------------[ cut here ]------------ WARNING: CPU: 1 PID: 4502 at kernel/softirq.c:363 __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:363 Modules linked in: CPU: 1 PID: 4502 Comm: syz.3.121 Not tainted 5.15.165-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:363 lr : local_bh_enable+0x28/0x34 include/linux/bottom_half.h:32 sp : ffff800020646e00 x29: ffff800020646e10 x28: dfff800000000000 x27: ffff0000d063a000 x26: 1fffe0001a0c741c x25: 1ffff000040c8dfc x24: 0000000000000000 x23: 1fffe00019c1fa39 x22: dfff800000000000 x21: ffff80000fee754c x20: 0000000000000200 x19: ffff0000ce0fd1c8 x18: ffff8000206465c0 x17: 0000000000000002 x16: ffff800011aaffbc x15: ffff8000089c7970 x14: ffff80000fe61a4c x13: ffff80000805d1f0 x12: 0000000000040000 x11: 000000000003ffff x10: ffff800021b19000 x9 : 0000000000000000 x8 : 0000000100000201 x7 : ffff80000805d1f0 x6 : ffff80000805d400 x5 : ffff0000dc00bef0 x4 : ffff800020646a78 x3 : ffff8000136156a0 x2 : 0000000000000001 x1 : 0000000000000200 x0 : ffff80000fee754c Call trace: __local_bh_enable_ip+0x28c/0x470 kernel/softirq.c:363 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:809 [inline] __dev_queue_xmit+0x1280/0x2a6c net/core/dev.c:4275 dev_queue_xmit+0x24/0x34 net/core/dev.c:4281 __netlink_deliver_tap_skb net/netlink/af_netlink.c:305 [inline] __netlink_deliver_tap+0x454/0x714 net/netlink/af_netlink.c:323 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:336 __netlink_sendskb net/netlink/af_netlink.c:1270 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1405 [inline] do_one_broadcast net/netlink/af_netlink.c:1490 [inline] netlink_broadcast_filtered+0x8f0/0xdf0 net/netlink/af_netlink.c:1534 netlink_broadcast+0x50/0x68 net/netlink/af_netlink.c:1558 nlmsg_multicast include/net/netlink.h:1033 [inline] genlmsg_multicast_netns+0xa8/0xf0 include/net/genetlink.h:314 nl80211_frame_tx_status+0x58c/0xab4 net/wireless/nl80211.c:17124 cfg80211_mgmt_tx_status+0x54/0x6c net/wireless/nl80211.c:17144 ieee80211_report_ack_skb net/mac80211/status.c:650 [inline] ieee80211_report_used_skb+0xf28/0x13c0 net/mac80211/status.c:732 ieee80211_free_txskb+0x2c/0x48 net/mac80211/status.c:1274 ieee80211_do_stop+0xe0c/0x18dc net/mac80211/iface.c:564 ieee80211_runtime_change_iftype net/mac80211/iface.c:1701 [inline] ieee80211_if_change_type+0x424/0xc68 net/mac80211/iface.c:1739 ieee80211_change_iface+0x6c/0x3a0 net/mac80211/cfg.c:160 rdev_change_virtual_intf net/wireless/rdev-ops.h:69 [inline] cfg80211_change_iface+0x778/0x143c net/wireless/util.c:1074 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1569 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x224/0x448 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x8ac net/socket.c:1191 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 2501 hardirqs last enabled at (2499): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (2499): [] _raw_spin_unlock_irqrestore+0xac/0x158 kernel/locking/spinlock.c:194 hardirqs last disabled at (2500): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2500): [] _raw_spin_lock_irqsave+0xfc/0x14c kernel/locking/spinlock.c:162 softirqs last enabled at (2454): [] spin_unlock_bh include/linux/spinlock.h:408 [inline] softirqs last enabled at (2454): [] netif_addr_unlock_bh include/linux/netdevice.h:4617 [inline] softirqs last enabled at (2454): [] ieee80211_do_stop+0x4c4/0x18dc net/mac80211/iface.c:444 softirqs last disabled at (2501): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 52f26fcc9e8db07a ]--- ================================ WARNING: inconsistent lock state 5.15.165-syzkaller #0 Tainted: G W -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. syz.3.121/4502 [HC0[0]:SC0[0]:HE0:SE1] takes: ffff0000d57394f8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xc74/0x18dc net/mac80211/iface.c:558 {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xc4/0x14c kernel/locking/spinlock.c:162 ieee80211_tx_frags+0x138/0x700 net/mac80211/tx.c:1669 __ieee80211_tx+0x1b0/0x40c net/mac80211/tx.c:1768 ieee80211_tx+0x2c4/0x400 net/mac80211/tx.c:1948 ieee80211_xmit+0x29c/0x3c0 net/mac80211/tx.c:2040 __ieee80211_subif_start_xmit+0xd68/0x2a4c net/mac80211/tx.c:4249 ieee80211_subif_start_xmit+0xe0/0x554 net/mac80211/tx.c:4388 __netdev_start_xmit include/linux/netdevice.h:5019 [inline] netdev_start_xmit include/linux/netdevice.h:5033 [inline] xmit_one net/core/dev.c:3617 [inline] dev_hard_start_xmit+0x2bc/0x92c net/core/dev.c:3633 sch_direct_xmit+0x2e0/0x484 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3844 [inline] __dev_queue_xmit+0x14b4/0x2a6c net/core/dev.c:4213 dev_queue_xmit+0x24/0x34 net/core/dev.c:4281 neigh_hh_output include/net/neighbour.h:493 [inline] neigh_output include/net/neighbour.h:507 [inline] ip6_finish_output2+0x1314/0x1c4c net/ipv6/ip6_output.c:126 __ip6_finish_output+0x580/0x6ec net/ipv6/ip6_output.c:197 ip6_finish_output+0x40/0x218 net/ipv6/ip6_output.c:207 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0x274/0x594 net/ipv6/ip6_output.c:230 dst_output include/net/dst.h:443 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] ndisc_send_skb+0xbf8/0x1788 net/ipv6/ndisc.c:511 ndisc_send_rs+0x494/0x5fc net/ipv6/ndisc.c:705 addrconf_rs_timer+0x308/0x5a8 net/ipv6/addrconf.c:3959 call_timer_fn+0x19c/0x8f0 kernel/time/timer.c:1451 expire_timers kernel/time/timer.c:1496 [inline] __run_timers+0x554/0x718 kernel/time/timer.c:1767 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780 handle_softirqs+0x384/0xdbc kernel/softirq.c:558 __do_softirq kernel/softirq.c:592 [inline] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] invoke_softirq kernel/softirq.c:439 [inline] __irq_exit_rcu+0x268/0x4d8 kernel/softirq.c:641 irq_exit+0x14/0x88 kernel/softirq.c:665 handle_domain_irq+0xf4/0x178 kernel/irq/irqdesc.c:711 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:758 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] seqcount_lockdep_reader_access+0x228/0x2d0 include/linux/seqlock.h:105 read_seqbegin include/linux/seqlock.h:840 [inline] read_seqbegin_or_lock include/linux/seqlock.h:1144 [inline] prepend_path+0xd8/0xaf8 fs/d_path.c:167 d_absolute_path+0x13c/0x27c fs/d_path.c:235 tomoyo_get_absolute_path security/tomoyo/realpath.c:101 [inline] tomoyo_realpath_from_path+0x2a4/0x508 security/tomoyo/realpath.c:276 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x208/0x568 security/tomoyo/file.c:822 tomoyo_inode_getattr+0x28/0x38 security/tomoyo/tomoyo.c:122 security_inode_getattr+0xd8/0x124 security/security.c:1348 vfs_getattr fs/stat.c:157 [inline] vfs_statx+0x16c/0x378 fs/stat.c:225 vfs_fstatat fs/stat.c:243 [inline] __do_sys_newfstatat fs/stat.c:411 [inline] __se_sys_newfstatat fs/stat.c:405 [inline] __arm64_sys_newfstatat+0x110/0x194 fs/stat.c:405 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 2502 hardirqs last enabled at (2499): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (2499): [] _raw_spin_unlock_irqrestore+0xac/0x158 kernel/locking/spinlock.c:194 hardirqs last disabled at (2500): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2500): [] _raw_spin_lock_irqsave+0xfc/0x14c kernel/locking/spinlock.c:162 softirqs last enabled at (2502): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (2501): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&local->queue_stop_reason_lock); lock(&local->queue_stop_reason_lock); *** DEADLOCK *** 5 locks held by syz.3.121/4502: #0: ffff800016be2ca8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:72 #1: ffff0000d5738628 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5314 [inline] #1: ffff0000d5738628 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wext_siwmode net/wireless/wext-compat.c:65 [inline] #1: ffff0000d5738628 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: __cfg80211_wext_siwmode+0x170/0x240 net/wireless/wext-compat.c:1569 #2: ffff0000d57394f8 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at: ieee80211_do_stop+0xc74/0x18dc net/mac80211/iface.c:558 #3: ffff800014c817a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:311 #4: ffff800014c817a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:311 stack backtrace: CPU: 1 PID: 4502 Comm: syz.3.121 Tainted: G W 5.15.165-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_usage_bug+0x64c/0x9a8 kernel/locking/lockdep.c:3920 mark_lock_irq+0x980/0xd2c mark_lock+0x258/0x360 kernel/locking/lockdep.c:4591 mark_held_locks kernel/locking/lockdep.c:4193 [inline] __trace_hardirqs_on_caller kernel/locking/lockdep.c:4219 [inline] lockdep_hardirqs_on_prepare+0x3e8/0x874 kernel/locking/lockdep.c:4278 trace_hardirqs_on+0x2a4/0x50c kernel/trace/trace_preemptirq.c:49 __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:388 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:809 [inline] __dev_queue_xmit+0x1280/0x2a6c net/core/dev.c:4275 dev_queue_xmit+0x24/0x34 net/core/dev.c:4281 __netlink_deliver_tap_skb net/netlink/af_netlink.c:305 [inline] __netlink_deliver_tap+0x454/0x714 net/netlink/af_netlink.c:323 netlink_deliver_tap+0x1ac/0x1b0 net/netlink/af_netlink.c:336 __netlink_sendskb net/netlink/af_netlink.c:1270 [inline] netlink_broadcast_deliver net/netlink/af_netlink.c:1405 [inline] do_one_broadcast net/netlink/af_netlink.c:1490 [inline] netlink_broadcast_filtered+0x8f0/0xdf0 net/netlink/af_netlink.c:1534 netlink_broadcast+0x50/0x68 net/netlink/af_netlink.c:1558 nlmsg_multicast include/net/netlink.h:1033 [inline] genlmsg_multicast_netns+0xa8/0xf0 include/net/genetlink.h:314 nl80211_frame_tx_status+0x58c/0xab4 net/wireless/nl80211.c:17124 cfg80211_mgmt_tx_status+0x54/0x6c net/wireless/nl80211.c:17144 ieee80211_report_ack_skb net/mac80211/status.c:650 [inline] ieee80211_report_used_skb+0xf28/0x13c0 net/mac80211/status.c:732 ieee80211_free_txskb+0x2c/0x48 net/mac80211/status.c:1274 ieee80211_do_stop+0xe0c/0x18dc net/mac80211/iface.c:564 ieee80211_runtime_change_iftype net/mac80211/iface.c:1701 [inline] ieee80211_if_change_type+0x424/0xc68 net/mac80211/iface.c:1739 ieee80211_change_iface+0x6c/0x3a0 net/mac80211/cfg.c:160 rdev_change_virtual_intf net/wireless/rdev-ops.h:69 [inline] cfg80211_change_iface+0x778/0x143c net/wireless/util.c:1074 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1569 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x224/0x448 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x8ac net/socket.c:1191 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 ------------[ cut here ]------------ raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 4502 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 Modules linked in: CPU: 1 PID: 4502 Comm: syz.3.121 Tainted: G W 5.15.165-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 lr : warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 sp : ffff800020647570 x29: ffff800020647570 x28: ffff0000d5739f30 x27: ffff0000d5739f30 x26: dfff800000000000 x25: 000000000000000f x24: 0000000000000010 x23: 000000000000000f x22: ffff80001145e218 x21: ffff0000d57394f8 x20: ffff0000d57394e0 x19: 0000000000000000 x18: 0000000000000002 x17: 0000000000000002 x16: ffff800008336484 x15: 00000000ffffffff x14: ffff0000ce0fd1c0 x13: 0000000000000001 x12: 0000000000040000 x11: 000000000003ffff x10: ffff800021b19000 x9 : 96095b46ed69dd00 x8 : 96095b46ed69dd00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800020646cd8 x4 : ffff800014b8faa0 x3 : ffff8000083365d0 x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000030 Call trace: warn_bogus_irq_restore+0x38/0x40 kernel/locking/irqflag-debug.c:10 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x10c/0x158 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:418 [inline] ieee80211_do_stop+0xf30/0x18dc net/mac80211/iface.c:568 ieee80211_runtime_change_iftype net/mac80211/iface.c:1701 [inline] ieee80211_if_change_type+0x424/0xc68 net/mac80211/iface.c:1739 ieee80211_change_iface+0x6c/0x3a0 net/mac80211/cfg.c:160 rdev_change_virtual_intf net/wireless/rdev-ops.h:69 [inline] cfg80211_change_iface+0x778/0x143c net/wireless/util.c:1074 cfg80211_wext_siwmode net/wireless/wext-compat.c:66 [inline] __cfg80211_wext_siwmode+0x184/0x240 net/wireless/wext-compat.c:1569 ioctl_standard_call+0xe8/0x264 net/wireless/wext-core.c:1026 wext_ioctl_dispatch+0x16c/0x3ec net/wireless/wext-core.c:997 wext_handle_ioctl+0x224/0x448 net/wireless/wext-core.c:1058 sock_ioctl+0x140/0x8ac net/socket.c:1191 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 2502 hardirqs last enabled at (2499): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (2499): [] _raw_spin_unlock_irqrestore+0xac/0x158 kernel/locking/spinlock.c:194 hardirqs last disabled at (2500): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2500): [] _raw_spin_lock_irqsave+0xfc/0x14c kernel/locking/spinlock.c:162 softirqs last enabled at (2502): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (2501): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 52f26fcc9e8db07b ]---