syzbot

================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
syz.4.998/9676 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff888056ff80a8 (&p->tcfa_lock){+.?.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888056ff80a8 (&p->tcfa_lock){+.?.}-{3:3}, at: est_fetch_counters net/core/gen_estimator.c:67 [inline]
ffff888056ff80a8 (&p->tcfa_lock){+.?.}-{3:3}, at: est_timer+0xd4/0x9f0 net/core/gen_estimator.c:83
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  tcf_vlan_init+0x973/0xdc0 net/sched/act_vlan.c:256
  tcf_action_init_1+0x463/0x6d0 net/sched/act_api.c:1431
  tcf_action_init+0x2cf/0xab0 net/sched/act_api.c:1506
  tcf_action_add net/sched/act_api.c:2100 [inline]
  tc_ctl_action+0x430/0xbd0 net/sched/act_api.c:2157
  rtnetlink_rcv_msg+0x77c/0xb70 net/core/rtnetlink.c:6955
  netlink_rcv_skb+0x205/0x470 net/netlink/af_netlink.c:2552
  netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
  netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
  netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
  sock_sendmsg_nosec net/socket.c:714 [inline]
  __sock_sendmsg+0x219/0x270 net/socket.c:729
  ____sys_sendmsg+0x505/0x830 net/socket.c:2614
  ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
  __sys_sendmsg net/socket.c:2700 [inline]
  __do_sys_sendmsg net/socket.c:2705 [inline]
  __se_sys_sendmsg net/socket.c:2703 [inline]
  __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
irq event stamp: 3218
hardirqs last  enabled at (3218): [<ffffffff8b7cdeb3>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last  enabled at (3218): [<ffffffff8b7cdeb3>] _raw_spin_unlock_irq+0x23/0x50 kernel/locking/spinlock.c:202
hardirqs last disabled at (3217): [<ffffffff8b7cdc2d>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline]
hardirqs last disabled at (3217): [<ffffffff8b7cdc2d>] _raw_spin_lock_irq+0x7d/0xf0 kernel/locking/spinlock.c:170
softirqs last  enabled at (3156): [<ffffffff81687bf2>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last  enabled at (3156): [<ffffffff81687bf2>] fpregs_lock arch/x86/include/asm/fpu/api.h:69 [inline]
softirqs last  enabled at (3156): [<ffffffff81687bf2>] fpu__clear_user_states+0x82/0x350 arch/x86/kernel/fpu/core.c:813
softirqs last disabled at (3215): [<ffffffff8184f4da>] __do_softirq kernel/softirq.c:613 [inline]
softirqs last disabled at (3215): [<ffffffff8184f4da>] invoke_softirq kernel/softirq.c:453 [inline]
softirqs last disabled at (3215): [<ffffffff8184f4da>] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&p->tcfa_lock);
  <Interrupt>
    lock(&p->tcfa_lock);

 *** DEADLOCK ***

5 locks held by syz.4.998/9676:
 #0: ffff888076b5ace0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:453 [inline]
 #0: ffff888076b5ace0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x12e/0xb50 mm/mmap.c:1265
 #1: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #1: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #1: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x29/0x250 mm/pgtable-generic.c:286
 #2: ffff88806b0f1558 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff88806b0f1558 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x13e/0x210 mm/pgtable-generic.c:401
 #3: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #3: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #3: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: page_table_check_clear+0x187/0x700 mm/page_table_check.c:77
 #4: ffffc90000a08be0 ((&est->timer)){+.-.}-{0:0}, at: call_timer_fn+0xbe/0x5f0 kernel/time/timer.c:1744

stack backtrace:
CPU: 1 UID: 0 PID: 9676 Comm: syz.4.998 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <IRQ>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_usage_bug+0x297/0x2e0 kernel/locking/lockdep.c:4042
 valid_state+0xc3/0xf0 kernel/locking/lockdep.c:4056
 mark_lock_irq+0x36/0x390 kernel/locking/lockdep.c:4267
 mark_lock+0x11b/0x190 kernel/locking/lockdep.c:4753
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0x680/0xd20 kernel/locking/lockdep.c:5191
 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 est_fetch_counters net/core/gen_estimator.c:67 [inline]
 est_timer+0xd4/0x9f0 net/core/gen_estimator.c:83
 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
 handle_softirqs+0x283/0x870 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lookup_page_ext mm/page_ext.c:252 [inline]
RIP: 0010:page_ext_lookup+0xdf/0x180 mm/page_ext.c:509
Code: 0f e8 d5 71 91 ff eb 05 e8 ce 71 91 ff 45 31 f6 49 83 c6 10 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 51 e2 f4 ff <49> 8b 1e e8 49 f5 76 ff 89 c5 31 ff 89 c6 e8 de 75 91 ff 85 ed 74
RSP: 0018:ffffc9000e65f558 EFLAGS: 00000246
RAX: 1ffff11027fff4ae RBX: 0000000000000160 RCX: ffff888076183c00
RDX: 0000000000000000 RSI: 0000000000001000 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff822e4a67
R10: dffffc0000000000 R11: fffff940002e9a41 R12: 000000000005d348
R13: dffffc0000000000 R14: ffff88813fffa570 R15: 0000000000001000
 page_ext_iter_begin include/linux/page_ext.h:132 [inline]
 page_table_check_clear+0x278/0x700 mm/page_table_check.c:78
 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline]
 get_and_clear_full_ptes include/linux/pgtable.h:725 [inline]
 zap_present_folio_ptes mm/memory.c:1499 [inline]
 zap_present_ptes mm/memory.c:1581 [inline]
 do_zap_pte_range mm/memory.c:1682 [inline]
 zap_pte_range mm/memory.c:1726 [inline]
 zap_pmd_range mm/memory.c:1818 [inline]
 zap_pud_range mm/memory.c:1847 [inline]
 zap_p4d_range mm/memory.c:1868 [inline]
 unmap_page_range+0x3445/0x4370 mm/memory.c:1889
 unmap_single_vma mm/memory.c:1932 [inline]
 unmap_vmas+0x399/0x580 mm/memory.c:1976
 exit_mmap+0x248/0xb50 mm/mmap.c:1280
 __mmput+0x118/0x420 kernel/fork.c:1130
 exit_mm+0x1da/0x2c0 kernel/exit.c:582
 do_exit+0x648/0x2300 kernel/exit.c:949
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1102
 __do_sys_exit_group kernel/exit.c:1113 [inline]
 __se_sys_exit_group kernel/exit.c:1111 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1111
 x64_sys_call+0x21f7/0x2200 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5b5238ebe9
Code: Unable to access opcode bytes at 0x7f5b5238ebbf.
RSP: 002b:00007ffeafe2b3b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f5b5238ebe9
RDX: 00007f5b523461d7 RSI: 0000000000000000 RDI: 000000000000000b
RBP: 0000000000000003 R08: 00007ffeafe2b857 R09: 000000000000000b
R10: 00007f5b525c5fa0 R11: 0000000000000246 R12: 00007f5b525c627c
R13: 00007f5b525c6270 R14: 00000000000002d3 R15: 0000000000000005
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 d5 71 91 ff       	call   0xff9171da
   5:	eb 05                	jmp    0xc
   7:	e8 ce 71 91 ff       	call   0xff9171da
   c:	45 31 f6             	xor    %r14d,%r14d
   f:	49 83 c6 10          	add    $0x10,%r14
  13:	4c 89 f0             	mov    %r14,%rax
  16:	48 c1 e8 03          	shr    $0x3,%rax
  1a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  1f:	74 08                	je     0x29
  21:	4c 89 f7             	mov    %r14,%rdi
  24:	e8 51 e2 f4 ff       	call   0xfff4e27a
* 29:	49 8b 1e             	mov    (%r14),%rbx <-- trapping instruction
  2c:	e8 49 f5 76 ff       	call   0xff76f57a
  31:	89 c5                	mov    %eax,%ebp
  33:	31 ff                	xor    %edi,%edi
  35:	89 c6                	mov    %eax,%esi
  37:	e8 de 75 91 ff       	call   0xff91761a
  3c:	85 ed                	test   %ebp,%ebp
  3e:	74                   	.byte 0x74