================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. kworker/u4:8/4456 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88807861a130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] ffff88807861a130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 lock_sock_nested+0x44/0x100 net/core/sock.c:3504 lock_sock include/net/sock.h:1805 [inline] x25_bind+0x1aa/0x3e0 net/x25/af_x25.c:698 __sys_bind+0x2e9/0x3e0 net/socket.c:1811 __do_sys_bind net/socket.c:1822 [inline] __se_sys_bind net/socket.c:1820 [inline] __x64_sys_bind+0x76/0x80 net/socket.c:1820 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 2715360 hardirqs last enabled at (2715360): [] __local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:426 hardirqs last disabled at (2715359): [] __local_bh_enable_ip+0xd7/0x1c0 kernel/softirq.c:403 softirqs last enabled at (2715292): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (2715292): [] cfg80211_bss_update+0x10f6/0x21a0 net/wireless/scan.c:1930 softirqs last disabled at (2715293): [] do_softirq+0x142/0x210 kernel/softirq.c:497 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 5 locks held by kworker/u4:8/4456: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc900048f7d00 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffff8880561087a8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5693 [inline] #2: ffff8880561087a8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x31/0x260 net/wireless/core.c:420 #3: ffff88801e770d40 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1114 [inline] #3: ffff88801e770d40 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_rx_queued_mgmt+0x11c/0x2eb0 net/mac80211/ibss.c:1627 #4: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #4: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #4: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x30/0x230 net/core/dev.c:5643 stack backtrace: CPU: 1 PID: 4456 Comm: kworker/u4:8 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: events_unbound cfg80211_wiphy_work Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3974 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4177 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4633 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xce0/0x7c40 kernel/locking/lockdep.c:5017 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 lock_sock_nested+0x44/0x100 net/core/sock.c:3504 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 do_softirq+0x142/0x210 kernel/softirq.c:497 __local_bh_enable_ip+0x180/0x1c0 kernel/softirq.c:421 spin_unlock_bh include/linux/spinlock.h:396 [inline] cfg80211_bss_update+0x10f6/0x21a0 net/wireless/scan.c:1930 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2509 [inline] cfg80211_inform_bss_frame_data+0xa77/0x1390 net/wireless/scan.c:2542 ieee80211_bss_info_update+0x6ef/0xbf0 net/mac80211/scan.c:190 ieee80211_rx_bss_info net/mac80211/ibss.c:1120 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline] ieee80211_ibss_rx_queued_mgmt+0x1931/0x2eb0 net/mac80211/ibss.c:1638 ieee80211_iface_process_skb net/mac80211/iface.c:1685 [inline] ieee80211_iface_work+0x72c/0xc70 net/mac80211/iface.c:1739 cfg80211_wiphy_work+0x224/0x260 net/wireless/core.c:433 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 BUG: sleeping function called from invalid context at net/core/sock.c:3506 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4456, name: kworker/u4:8 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 PID: 4456 Comm: kworker/u4:8 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: events_unbound cfg80211_wiphy_work Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 __might_resched+0x489/0x5f0 kernel/sched/core.c:9970 lock_sock_nested+0x59/0x100 net/core/sock.c:3506 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 do_softirq+0x142/0x210 kernel/softirq.c:497 __local_bh_enable_ip+0x180/0x1c0 kernel/softirq.c:421 spin_unlock_bh include/linux/spinlock.h:396 [inline] cfg80211_bss_update+0x10f6/0x21a0 net/wireless/scan.c:1930 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2509 [inline] cfg80211_inform_bss_frame_data+0xa77/0x1390 net/wireless/scan.c:2542 ieee80211_bss_info_update+0x6ef/0xbf0 net/mac80211/scan.c:190 ieee80211_rx_bss_info net/mac80211/ibss.c:1120 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline] ieee80211_ibss_rx_queued_mgmt+0x1931/0x2eb0 net/mac80211/ibss.c:1638 ieee80211_iface_process_skb net/mac80211/iface.c:1685 [inline] ieee80211_iface_work+0x72c/0xc70 net/mac80211/iface.c:1739 cfg80211_wiphy_work+0x224/0x260 net/wireless/core.c:433 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295