================================ WARNING: inconsistent lock state syzkaller #0 Tainted: G L -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.4.5633/22466 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88803240a260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] ffff88803240a260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908 lock_sock_nested+0x41/0x100 net/core/sock.c:3827 lock_sock include/net/sock.h:1713 [inline] x25_bind+0x209/0x450 net/x25/af_x25.c:694 __sys_bind_socket net/socket.c:1945 [inline] __sys_bind+0x2e3/0x410 net/socket.c:1976 __do_sys_bind net/socket.c:1981 [inline] __se_sys_bind net/socket.c:1979 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1979 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 17110 hardirqs last enabled at (17110): [] __local_bh_enable_ip+0xd6/0x140 kernel/softirq.c:478 hardirqs last disabled at (17109): [] __local_bh_enable_ip+0x72/0x140 kernel/softirq.c:455 softirqs last enabled at (16500): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last enabled at (16500): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last enabled at (16500): [] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767 softirqs last disabled at (16855): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (16855): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (16855): [] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** locks held by syz.4.5633/22466: 1, last CPU#0: #0: ffffffff8eb5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8eb5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8eb5c8a0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x33/0x2b0 net/core/dev.c:6269 stack backtrace: CPU: 0 UID: 0 PID: 22466 Comm: syz.4.5633 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_usage_bug+0x28c/0x2e0 kernel/locking/lockdep.c:4058 valid_state+0xbe/0xf0 kernel/locking/lockdep.c:4072 mark_lock_irq+0x36/0x380 kernel/locking/lockdep.c:4283 mark_lock+0x117/0x190 kernel/locking/lockdep.c:4769 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0x6b7/0x2e50 kernel/locking/lockdep.c:5208 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908 lock_sock_nested+0x41/0x100 net/core/sock.c:3827 lock_sock include/net/sock.h:1713 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:6245 [inline] netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6270 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100 __napi_poll+0xaa/0x330 net/core/dev.c:7768 napi_poll net/core/dev.c:7831 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:7988 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767 irq_exit_rcu+0x9/0x30 kernel/softirq.c:784 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:finish_task_switch+0x413/0xc60 kernel/sched/core.c:5361 Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 b7 b1 48 0a e8 52 e7 39 00 fb 4c 8b 65 c8 <49> 8d bc 24 10 17 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 RSP: 0018:ffffc90005ad7980 EFLAGS: 00000202 RAX: 00000000000041d5 RBX: ffff8880b863ca60 RCX: 8000000000000001 RDX: 0000000000000000 RSI: ffffffff8e256ee9 RDI: ffffffff8c4c9480 RBP: ffffc90005ad79d0 R08: ffffffff9059037f R09: 1ffffffff20b206f R10: dffffc0000000000 R11: fffffbfff20b2070 R12: ffff88806040ddc0 R13: ffff88806040ddc0 R14: dffffc0000000000 R15: 1ffff110170c794c context_switch kernel/sched/core.c:5513 [inline] __schedule+0x1b55/0x59e0 kernel/sched/core.c:7240 __schedule_loop kernel/sched/core.c:7317 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7332 do_nanosleep+0x21e/0x6a0 kernel/time/hrtimer.c:2426 hrtimer_nanosleep+0x18f/0x3a0 kernel/time/hrtimer.c:2472 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1406 [inline] __se_sys_clock_nanosleep+0x35b/0x3b0 kernel/time/posix-timers.c:1383 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f452615e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007fff511134c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000555580432500 RCX: 00007f452615e90e RDX: 00007fff51113520 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f4526427da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000008c896 R13: 00007f452642618c R14: 000000000008c67e R15: 00007f4526426180 BUG: sleeping function called from invalid context at net/core/sock.c:3829 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 22466, name: syz.4.5633 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] __schedule_loop kernel/sched/core.c:7316 [inline] [] schedule+0x15d/0x2b0 kernel/sched/core.c:7332 CPU: 0 UID: 0 PID: 22466 Comm: syz.4.5633 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9203 lock_sock_nested+0x56/0x100 net/core/sock.c:3829 lock_sock include/net/sock.h:1713 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:6245 [inline] netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6270 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100 __napi_poll+0xaa/0x330 net/core/dev.c:7768 napi_poll net/core/dev.c:7831 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:7988 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767 irq_exit_rcu+0x9/0x30 kernel/softirq.c:784 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:finish_task_switch+0x413/0xc60 kernel/sched/core.c:5361 Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 b7 b1 48 0a e8 52 e7 39 00 fb 4c 8b 65 c8 <49> 8d bc 24 10 17 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 RSP: 0018:ffffc90005ad7980 EFLAGS: 00000202 RAX: 00000000000041d5 RBX: ffff8880b863ca60 RCX: 8000000000000001 RDX: 0000000000000000 RSI: ffffffff8e256ee9 RDI: ffffffff8c4c9480 RBP: ffffc90005ad79d0 R08: ffffffff9059037f R09: 1ffffffff20b206f R10: dffffc0000000000 R11: fffffbfff20b2070 R12: ffff88806040ddc0 R13: ffff88806040ddc0 R14: dffffc0000000000 R15: 1ffff110170c794c context_switch kernel/sched/core.c:5513 [inline] __schedule+0x1b55/0x59e0 kernel/sched/core.c:7240 __schedule_loop kernel/sched/core.c:7317 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7332 do_nanosleep+0x21e/0x6a0 kernel/time/hrtimer.c:2426 hrtimer_nanosleep+0x18f/0x3a0 kernel/time/hrtimer.c:2472 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1406 [inline] __se_sys_clock_nanosleep+0x35b/0x3b0 kernel/time/posix-timers.c:1383 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f452615e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007fff511134c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000555580432500 RCX: 00007f452615e90e RDX: 00007fff51113520 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f4526427da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000008c896 R13: 00007f452642618c R14: 000000000008c67e R15: 00007f4526426180 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 00 00 add %al,(%rax) 2: 41 c7 84 24 20 0e 00 movl $0x0,0xe20(%r12) 9: 00 00 00 00 00 e: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 13: 49 83 c4 48 add $0x48,%r12 17: 4c 89 e7 mov %r12,%rdi 1a: e8 b7 b1 48 0a call 0xa48b1d6 1f: e8 52 e7 39 00 call 0x39e776 24: fb sti 25: 4c 8b 65 c8 mov -0x38(%rbp),%r12 * 29: 49 8d bc 24 10 17 00 lea 0x1710(%r12),%rdi <-- trapping instruction 30: 00 31: 48 89 f8 mov %rdi,%rax 34: 48 c1 e8 03 shr $0x3,%rax 38: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax 3d: 84 c0 test %al,%al