------------[ cut here ]------------ WARNING: CPU: 1 PID: 4857 at kernel/softirq.c:376 __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:376 Modules linked in: CPU: 1 PID: 4857 Comm: syz.1.124 Not tainted 6.1.109-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:376 lr : local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 sp : ffff800021a06d40 x29: ffff800021a06d50 x28: ffff0000d58aecf0 x27: ffff0000cd84dc00 x26: dfff800000000000 x25: ffff800015938240 x24: 0000000000000000 x23: 1fffe0001bda16f1 x22: dfff800000000000 x21: ffff80001056aa04 x20: 0000000000000200 x19: ffff0000ded0b788 x18: ffff800021a065a0 x17: ffff800018aa4000 x16: ffff8000081c6f2c x15: ffff800008a92de4 x14: ffff8000104e1684 x13: ffff80001228dac4 x12: 0000000000040000 x11: 0000000000036ada x10: ffff800021ad9000 x9 : 0000000000000000 x8 : 0000000100000201 x7 : ffff800008061c64 x6 : ffff800008061e74 x5 : ffff0000da5aa3e8 x4 : ffff800021a06a40 x3 : ffff80000831e428 x2 : 0000000000000001 x1 : 0000000000000200 x0 : ffff80001056aa04 Call trace: __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:376 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline] __dev_queue_xmit+0x1a68/0x38d8 net/core/dev.c:4320 dev_queue_xmit include/linux/netdevice.h:3021 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] __netlink_deliver_tap+0x464/0x6e4 net/netlink/af_netlink.c:325 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1270 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1403 [inline] do_one_broadcast net/netlink/af_netlink.c:1481 [inline] netlink_broadcast+0x9bc/0xff4 net/netlink/af_netlink.c:1521 nlmsg_multicast include/net/netlink.h:1071 [inline] genlmsg_multicast_netns+0xa8/0xf0 include/net/genetlink.h:333 nl80211_frame_tx_status+0x7c8/0xe54 net/wireless/nl80211.c:18624 cfg80211_mgmt_tx_status_ext+0x38/0x4c net/wireless/nl80211.c:18651 ieee80211_report_ack_skb net/mac80211/status.c:680 [inline] ieee80211_report_used_skb+0x1258/0x17b4 net/mac80211/status.c:763 ieee80211_free_txskb+0x30/0x4c net/mac80211/status.c:1284 ieee80211_do_stop+0xe88/0x1994 net/mac80211/iface.c:667 ieee80211_runtime_change_iftype net/mac80211/iface.c:1926 [inline] ieee80211_if_change_type+0x478/0xcf4 net/mac80211/iface.c:1964 ieee80211_change_iface+0x6c/0x418 net/mac80211/cfg.c:217 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x844/0x11ac net/wireless/util.c:1159 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1599 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x858 net/socket.c:1255 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 3017 hardirqs last enabled at (3015): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (3015): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (3016): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3016): [] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162 softirqs last enabled at (2964): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (2964): [] netif_addr_unlock_bh include/linux/netdevice.h:4467 [inline] softirqs last enabled at (2964): [] ieee80211_do_stop+0x504/0x1994 net/mac80211/iface.c:542 softirqs last disabled at (3017): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- ================================ WARNING: inconsistent lock state 6.1.109-syzkaller #0 Tainted: G W -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. syz.1.124/4857 [HC0[0]:SC0[0]:HE0:SE1] takes: ffff0000f1d394f8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xcf0/0x1994 net/mac80211/iface.c:661 {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162 ieee80211_tx_frags+0x138/0x700 net/mac80211/tx.c:1721 __ieee80211_tx+0x1b0/0x40c net/mac80211/tx.c:1820 ieee80211_tx+0x2c4/0x400 net/mac80211/tx.c:2000 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2092 __ieee80211_subif_start_xmit+0xc88/0x2af8 net/mac80211/tx.c:4265 ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4457 __netdev_start_xmit include/linux/netdevice.h:4853 [inline] netdev_start_xmit include/linux/netdevice.h:4867 [inline] xmit_one net/core/dev.c:3627 [inline] dev_hard_start_xmit+0x25c/0x9a4 net/core/dev.c:3643 sch_direct_xmit+0x234/0x548 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3854 [inline] __dev_queue_xmit+0x1658/0x38d8 net/core/dev.c:4259 dev_queue_xmit include/linux/netdevice.h:3021 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0xd84/0x1b54 net/ipv6/ip6_output.c:138 __ip6_finish_output net/ipv6/ip6_output.c:205 [inline] ip6_finish_output+0x5a4/0x940 net/ipv6/ip6_output.c:216 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0x274/0x594 net/ipv6/ip6_output.c:237 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] ndisc_send_skb+0xc38/0x179c net/ipv6/ndisc.c:511 ndisc_send_rs+0x47c/0x5d4 net/ipv6/ndisc.c:721 addrconf_rs_timer+0x300/0x58c net/ipv6/addrconf.c:3963 call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1504 expire_timers kernel/time/timer.c:1549 [inline] __run_timers+0x554/0x718 kernel/time/timer.c:1820 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1833 handle_softirqs+0x318/0xd58 kernel/softirq.c:571 __do_softirq+0x14/0x20 kernel/softirq.c:605 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:893 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:654 irq_exit_rcu+0x14/0x84 kernel/softirq.c:666 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] lock_release+0x528/0xa50 kernel/locking/lockdep.c:5685 __raw_spin_unlock include/linux/spinlock_api_smp.h:141 [inline] _raw_spin_unlock+0x30/0x84 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] follow_page_pte+0x2b4/0xd50 mm/gup.c:659 follow_pud_mask mm/gup.c:810 [inline] follow_p4d_mask mm/gup.c:836 [inline] follow_page_mask+0x964/0x1088 mm/gup.c:900 __get_user_pages+0x348/0x968 mm/gup.c:1231 populate_vma_page_range+0x1fc/0x2a0 mm/gup.c:1590 __mm_populate+0x240/0x3d8 mm/gup.c:1704 mm_populate include/linux/mm.h:2797 [inline] vm_mmap_pgoff+0x1fc/0x2b4 mm/util.c:525 ksys_mmap_pgoff+0xd0/0x5b0 mm/mmap.c:1471 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline] __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline] __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 3018 hardirqs last enabled at (3015): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (3015): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (3016): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3016): [] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162 softirqs last enabled at (3018): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (3017): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&local->queue_stop_reason_lock); lock(&local->queue_stop_reason_lock); *** DEADLOCK *** 5 locks held by syz.1.124/4857: #0: ffff800017ff16c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 #1: ffff0000f1d387c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5639 [inline] #1: ffff0000f1d387c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wext_siwmode net/wireless/wext-compat.c:65 [inline] #1: ffff0000f1d387c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: __cfg80211_wext_siwmode+0x170/0x240 net/wireless/wext-compat.c:1599 #2: ffff0000f1d394f8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xcf0/0x1994 net/mac80211/iface.c:661 #3: ffff800015ba4ee0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 #4: ffff800015ba4ee0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:349 stack backtrace: CPU: 1 PID: 4857 Comm: syz.1.124 Tainted: G W 6.1.109-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_usage_bug+0x654/0x9b0 kernel/locking/lockdep.c:3957 mark_lock_irq+0x980/0xd2c mark_lock+0x258/0x360 kernel/locking/lockdep.c:4628 mark_held_locks kernel/locking/lockdep.c:4230 [inline] __trace_hardirqs_on_caller kernel/locking/lockdep.c:4256 [inline] lockdep_hardirqs_on_prepare+0x3e8/0x874 kernel/locking/lockdep.c:4315 trace_hardirqs_on+0x184/0x2d4 kernel/trace/trace_preemptirq.c:49 __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:401 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline] __dev_queue_xmit+0x1a68/0x38d8 net/core/dev.c:4320 dev_queue_xmit include/linux/netdevice.h:3021 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] __netlink_deliver_tap+0x464/0x6e4 net/netlink/af_netlink.c:325 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1270 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1403 [inline] do_one_broadcast net/netlink/af_netlink.c:1481 [inline] netlink_broadcast+0x9bc/0xff4 net/netlink/af_netlink.c:1521 nlmsg_multicast include/net/netlink.h:1071 [inline] genlmsg_multicast_netns+0xa8/0xf0 include/net/genetlink.h:333 nl80211_frame_tx_status+0x7c8/0xe54 net/wireless/nl80211.c:18624 cfg80211_mgmt_tx_status_ext+0x38/0x4c net/wireless/nl80211.c:18651 ieee80211_report_ack_skb net/mac80211/status.c:680 [inline] ieee80211_report_used_skb+0x1258/0x17b4 net/mac80211/status.c:763 ieee80211_free_txskb+0x30/0x4c net/mac80211/status.c:1284 ieee80211_do_stop+0xe88/0x1994 net/mac80211/iface.c:667 ieee80211_runtime_change_iftype net/mac80211/iface.c:1926 [inline] ieee80211_if_change_type+0x478/0xcf4 net/mac80211/iface.c:1964 ieee80211_change_iface+0x6c/0x418 net/mac80211/cfg.c:217 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x844/0x11ac net/wireless/util.c:1159 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1599 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x858 net/socket.c:1255 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 4857 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 1 PID: 4857 Comm: syz.1.124 Tainted: G W 6.1.109-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 lr : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 sp : ffff800021a07590 x29: ffff800021a07590 x28: ffff0000f1d3a060 x27: dfff800000000000 x26: 0000000000000058 x25: 000000000000000f x24: 0000000000000010 x23: ffff0000f1c36790 x22: 000000000000000f x21: 000000000000000f x20: ffff0000f1d394e0 x19: 0000000000000000 x18: ffff800021a065a0 x17: 0000000000000000 x16: ffff8000121dfa40 x15: 0000000000000002 x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000040000 x11: 000000000003ffff x10: ffff800021ad9000 x9 : dcd4d6284acf8100 x8 : dcd4d6284acf8100 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800021a06e78 x4 : ffff800015ab2d40 x3 : ffff80000834e1d8 x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000 Call trace: warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0xa0/0xac kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] ieee80211_do_stop+0xfac/0x1994 net/mac80211/iface.c:671 ieee80211_runtime_change_iftype net/mac80211/iface.c:1926 [inline] ieee80211_if_change_type+0x478/0xcf4 net/mac80211/iface.c:1964 ieee80211_change_iface+0x6c/0x418 net/mac80211/cfg.c:217 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x844/0x11ac net/wireless/util.c:1159 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1599 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x1f8/0x3f4 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x858 net/socket.c:1255 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 3018 hardirqs last enabled at (3015): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (3015): [] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194 hardirqs last disabled at (3016): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3016): [] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162 softirqs last enabled at (3018): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (3017): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]---