================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz.0.757/8796 [HC0[0]:SC1[3]:HE1:SE0] takes:
ffffffff8efca220 (fs_reclaim){+.?.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline]
ffffffff8efca220 (fs_reclaim){+.?.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4636 [inline]
ffffffff8efca220 (fs_reclaim){+.?.}-{0:0}, at: slab_alloc_node mm/slub.c:4974 [inline]
ffffffff8efca220 (fs_reclaim){+.?.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x66/0x6e0 mm/slub.c:5068
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire kernel/locking/lockdep.c:5942 [inline]
  lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
  __fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
  fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389
  might_alloc include/linux/sched/mm.h:316 [inline]
  xa_alloc include/linux/xarray.h:876 [inline]
  mem_cgroup_alloc mm/memcontrol.c:4160 [inline]
  mem_cgroup_css_alloc+0x7e/0x1d10 mm/memcontrol.c:4225
  cgroup_init_subsys+0x223/0x700 kernel/cgroup/cgroup.c:6434
  cgroup_init+0x569/0xe50 kernel/cgroup/cgroup.c:6561
  start_kernel+0x475/0x490 init/main.c:1181
  x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
  x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291
  common_startup_64+0x13e/0x158
irq event stamp: 1546
hardirqs last  enabled at (1546): [<ffffffff81ca3135>] __local_bh_enable_ip+0xa5/0x120 kernel/softirq.c:478
hardirqs last disabled at (1545): [<ffffffff81ca315e>] __local_bh_enable_ip+0xce/0x120 kernel/softirq.c:455
softirqs last  enabled at (1526): [<ffffffff899fea52>] rcu_lock_release include/linux/rcupdate.h:319 [inline]
softirqs last  enabled at (1526): [<ffffffff899fea52>] rcu_read_unlock_bh include/linux/rcupdate.h:920 [inline]
softirqs last  enabled at (1526): [<ffffffff899fea52>] __dev_queue_xmit+0xa12/0x4970 net/core/dev.c:4961
softirqs last disabled at (1527): [<ffffffff81ca303f>] do_softirq kernel/softirq.c:546 [inline]
softirqs last disabled at (1527): [<ffffffff81ca303f>] do_softirq+0xaf/0xf0 kernel/softirq.c:533

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(fs_reclaim);
  <Interrupt>
    lock(fs_reclaim);

 *** DEADLOCK ***

locks held by syz.0.757/8796: 8, last CPU#0:
 #0: ffff888033a58260 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff888033a58260 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 net/ipv4/tcp.c:1450
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x1f40 net/ipv4/ip_output.c:476
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: ip_output+0xb3/0xc10 net/ipv4/ip_output.c:432
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x356/0x2400 net/ipv4/ip_output.c:229
 #4: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: local_lock_release include/linux/local_lock_internal.h:62 [inline]
 #4: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x437/0x1600 net/core/dev.c:6727
 #5: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #5: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #5: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: ip_local_deliver_finish+0x335/0x6e0 net/ipv4/ip_input.c:240
 #6: ffff888033b9e9e8 (slock-AF_INET/1){+.-.}-{3:3}, at: tcp_v4_rcv+0x2c2c/0x4840 net/ipv4/tcp_ipv4.c:2244
 #7: ffff888033b9ec08 (clock-AF_INET){++.-}-{3:3}, at: psock_data_ready+0x84/0x270 net/kcm/kcmsock.c:358

stack backtrace:
CPU: 0 UID: 0 PID: 8796 Comm: syz.0.757 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_usage_bug.part.0+0x258/0x340 kernel/locking/lockdep.c:4086
 print_usage_bug kernel/locking/lockdep.c:4054 [inline]
 valid_state kernel/locking/lockdep.c:4100 [inline]
 mark_lock_irq kernel/locking/lockdep.c:4311 [inline]
 mark_lock+0x956/0x1020 kernel/locking/lockdep.c:4797
 mark_usage kernel/locking/lockdep.c:4686 [inline]
 __lock_acquire+0x7f1/0x1f40 kernel/locking/lockdep.c:5242
 lock_acquire kernel/locking/lockdep.c:5942 [inline]
 lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
 fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389
 might_alloc include/linux/sched/mm.h:316 [inline]
 slab_pre_alloc_hook mm/slub.c:4636 [inline]
 slab_alloc_node mm/slub.c:4974 [inline]
 kmem_cache_alloc_node_noprof+0x66/0x6e0 mm/slub.c:5068
 __alloc_skb+0x140/0x710 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6799
 tls_alloc_clrtxt_skb net/tls/tls_sw.c:1230 [inline]
 tls_decrypt_sg+0x4d8/0x2c10 net/tls/tls_sw.c:1302
 tls_decrypt_sw net/tls/tls_sw.c:1448 [inline]
 tls_rx_one_record+0x133/0x13e0 net/tls/tls_sw.c:1574
 tls_sw_read_sock+0x64a/0x11d0 net/tls/tls_sw.c:2118
 strp_read_sock+0x250/0x2a0 net/strparser/strparser.c:372
 strp_data_ready net/strparser/strparser.c:402 [inline]
 strp_data_ready+0x1d8/0x290 net/strparser/strparser.c:380
 psock_data_ready+0xc0/0x270 net/kcm/kcmsock.c:362
 tcp_data_ready+0x114/0x5b0 net/ipv4/tcp_input.c:5604
 tcp_data_queue+0x1af9/0x4fb0 net/ipv4/tcp_input.c:5694
 tcp_rcv_established+0xb8d/0x39f0 net/ipv4/tcp_input.c:6690
 tcp_v4_do_rcv+0xbb6/0x1260 net/ipv4/tcp_ipv4.c:1854
 tcp_v4_rcv+0x2ec1/0x4840 net/ipv4/tcp_ipv4.c:2248
 ip_protocol_deliver_rcu+0xba/0x4d0 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3f2/0x6e0 net/ipv4/ip_input.c:241
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_local_deliver+0x19a/0x1f0 net/ipv4/ip_input.c:262
 dst_input include/net/dst.h:481 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_rcv+0x33a/0x3c0 net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6265
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6378
 process_backlog+0x487/0x1600 net/core/dev.c:6729
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7798
 napi_poll net/core/dev.c:7861 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8018
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 do_softirq kernel/softirq.c:546 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:533
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0xa27/0x4970 net/core/dev.c:4961
 dev_queue_xmit include/linux/netdevice.h:3461 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xf4a/0x2400 net/ipv4/ip_output.c:236
 __ip_finish_output.part.0+0x444/0x6f0 net/ipv4/ip_output.c:314
 __ip_finish_output net/ipv4/ip_output.c:302 [inline]
 ip_finish_output net/ipv4/ip_output.c:324 [inline]
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x39b/0xc10 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131
 __ip_queue_xmit+0x885/0x1f40 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x3503/0x4f40 net/ipv4/tcp_output.c:1716
 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
 tcp_write_xmit+0x1130/0x8470 net/ipv4/tcp_output.c:3062
 __tcp_push_pending_frames+0xaf/0x3b0 net/ipv4/tcp_output.c:3245
 tcp_push+0x225/0x700 net/ipv4/tcp.c:772
 tcp_sendmsg_locked+0x181b/0x4420 net/ipv4/tcp.c:1414
 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1451
 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:865
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x453/0x4e0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f45e4d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f45e5d3a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f45e5025fa0 RCX: 00007f45e4d9e159
RDX: 0000000000000025 RSI: 0000200000000400 RDI: 0000000000000004
RBP: 00007f45e4e3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f45e5026038 R14: 00007f45e5025fa0 R15: 00007ffdcc154e98
 </TASK>
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 8796, name: syz.0.757
preempt_count: 303, expected: 0
RCU nest depth: 5, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff899fe2de>] local_bh_disable include/linux/bottom_half.h:20 [inline]
[<ffffffff899fe2de>] rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
[<ffffffff899fe2de>] __dev_queue_xmit+0x29e/0x4970 net/core/dev.c:4844
CPU: 0 UID: 0 PID: 8796 Comm: syz.0.757 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9264
 might_alloc include/linux/sched/mm.h:322 [inline]
 slab_pre_alloc_hook mm/slub.c:4636 [inline]
 slab_alloc_node mm/slub.c:4974 [inline]
 kmem_cache_alloc_node_noprof+0x3a2/0x6e0 mm/slub.c:5068
 __alloc_skb+0x140/0x710 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6799
 tls_alloc_clrtxt_skb net/tls/tls_sw.c:1230 [inline]
 tls_decrypt_sg+0x4d8/0x2c10 net/tls/tls_sw.c:1302
 tls_decrypt_sw net/tls/tls_sw.c:1448 [inline]
 tls_rx_one_record+0x133/0x13e0 net/tls/tls_sw.c:1574
 tls_sw_read_sock+0x64a/0x11d0 net/tls/tls_sw.c:2118
 strp_read_sock+0x250/0x2a0 net/strparser/strparser.c:372
 strp_data_ready net/strparser/strparser.c:402 [inline]
 strp_data_ready+0x1d8/0x290 net/strparser/strparser.c:380
 psock_data_ready+0xc0/0x270 net/kcm/kcmsock.c:362
 tcp_data_ready+0x114/0x5b0 net/ipv4/tcp_input.c:5604
 tcp_data_queue+0x1af9/0x4fb0 net/ipv4/tcp_input.c:5694
 tcp_rcv_established+0xb8d/0x39f0 net/ipv4/tcp_input.c:6690
 tcp_v4_do_rcv+0xbb6/0x1260 net/ipv4/tcp_ipv4.c:1854
 tcp_v4_rcv+0x2ec1/0x4840 net/ipv4/tcp_ipv4.c:2248
 ip_protocol_deliver_rcu+0xba/0x4d0 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3f2/0x6e0 net/ipv4/ip_input.c:241
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_local_deliver+0x19a/0x1f0 net/ipv4/ip_input.c:262
 dst_input include/net/dst.h:481 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_rcv+0x33a/0x3c0 net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6265
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6378
 process_backlog+0x487/0x1600 net/core/dev.c:6729
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7798
 napi_poll net/core/dev.c:7861 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8018
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 do_softirq kernel/softirq.c:546 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:533
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0xa27/0x4970 net/core/dev.c:4961
 dev_queue_xmit include/linux/netdevice.h:3461 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xf4a/0x2400 net/ipv4/ip_output.c:236
 __ip_finish_output.part.0+0x444/0x6f0 net/ipv4/ip_output.c:314
 __ip_finish_output net/ipv4/ip_output.c:302 [inline]
 ip_finish_output net/ipv4/ip_output.c:324 [inline]
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x39b/0xc10 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131
 __ip_queue_xmit+0x885/0x1f40 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x3503/0x4f40 net/ipv4/tcp_output.c:1716
 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
 tcp_write_xmit+0x1130/0x8470 net/ipv4/tcp_output.c:3062
 __tcp_push_pending_frames+0xaf/0x3b0 net/ipv4/tcp_output.c:3245
 tcp_push+0x225/0x700 net/ipv4/tcp.c:772
 tcp_sendmsg_locked+0x181b/0x4420 net/ipv4/tcp.c:1414
 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1451
 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:865
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x453/0x4e0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f45e4d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f45e5d3a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f45e5025fa0 RCX: 00007f45e4d9e159
RDX: 0000000000000025 RSI: 0000200000000400 RDI: 0000000000000004
RBP: 00007f45e4e3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f45e5026038 R14: 00007f45e5025fa0 R15: 00007ffdcc154e98
 </TASK>