================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. ksoftirqd/1/20 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff8880244e4120 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] ffff8880244e4120 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] x25_bind+0x18a/0x3b0 net/x25/af_x25.c:698 __sys_bind+0x2e9/0x3e0 net/socket.c:1730 __do_sys_bind net/socket.c:1741 [inline] __se_sys_bind net/socket.c:1739 [inline] __x64_sys_bind+0x76/0x80 net/socket.c:1739 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 irq event stamp: 424578 hardirqs last enabled at (424578): [] __local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:406 hardirqs last disabled at (424577): [] __local_bh_enable_ip+0xd7/0x1c0 kernel/softirq.c:383 softirqs last enabled at (424484): [] run_ksoftirqd+0xa4/0x100 kernel/softirq.c:943 softirqs last disabled at (424491): [] run_ksoftirqd+0xa4/0x100 kernel/softirq.c:943 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 1 lock held by ksoftirqd/1/20: #0: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313 stack backtrace: CPU: 1 PID: 20 Comm: ksoftirqd/1 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3932 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4135 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4591 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xc63/0x7b50 kernel/locking/lockdep.c:4966 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 lock_sock_nested+0x44/0x100 net/core/sock.c:3258 lock_sock include/net/sock.h:1744 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779 x25_lapb_receive_frame+0x19d/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5551 [inline] netif_receive_skb_core+0x149/0x210 net/core/dev.c:5576 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x430 net/core/dev.c:7101 napi_poll net/core/dev.c:7168 [inline] net_rx_action+0x522/0xa80 net/core/dev.c:7258 handle_softirqs+0x336/0x830 kernel/softirq.c:576 run_ksoftirqd+0xa4/0x100 kernel/softirq.c:943 smpboot_thread_fn+0x520/0x990 kernel/smpboot.c:164 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 BUG: sleeping function called from invalid context at net/core/sock.c:3260 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 20, name: ksoftirqd/1 INFO: lockdep is turned off. Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:414 [inline] [] handle_softirqs+0xfd/0x830 kernel/softirq.c:552 CPU: 1 PID: 20 Comm: ksoftirqd/1 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 ___might_sleep+0x493/0x610 kernel/sched/core.c:9658 lock_sock_nested+0x5b/0x100 net/core/sock.c:3260 lock_sock include/net/sock.h:1744 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779 x25_lapb_receive_frame+0x19d/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5551 [inline] netif_receive_skb_core+0x149/0x210 net/core/dev.c:5576 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x430 net/core/dev.c:7101 napi_poll net/core/dev.c:7168 [inline] net_rx_action+0x522/0xa80 net/core/dev.c:7258 handle_softirqs+0x336/0x830 kernel/softirq.c:576 run_ksoftirqd+0xa4/0x100 kernel/softirq.c:943 smpboot_thread_fn+0x520/0x990 kernel/smpboot.c:164 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 net_ratelimit: 29 callbacks suppressed wireguard: wg0: Sending keepalive packet to peer 7 ([::1]:20002/0%0) wireguard: wg0: Sending keepalive packet to peer 2 ([::1]:20003/0%0) wireguard: wg0: Sending keepalive packet to peer 25 ([::1]:20002/0%0) wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0) wireguard: wg1: Receiving keepalive packet from peer 27 ([::1]:20001/0%0) virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c41928 response 0 status 0x0 sense_len 0 No more buffers in queue nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff8880229e9128 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c1c928 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff8880229e9128 response 0 status 0x0 sense_len 0 No more buffers in queue wireguard: wg0: Handshake for peer 8 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2) wireguard: wg1: Sending keepalive packet to peer 9 ([::1]:20001/0%0) virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c1cd28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1d528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1d928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1e128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1dd28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1d128 response 0 status 0x0 sense_len 0 No more buffers in queue wireguard: wg0: Sending keepalive packet to peer 7 ([::1]:20002/0%0) wireguard: wg0: Sending keepalive packet to peer 25 ([::1]:20002/0%0) kobject: '30' (ffff888147783998): kobject_cleanup, parent 0000000000000000 kobject: '30' (ffff888147783998): calling ktype release kobject: '30': free name nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) kobject: '31' (ffff888147784198): kobject_cleanup, parent 0000000000000000 kobject: '31' (ffff888147784198): calling ktype release kobject: '31': free name kobject: '32' (ffff888147784998): kobject_cleanup, parent 0000000000000000 kobject: '32' (ffff888147784998): calling ktype release kobject: '32': free name wireguard: wg2: Handshake for peer 24 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 7) sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffff888079770c98 is addr:fc02:: for cmd:0 at entry:ffff8880632cbf80 kobject: '33' (ffff888147785198): kobject_cleanup, parent 0000000000000000 kobject: '33' (ffff888147785198): calling ktype release kobject: '33': free name nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) wireguard: wg0: Handshake for peer 31 (224.0.0.1:20000) did not complete after 5 seconds, retrying (try 2) wireguard: wg0: Handshake for peer 2 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2) wireguard: wg1: Handshake for peer 22 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 7) nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) percpu_ref_switch_to_atomic_rcu: global 9223372036854775809 percpu 0 wireguard: wg0: Handshake for peer 20 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2) nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0) wireguard: wg0: Sending keepalive packet to peer 7 ([::1]:20002/0%0) wireguard: wg0: Sending keepalive packet to peer 25 ([::1]:20002/0%0) wireguard: wg2: Sending keepalive packet to peer 29 ([::1]:20001/0%0) virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c41d28 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff8880229e9128 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c42128 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff8880229e9128 response 0 status 0x0 sense_len 0 No more buffers in queue nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c43128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c45928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1e928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c44528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c44928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1fd28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c13928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c14128 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c13d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c44d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c45528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c14928 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c10928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1f528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1f128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1dd28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c43928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c46928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c46d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c11528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c11128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c10d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c46128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c46528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c45d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1e128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c43528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c44128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c12928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c11928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1e528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c12528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c11d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c42d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c10528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c12d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c10128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c12128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c42128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c43d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c14528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1d128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c42528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1ed28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1f928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c13528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1d528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c1d928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c13128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c45128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c42928 response 0 status 0x0 sense_len 0 No more buffers in queue nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_conntrack: clean_from_lists(ffff8880213d2c00) nf_conntrack: nf_ct_destroy(ffff8880213d2c00) nf_conntrack: nf_ct_destroy: returning ct=ffff8880213d2c00 to slab nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c48528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c48928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c47528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c47d28 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c49528 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c49928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c47928 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c48d28 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c47128 response 0 status 0x0 sense_len 0 sd 0:0:1:0: cmd ffff888023c48128 response 0 status 0x0 sense_len 0 No more buffers in queue virtqueue callback for ffff8880217e7400 (ffffffff85068310) sd 0:0:1:0: cmd ffff888023c49128 response 0 status 0x0 sense_len 0 No more buffers in queue percpu_ref_switch_to_atomic_rcu: global 9223372036854775809 percpu 0 nf_conntrack: new packet for ffff88801f2f3080 nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip DST for ct ffff88801f2f3080 (status bits 0x188) nf_nat: Already setup manip SRC for ct ffff88801f2f3080 (status bits 0x188) wireguard: wg0: Handshake for peer 2 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 3)