------------[ cut here ]------------ WARNING: CPU: 0 PID: 7519 at kernel/softirq.c:362 __local_bh_enable_ip+0x27c/0x44c kernel/softirq.c:362 Modules linked in: CPU: 0 UID: 0 PID: 7519 Comm: syz.3.259 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __local_bh_enable_ip+0x27c/0x44c kernel/softirq.c:362 lr : local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 sp : ffff80009fc76c20 x29: ffff80009fc76c30 x28: 1fffe0001d6d1817 x27: ffff0000ee7db140 x26: dfff800000000000 x25: 1fffe0001a02dba0 x24: 0000000000000000 x23: 1fffe0001af7ab59 x22: dfff800000000000 x21: ffff8000894c0304 x20: 0000000000000200 x19: ffff0000d7bd5ac8 x18: ffff80009fc76420 x17: 00000000000330ff x16: ffff8000801f7f08 x15: 0000000000000001 x14: 1ffff00011fc8cf2 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000040000 x10: 000000000001640d x9 : 0000000000000000 x8 : 0000000100000201 x7 : ffff8000800614a8 x6 : ffff8000800616a4 x5 : ffff0000ec923960 x4 : ffff80009fc768e0 x3 : ffff800080360750 x2 : 0000000000000001 x1 : 0000000000000200 x0 : ffff8000894c0304 Call trace: __local_bh_enable_ip+0x27c/0x44c kernel/softirq.c:362 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x1864/0x3504 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] __netlink_deliver_tap+0x46c/0x6e4 net/netlink/af_netlink.c:325 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1275 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1408 [inline] do_one_broadcast net/netlink/af_netlink.c:1495 [inline] netlink_broadcast_filtered+0xb2c/0x10ec net/netlink/af_netlink.c:1540 nlmsg_multicast_filtered include/net/netlink.h:1125 [inline] genlmsg_multicast_netns_filtered include/net/genetlink.h:491 [inline] genlmsg_multicast_netns+0xb0/0xf8 include/net/genetlink.h:508 nl80211_frame_tx_status+0x794/0xd48 net/wireless/nl80211.c:19090 cfg80211_mgmt_tx_status_ext+0x38/0x4c net/wireless/nl80211.c:19117 ieee80211_report_ack_skb net/mac80211/status.c:645 [inline] ieee80211_report_used_skb+0x14bc/0x1d4c net/mac80211/status.c:778 ieee80211_free_txskb+0x30/0x4c net/mac80211/status.c:1291 ieee80211_do_stop+0xed4/0x1a68 net/mac80211/iface.c:646 ieee80211_runtime_change_iftype net/mac80211/iface.c:1860 [inline] ieee80211_if_change_type+0x47c/0xd00 net/mac80211/iface.c:1898 ieee80211_change_iface+0xe0/0x4ac net/mac80211/cfg.c:219 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x6e0/0xf60 net/wireless/util.c:1215 cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:67 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1045 wext_ioctl_dispatch+0x1b4/0x534 net/wireless/wext-core.c:1016 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1077 sock_ioctl+0x15c/0x838 net/socket.c:1275 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 irq event stamp: 2477 hardirqs last enabled at (2475): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1427 [inline] hardirqs last enabled at (2475): [] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:4942 hardirqs last disabled at (2476): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2476): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162 softirqs last enabled at (2436): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (2436): [] netif_addr_unlock_bh include/linux/netdevice.h:4519 [inline] softirqs last enabled at (2436): [] ieee80211_do_stop+0x4f8/0x1a68 net/mac80211/iface.c:534 softirqs last disabled at (2477): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- ================================ WARNING: inconsistent lock state 6.11.0-rc7-syzkaller-g5f5673607153 #0 Tainted: G W -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. syz.3.259/7519 [HC0[0]:SC0[0]:HE0:SE1] takes: ffff0000d28514d8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xd3c/0x1a68 net/mac80211/iface.c:640 {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162 ieee80211_tx_dequeue+0x2a0/0x3b80 net/mac80211/tx.c:3828 wake_tx_push_queue net/mac80211/util.c:294 [inline] ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315 drv_wake_tx_queue net/mac80211/driver-ops.h:1362 [inline] schedule_and_wake_txq net/mac80211/driver-ops.h:1369 [inline] ieee80211_queue_skb+0x18e4/0x2234 net/mac80211/tx.c:1664 ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062 __ieee80211_subif_start_xmit+0xabc/0x1234 net/mac80211/tx.c:4337 ieee80211_subif_start_xmit+0xe0/0x43c net/mac80211/tx.c:4531 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x260/0x904 net/core/dev.c:3596 __dev_queue_xmit+0x168c/0x3504 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] neigh_hh_output include/net/neighbour.h:526 [inline] neigh_output include/net/neighbour.h:540 [inline] ip6_finish_output2+0x1028/0x1fa0 net/ipv6/ip6_output.c:141 ip6_finish_output+0x428/0x7a8 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x274/0x598 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ndisc_send_skb+0xaac/0x14f4 net/ipv6/ndisc.c:511 ndisc_send_rs+0x494/0x5ec net/ipv6/ndisc.c:721 addrconf_rs_timer+0x300/0x598 net/ipv6/addrconf.c:4040 call_timer_fn+0x1b4/0x8e8 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers kernel/time/timer.c:2417 [inline] __run_timer_base+0x56c/0x7b4 kernel/time/timer.c:2428 run_timer_base kernel/time/timer.c:2437 [inline] run_timer_softirq+0xcc/0x194 kernel/time/timer.c:2447 handle_softirqs+0x2e4/0xbfc kernel/softirq.c:554 __do_softirq+0x14/0x20 kernel/softirq.c:588 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86 invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x1d8/0x434 kernel/softirq.c:637 irq_exit_rcu+0x14/0x84 kernel/softirq.c:649 __el1_irq arch/arm64/kernel/entry-common.c:537 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:551 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] lock_acquire+0x27c/0x728 kernel/locking/lockdep.c:5762 lock_sock_nested net/core/sock.c:3543 [inline] lock_sock include/net/sock.h:1607 [inline] sockopt_lock_sock+0x88/0x148 net/core/sock.c:1061 do_ipv6_setsockopt+0xa98/0x3108 net/ipv6/ipv6_sockglue.c:567 ipv6_setsockopt+0x68/0x1a4 net/ipv6/ipv6_sockglue.c:993 udpv6_setsockopt+0xb8/0xd0 net/ipv6/udp.c:1702 sock_common_setsockopt+0xb0/0xcc net/core/sock.c:3735 do_sock_setsockopt+0x2a0/0x4e0 net/socket.c:2324 __sys_setsockopt+0x128/0x1a8 net/socket.c:2347 __do_sys_setsockopt net/socket.c:2356 [inline] __se_sys_setsockopt net/socket.c:2353 [inline] __arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2353 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 irq event stamp: 2478 hardirqs last enabled at (2475): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1427 [inline] hardirqs last enabled at (2475): [] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:4942 hardirqs last disabled at (2476): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2476): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162 softirqs last enabled at (2478): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (2477): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&local->queue_stop_reason_lock); lock(&local->queue_stop_reason_lock); *** DEADLOCK *** 5 locks held by syz.3.259/7519: #0: ffff800092437ee8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:79 #1: ffff0000d2850768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:6014 [inline] #1: ffff0000d2850768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wext_siwmode+0x170/0x240 net/wireless/wext-compat.c:66 #2: ffff0000d28514d8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xd3c/0x1a68 net/mac80211/iface.c:640 #3: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325 #4: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325 stack backtrace: CPU: 0 UID: 0 PID: 7519 Comm: syz.3.259 Tainted: G W 6.11.0-rc7-syzkaller-g5f5673607153 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326 __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119 dump_stack+0x1c/0x28 lib/dump_stack.c:128 print_usage_bug+0x698/0x9ac kernel/locking/lockdep.c:4000 mark_lock_irq+0x980/0xd2c mark_lock+0x258/0x360 kernel/locking/lockdep.c:4677 mark_held_locks kernel/locking/lockdep.c:4273 [inline] __trace_hardirqs_on_caller kernel/locking/lockdep.c:4299 [inline] lockdep_hardirqs_on_prepare+0x3e4/0x870 kernel/locking/lockdep.c:4358 trace_hardirqs_on+0x164/0x28c kernel/trace/trace_preemptirq.c:61 __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:387 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x1864/0x3504 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] __netlink_deliver_tap+0x46c/0x6e4 net/netlink/af_netlink.c:325 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1275 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1408 [inline] do_one_broadcast net/netlink/af_netlink.c:1495 [inline] netlink_broadcast_filtered+0xb2c/0x10ec net/netlink/af_netlink.c:1540 nlmsg_multicast_filtered include/net/netlink.h:1125 [inline] genlmsg_multicast_netns_filtered include/net/genetlink.h:491 [inline] genlmsg_multicast_netns+0xb0/0xf8 include/net/genetlink.h:508 nl80211_frame_tx_status+0x794/0xd48 net/wireless/nl80211.c:19090 cfg80211_mgmt_tx_status_ext+0x38/0x4c net/wireless/nl80211.c:19117 ieee80211_report_ack_skb net/mac80211/status.c:645 [inline] ieee80211_report_used_skb+0x14bc/0x1d4c net/mac80211/status.c:778 ieee80211_free_txskb+0x30/0x4c net/mac80211/status.c:1291 ieee80211_do_stop+0xed4/0x1a68 net/mac80211/iface.c:646 ieee80211_runtime_change_iftype net/mac80211/iface.c:1860 [inline] ieee80211_if_change_type+0x47c/0xd00 net/mac80211/iface.c:1898 ieee80211_change_iface+0xe0/0x4ac net/mac80211/cfg.c:219 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x6e0/0xf60 net/wireless/util.c:1215 cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:67 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1045 wext_ioctl_dispatch+0x1b4/0x534 net/wireless/wext-core.c:1016 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1077 sock_ioctl+0x15c/0x838 net/socket.c:1275 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 0 PID: 7519 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 0 UID: 0 PID: 7519 Comm: syz.3.259 Tainted: G W 6.11.0-rc7-syzkaller-g5f5673607153 #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 lr : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 sp : ffff80009fc77530 x29: ffff80009fc77530 x28: 0000000000000010 x27: dfff800000000000 x26: 0000000000000058 x25: 000000000000000f x24: 1fffe0001a50a3f6 x23: ffff0000d13ee800 x22: 000000000000000f x21: 000000000000000f x20: ffff0000d28514c0 x19: 0000000000000000 x18: 0000000000000008 x17: 0000000000000000 x16: ffff800083032784 x15: 0000000000000001 x14: 1ffff00013f8edf4 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000040000 x10: 000000000003ffff x9 : 44cdf5ecdbeb5200 x8 : 44cdf5ecdbeb5200 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80009fc76c78 x4 : ffff80008f65b620 x3 : ffff800082fbd1a4 x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000 Call trace: warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x8c/0x98 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] ieee80211_do_stop+0xff8/0x1a68 net/mac80211/iface.c:650 ieee80211_runtime_change_iftype net/mac80211/iface.c:1860 [inline] ieee80211_if_change_type+0x47c/0xd00 net/mac80211/iface.c:1898 ieee80211_change_iface+0xe0/0x4ac net/mac80211/cfg.c:219 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x6e0/0xf60 net/wireless/util.c:1215 cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:67 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1045 wext_ioctl_dispatch+0x1b4/0x534 net/wireless/wext-core.c:1016 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1077 sock_ioctl+0x15c/0x838 net/socket.c:1275 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 irq event stamp: 2478 hardirqs last enabled at (2475): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1427 [inline] hardirqs last enabled at (2475): [] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:4942 hardirqs last disabled at (2476): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2476): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162 softirqs last enabled at (2478): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (2477): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]---