================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.2.139/6526 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888031eb6260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] ffff888031eb6260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1775 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 lock_sock_nested+0x41/0x100 net/core/sock.c:3837 lock_sock include/net/sock.h:1713 [inline] x25_bind+0x209/0x450 net/x25/af_x25.c:691 __sys_bind_socket net/socket.c:1947 [inline] __sys_bind+0x2e3/0x410 net/socket.c:1978 __do_sys_bind net/socket.c:1983 [inline] __se_sys_bind net/socket.c:1981 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1981 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 214 hardirqs last enabled at (214): [] __local_bh_enable_ip+0xd6/0x140 kernel/softirq.c:478 hardirqs last disabled at (213): [] __local_bh_enable_ip+0x72/0x140 kernel/softirq.c:455 softirqs last enabled at (0): [] rcu_lock_acquire include/linux/rcupdate.h:309 [inline] softirqs last enabled at (0): [] rcu_read_lock include/linux/rcupdate.h:849 [inline] softirqs last enabled at (0): [] copy_process+0xd11/0x4430 kernel/fork.c:2177 softirqs last disabled at (133): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (133): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (133): [] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** locks held by syz.2.139/6526: 5, last CPU#0: #0: ffff88801b09b440 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:586 [inline] #0: ffff88801b09b440 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1299 #1: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302 #2: ffff888059be23d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #2: ffff888059be23d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:423 #3: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: page_table_check_clear+0x1d0/0x590 mm/page_table_check.c:77 #4: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffffffff8ed5a3a0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x33/0x2b0 net/core/dev.c:6357 stack backtrace: CPU: 0 UID: 0 PID: 6526 Comm: syz.2.139 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_usage_bug+0x28c/0x2e0 kernel/locking/lockdep.c:4086 valid_state+0xbe/0xf0 kernel/locking/lockdep.c:4100 mark_lock_irq+0x36/0x380 kernel/locking/lockdep.c:4311 mark_lock+0x117/0x190 kernel/locking/lockdep.c:4797 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0x71e/0x2de0 kernel/locking/lockdep.c:5242 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 lock_sock_nested+0x41/0x100 net/core/sock.c:3837 lock_sock include/net/sock.h:1713 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1775 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:6333 [inline] netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6358 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100 __napi_poll+0xaa/0x330 net/core/dev.c:7866 napi_poll net/core/dev.c:7929 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8086 handle_softirqs+0x223/0x840 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 a0 f0 47 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 02 9b f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 27 56 d9 RSP: 0018:ffffc90004b2f5b0 EFLAGS: 00000292 RAX: d552df13a6d3da00 RBX: 0000000000000000 RCX: 8000000000000001 RDX: 0000000035f8725a RSI: ffffffff8e6c2900 RDI: ffffffff8c6df680 RBP: ffff88807b579f40 R08: ffffffff82464620 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff94000337051 R12: ffffffff8ed5a3a0 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] page_table_check_clear+0x1ed/0x590 mm/page_table_check.c:77 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline] clear_full_ptes include/linux/pgtable.h:939 [inline] zap_present_folio_ptes mm/memory.c:1755 [inline] zap_present_ptes mm/memory.c:1824 [inline] do_zap_pte_range mm/memory.c:1926 [inline] zap_pte_range mm/memory.c:2028 [inline] zap_pmd_range mm/memory.c:2114 [inline] zap_pud_range mm/memory.c:2142 [inline] zap_p4d_range mm/memory.c:2163 [inline] __zap_vma_range+0x3a34/0x4f70 mm/memory.c:2203 unmap_vmas+0x38b/0x550 mm/memory.c:2272 exit_mmap+0x293/0x9f0 mm/mmap.c:1315 __mmput+0x118/0x420 kernel/fork.c:1192 exit_mm+0x18e/0x240 kernel/exit.c:586 do_exit+0x6a8/0x2380 kernel/exit.c:967 __do_sys_exit kernel/exit.c:1090 [inline] __se_sys_exit kernel/exit.c:1088 [inline] __x64_sys_exit+0x40/0x40 kernel/exit.c:1088 x64_sys_call+0x18b4/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:61 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7d8959e159 Code: Unable to access opcode bytes at 0x7f7d8959e12f. RSP: 002b:00007f7d8a4b8ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f7d8959e159 RDX: 00007f7d8a4b99c8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f7d8963506b R08: 0000000000000000 R09: 0000000000000058 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7d89826128 R14: 00007f7d89826090 R15: 00007ffcab644e08 BUG: sleeping function called from invalid context at net/core/sock.c:3839 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6526, name: syz.2.139 preempt_count: 101, expected: 0 RCU nest depth: 3, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 0 UID: 0 PID: 6526 Comm: syz.2.139 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9197 lock_sock_nested+0x56/0x100 net/core/sock.c:3839 lock_sock include/net/sock.h:1713 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1775 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:6333 [inline] netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6358 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100 __napi_poll+0xaa/0x330 net/core/dev.c:7866 napi_poll net/core/dev.c:7929 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8086 handle_softirqs+0x223/0x840 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 a0 f0 47 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 02 9b f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 27 56 d9 RSP: 0018:ffffc90004b2f5b0 EFLAGS: 00000292 RAX: d552df13a6d3da00 RBX: 0000000000000000 RCX: 8000000000000001 RDX: 0000000035f8725a RSI: ffffffff8e6c2900 RDI: ffffffff8c6df680 RBP: ffff88807b579f40 R08: ffffffff82464620 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff94000337051 R12: ffffffff8ed5a3a0 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] page_table_check_clear+0x1ed/0x590 mm/page_table_check.c:77 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline] clear_full_ptes include/linux/pgtable.h:939 [inline] zap_present_folio_ptes mm/memory.c:1755 [inline] zap_present_ptes mm/memory.c:1824 [inline] do_zap_pte_range mm/memory.c:1926 [inline] zap_pte_range mm/memory.c:2028 [inline] zap_pmd_range mm/memory.c:2114 [inline] zap_pud_range mm/memory.c:2142 [inline] zap_p4d_range mm/memory.c:2163 [inline] __zap_vma_range+0x3a34/0x4f70 mm/memory.c:2203 unmap_vmas+0x38b/0x550 mm/memory.c:2272 exit_mmap+0x293/0x9f0 mm/mmap.c:1315 __mmput+0x118/0x420 kernel/fork.c:1192 exit_mm+0x18e/0x240 kernel/exit.c:586 do_exit+0x6a8/0x2380 kernel/exit.c:967 __do_sys_exit kernel/exit.c:1090 [inline] __se_sys_exit kernel/exit.c:1088 [inline] __x64_sys_exit+0x40/0x40 kernel/exit.c:1088 x64_sys_call+0x18b4/0x18d0 arch/x86/include/generated/asm/syscalls_64.h:61 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7d8959e159 Code: Unable to access opcode bytes at 0x7f7d8959e12f. RSP: 002b:00007f7d8a4b8ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f7d8959e159 RDX: 00007f7d8a4b99c8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f7d8963506b R08: 0000000000000000 R09: 0000000000000058 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7d89826128 R14: 00007f7d89826090 R15: 00007ffcab644e08 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: ff ljmp (bad) 1: e8 a0 f0 47 0a call 0xa47f0a6 6: f7 44 24 10 00 02 00 testl $0x200,0x10(%rsp) d: 00 e: 0f 84 38 ff ff ff je 0xffffff4c 14: 65 48 8b 05 02 9b f2 mov %gs:0x11f29b02(%rip),%rax # 0x11f29b1e 1b: 11 1c: 48 3b 44 24 50 cmp 0x50(%rsp),%rax 21: 75 33 jne 0x56 23: fb sti 24: 48 83 c4 58 add $0x58,%rsp * 28: 5b pop %rbx <-- trapping instruction 29: 41 5c pop %r12 2b: 41 5d pop %r13 2d: 41 5e pop %r14 2f: 41 5f pop %r15 31: 5d pop %rbp 32: c3 ret 33: cc int3 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: 48 rex.W 39: 8d .byte 0x8d 3a: 3d .byte 0x3d 3b: 27 (bad) 3c: 56 push %rsi 3d: d9 .byte 0xd9