ci2 starts bisection 2026-06-24 22:25:18.494576062 +0000 UTC m=+38667.179497388 bisecting fixing commit since 7c87defbd336df289c8c0280f019647864ff70c6 building syzkaller on 303e2802d4760a2024848e19b613070c0df2a791 ensuring issue is reproducible on original commit 7c87defbd336df289c8c0280f019647864ff70c6 testing commit 7c87defbd336df289c8c0280f019647864ff70c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 4304da891fc361abe1405f523afdf76697b1cf06eac72f15d34a9b59a295ed96 all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] check whether we can drop unnecessary instrumentation disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit 7c87defbd336df289c8c0280f019647864ff70c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 2b3c2671d2b52350cfd454e6738a4e9d4706cee9c66e10c21f6f5cbd085780d2 all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] the bug reproduces without the instrumentation disabling configs for [bug_or_warning kasan atomic_sleep hang memleak ubsan], they are not needed kconfig minimization: base=7505 full=9786 leaves diff=2008 split chunks (needed=false): <2008> split chunk #0 of len 2008 into 5 parts testing without sub-chunk 1/5 disabling configs for [bug_or_warning kasan atomic_sleep hang memleak ubsan], they are not needed testing commit 7c87defbd336df289c8c0280f019647864ff70c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: d0646a38d97a24087d88f073f429d5d8857ed975337af0c6c28ac8062b0a84c4 run #0: crashed: inconsistent lock state in __sk_receive_skb run #1: crashed: inconsistent lock state in __sk_receive_skb run #2: crashed: inconsistent lock state in __sk_receive_skb run #3: ignore: lost connection to test machine run #4: crashed: inconsistent lock state in __sk_receive_skb run #5: crashed: inconsistent lock state in __sk_receive_skb run #6: crashed: inconsistent lock state in __sk_receive_skb run #7: crashed: inconsistent lock state in __sk_receive_skb run #8: crashed: inconsistent lock state in __sk_receive_skb run #9: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan bug_or_warning kasan atomic_sleep], they are not needed testing commit 7c87defbd336df289c8c0280f019647864ff70c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: a11dbe372b74258df92f91dd3f476c66c842eb8fe03250a2b540ba8e1ebce43f all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit 7c87defbd336df289c8c0280f019647864ff70c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 9c68ae3b6d410e6d8cac268512f2ea78253203c768a98e6b3fe43b18d8c22dc0 all runs: OK false negative chance: 0.000 testing without sub-chunk 4/5 disabling configs for [memleak ubsan bug_or_warning kasan atomic_sleep hang], they are not needed testing commit 7c87defbd336df289c8c0280f019647864ff70c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: ce00f0e6ee8e2f08b5eef940ff5ef83562cf874667555816d1c87bdd9780e68e all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit 7c87defbd336df289c8c0280f019647864ff70c6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 3cb3e1eb7163cbbec5a8b2c8ddd55b9808eee561f1a35787bd8035a3328efbb7 all runs: OK false negative chance: 0.000 minimized to 802 configs; suspects: [ATM AX25 BCMA BLK_DEV_ZONED CFG80211 CFG80211_WEXT CRYPTO_842 CRYPTO_LZ4 CRYPTO_LZ4HC CRYPTO_LZO CRYPTO_ZSTD DLM DRM DRM_NOUVEAU FSCACHE HAMRADIO HID_NINTENDO HID_ZEROPLUS HSR INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_USER_ACCESS INPUT_JOYSTICK INPUT_MOUSE INPUT_TOUCHSCREEN IP6_NF_RAW IPV6_MULTIPLE_TABLES IP_ADVANCED_ROUTER IP_MULTIPLE_TABLES IP_NF_RAW IP_SET ISDN ISO9660_FS JFFS2_FS JFFS2_RTIME JFFS2_RUBIN JFFS2_SUMMARY JFFS2_ZLIB JFS_DEBUG JFS_FS JFS_POSIX_ACL JFS_SECURITY JOLIET JOYSTICK_IFORCE JOYSTICK_IFORCE_USB JOYSTICK_PXRC JOYSTICK_XPAD JOYSTICK_XPAD_FF JOYSTICK_XPAD_LEDS KARMA_PARTITION KCOV KCOV_ENABLE_COMPARISONS KCOV_INSTRUMENT_ALL KEYS_REQUEST_CACHE KEY_DH_OPERATIONS KEY_NOTIFICATIONS L2TP L2TP_ETH L2TP_IP L2TP_V3 LAPB LAPBETHER LDM_PARTITION LEDS_TRIGGER_AUDIO LLC2 LOGIG940_FF LOGIRUMBLEPAD2_FF LOGITECH_FF LOGIWHEELS_FF LOGO_LINUX_MONO LOGO_LINUX_VGA16 LPC_ICH LWTUNNEL LWTUNNEL_BPF LZ4HC_COMPRESS LZ4_COMPRESS MAC80211 MAC80211_DEBUGFS MAC80211_HAS_RC MAC80211_HWSIM MAC80211_MESH MAC80211_RC_DEFAULT_MINSTREL MAC80211_RC_MINSTREL MACSEC MAC_PARTITION MDIO_MVUSB MD_LINEAR MD_MULTIPATH MD_RAID0 MD_RAID1 MD_RAID10 MD_RAID456 MEDIA_CEC_SUPPORT MEDIA_CONTROLLER_DVB MEDIA_RADIO_SUPPORT MEDIA_TEST_SUPPORT MEDIA_TUNER_MSI001 MEMORY_HOTPLUG_DEFAULT_ONLINE MEMSTICK MEMSTICK_REALTEK_USB MFD_MT6370 MFD_VIPERBOARD MHI_WWAN_CTRL MINIX_FS MINIX_SUBPARTITION MISC_RTSX MISC_RTSX_USB MISDN MISDN_DSP MISDN_HFCUSB MISDN_L1OIP MKISS MLX4_INFINIBAND MMC_REALTEK_USB MMC_USHC MMC_VUB300 MODULE_FORCE_UNLOAD MODULE_SRCVERSION_ALL MODVERSIONS MOST MOST_USB_HDM MOUSE_APPLETOUCH MOUSE_BCM5974 MOUSE_PS2 MOUSE_PS2_ALPS MOUSE_PS2_BYD MOUSE_PS2_CYPRESS MOUSE_PS2_FOCALTECH MOUSE_PS2_LOGIPS2PP MOUSE_PS2_SMBUS MOUSE_PS2_SYNAPTICS MOUSE_PS2_SYNAPTICS_SMBUS MOUSE_PS2_TRACKPOINT MOUSE_SYNAPTICS_USB MPLS MPLS_IPTUNNEL MPLS_ROUTING MPTCP MPTCP_IPV6 MSDOS_FS MTD_BLOCK2MTD MTD_MTDRAM MTD_PHRAM MTD_SLRAM MTD_UBI MUSB_PIO_ONLY NETCONSOLE NETDEVSIM NETFILTER_FAMILY_ARP NETFILTER_NETLINK NETFILTER_NETLINK_ACCT NETFILTER_NETLINK_GLUE_CT NETFILTER_NETLINK_LOG NETFILTER_NETLINK_OSF NETFILTER_NETLINK_QUEUE NETFILTER_SYNPROXY NETFILTER_XT_CONNMARK NETFILTER_XT_MATCH_BPF NETFILTER_XT_MATCH_CGROUP NETFILTER_XT_MATCH_CLUSTER NETFILTER_XT_MATCH_COMMENT NETFILTER_XT_MATCH_CONNBYTES NETFILTER_XT_MATCH_CONNLABEL NETFILTER_XT_MATCH_CONNLIMIT NETFILTER_XT_MATCH_CONNMARK NETFILTER_XT_MATCH_CPU NETFILTER_XT_MATCH_DCCP NETFILTER_XT_MATCH_DEVGROUP NETFILTER_XT_MATCH_DSCP NETFILTER_XT_MATCH_ECN NETFILTER_XT_MATCH_ESP NETFILTER_XT_MATCH_HASHLIMIT NETFILTER_XT_MATCH_HELPER NETFILTER_XT_MATCH_HL NETFILTER_XT_MATCH_IPCOMP NETFILTER_XT_MATCH_IPRANGE NETFILTER_XT_MATCH_L2TP NETFILTER_XT_MATCH_LENGTH NETFILTER_XT_MATCH_LIMIT NETFILTER_XT_MATCH_MAC NETFILTER_XT_MATCH_MARK NETFILTER_XT_MATCH_MULTIPORT NETFILTER_XT_MATCH_NFACCT NETFILTER_XT_MATCH_OSF NETFILTER_XT_MATCH_OWNER NETFILTER_XT_MATCH_PHYSDEV NETFILTER_XT_MATCH_PKTTYPE NETFILTER_XT_MATCH_POLICY NETFILTER_XT_MATCH_QUOTA NETFILTER_XT_MATCH_RATEEST NETFILTER_XT_MATCH_REALM NETFILTER_XT_MATCH_RECENT NETFILTER_XT_MATCH_SCTP NETFILTER_XT_MATCH_SOCKET NETFILTER_XT_MATCH_STATE NETFILTER_XT_MATCH_STATISTIC NETFILTER_XT_MATCH_STRING NETFILTER_XT_MATCH_TCPMSS NETFILTER_XT_MATCH_TIME NETFILTER_XT_MATCH_U32 NETFILTER_XT_SET NETFILTER_XT_TARGET_AUDIT NETFILTER_XT_TARGET_CLASSIFY NETFILTER_XT_TARGET_CONNMARK NETFILTER_XT_TARGET_CONNSECMARK NETFILTER_XT_TARGET_CT NETFILTER_XT_TARGET_DSCP NETFILTER_XT_TARGET_HL NETFILTER_XT_TARGET_HMARK NETFILTER_XT_TARGET_IDLETIMER NETFILTER_XT_TARGET_LED NETFILTER_XT_TARGET_MARK NETFILTER_XT_TARGET_NETMAP NETFILTER_XT_TARGET_NFLOG NETFILTER_XT_TARGET_NFQUEUE NETFILTER_XT_TARGET_NOTRACK NETFILTER_XT_TARGET_RATEEST NETFILTER_XT_TARGET_REDIRECT NETFILTER_XT_TARGET_SECMARK NETFILTER_XT_TARGET_TCPMSS NETFILTER_XT_TARGET_TCPOPTSTRIP NETFILTER_XT_TARGET_TEE NETFILTER_XT_TARGET_TPROXY NETFILTER_XT_TARGET_TRACE NETLABEL NETLINK_DIAG NETPOLL NETROM NETWORK_SECMARK NET_9P_RDMA NET_ACT_BPF NET_ACT_CONNMARK NET_ACT_CSUM NET_ACT_CT NET_ACT_CTINFO NET_ACT_IFE NET_ACT_IPT NET_ACT_MPLS NET_ACT_NAT NET_ACT_PEDIT NET_ACT_POLICE NET_ACT_SAMPLE NET_ACT_SIMP NET_ACT_SKBEDIT NET_ACT_SKBMOD NET_ACT_TUNNEL_KEY NET_ACT_VLAN NET_CLS_BPF NET_CLS_CGROUP NET_CLS_FLOW NET_CLS_FW NET_CLS_MATCHALL NET_CLS_ROUTE4 NET_DSA_TAG_MTK NET_DSA_TAG_QCA NET_DSA_TAG_RTL4_A NET_EMATCH NET_EMATCH_CANID NET_EMATCH_CMP NET_EMATCH_IPSET NET_EMATCH_IPT NET_EMATCH_META NET_EMATCH_NBYTE NET_EMATCH_TEXT NET_EMATCH_U32 NET_FC NET_FOU NET_FOU_IP_TUNNELS NET_IFE NET_IFE_SKBMARK NET_IFE_SKBPRIO NET_IFE_SKBTCINDEX NET_IPGRE NET_IPGRE_BROADCAST NET_IPGRE_DEMUX NET_IPIP NET_IPVTI NET_KEY NET_KEY_MIGRATE NET_L3_MASTER_DEV NET_MPLS_GSO NET_NCSI NET_NSH NET_POLL_CONTROLLER NET_REDIRECT NET_SCH_CAKE NET_SCH_CHOKE NET_SCH_CODEL NET_SCH_DRR NET_SCH_ETS NET_SCH_FQ NET_SCH_FQ_CODEL NET_SCH_FQ_PIE NET_SCH_GRED NET_SCH_HFSC NET_SCH_HHF NET_SCH_HTB NET_SCH_MULTIQ NET_SCH_NETEM NET_SCH_PIE NET_SCH_PLUG NET_SCH_PRIO NET_SCH_QFQ NET_SCH_RED NET_SCH_SFB NET_SCH_SFQ NET_SCH_SKBPRIO NET_SCH_TBF NET_SCH_TEQL NET_TC_SKB_EXT NET_TEAM NET_TEAM_MODE_ACTIVEBACKUP NET_TEAM_MODE_BROADCAST NET_TEAM_MODE_LOADBALANCE NET_TEAM_MODE_RANDOM NET_TEAM_MODE_ROUNDROBIN NET_UDP_TUNNEL NET_VRF NFC_DIGITAL NFC_FDP NFC_HCI NFC_MRVL NFC_MRVL_USB NFC_NCI_UART NFC_PN533 NFC_PN533_USB NFC_PORT100 NFC_SHDLC NFC_SIM NFC_VIRTUAL_NCI NFSD NFSD_BLOCKLAYOUT NFSD_FLEXFILELAYOUT NFSD_PNFS NFSD_SCSILAYOUT NFSD_V3_ACL NFSD_V4 NFSD_V4_2_INTER_SSC NFSD_V4_SECURITY_LABEL NFS_ACL_SUPPORT NFS_FSCACHE NFS_V3_ACL NFS_V4_2_READ_PLUS NFT_BRIDGE_META NFT_BRIDGE_REJECT NFT_COMPAT NFT_CONNLIMIT NFT_CT NFT_DUP_IPV4 NFT_DUP_IPV6 NFT_DUP_NETDEV NFT_FIB NFT_FIB_INET NFT_FIB_IPV4 NFT_FIB_IPV6 NFT_FIB_NETDEV NFT_FLOW_OFFLOAD NFT_HASH NFT_LIMIT NFT_LOG NFT_MASQ NFT_NAT NFT_NUMGEN NFT_OSF NFT_QUEUE NFT_QUOTA NFT_REDIR NFT_REJECT NFT_REJECT_INET NFT_REJECT_IPV4 NFT_REJECT_IPV6 NFT_REJECT_NETDEV NFT_SOCKET NFT_SYNPROXY NFT_TPROXY NFT_TUNNEL NFT_XFRM NF_CONNTRACK_AMANDA NF_CONNTRACK_BRIDGE NF_CONNTRACK_BROADCAST NF_CONNTRACK_H323 NF_CONNTRACK_IRC NF_CONNTRACK_LABELS NF_CONNTRACK_MARK NF_CONNTRACK_NETBIOS_NS NF_CONNTRACK_PPTP NF_CONNTRACK_SANE NF_CONNTRACK_SECMARK NF_CONNTRACK_SNMP NF_CONNTRACK_TFTP NF_CONNTRACK_TIMEOUT NF_CONNTRACK_TIMESTAMP NF_CONNTRACK_ZONES NF_CT_NETLINK NF_CT_NETLINK_HELPER NF_CT_NETLINK_TIMEOUT NF_CT_PROTO_GRE NF_DUP_IPV4 NF_DUP_IPV6 NF_DUP_NETDEV NF_FLOW_TABLE NF_FLOW_TABLE_INET NF_LOG_ARP NF_NAT_AMANDA NF_NAT_FTP NF_NAT_H323 NF_NAT_IRC NF_NAT_PPTP NF_NAT_REDIRECT NF_NAT_SIP NF_NAT_SNMP_BASIC NF_NAT_TFTP NF_SOCKET_IPV4 NF_SOCKET_IPV6 NF_TABLES NF_TABLES_ARP NF_TABLES_BRIDGE NF_TABLES_INET NF_TABLES_IPV4 NF_TABLES_IPV6 NF_TABLES_NETDEV NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NLMON NLS_ASCII NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UTF8 NOUVEAU_LEGACY_CTX_SUPPORT NOUVEAU_PLATFORM_DRIVER NOZOMI NO_HZ NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NTFS_FS NTFS_RW NULL_TTY NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS OCFS2_FS_USERSPACE_CLUSTER PARPORT PARTITION_ADVANCED PCCARD PCMCIA PHONET PSAMPLE RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RFKILL SERIAL_NONSTANDARD SND SOUND SSB TARGET_CORE TOOLS_SUPPORT_RELR TOUCHSCREEN_ATMEL_MXT TOUCHSCREEN_EDT_FT5X06 TOUCHSCREEN_GOODIX TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TRANSPARENT_HUGEPAGE_MADVISE TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TYPEC_ANX7411 TYPEC_DP_ALTMODE TYPEC_MT6360 TYPEC_MUX_FSA4480 TYPEC_MUX_PI3USB30532 TYPEC_NVIDIA_ALTMODE TYPEC_RT1711H TYPEC_RT1719 TYPEC_STUSB160X TYPEC_TCPCI_MAXIM TYPEC_TCPCI_MT6370 TYPEC_UCSI TYPEC_WUSB3801 UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UCSI_CCG UCSI_STM32G0 UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_ADUTUX USB_AIRSPY USB_ALI_M5632 USB_AMD5536UDC USB_AN2720 USB_ANNOUNCE_NEW_DEVICES USB_APPLEDISPLAY USB_ATM USB_C67X00_HCD USB_CATC USB_CDC_PHONET USB_CDNSP_GADGET USB_CDNSP_HOST USB_CDNSP_PCI USB_CHAOSKEY USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_PHONET USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2_PCI USB_DWC3_GADGET USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_FOTG210_HCD USB_FOTG210_UDC USB_FTDI_ELAN USB_F_HID USB_F_MIDI USB_F_PHONET USB_F_PRINTER USB_F_SS_LB USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GPIO_VBUS USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HIDDEV USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_KAWETH USB_KC2190 USB_KEENE USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MON USB_MR800 USB_MSI2500 USB_MV_U3D USB_MV_UDC USB_NET2272 USB_NET2272_DMA USB_NET2280 USB_NET_AQC111 USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_RNDIS_WLAN USB_NET_SR9700 USB_OTG_FSM USB_OXU210HP_HCD USB_PRINTER USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_S2255 USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_U132_HCD USB_UAS USB_UEAGLEATM USB_UHCI_HCD USB_USS720 USB_U_AUDIO USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XUSBATM USB_YUREX USERFAULTFD USERIO U_SERIAL_CONSOLE V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VDPA_USER VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_VDPA VHOST_VSOCK VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_STK1160_COMMON VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_DMA_SHARED_BUFFER VIRTIO_FS VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VXFS_FS WAN WATCH_QUEUE WCN36XX WEXT_CORE WEXT_PRIV WEXT_PROC WIREGUARD WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_ATH WLAN_VENDOR_SILABS WWAN X25 XDP_SOCKETS XDP_SOCKETS_DIAG XFRM XFRM_AH XFRM_ALGO XFRM_ESP XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER XFS_FS XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB ZBUD ZEROPLUS_FF ZISOFS ZONEFS_FS ZPOOL ZRAM ZRAM_DEF_COMP_LZORLE ZSMALLOC ZSWAP ZSWAP_COMPRESSOR_DEFAULT_LZO ZSWAP_DEFAULT_ON ZSWAP_ZPOOL_DEFAULT_ZBUD] disabling configs for [memleak ubsan bug_or_warning kasan atomic_sleep hang], they are not needed testing current HEAD fdb6fcb41cc741ad5eaa7995f278dfcb94fdf795 testing commit fdb6fcb41cc741ad5eaa7995f278dfcb94fdf795 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: dc3ae6cd8e8242db45c609768146c25007a294043942225da91b218016af6919 all runs: OK false negative chance: 0.000 # git bisect start fdb6fcb41cc741ad5eaa7995f278dfcb94fdf795 7c87defbd336df289c8c0280f019647864ff70c6 Bisecting: 753 revisions left to test after this (roughly 10 steps) [36b47bb4046f90ac2a1d073a656a5d26237f66a2] btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() determine whether the revision contains the guilty commit revision 7c87defbd336df289c8c0280f019647864ff70c6 crashed and is reachable testing commit 36b47bb4046f90ac2a1d073a656a5d26237f66a2 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 904fbf45773c64261d810f0620bb2fa4c74509cc4f51e9ffe6b030b2928519a4 all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] # git bisect good 36b47bb4046f90ac2a1d073a656a5d26237f66a2 Bisecting: 376 revisions left to test after this (roughly 9 steps) [44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed] USB: serial: cypress_m8: validate interrupt packet headers determine whether the revision contains the guilty commit revision 7c87defbd336df289c8c0280f019647864ff70c6 crashed and is reachable testing commit 44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 18b4a7fa4bf27bedb8ed347b35267bf2f16dbb5ec217e06ed4f03cb94f494a3f all runs: OK false negative chance: 0.000 # git bisect bad 44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed Bisecting: 188 revisions left to test after this (roughly 8 steps) [97bee44eb172a48127bbea6febb45cc1f29a803c] ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics determine whether the revision contains the guilty commit revision 36b47bb4046f90ac2a1d073a656a5d26237f66a2 crashed and is reachable testing commit 97bee44eb172a48127bbea6febb45cc1f29a803c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: fdd691f6aed02d5c957c46a17ebc0d53b969d23bcf0eeb739804082e2f93eaaf all runs: OK false negative chance: 0.000 # git bisect bad 97bee44eb172a48127bbea6febb45cc1f29a803c Bisecting: 93 revisions left to test after this (roughly 7 steps) [8e7bfea35675b7ab051d745fe44cdcb672f188e6] drm/i915: skip __i915_request_skip() for already signaled requests determine whether the revision contains the guilty commit revision 36b47bb4046f90ac2a1d073a656a5d26237f66a2 crashed and is reachable testing commit 8e7bfea35675b7ab051d745fe44cdcb672f188e6 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 87526bee371644a1e70483f62ec3cdd0f0c93804ab098f9859c1afeecd0feae5 all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] # git bisect good 8e7bfea35675b7ab051d745fe44cdcb672f188e6 Bisecting: 46 revisions left to test after this (roughly 6 steps) [3f1024deeab3b5443c29b3de4fe475e87309b8fa] device property: set fwnode->secondary to NULL in fwnode_init() determine whether the revision contains the guilty commit revision 7c87defbd336df289c8c0280f019647864ff70c6 crashed and is reachable testing commit 3f1024deeab3b5443c29b3de4fe475e87309b8fa gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 08e9ffaca9308db136f9eb9416567a072dd02aa6e218dbe2e698271b701a4310 all runs: OK false negative chance: 0.000 # git bisect bad 3f1024deeab3b5443c29b3de4fe475e87309b8fa Bisecting: 23 revisions left to test after this (roughly 5 steps) [02c04df84de709060f63e1d52ec67488c4f6f212] phonet/pep: disable BH around forwarded sk_receive_skb() determine whether the revision contains the guilty commit revision 7c87defbd336df289c8c0280f019647864ff70c6 crashed and is reachable testing commit 02c04df84de709060f63e1d52ec67488c4f6f212 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: b44867c7020fb5d1e7d8833df8252c54cd8b271e5361f2184e17d49522ab9c72 all runs: OK false negative chance: 0.000 # git bisect bad 02c04df84de709060f63e1d52ec67488c4f6f212 Bisecting: 11 revisions left to test after this (roughly 4 steps) [5752c2c7795713d9a578b6447e591e7f7ac1447c] Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" determine whether the revision contains the guilty commit revision 8e7bfea35675b7ab051d745fe44cdcb672f188e6 crashed and is reachable testing commit 5752c2c7795713d9a578b6447e591e7f7ac1447c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 8ff97147eb30f14695cc988e6164b15962e9789fcde69583e6bbf7a44e4d0d56 all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] # git bisect good 5752c2c7795713d9a578b6447e591e7f7ac1447c Bisecting: 5 revisions left to test after this (roughly 3 steps) [ba6d8643019c33428f7c0658863e80e0b04a70f4] net: wwan: iosm: fix potential memory leaks in ipc_imem_init() determine whether the revision contains the guilty commit revision 7c87defbd336df289c8c0280f019647864ff70c6 crashed and is reachable testing commit ba6d8643019c33428f7c0658863e80e0b04a70f4 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 64c62157132ab9544dcc6d47617c7e39166111bd2543592fb0866cdde2780c18 all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] # git bisect good ba6d8643019c33428f7c0658863e80e0b04a70f4 Bisecting: 2 revisions left to test after this (roughly 2 steps) [915a92182e2cda9cd7d2479020a44c6eda986f7c] Bluetooth: bnep: Fix UAF read of dev->name determine whether the revision contains the guilty commit revision 36b47bb4046f90ac2a1d073a656a5d26237f66a2 crashed and is reachable testing commit 915a92182e2cda9cd7d2479020a44c6eda986f7c gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: b5784a583dee75b99373a34a48fac9c37b5b9df43adec443f59daabe4493f321 all runs: crashed: inconsistent lock state in __sk_receive_skb representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] # git bisect good 915a92182e2cda9cd7d2479020a44c6eda986f7c Bisecting: 0 revisions left to test after this (roughly 1 step) [14b01b9cba04e6ce82825f68fc4c4322fa4ffa43] Bluetooth: MGMT: validate Add Extended Advertising Data length determine whether the revision contains the guilty commit revision 5752c2c7795713d9a578b6447e591e7f7ac1447c crashed and is reachable testing commit 14b01b9cba04e6ce82825f68fc4c4322fa4ffa43 gcc compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 kernel signature: 0c773a583bc1fd22ccf722c296669497a1c2666e75514d2fe6aa0aeb6e940cb9 run #0: crashed: inconsistent lock state in __sk_receive_skb run #1: crashed: inconsistent lock state in __sk_receive_skb run #2: crashed: inconsistent lock state in __sk_receive_skb run #3: crashed: inconsistent lock state in __sk_receive_skb run #4: crashed: inconsistent lock state in __sk_receive_skb run #5: crashed: inconsistent lock state in __sk_receive_skb run #6: crashed: inconsistent lock state in __sk_receive_skb run #7: crashed: inconsistent lock state in __sk_receive_skb run #8: crashed: inconsistent lock state in __sk_receive_skb run #9: OK representative crash: inconsistent lock state in __sk_receive_skb, types: [LOCKDEP] # git bisect good 14b01b9cba04e6ce82825f68fc4c4322fa4ffa43 02c04df84de709060f63e1d52ec67488c4f6f212 is the first bad commit commit 02c04df84de709060f63e1d52ec67488c4f6f212 Author: Zijing Yin Date: Tue May 19 10:26:33 2026 -0700 phonet/pep: disable BH around forwarded sk_receive_skb() commit dbc81608e3a653dea6cf403f20cae35468b8ab9c upstream. The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process context. In that case release_sock() -> __release_sock() drops the slock with spin_unlock_bh() and then calls sk->sk_backlog_rcv() with bottom halves enabled. Typical sk_backlog_rcv handlers process the socket whose backlog is being drained, so the BH state at entry is irrelevant for the slocks they touch. pep_do_rcv() is different: when the inbound skb targets an existing PEP pipe, it forwards the skb to a different *child* socket via sk_receive_skb(). That helper takes the child slock with bh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH is already off. The same child slock therefore ends up acquired with BH on (process path) and with BH off (softirq path): process context softirq context --------------- --------------- release_sock(listener) __netif_receive_skb() __release_sock() phonet_rcv() spin_unlock_bh() __sk_receive_skb(listener) [BH now ENABLED] [BH already disabled] sk_backlog_rcv: sk_backlog_rcv: pep_do_rcv() pep_do_rcv() sk_receive_skb(child) sk_receive_skb(child) bh_lock_sock_nested(child) bh_lock_sock_nested(child) => SOFTIRQ-ON-W => IN-SOFTIRQ-W Lockdep flags this as inconsistent lock state, and it can become a real self-deadlock if a softirq on the same CPU tries to receive to the same child socket while its slock is held in the BH-enabled path: WARNING: inconsistent lock state inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. (slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900 __sk_receive_skb net/core/sock.c:563 sk_receive_skb include/net/sock.h:2022 [inline] pep_do_rcv net/phonet/pep.c:675 sk_backlog_rcv include/net/sock.h:1190 __release_sock net/core/sock.c:3216 release_sock net/core/sock.c:3815 pep_sock_accept net/phonet/pep.c:879 Wrap the forwarded sk_receive_skb() in local_bh_disable() / local_bh_enable() so the child slock is always acquired with BH off. local_bh_disable() nests safely on the softirq path. Discovered via in-house syzkaller fuzzing; the same root cause also on the linux-6.1.y syzbot dashboard as extid 44f0626dd6284f02663c. Reproduced under KASAN + LOCKDEP + PROVE_LOCKING, reproducer: https://pastebin.com/A3t8xzCR Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol") Link: https://syzkaller.appspot.com/bug?extid=44f0626dd6284f02663c Cc: stable@vger.kernel.org Signed-off-by: Zijing Yin Acked-by: Rémi Denis-Courmont Reported-by: syzbot+9f4a135646b66c509935@syzkaller.appspotmail.com Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260519172635.86304-1-yzjaurora@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman net/phonet/pep.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) accumulated error probability: 0.00 culprit signature: b44867c7020fb5d1e7d8833df8252c54cd8b271e5361f2184e17d49522ab9c72 parent signature: 0c773a583bc1fd22ccf722c296669497a1c2666e75514d2fe6aa0aeb6e940cb9 revisions tested: 18, total time: 6h0m57.641947238s (build: 1h52m39.266580144s, test: 3h41m49.789601926s) first good commit: 02c04df84de709060f63e1d52ec67488c4f6f212 phonet/pep: disable BH around forwarded sk_receive_skb() recipients (to): ["edumazet@google.com" "gregkh@linuxfoundation.org" "kuba@kernel.org" "remi@remlab.net" "yzjaurora@gmail.com"] recipients (cc): []