:217 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x758/0x100c net/wireless/util.c:1084 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1599 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x858 net/socket.c:1255 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 2914 hardirqs last enabled at (2911): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (2911): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (2912): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2912): [] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162 softirqs last enabled at (2914): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (2913): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]---