================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz.0.0/5318 [HC0[0]:SC1[3]:HE1:SE0] takes:
ffffffff8ee927e0 (fs_reclaim){+.?.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline]
ffffffff8ee927e0 (fs_reclaim){+.?.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4636 [inline]
ffffffff8ee927e0 (fs_reclaim){+.?.}-{0:0}, at: slab_alloc_node mm/slub.c:4974 [inline]
ffffffff8ee927e0 (fs_reclaim){+.?.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x5f/0x610 mm/slub.c:5068
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
  __fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
  fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4389
  might_alloc include/linux/sched/mm.h:316 [inline]
  xa_alloc include/linux/xarray.h:876 [inline]
  mem_cgroup_alloc mm/memcontrol.c:4160 [inline]
  mem_cgroup_css_alloc+0xa2/0x1970 mm/memcontrol.c:4225
  cgroup_init_subsys+0x114/0x630 kernel/cgroup/cgroup.c:6434
  cgroup_init+0x72e/0xbf0 kernel/cgroup/cgroup.c:6561
  start_kernel+0x379/0x3e0 init/main.c:1181
  x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
  x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
  common_startup_64+0x13e/0x157
irq event stamp: 1696
hardirqs last  enabled at (1696): [<ffffffff8188f096>] __local_bh_enable_ip+0xd6/0x140 kernel/softirq.c:478
hardirqs last disabled at (1695): [<ffffffff8188f032>] __local_bh_enable_ip+0x72/0x140 kernel/softirq.c:455
softirqs last  enabled at (1676): [<ffffffff89b45c6b>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last  enabled at (1676): [<ffffffff89b45c6b>] rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
softirqs last  enabled at (1676): [<ffffffff89b45c6b>] __dev_queue_xmit+0x29b/0x3820 net/core/dev.c:4844
softirqs last disabled at (1677): [<ffffffff8188f187>] do_softirq+0x77/0xd0 kernel/softirq.c:546

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(fs_reclaim);
  <Interrupt>
    lock(fs_reclaim);

 *** DEADLOCK ***

locks held by syz.0.0/5318: 8, last CPU#0:
 #0: ffff888012ccea60 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff888012ccea60 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x21/0x50 net/ipv4/tcp.c:1450
 #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x65/0x1b10 net/ipv4/ip_output.c:476
 #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 net/ipv4/ip_output.c:432
 #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x10b0 net/ipv4/ip_output.c:229
 #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: local_lock_acquire include/linux/local_lock_internal.h:46 [inline]
 #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 net/core/dev.c:6725
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: ip_local_deliver_finish+0x2ae/0x6f0 net/ipv4/ip_input.c:240
 #6: ffff888012ccdce8 (slock-AF_INET/1){+.-.}-{3:3}, at: tcp_v4_rcv+0x26e7/0x3170 net/ipv4/tcp_ipv4.c:2244
 #7: ffff888012ccdf08 (clock-AF_INET){++.-}-{3:3}, at: psock_data_ready+0xaa/0x250 net/kcm/kcmsock.c:358

stack backtrace:
CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_usage_bug+0x28c/0x2e0 kernel/locking/lockdep.c:4086
 valid_state+0xbe/0xf0 kernel/locking/lockdep.c:4100
 mark_lock_irq+0x36/0x380 kernel/locking/lockdep.c:4311
 mark_lock+0x117/0x190 kernel/locking/lockdep.c:4797
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0x71e/0x2de0 kernel/locking/lockdep.c:5242
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
 fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4389
 might_alloc include/linux/sched/mm.h:316 [inline]
 slab_pre_alloc_hook mm/slub.c:4636 [inline]
 slab_alloc_node mm/slub.c:4974 [inline]
 kmem_cache_alloc_node_noprof+0x5f/0x610 mm/slub.c:5068
 __alloc_skb+0x1db/0x7a0 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xc6/0x760 net/core/skbuff.c:6799
 tls_alloc_clrtxt_skb net/tls/tls_sw.c:1230 [inline]
 tls_decrypt_sg+0x3e8/0x3110 net/tls/tls_sw.c:1302
 tls_decrypt_sw net/tls/tls_sw.c:1448 [inline]
 tls_rx_one_record+0x209/0x1950 net/tls/tls_sw.c:1574
 tls_sw_read_sock+0x812/0x10e0 net/tls/tls_sw.c:2118
 strp_read_sock net/strparser/strparser.c:-1 [inline]
 strp_data_ready+0x415/0x5c0 net/strparser/strparser.c:402
 psock_data_ready+0xe0/0x250 net/kcm/kcmsock.c:362
 tcp_data_queue+0x1e94/0x5fa0 net/ipv4/tcp_input.c:5694
 tcp_rcv_established+0xb05/0x2940 net/ipv4/tcp_input.c:6690
 tcp_v4_do_rcv+0x727/0x13b0 net/ipv4/tcp_ipv4.c:1854
 tcp_v4_rcv+0x27d4/0x3170 net/ipv4/tcp_ipv4.c:2248
 ip_protocol_deliver_rcu+0x21d/0x440 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325
 __netif_receive_skb_one_core net/core/dev.c:6265 [inline]
 __netif_receive_skb net/core/dev.c:6378 [inline]
 process_backlog+0xa6b/0x18b0 net/core/dev.c:6729
 __napi_poll+0xaa/0x330 net/core/dev.c:7798
 napi_poll net/core/dev.c:7861 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8018
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4961
 dev_queue_xmit include/linux/netdevice.h:3461 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x2d6b/0x4820 net/ipv4/tcp_output.c:1717
 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
 tcp_write_xmit+0x1bfa/0x6400 net/ipv4/tcp_output.c:3062
 __tcp_push_pending_frames+0x96/0x380 net/ipv4/tcp_output.c:3245
 tcp_sendmsg_locked+0x47dc/0x54a0 net/ipv4/tcp.c:1414
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1451
 sock_sendmsg_nosec+0x10e/0x180 net/socket.c:801
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x408/0x5a0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2284
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f91d879e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f91d95edfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f91d8a25fa0 RCX: 00007f91d879e159
RDX: 0000000000000025 RSI: 0000200000000400 RDI: 0000000000000004
RBP: 00007f91d883506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f91d8a26038 R14: 00007f91d8a25fa0 R15: 00007fff53dc0298
 </TASK>
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5318, name: syz.0.0
preempt_count: 303, expected: 0
RCU nest depth: 5, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff89b45c78>] local_bh_disable include/linux/bottom_half.h:20 [inline]
[<ffffffff89b45c78>] rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
[<ffffffff89b45c78>] __dev_queue_xmit+0x2a8/0x3820 net/core/dev.c:4844
CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264
 might_alloc include/linux/sched/mm.h:322 [inline]
 slab_pre_alloc_hook mm/slub.c:4636 [inline]
 slab_alloc_node mm/slub.c:4974 [inline]
 kmem_cache_alloc_node_noprof+0x92/0x610 mm/slub.c:5068
 __alloc_skb+0x1db/0x7a0 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xc6/0x760 net/core/skbuff.c:6799
 tls_alloc_clrtxt_skb net/tls/tls_sw.c:1230 [inline]
 tls_decrypt_sg+0x3e8/0x3110 net/tls/tls_sw.c:1302
 tls_decrypt_sw net/tls/tls_sw.c:1448 [inline]
 tls_rx_one_record+0x209/0x1950 net/tls/tls_sw.c:1574
 tls_sw_read_sock+0x812/0x10e0 net/tls/tls_sw.c:2118
 strp_read_sock net/strparser/strparser.c:-1 [inline]
 strp_data_ready+0x415/0x5c0 net/strparser/strparser.c:402
 psock_data_ready+0xe0/0x250 net/kcm/kcmsock.c:362
 tcp_data_queue+0x1e94/0x5fa0 net/ipv4/tcp_input.c:5694
 tcp_rcv_established+0xb05/0x2940 net/ipv4/tcp_input.c:6690
 tcp_v4_do_rcv+0x727/0x13b0 net/ipv4/tcp_ipv4.c:1854
 tcp_v4_rcv+0x27d4/0x3170 net/ipv4/tcp_ipv4.c:2248
 ip_protocol_deliver_rcu+0x21d/0x440 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325
 __netif_receive_skb_one_core net/core/dev.c:6265 [inline]
 __netif_receive_skb net/core/dev.c:6378 [inline]
 process_backlog+0xa6b/0x18b0 net/core/dev.c:6729
 __napi_poll+0xaa/0x330 net/core/dev.c:7798
 napi_poll net/core/dev.c:7861 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8018
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4961
 dev_queue_xmit include/linux/netdevice.h:3461 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x2d6b/0x4820 net/ipv4/tcp_output.c:1717
 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
 tcp_write_xmit+0x1bfa/0x6400 net/ipv4/tcp_output.c:3062
 __tcp_push_pending_frames+0x96/0x380 net/ipv4/tcp_output.c:3245
 tcp_sendmsg_locked+0x47dc/0x54a0 net/ipv4/tcp.c:1414
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1451
 sock_sendmsg_nosec+0x10e/0x180 net/socket.c:801
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x408/0x5a0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2284
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f91d879e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f91d95edfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f91d8a25fa0 RCX: 00007f91d879e159
RDX: 0000000000000025 RSI: 0000200000000400 RDI: 0000000000000004
RBP: 00007f91d883506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f91d8a26038 R14: 00007f91d8a25fa0 R15: 00007fff53dc0298
 </TASK>