================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.3.3046/18507 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88802c1fe130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline] ffff88802c1fe130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754 lock_sock_nested+0x48/0x100 net/core/sock.c:3544 lock_sock include/net/sock.h:1780 [inline] x25_ioctl+0x7ec/0xff0 net/x25/af_x25.c:1571 sock_do_ioctl+0xfc/0x310 net/socket.c:1220 sock_ioctl+0x5be/0x7e0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 278386 hardirqs last enabled at (278386): [] __local_bh_enable_ip+0x13a/0x1c0 kernel/softirq.c:411 hardirqs last disabled at (278385): [] __local_bh_enable_ip+0xdb/0x1c0 kernel/softirq.c:388 softirqs last enabled at (271080): [] __do_softirq kernel/softirq.c:612 [inline] softirqs last enabled at (271080): [] invoke_softirq kernel/softirq.c:452 [inline] softirqs last enabled at (271080): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 softirqs last disabled at (278309): [] __do_softirq kernel/softirq.c:612 [inline] softirqs last disabled at (278309): [] invoke_softirq kernel/softirq.c:452 [inline] softirqs last disabled at (278309): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 2 locks held by syz.3.3046/18507: #0: ffff88802e7db598 (&u->iolock){+.+.}-{3:3}, at: __unix_dgram_recvmsg+0x1fd/0xd90 net/unix/af_unix.c:2409 #1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x34/0x230 net/core/dev.c:5670 stack backtrace: CPU: 0 PID: 18507 Comm: syz.3.3046 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:4013 mark_lock_irq+0xad/0x900 kernel/locking/lockdep.c:4216 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4678 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xcfc/0x7d80 kernel/locking/lockdep.c:5091 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754 lock_sock_nested+0x48/0x100 net/core/sock.c:3544 lock_sock include/net/sock.h:1780 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671 lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 fb 4e c6 f6 65 8b 05 5c 1d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc90003b0f5a0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 0c26fefa3699b900 RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 RBP: ffffc90003b0f638 R08: ffffffff911eb5af R09: 1ffffffff223d6b5 R10: dffffc0000000000 R11: fffffbfff223d6b6 R12: dffffc0000000000 R13: ffff88802e7db1d0 R14: ffff88802e7db1d0 R15: 1ffff92000761eb4 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] __skb_try_recv_datagram+0x181/0x4e0 net/core/datagram.c:265 __unix_dgram_recvmsg+0x2f9/0xd90 net/unix/af_unix.c:2412 sock_recvmsg_nosec+0x82/0xd0 net/socket.c:1047 ____sys_recvmsg+0x4d7/0x5d0 net/socket.c:2812 ___sys_recvmsg+0x214/0x590 net/socket.c:2856 do_recvmmsg+0x377/0x810 net/socket.c:2950 __sys_recvmmsg net/socket.c:3029 [inline] __do_sys_recvmmsg net/socket.c:3052 [inline] __se_sys_recvmmsg net/socket.c:3045 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3045 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f765e59e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f765f517028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f765e826090 RCX: 00007f765e59e0d9 RDX: 03fffffffffffcb5 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007f765e635024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f765e826128 R14: 00007f765e826090 R15: 00007ffe0d66a4e8 BUG: sleeping function called from invalid context at net/core/sock.c:3546 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 18507, name: syz.3.3046 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 0 PID: 18507 Comm: syz.3.3046 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 lock_sock_nested+0x5d/0x100 net/core/sock.c:3546 lock_sock include/net/sock.h:1780 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671 lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 fb 4e c6 f6 65 8b 05 5c 1d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc90003b0f5a0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 0c26fefa3699b900 RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 RBP: ffffc90003b0f638 R08: ffffffff911eb5af R09: 1ffffffff223d6b5 R10: dffffc0000000000 R11: fffffbfff223d6b6 R12: dffffc0000000000 R13: ffff88802e7db1d0 R14: ffff88802e7db1d0 R15: 1ffff92000761eb4 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] __skb_try_recv_datagram+0x181/0x4e0 net/core/datagram.c:265 __unix_dgram_recvmsg+0x2f9/0xd90 net/unix/af_unix.c:2412 sock_recvmsg_nosec+0x82/0xd0 net/socket.c:1047 ____sys_recvmsg+0x4d7/0x5d0 net/socket.c:2812 ___sys_recvmsg+0x214/0x590 net/socket.c:2856 do_recvmmsg+0x377/0x810 net/socket.c:2950 __sys_recvmmsg net/socket.c:3029 [inline] __do_sys_recvmmsg net/socket.c:3052 [inline] __se_sys_recvmmsg net/socket.c:3045 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3045 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f765e59e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f765f517028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f765e826090 RCX: 00007f765e59e0d9 RDX: 03fffffffffffcb5 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007f765e635024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f765e826128 R14: 00007f765e826090 R15: 00007ffe0d66a4e8 ---------------- Code disassembly (best guess): 0: c7 44 24 20 00 00 00 movl $0x0,0x20(%rsp) 7: 00 8: 9c pushf 9: 8f 44 24 20 pop 0x20(%rsp) d: f7 44 24 20 00 02 00 testl $0x200,0x20(%rsp) 14: 00 15: 41 c6 04 07 f8 movb $0xf8,(%r15,%rax,1) 1a: 75 4b jne 0x67 1c: f7 c3 00 02 00 00 test $0x200,%ebx 22: 74 01 je 0x25 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 fb 4e c6 f6 call 0xf6c64f2a <-- trapping instruction 2f: 65 8b 05 5c 1d 6d 75 mov %gs:0x756d1d5c(%rip),%eax # 0x756d1d92 36: 85 c0 test %eax,%eax 38: 74 3c je 0x76 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: 04 24 add $0x24,%al 3e: 0e (bad) 3f: 36 ss