================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. kworker/u4:16/4536 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888053894648 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0x109/0xac0 kernel/workqueue.c:3072 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 process_one_work+0x7ec/0x1160 kernel/workqueue.c:2268 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 irq event stamp: 5293094 hardirqs last enabled at (5293094): [] __cancel_work_timer+0x36a/0x560 kernel/workqueue.c:3156 hardirqs last disabled at (5293093): [] try_to_grab_pending+0xfa/0x890 kernel/workqueue.c:1267 softirqs last enabled at (5293008): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (5293008): [] fib6_run_gc+0x1e1/0x2a0 net/ipv6/ip6_fib.c:2349 softirqs last disabled at (5293029): [] __do_softirq kernel/softirq.c:630 [inline] softirqs last disabled at (5293029): [] invoke_softirq kernel/softirq.c:470 [inline] softirqs last disabled at (5293029): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((work_completion)(&(&host->detect)->work)); lock((work_completion)(&(&host->detect)->work)); *** DEADLOCK *** 6 locks held by kworker/u4:16/4536: #0: ffff88801761e938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90004f6fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd4fa90 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:594 #3: ffff8880553602f8 (&devlink->lock_key#13){+.+.}-{3:3}, at: devlink_pernet_pre_exit+0x104/0x280 net/devlink/leftover.c:12502 #4: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3b/0x150 drivers/net/netdevsim/netdev.c:381 #5: ffffc900001e0bc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698 stack backtrace: CPU: 1 PID: 4536 Comm: kworker/u4:16 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: netns cleanup_net Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3974 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4177 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4633 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xce0/0x7c40 kernel/locking/lockdep.c:5017 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 __flush_work+0x122/0xac0 kernel/workqueue.c:3072 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:672 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x291/0x910 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:lockdep_unregister_key+0x4e8/0x550 kernel/locking/lockdep.c:6384 Code: 31 ac 90 48 c7 c6 30 b2 64 81 e8 73 a5 07 00 e8 be b8 07 00 e9 5c fc ff ff e8 44 96 cc 08 41 f7 c4 00 02 00 00 74 d1 fb 84 db <75> d0 eb e1 0f 0b eb 88 0f 0b e9 f8 fe ff ff 0f 0b e9 45 ff ff ff RSP: 0018:ffffc90004f6f4e0 EFLAGS: 00000202 RAX: dffffc0000000000 RBX: ffff88805836ba01 RCX: 65cab3831ec66400 RDX: 0000000000000001 RSI: ffffffff8a8c2580 RDI: ffffffff8adf6420 RBP: ffffc90004f6f5c0 R08: ffffffff90ae521f R09: 1ffffffff215ca43 R10: dffffc0000000000 R11: fffffbfff215ca44 R12: 0000000000000a03 R13: ffff88805836ba99 R14: ffffffff90ae31a8 R15: 1ffff920009edea0 __qdisc_destroy+0x128/0x430 net/sched/sch_generic.c:1081 qdisc_put net/sched/sch_generic.c:1107 [inline] dev_shutdown+0x351/0x440 net/sched/sch_generic.c:1468 unregister_netdevice_many_notify+0xa7e/0x1990 net/core/dev.c:11014 unregister_netdevice_many net/core/dev.c:11077 [inline] unregister_netdevice_queue+0x2e5/0x330 net/core/dev.c:10960 unregister_netdevice include/linux/netdevice.h:3077 [inline] nsim_destroy+0x49/0x150 drivers/net/netdevsim/netdev.c:382 __nsim_dev_port_del+0x155/0x1c0 drivers/net/netdevsim/dev.c:1433 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1445 [inline] nsim_dev_reload_destroy+0x283/0x480 drivers/net/netdevsim/dev.c:1663 nsim_dev_reload_down+0x86/0xb0 drivers/net/netdevsim/dev.c:968 devlink_reload+0x202/0x690 net/devlink/leftover.c:4472 devlink_pernet_pre_exit+0x122/0x280 net/devlink/leftover.c:12503 ops_pre_exit_list net/core/net_namespace.c:162 [inline] cleanup_net+0x58e/0xba0 net/core/net_namespace.c:620 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 BUG: sleeping function called from invalid context at kernel/workqueue.c:3013 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4536, name: kworker/u4:16 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:434 [inline] [] handle_softirqs+0xfd/0x910 kernel/softirq.c:572 CPU: 1 PID: 4536 Comm: kworker/u4:16 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: netns cleanup_net Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 __might_resched+0x489/0x5f0 kernel/sched/core.c:9970 start_flush_work kernel/workqueue.c:3013 [inline] __flush_work+0x142/0xac0 kernel/workqueue.c:3075 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:672 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x291/0x910 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:lockdep_unregister_key+0x4e8/0x550 kernel/locking/lockdep.c:6384 Code: 31 ac 90 48 c7 c6 30 b2 64 81 e8 73 a5 07 00 e8 be b8 07 00 e9 5c fc ff ff e8 44 96 cc 08 41 f7 c4 00 02 00 00 74 d1 fb 84 db <75> d0 eb e1 0f 0b eb 88 0f 0b e9 f8 fe ff ff 0f 0b e9 45 ff ff ff RSP: 0018:ffffc90004f6f4e0 EFLAGS: 00000202 RAX: dffffc0000000000 RBX: ffff88805836ba01 RCX: 65cab3831ec66400 RDX: 0000000000000001 RSI: ffffffff8a8c2580 RDI: ffffffff8adf6420 RBP: ffffc90004f6f5c0 R08: ffffffff90ae521f R09: 1ffffffff215ca43 R10: dffffc0000000000 R11: fffffbfff215ca44 R12: 0000000000000a03 R13: ffff88805836ba99 R14: ffffffff90ae31a8 R15: 1ffff920009edea0 __qdisc_destroy+0x128/0x430 net/sched/sch_generic.c:1081 qdisc_put net/sched/sch_generic.c:1107 [inline] dev_shutdown+0x351/0x440 net/sched/sch_generic.c:1468 unregister_netdevice_many_notify+0xa7e/0x1990 net/core/dev.c:11014 unregister_netdevice_many net/core/dev.c:11077 [inline] unregister_netdevice_queue+0x2e5/0x330 net/core/dev.c:10960 unregister_netdevice include/linux/netdevice.h:3077 [inline] nsim_destroy+0x49/0x150 drivers/net/netdevsim/netdev.c:382 __nsim_dev_port_del+0x155/0x1c0 drivers/net/netdevsim/dev.c:1433 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1445 [inline] nsim_dev_reload_destroy+0x283/0x480 drivers/net/netdevsim/dev.c:1663 nsim_dev_reload_down+0x86/0xb0 drivers/net/netdevsim/dev.c:968 devlink_reload+0x202/0x690 net/devlink/leftover.c:4472 devlink_pernet_pre_exit+0x122/0x280 net/devlink/leftover.c:12503 ops_pre_exit_list net/core/net_namespace.c:162 [inline] cleanup_net+0x58e/0xba0 net/core/net_namespace.c:620 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ODEBUG: object ffffc900001e09a0 is NOT on stack ffffc90004f68000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4536 at lib/debugobjects.c:558 debug_object_is_on_stack lib/debugobjects.c:-1 [inline] WARNING: CPU: 1 PID: 4536 at lib/debugobjects.c:558 lookup_object_or_alloc lib/debugobjects.c:591 [inline] WARNING: CPU: 1 PID: 4536 at lib/debugobjects.c:558 __debug_object_init+0x18e/0x440 lib/debugobjects.c:672 Modules linked in: CPU: 1 PID: 4536 Comm: kworker/u4:16 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: netns cleanup_net RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:558 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:591 [inline] RIP: 0010:__debug_object_init+0x18e/0x440 lib/debugobjects.c:672 Code: 24 04 74 2f 41 ff c6 44 89 35 9e ed dd 12 48 c7 c1 c0 6c df 8a 48 c7 c7 20 6d df 8a 84 c0 48 0f 45 f9 48 89 de e8 32 bd 0b 06 <0f> 0b eb 05 4c 8b 7c 24 18 4d 8d 65 10 4d 89 e6 49 c1 ee 03 41 0f RSP: 0018:ffffc900001e0908 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc900001e09a0 RCX: 65cab3831ec66400 RDX: 0000000000000100 RSI: 0000000000000101 RDI: 0000000000000000 RBP: dffffc0000000000 R08: ffffc900001e0587 R09: 1ffff9200003c0b0 R10: dffffc0000000000 R11: fffff5200003c0b1 R12: ffff888030823c20 R13: ffff888030a17e38 R14: 0000000000000001 R15: ffffffff8a8d3120 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2fb22ff6 CR3: 000000000c88e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000006800 DR2: 0000000000009951 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __synchronize_srcu+0x227/0x350 kernel/rcu/srcutree.c:1241 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x112/0x190 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x43/0xf0 drivers/mmc/core/host.c:77 device_release+0x92/0x1c0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x217/0x450 lib/kobject.c:729 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x291/0x910 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:lockdep_unregister_key+0x4e8/0x550 kernel/locking/lockdep.c:6384 Code: 31 ac 90 48 c7 c6 30 b2 64 81 e8 73 a5 07 00 e8 be b8 07 00 e9 5c fc ff ff e8 44 96 cc 08 41 f7 c4 00 02 00 00 74 d1 fb 84 db <75> d0 eb e1 0f 0b eb 88 0f 0b e9 f8 fe ff ff 0f 0b e9 45 ff ff ff RSP: 0018:ffffc90004f6f4e0 EFLAGS: 00000202 RAX: dffffc0000000000 RBX: ffff88805836ba01 RCX: 65cab3831ec66400 RDX: 0000000000000001 RSI: ffffffff8a8c2580 RDI: ffffffff8adf6420 RBP: ffffc90004f6f5c0 R08: ffffffff90ae521f R09: 1ffffffff215ca43 R10: dffffc0000000000 R11: fffffbfff215ca44 R12: 0000000000000a03 R13: ffff88805836ba99 R14: ffffffff90ae31a8 R15: 1ffff920009edea0 __qdisc_destroy+0x128/0x430 net/sched/sch_generic.c:1081 qdisc_put net/sched/sch_generic.c:1107 [inline] dev_shutdown+0x351/0x440 net/sched/sch_generic.c:1468 unregister_netdevice_many_notify+0xa7e/0x1990 net/core/dev.c:11014 unregister_netdevice_many net/core/dev.c:11077 [inline] unregister_netdevice_queue+0x2e5/0x330 net/core/dev.c:10960 unregister_netdevice include/linux/netdevice.h:3077 [inline] nsim_destroy+0x49/0x150 drivers/net/netdevsim/netdev.c:382 __nsim_dev_port_del+0x155/0x1c0 drivers/net/netdevsim/dev.c:1433 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1445 [inline] nsim_dev_reload_destroy+0x283/0x480 drivers/net/netdevsim/dev.c:1663 nsim_dev_reload_down+0x86/0xb0 drivers/net/netdevsim/dev.c:968 devlink_reload+0x202/0x690 net/devlink/leftover.c:4472 devlink_pernet_pre_exit+0x122/0x280 net/devlink/leftover.c:12503 ops_pre_exit_list net/core/net_namespace.c:162 [inline] cleanup_net+0x58e/0xba0 net/core/net_namespace.c:620 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 31 ac 90 48 c7 c6 30 xor %ebp,0x30c6c748(%rax,%rdx,4) 7: b2 64 mov $0x64,%dl 9: 81 e8 73 a5 07 00 sub $0x7a573,%eax f: e8 be b8 07 00 call 0x7b8d2 14: e9 5c fc ff ff jmp 0xfffffc75 19: e8 44 96 cc 08 call 0x8cc9662 1e: 41 f7 c4 00 02 00 00 test $0x200,%r12d 25: 74 d1 je 0xfffffff8 27: fb sti 28: 84 db test %bl,%bl * 2a: 75 d0 jne 0xfffffffc <-- trapping instruction 2c: eb e1 jmp 0xf 2e: 0f 0b ud2 30: eb 88 jmp 0xffffffba 32: 0f 0b ud2 34: e9 f8 fe ff ff jmp 0xffffff31 39: 0f 0b ud2 3b: e9 45 ff ff ff jmp 0xffffff85