------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(1) WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:-1 [inline], CPU#0: syz.1.905/8518 WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4870 [inline], CPU#0: syz.1.905/8518 WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x2f4/0x2a6c kernel/locking/lockdep.c:5204, CPU#0: syz.1.905/8518 Modules linked in: CPU: 0 UID: 0 PID: 8518 Comm: syz.1.905 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : hlock_class kernel/locking/lockdep.c:-1 [inline] pc : check_wait_context kernel/locking/lockdep.c:4870 [inline] pc : __lock_acquire+0x2f4/0x2a6c kernel/locking/lockdep.c:5204 lr : hlock_class kernel/locking/lockdep.c:238 [inline] lr : check_wait_context kernel/locking/lockdep.c:4870 [inline] lr : __lock_acquire+0x2f0/0x2a6c kernel/locking/lockdep.c:5204 sp : ffff80008ec37950 x29: ffff80008ec37a40 x28: ffff0000c39b1d80 x27: ffff0000c39b2948 x26: ffff8000854d59ac x25: 0000000000000000 x24: 0000000000000001 x23: 0000000000000000 x22: ffff80008e8df000 x21: ffff80008a6a6e28 x20: 0000000000000000 x19: ffff80008a4d0da0 x18: 00000000ffffffff x17: 00000000ffff0010 x16: 0024000800000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000000104 x9 : 226877e7c17bc600 x8 : 0000000000000000 x7 : 4e5241575f534b43 x6 : ffff80008048e314 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f9194 x2 : 0000000100000102 x1 : ffff0000c39b1d80 x0 : 0000000000000000 Call trace: hlock_class kernel/locking/lockdep.c:-1 [inline] (P) check_wait_context kernel/locking/lockdep.c:4870 [inline] (P) __lock_acquire+0x2f4/0x2a6c kernel/locking/lockdep.c:5204 (P) lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:173 spin_lock include/linux/spinlock.h:347 [inline] tcp_tsq_handler+0x2c/0x22c net/ipv4/tcp_output.c:1291 tcp_tsq_workfn+0x2dc/0x384 net/ipv4/tcp_output.c:1325 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 bh_worker+0x260/0x57c kernel/workqueue.c:3773 workqueue_softirq_action+0x104/0x14c kernel/workqueue.c:3801 tasklet_action+0x18/0x8c kernel/softirq.c:997 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x1c0/0x458 kernel/softirq.c:767 irq_exit_rcu+0x14/0x84 kernel/softirq.c:784 __el1_irq arch/arm64/kernel/entry-common.c:531 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:543 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P) _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P) spin_unlock_irqrestore include/linux/spinlock.h:425 [inline] __wake_up_common_lock+0x5c/0x78 kernel/sched/wait.c:128 __wake_up_sync_key+0x20/0x2c kernel/sched/wait.c:193 __unix_dgram_recvmsg+0x2b0/0x85c net/unix/af_unix.c:2615 unix_dgram_recvmsg+0xcc/0xe4 net/unix/af_unix.c:2689 sock_recvmsg_nosec+0x94/0x130 net/socket.c:1151 ____sys_recvmsg+0x4fc/0x608 net/socket.c:2931 ___sys_recvmsg+0x16c/0x1f4 net/socket.c:2975 do_recvmmsg+0x288/0x7d4 net/socket.c:3070 __sys_recvmmsg+0x1e0/0x270 net/socket.c:3144 __do_sys_recvmmsg net/socket.c:3167 [inline] __se_sys_recvmmsg net/socket.c:3160 [inline] __arm64_sys_recvmmsg+0xe0/0x108 net/socket.c:3160 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 irq event stamp: 184490 hardirqs last enabled at (184490): [] tcp_tsq_workfn+0x1a8/0x384 net/ipv4/tcp_output.c:1315 hardirqs last disabled at (184489): [] tcp_tsq_workfn+0xe0/0x384 net/ipv4/tcp_output.c:1313 softirqs last enabled at (177348): [] softirq_handle_end kernel/softirq.c:491 [inline] softirqs last enabled at (177348): [] handle_softirqs+0xc28/0xd98 kernel/softirq.c:673 softirqs last disabled at (184287): [] __do_softirq+0x14/0x20 kernel/softirq.c:679 ---[ end trace 0000000000000000 ]--- Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c4 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000113a68000 [00000000000000c4] pgd=08000001353ea403, p4d=08000001353ea403, pud=080000010df20403, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 8518 Comm: syz.1.905 Tainted: G W L syzkaller #0 PREEMPT Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : check_wait_context kernel/locking/lockdep.c:4870 [inline] pc : __lock_acquire+0x2fc/0x2a6c kernel/locking/lockdep.c:5204 lr : hlock_class kernel/locking/lockdep.c:238 [inline] lr : check_wait_context kernel/locking/lockdep.c:4870 [inline] lr : __lock_acquire+0x2f0/0x2a6c kernel/locking/lockdep.c:5204 sp : ffff80008ec37950 x29: ffff80008ec37a40 x28: ffff0000c39b1d80 x27: ffff0000c39b2948 x26: ffff8000854d59ac x25: 0000000000000000 x24: 0000000000000001 x23: 0000000000000000 x22: ffff80008e8df000 x21: ffff80008a6a6e28 x20: 0000000000000000 x19: ffff80008a4d0da0 x18: 00000000ffffffff x17: 00000000ffff0010 x16: 0024000800000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000000104 x9 : 4b00000000042c77 x8 : 0000000000000000 x7 : 4e5241575f534b43 x6 : ffff80008048e314 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f9194 x2 : 0000000100000102 x1 : ffff0000c39b1d80 x0 : 0000000000000000 Call trace: hlock_class kernel/locking/lockdep.c:229 [inline] (P) check_wait_context kernel/locking/lockdep.c:4871 [inline] (P) __lock_acquire+0x2fc/0x2a6c kernel/locking/lockdep.c:5204 (P) lock_acquire+0x150/0x370 kernel/locking/lockdep.c:5908 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:173 spin_lock include/linux/spinlock.h:347 [inline] tcp_tsq_handler+0x2c/0x22c net/ipv4/tcp_output.c:1291 tcp_tsq_workfn+0x2dc/0x384 net/ipv4/tcp_output.c:1325 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 bh_worker+0x260/0x57c kernel/workqueue.c:3773 workqueue_softirq_action+0x104/0x14c kernel/workqueue.c:3801 tasklet_action+0x18/0x8c kernel/softirq.c:997 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x1c0/0x458 kernel/softirq.c:767 irq_exit_rcu+0x14/0x84 kernel/softirq.c:784 __el1_irq arch/arm64/kernel/entry-common.c:531 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:543 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P) _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P) spin_unlock_irqrestore include/linux/spinlock.h:425 [inline] __wake_up_common_lock+0x5c/0x78 kernel/sched/wait.c:128 __wake_up_sync_key+0x20/0x2c kernel/sched/wait.c:193 __unix_dgram_recvmsg+0x2b0/0x85c net/unix/af_unix.c:2615 unix_dgram_recvmsg+0xcc/0xe4 net/unix/af_unix.c:2689 sock_recvmsg_nosec+0x94/0x130 net/socket.c:1151 ____sys_recvmsg+0x4fc/0x608 net/socket.c:2931 ___sys_recvmsg+0x16c/0x1f4 net/socket.c:2975 do_recvmmsg+0x288/0x7d4 net/socket.c:3070 __sys_recvmmsg+0x1e0/0x270 net/socket.c:3144 __do_sys_recvmmsg net/socket.c:3167 [inline] __se_sys_recvmmsg net/socket.c:3160 [inline] __arm64_sys_recvmmsg+0xe0/0x108 net/socket.c:3160 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Code: 97fa5a10 aa1f03e8 d4210000 f9401369 (39431114) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97fa5a10 bl 0xffffffffffe96840 4: aa1f03e8 mov x8, xzr 8: d4210000 brk #0x800 c: f9401369 ldr x9, [x27, #32] * 10: 39431114 ldrb w20, [x8, #196] <-- trapping instruction