================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.4.894/7782 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff8880224e8120 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] ffff8880224e8120 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] x25_bind+0x18a/0x3b0 net/x25/af_x25.c:698 __sys_bind+0x2e9/0x3e0 net/socket.c:1730 __do_sys_bind net/socket.c:1741 [inline] __se_sys_bind net/socket.c:1739 [inline] __x64_sys_bind+0x76/0x80 net/socket.c:1739 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 irq event stamp: 148752 hardirqs last enabled at (148752): [] __local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:406 hardirqs last disabled at (148751): [] __local_bh_enable_ip+0xd7/0x1c0 kernel/softirq.c:383 softirqs last enabled at (146394): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last enabled at (146394): [] invoke_softirq kernel/softirq.c:450 [inline] softirqs last enabled at (146394): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 softirqs last disabled at (148655): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last disabled at (148655): [] invoke_softirq kernel/softirq.c:450 [inline] softirqs last disabled at (148655): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25 ); *** DEADLOCK *** 2 locks held by syz.4.894/7782: #0: ffff88802a0bc5a0 (&u->iolock){+.+.}-{3:3}, at: __unix_dgram_recvmsg+0x1f8/0xd50 net/unix/af_unix.c:2312 #1: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2} , at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313 stack backtrace: CPU: 0 PID: 7782 Comm: syz.4.894 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3932 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4135 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4591 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xc63/0x7b50 kernel/locking/lockdep.c:4966 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779 x25_lapb_receive_frame+0x19d/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5551 [inline] netif_receive_skb_core+0x149/0x210 net/core/dev.c:5576 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x430 net/core/dev.c:7101 napi_poll net/core/dev.c:7168 [inline] net_rx_action+0x522/0xa80 net/core/dev.c:7258 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 3f b1 87 f7 65 8b 05 70 c7 37 76 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc90003eff5e0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: d660cb6a23003a00 RDX: dffffc0000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000000001 RBP: ffffc90003eff670 R08: ffffffff901f1177 R09: 1ffffffff203e22e R10: dffffc0000000000 R11: fffffbfff203e22f R12: dffffc0000000000 R13: 0000000000000000 R14: ffff88802a0bc6c0 R15: 1ffff920007dfebc spin_unlock_irqrestore include/linux/spinlock.h:419 [inline] __wake_up_common_lock kernel/sched/wait.c:140 [inline] __wake_up_sync_key+0x128/0x190 kernel/sched/wait.c:205 __unix_dgram_recvmsg+0x4b1/0xd50 net/unix/af_unix.c:2342 ____sys_recvmsg+0x2ca/0x5b0 net/socket.c:-1 ___sys_recvmsg+0x213/0x5c0 net/socket.c:2707 do_recvmmsg+0x360/0x7f0 net/socket.c:2801 __sys_recvmmsg net/socket.c:2880 [inline] __do_sys_recvmmsg net/socket.c:2903 [inline] __se_sys_recvmmsg net/socket.c:2896 [inline] __x64_sys_recvmmsg+0x195/0x250 net/socket.c:2896 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f89ce75b159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f89cc992028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f89ce9e3090 RCX: 00007f89ce75b159 RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007f89ce7f206b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f89ce9e3128 R14: 00007f89ce9e3090 R15: 00007ffef953f628 BUG: sleeping function called from invalid context at net/core/sock.c:3260 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 7782, name: syz.4.894 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 0 PID: 7782 Comm: syz.4.894 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 ___might_sleep+0x493/0x610 kernel/sched/core.c:9658 lock_sock_nested+0x5b/0x100 net/core/sock.c:3260 lock_sock include/net/sock.h:1744 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779 x25_lapb_receive_frame+0x19d/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5551 [inline] netif_receive_skb_core+0x149/0x210 net/core/dev.c:5576 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x430 net/core/dev.c:7101 napi_poll net/core/dev.c:7168 [inline] net_rx_action+0x522/0xa80 net/core/dev.c:7258 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 3f b1 87 f7 65 8b 05 70 c7 37 76 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc90003eff5e0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: d660cb6a23003a00 RDX: dffffc0000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000000001 RBP: ffffc90003eff670 R08: ffffffff901f1177 R09: 1ffffffff203e22e R10: dffffc0000000000 R11: fffffbfff203e22f R12: dffffc0000000000 R13: 0000000000000000 R14: ffff88802a0bc6c0 R15: 1ffff920007dfebc spin_unlock_irqrestore include/linux/spinlock.h:419 [inline] __wake_up_common_lock kernel/sched/wait.c:140 [inline] __wake_up_sync_key+0x128/0x190 kernel/sched/wait.c:205 __unix_dgram_recvmsg+0x4b1/0xd50 net/unix/af_unix.c:2342 ____sys_recvmsg+0x2ca/0x5b0 net/socket.c:-1 ___sys_recvmsg+0x213/0x5c0 net/socket.c:2707 do_recvmmsg+0x360/0x7f0 net/socket.c:2801 __sys_recvmmsg net/socket.c:2880 [inline] __do_sys_recvmmsg net/socket.c:2903 [inline] __se_sys_recvmmsg net/socket.c:2896 [inline] __x64_sys_recvmmsg+0x195/0x250 net/socket.c:2896 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f89ce75b159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f89cc992028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f89ce9e3090 RCX: 00007f89ce75b159 RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007f89ce7f206b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f89ce9e3128 R14: 00007f89ce9e3090 R15: 00007ffef953f628 wireguard: wg1: Handshake for peer 33 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 3) net_ratelimit: 7 callbacks suppressed wireguard: wg1: Sending keepalive packet to peer 34 (127.0.0.1:20003) wireguard: wg0: Sending keepalive packet to peer 32 ([::1]:20003/0%0) wireguard: wg1: Sending keepalive packet to peer 33 ([::1]:20001/0%0) virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffffffff966b5cd8 is addr:169.254.221.105 for cmd:0 at entry:ffff888062b78700 virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 wireguard: wg1: Receiving keepalive packet from peer 15 ([::1]:20001/0%0) wireguard: wg0: Handshake for peer 32 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2) virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 wireguard: wg1: Receiving keepalive packet from peer 15 ([::1]:20001/0%0) virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffffffff966b5cd8 is addr:169.254.217.32 for cmd:0 at entry:ffff88805f533780 virtqueue callback for ffff88814741c300 (ffffffff8444ab50) virtqueue interrupt with no work for ffff88814741c200 virtqueue interrupt with no work for ffff88814741c100 wireguard: wg0: Handshake for peer 32 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 3) ---------------- Code disassembly (best guess): 0: c7 44 24 20 00 00 00 movl $0x0,0x20(%rsp) 7: 00 8: 9c pushf 9: 8f 44 24 20 pop 0x20(%rsp) d: f7 44 24 20 00 02 00 testl $0x200,0x20(%rsp) 14: 00 15: 41 c6 04 07 f8 movb $0xf8,(%r15,%rax,1) 1a: 75 4b jne 0x67 1c: f7 c3 00 02 00 00 test $0x200,%ebx 22: 74 01 je 0x25 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 3f b1 87 f7 call 0xf787b16e <-- trapping instruction 2f: 65 8b 05 70 c7 37 76 mov %gs:0x7637c770(%rip),%eax # 0x7637c7a6 36: 85 c0 test %eax,%eax 38: 74 3c je 0x76 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: 04 24 add $0x24,%al 3e: 0e (bad) 3f: 36 ss