================================ WARNING: inconsistent lock state 6.1.0-rc6-syzkaller-32662-g6d464646530f #0 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage. syz-executor.2/5804 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff0000cb177438 (clock-AF_INET6){+++-}-{2:2}, at: l2tp_tunnel_register+0x354/0x79c net/l2tp/l2tp_core.c:1477 {IN-SOFTIRQ-R} state was registered at: lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline] _raw_read_lock_bh+0x64/0x7c kernel/locking/spinlock.c:252 rds_tcp_data_ready+0x3c/0x2d0 net/rds/tcp_recv.c:314 tcp_data_ready+0x124/0x1b8 net/ipv4/tcp_input.c:5005 tcp_data_queue+0xe48/0x1148 net/ipv4/tcp_input.c:5079 tcp_rcv_established+0x6a0/0xa64 net/ipv4/tcp_input.c:6005 tcp_v6_do_rcv+0x54c/0x788 net/ipv6/tcp_ipv6.c:1502 tcp_v6_rcv+0xea8/0x1008 net/ipv6/tcp_ipv6.c:1761 ip6_protocol_deliver_rcu+0x4d0/0x83c net/ipv6/ip6_input.c:439 ip6_input_finish+0xe0/0x188 net/ipv6/ip6_input.c:484 NF_HOOK include/linux/netfilter.h:302 [inline] ip6_input+0x68/0x8c net/ipv6/ip6_input.c:493 dst_input include/net/dst.h:455 [inline] ip6_rcv_finish+0x138/0x158 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:302 [inline] ipv6_rcv+0x88/0xb8 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core net/core/dev.c:5489 [inline] __netif_receive_skb+0x70/0x14c net/core/dev.c:5603 process_backlog+0x240/0x388 net/core/dev.c:5931 __napi_poll+0x5c/0x24c net/core/dev.c:6498 napi_poll+0x110/0x484 net/core/dev.c:6565 net_rx_action+0x18c/0x414 net/core/dev.c:6676 _stext+0x168/0x37c ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 do_softirq+0xac/0x108 kernel/softirq.c:472 __local_bh_enable_ip+0x18c/0x1a4 kernel/softirq.c:396 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:808 [inline] ip6_finish_output2+0xa1c/0xbec net/ipv6/ip6_output.c:135 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x448/0x4c4 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0x180/0x2dc net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:445 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] ip6_xmit+0x888/0xb88 net/ipv6/ip6_output.c:343 inet6_csk_xmit+0x1e8/0x30c net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0xaf4/0xe60 net/ipv4/tcp_output.c:1402 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] tcp_write_xmit+0x84c/0x1938 net/ipv4/tcp_output.c:2696 tcp_push_one+0x68/0x8c net/ipv4/tcp_output.c:2894 do_tcp_sendpages+0x52c/0x7fc net/ipv4/tcp.c:1096 tcp_sendpage_locked net/ipv4/tcp.c:1141 [inline] tcp_sendpage+0x94/0xbc net/ipv4/tcp.c:1151 inet_sendpage+0xd0/0x164 net/ipv4/af_inet.c:844 kernel_sendpage net/socket.c:3561 [inline] sock_sendpage+0x8c/0xe8 net/socket.c:1054 pipe_to_sendpage+0xc0/0x104 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe+0x140/0x31c fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x78/0xbc fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x4c/0xe0 fs/splice.c:931 splice_direct_to_actor+0x1dc/0x3e4 fs/splice.c:886 do_splice_direct+0xc4/0x14c fs/splice.c:974 do_sendfile+0x298/0x68c fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __arm64_sys_sendfile64+0xb0/0x230 fs/read_write.c:1309 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 irq event stamp: 203 hardirqs last enabled at (203): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (203): [] _raw_spin_unlock_irqrestore+0x48/0x8c kernel/locking/spinlock.c:194 hardirqs last disabled at (202): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (202): [] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162 softirqs last enabled at (200): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (198): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock( clock-AF_INET6 ); lock( clock-AF_INET6 ); *** DEADLOCK *** 1 lock held by syz-executor.2/5804: #0: ffff000106c46130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1721 [inline] (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0x184/0x6c4 net/l2tp/l2tp_ppp.c:675 stack backtrace: CPU: 1 PID: 5804 Comm: syz-executor.2 Tainted: G W 6.1.0-rc6-syzkaller-32662-g6d464646530f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156 show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106 dump_stack+0x1c/0x58 lib/dump_stack.c:113 print_usage_bug+0x39c/0x3cc kernel/locking/lockdep.c:3963 mark_lock_irq+0x4a8/0x4b4 mark_lock+0x154/0x1b4 kernel/locking/lockdep.c:4634 __lock_acquire+0x618/0x3084 kernel/locking/lockdep.c:5009 lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668 __raw_write_lock include/linux/rwlock_api_smp.h:209 [inline] _raw_write_lock+0x54/0x6c kernel/locking/spinlock.c:300 l2tp_tunnel_register+0x354/0x79c net/l2tp/l2tp_core.c:1477 pppol2tp_connect+0x3e8/0x6c4 net/l2tp/l2tp_ppp.c:723 __sys_connect_file net/socket.c:1976 [inline] __sys_connect+0x184/0x190 net/socket.c:1993 __do_sys_connect net/socket.c:2003 [inline] __se_sys_connect net/socket.c:2000 [inline] __arm64_sys_connect+0x28/0x3c net/socket.c:2000 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584