syzbot
inconsistent lock state in valid_state (2)
Status:
upstream: reported on 2026/08/05 10:00
Reported-by: syzbot+4358593ed3ab3b8a104b@syzkaller.appspotmail.com
First crash: 4d12h, last: 7h53m
Sample crash report:
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz-executor/5769 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff888057b06130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
ffff888057b06130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3544
lock_sock include/net/sock.h:1780 [inline]
x25_bind+0x20a/0x460 net/x25/af_x25.c:698
__sys_bind+0x2f0/0x3f0 net/socket.c:1856
__do_sys_bind net/socket.c:1867 [inline]
__se_sys_bind net/socket.c:1865 [inline]
__x64_sys_bind+0x7a/0x90 net/socket.c:1865
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
irq event stamp: 1782846
hardirqs last enabled at (1782846): [<ffffffff8152ccba>] __local_bh_enable_ip+0x13a/0x1c0 kernel/softirq.c:411
hardirqs last disabled at (1782845): [<ffffffff8152cc5b>] __local_bh_enable_ip+0xdb/0x1c0 kernel/softirq.c:388
softirqs last enabled at (1781768): [<ffffffff8152d8f3>] __do_softirq kernel/softirq.c:612 [inline]
softirqs last enabled at (1781768): [<ffffffff8152d8f3>] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last enabled at (1781768): [<ffffffff8152d8f3>] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
softirqs last disabled at (1782495): [<ffffffff8152d8f3>] __do_softirq kernel/softirq.c:612 [inline]
softirqs last disabled at (1782495): [<ffffffff8152d8f3>] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last disabled at (1782495): [<ffffffff8152d8f3>] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
2 locks held by syz-executor/5769:
#0: ffffffff97360a90 (&fsnotify_mark_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:116 [inline]
#0: ffffffff97360a90 (&fsnotify_mark_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:215 [inline]
#0: ffffffff97360a90 (&fsnotify_mark_srcu){.+.+}-{0:0}, at: fsnotify+0x513/0x1800 fs/notify/fsnotify.c:568
#1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x34/0x230 net/core/dev.c:5670
stack backtrace:
CPU: 0 PID: 5769 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:4013
mark_lock_irq+0xad/0x900 kernel/locking/lockdep.c:4216
mark_lock+0x208/0x320 kernel/locking/lockdep.c:4678
mark_usage kernel/locking/lockdep.c:-1 [inline]
__lock_acquire+0xcfc/0x7d80 kernel/locking/lockdep.c:5091
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3544
lock_sock include/net/sock.h:1780 [inline]
x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782
x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5646 [inline]
netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671
lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99
__napi_poll+0xbb/0x460 net/core/dev.c:6650
napi_poll net/core/dev.c:6717 [inline]
net_rx_action+0x65f/0xcc0 net/core/dev.c:6853
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:finish_task_switch+0x267/0x8f0 kernel/sched/core.c:5256
Code: 2f 09 85 c0 0f 84 30 01 00 00 48 85 db 0f 85 4f 01 00 00 e9 d5 04 00 00 4c 89 e7 e8 93 d0 38 09 e8 1e 19 30 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc9000466f5a0 EFLAGS: 00000286
RAX: 74d584e991b51900 RBX: 0000000000000000 RCX: 74d584e991b51900
RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d0ca0
RBP: ffffc9000466f5f0 R08: ffffffff911eb577 R09: 1ffffffff223d6ae
R10: dffffc0000000000 R11: fffffbfff223d6af R12: ffff88802baf3c00
R13: ffff8880b8e3cfc8 R14: dffffc0000000000 R15: ffff8880b8e3cd48
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x15b6/0x4660 kernel/sched/core.c:6701
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6868
preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6892
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x111/0x120 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:140 [inline]
__wake_up+0x132/0x1a0 kernel/sched/wait.c:160
fsnotify_insert_event+0x2ea/0x3b0 fs/notify/notification.c:127
fsnotify_add_event include/linux/fsnotify_backend.h:629 [inline]
inotify_handle_inode_event+0x3d9/0x560 fs/notify/inotify/inotify_fsnotify.c:126
fsnotify_handle_event fs/notify/fsnotify.c:337 [inline]
send_to_group fs/notify/fsnotify.c:385 [inline]
fsnotify+0x14db/0x1800 fs/notify/fsnotify.c:591
__fsnotify_parent+0x577/0x7c0 fs/notify/fsnotify.c:248
fsnotify_parent include/linux/fsnotify.h:77 [inline]
fsnotify_file include/linux/fsnotify.h:107 [inline]
fsnotify_close include/linux/fsnotify.h:349 [inline]
__fput+0x6ed/0x940 fs/file_table.c:404
__do_sys_close fs/open.c:1574 [inline]
__se_sys_close+0x15c/0x1e0 fs/open.c:1559
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1eb675e90e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffe4d1699b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000555556485500 RCX: 00007f1eb675e90e
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffe4d169a5c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000000bb
R13: 00000000000927c0 R14: 000000000004cfe7 R15: 00007ffe4d169ab0
</TASK>
BUG: sleeping function called from invalid context at net/core/sock.c:3546
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5769, name: syz-executor
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff8a953300>] preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6892
CPU: 0 PID: 5769 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
__might_resched+0x48d/0x5f0 kernel/sched/core.c:10212
lock_sock_nested+0x5d/0x100 net/core/sock.c:3546
lock_sock include/net/sock.h:1780 [inline]
x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782
x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5646 [inline]
netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671
lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99
__napi_poll+0xbb/0x460 net/core/dev.c:6650
napi_poll net/core/dev.c:6717 [inline]
net_rx_action+0x65f/0xcc0 net/core/dev.c:6853
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:finish_task_switch+0x267/0x8f0 kernel/sched/core.c:5256
Code: 2f 09 85 c0 0f 84 30 01 00 00 48 85 db 0f 85 4f 01 00 00 e9 d5 04 00 00 4c 89 e7 e8 93 d0 38 09 e8 1e 19 30 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc9000466f5a0 EFLAGS: 00000286
RAX: 74d584e991b51900 RBX: 0000000000000000 RCX: 74d584e991b51900
RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d0ca0
RBP: ffffc9000466f5f0 R08: ffffffff911eb577 R09: 1ffffffff223d6ae
R10: dffffc0000000000 R11: fffffbfff223d6af R12: ffff88802baf3c00
R13: ffff8880b8e3cfc8 R14: dffffc0000000000 R15: ffff8880b8e3cd48
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x15b6/0x4660 kernel/sched/core.c:6701
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6868
preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6892
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x111/0x120 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:140 [inline]
__wake_up+0x132/0x1a0 kernel/sched/wait.c:160
fsnotify_insert_event+0x2ea/0x3b0 fs/notify/notification.c:127
fsnotify_add_event include/linux/fsnotify_backend.h:629 [inline]
inotify_handle_inode_event+0x3d9/0x560 fs/notify/inotify/inotify_fsnotify.c:126
fsnotify_handle_event fs/notify/fsnotify.c:337 [inline]
send_to_group fs/notify/fsnotify.c:385 [inline]
fsnotify+0x14db/0x1800 fs/notify/fsnotify.c:591
__fsnotify_parent+0x577/0x7c0 fs/notify/fsnotify.c:248
fsnotify_parent include/linux/fsnotify.h:77 [inline]
fsnotify_file include/linux/fsnotify.h:107 [inline]
fsnotify_close include/linux/fsnotify.h:349 [inline]
__fput+0x6ed/0x940 fs/file_table.c:404
__do_sys_close fs/open.c:1574 [inline]
__se_sys_close+0x15c/0x1e0 fs/open.c:1559
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1eb675e90e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffe4d1699b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000555556485500 RCX: 00007f1eb675e90e
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffe4d169a5c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000000bb
R13: 00000000000927c0 R14: 000000000004cfe7 R15: 00007ffe4d169ab0
</TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 09 85 c0 0f 84 30 or %eax,0x30840fc0(%rbp)
6: 01 00 add %eax,(%rax)
8: 00 48 85 add %cl,-0x7b(%rax)
b: db 0f fisttpl (%rdi)
d: 85 4f 01 test %ecx,0x1(%rdi)
10: 00 00 add %al,(%rax)
12: e9 d5 04 00 00 jmp 0x4ec
17: 4c 89 e7 mov %r12,%rdi
1a: e8 93 d0 38 09 call 0x938d0b2
1f: e8 1e 19 30 00 call 0x301942
24: fb sti
25: 4c 8b 65 b8 mov -0x48(%rbp),%r12
* 29: 49 8d bc 24 f8 15 00 lea 0x15f8(%r12),%rdi <-- trapping instruction
30: 00
31: 48 89 f8 mov %rdi,%rax
34: 48 c1 e8 03 shr $0x3,%rax
38: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax
3d: 84 c0 test %al,%al
Struck through repros no longer work on HEAD.