------------[ cut here ]------------
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.3.410/6614 is trying to acquire lock:
ffff80001528cb60 (console_owner){..-.}-{0:0}, at: console_lock_spinning_enable+0x88/0xec kernel/printk/printk.c:1814

but task is already holding lock:
ffff00019f6bd798 (&base->lock){-.-.}-{2:2}, at: __run_timers+0xf4/0x6d8 kernel/time/timer.c:2004

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #5 (&base->lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
       lock_timer_base+0x11c/0x224 kernel/time/timer.c:999
       __mod_timer+0xe4/0xb4c kernel/time/timer.c:1080
       add_timer+0x6c/0x8c kernel/time/timer.c:1244
       __queue_delayed_work kernel/workqueue.c:1679 [inline]
       queue_delayed_work_on+0x1e4/0x314 kernel/workqueue.c:1704
       queue_delayed_work include/linux/workqueue.h:527 [inline]
       schedule_delayed_work include/linux/workqueue.h:679 [inline]
       psi_group_change+0xdb8/0x1344 kernel/sched/psi.c:885
       psi_task_change+0xec/0x244 kernel/sched/psi.c:924
       psi_enqueue kernel/sched/stats.h:143 [inline]
       enqueue_task kernel/sched/core.c:2055 [inline]
       activate_task+0x224/0x244 kernel/sched/core.c:2087
       wake_up_new_task+0x390/0xae8 kernel/sched/core.c:4741
       kernel_clone+0x4a4/0x8fc kernel/fork.c:2788
       user_mode_thread+0xc8/0x11c kernel/fork.c:2833
       rest_init+0x30/0x2f0 init/main.c:710
       start_kernel+0x0/0x554 init/main.c:905
       start_kernel+0x4a4/0x554 init/main.c:1152
       __primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468

-> #4 (&rq->__lock){-.-.}-{2:2}:
       _raw_spin_lock_nested+0x5c/0x78 kernel/locking/spinlock.c:378
       raw_spin_rq_lock_nested+0x2c/0x44 kernel/sched/core.c:537
       raw_spin_rq_lock kernel/sched/sched.h:1355 [inline]
       rq_lock kernel/sched/sched.h:1645 [inline]
       task_fork_fair+0x78/0x228 kernel/sched/fair.c:11901
       sched_cgroup_fork+0x360/0x438 kernel/sched/core.c:4685
       copy_process+0x2500/0x3670 kernel/fork.c:2459
       kernel_clone+0x1d8/0x8fc kernel/fork.c:2757
       user_mode_thread+0xc8/0x11c kernel/fork.c:2833
       rest_init+0x30/0x2f0 init/main.c:710
       start_kernel+0x0/0x554 init/main.c:905
       start_kernel+0x4a4/0x554 init/main.c:1152
       __primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468

-> #3 (&p->pi_lock){-.-.}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
       try_to_wake_up+0x60/0xc74 kernel/sched/core.c:4111
       default_wake_function+0x4c/0x60 kernel/sched/core.c:6885
       woken_wake_function+0x48/0x78 kernel/sched/wait.c:484
       __wake_up_common+0x224/0x3b0 kernel/sched/wait.c:107
       __wake_up_common_lock kernel/sched/wait.c:138 [inline]
       __wake_up+0x104/0x174 kernel/sched/wait.c:160
       tty_wakeup+0xd8/0xec drivers/tty/tty_io.c:528
       n_tty_check_unthrottle+0x268/0x2d8 drivers/tty/n_tty.c:277
       n_tty_read+0x268/0xf9c drivers/tty/n_tty.c:2180
       iterate_tty_read drivers/tty/tty_io.c:852 [inline]
       tty_read+0x210/0x4a8 drivers/tty/tty_io.c:927
       call_read_iter include/linux/fs.h:2259 [inline]
       new_sync_read fs/read_write.c:389 [inline]
       vfs_read+0x5ac/0x7c4 fs/read_write.c:470
       ksys_read+0x120/0x210 fs/read_write.c:613
       __do_sys_read fs/read_write.c:623 [inline]
       __se_sys_read fs/read_write.c:621 [inline]
       __arm64_sys_read+0x7c/0x90 fs/read_write.c:621
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #2 (&tty->write_wait){....}-{2:2}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
       __wake_up_common_lock kernel/sched/wait.c:137 [inline]
       __wake_up+0xe4/0x174 kernel/sched/wait.c:160
       tty_wakeup+0xd8/0xec drivers/tty/tty_io.c:528
       tty_port_default_wakeup+0xb0/0x124 drivers/tty/tty_port.c:71
       tty_port_tty_wakeup+0x64/0x78 drivers/tty/tty_port.c:435
       uart_write_wakeup+0x4c/0x64 drivers/tty/serial/serial_core.c:117
       pl011_tx_chars+0x9d8/0x11f8 drivers/tty/serial/amba-pl011.c:1496
       pl011_start_tx_pio drivers/tty/serial/amba-pl011.c:1342 [inline]
       pl011_start_tx+0x544/0xb68 drivers/tty/serial/amba-pl011.c:1384
       __uart_start drivers/tty/serial/serial_core.c:139 [inline]
       uart_write+0x568/0x7ec drivers/tty/serial/serial_core.c:601
       process_output_block drivers/tty/n_tty.c:586 [inline]
       n_tty_write+0xab0/0xeb4 drivers/tty/n_tty.c:2377
       do_tty_write drivers/tty/tty_io.c:1018 [inline]
       file_tty_write+0x3e0/0x6c4 drivers/tty/tty_io.c:1089
       tty_write drivers/tty/tty_io.c:1110 [inline]
       redirected_tty_write+0xbc/0xf0 drivers/tty/tty_io.c:1133
       call_write_iter include/linux/fs.h:2265 [inline]
       new_sync_write fs/read_write.c:491 [inline]
       vfs_write+0x5ac/0x7c4 fs/read_write.c:584
       ksys_write+0x120/0x210 fs/read_write.c:637
       __do_sys_write fs/read_write.c:649 [inline]
       __se_sys_write fs/read_write.c:646 [inline]
       __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #1 (&port_lock_key){..-.}-{2:2}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       uart_port_lock include/linux/serial_core.h:593 [inline]
       pl011_console_write+0x1b8/0x754 drivers/tty/serial/amba-pl011.c:2337
       call_console_driver kernel/printk/printk.c:1977 [inline]
       console_emit_next_record+0x758/0x954 kernel/printk/printk.c:2777
       console_flush_all kernel/printk/printk.c:-1 [inline]
       console_unlock+0x240/0x57c kernel/printk/printk.c:2906
       register_console+0x590/0x8a0 kernel/printk/printk.c:3259
       uart_configure_port drivers/tty/serial/serial_core.c:2616 [inline]
       uart_add_one_port+0x10e8/0x1928 drivers/tty/serial/serial_core.c:3135
       pl011_register_port+0x190/0x434 drivers/tty/serial/amba-pl011.c:2776
       sbsa_uart_probe+0x418/0x528 drivers/tty/serial/amba-pl011.c:2935
       platform_probe+0x13c/0x1b4 drivers/base/platform.c:1400
       call_driver_probe drivers/base/dd.c:-1 [inline]
       really_probe+0x39c/0xae0 drivers/base/dd.c:639
       __driver_probe_device+0x180/0x314 drivers/base/dd.c:785
       driver_probe_device+0x78/0x330 drivers/base/dd.c:815
       __device_attach_driver+0x290/0x4e0 drivers/base/dd.c:943
       bus_for_each_drv+0x150/0x1d8 drivers/base/bus.c:429
       __device_attach+0x2a8/0x3d4 drivers/base/dd.c:1015
       device_initial_probe+0x24/0x34 drivers/base/dd.c:1064
       bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489
       device_add+0xb04/0xf94 drivers/base/core.c:3697
       platform_device_add+0x3f8/0x6ec drivers/base/platform.c:717
       platform_device_register_full+0x4f0/0x610 drivers/base/platform.c:844
       acpi_create_platform_device+0x44c/0x588 drivers/acpi/acpi_platform.c:152
       acpi_default_enumeration+0x6c/0xdc drivers/acpi/scan.c:2116
       acpi_bus_attach+0x80c/0xa08 drivers/acpi/scan.c:2225
       acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1090
       device_for_each_child+0xec/0x174 drivers/base/core.c:4028
       acpi_dev_for_each_child+0x94/0xd8 drivers/acpi/bus.c:1102
       acpi_bus_attach+0x2cc/0xa08 drivers/acpi/scan.c:2230
       acpi_dev_for_one_check+0xa0/0xb4 drivers/acpi/bus.c:1090
       device_for_each_child+0xec/0x174 drivers/base/core.c:4028
       acpi_dev_for_each_child+0x94/0xd8 drivers/acpi/bus.c:1102
       acpi_bus_attach+0x2cc/0xa08 drivers/acpi/scan.c:2230
       acpi_bus_scan+0xb8/0x1b8 drivers/acpi/scan.c:2441
       acpi_scan_init+0x1b8/0x5d0 drivers/acpi/scan.c:2611
       acpi_init+0x16c/0x220 drivers/acpi/bus.c:1411
       do_one_initcall+0x24c/0x9cc init/main.c:1310
       do_initcall_level+0x154/0x214 init/main.c:1383
       do_initcalls+0x58/0xac init/main.c:1399
       do_basic_setup+0x8c/0xa0 init/main.c:1418
       kernel_init_freeable+0x35c/0x4f8 init/main.c:1638
       kernel_init+0x24/0x1d8 init/main.c:1526
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #0 (console_owner){..-.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3090 [inline]
       check_prevs_add kernel/locking/lockdep.c:3209 [inline]
       validate_chain kernel/locking/lockdep.c:3825 [inline]
       __lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
       lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
       console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1818
       console_emit_next_record+0x680/0x954 kernel/printk/printk.c:2774
       console_flush_all kernel/printk/printk.c:-1 [inline]
       console_unlock+0x240/0x57c kernel/printk/printk.c:2906
       vprintk_emit+0x14c/0x2dc kernel/printk/printk.c:2303
       vprintk_default+0x54/0x80 kernel/printk/printk.c:2318
       vprintk+0x1e8/0x284 kernel/printk/printk_safe.c:45
       _printk+0xd0/0x118 kernel/printk/printk.c:2328
       __report_bug lib/bug.c:195 [inline]
       report_bug+0x3a8/0x568 lib/bug.c:219
       bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:983
       call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
       brk_handler+0x174/0x2dc arch/arm64/kernel/debug-monitors.c:328
       do_debug_exception+0x1b8/0x3ac arch/arm64/mm/fault.c:890
       el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:407
       el1h_64_sync_handler+0x40/0xcc arch/arm64/kernel/entry-common.c:447
       el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:580
       expire_timers kernel/time/timer.c:1738 [inline]
       __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
       run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
       handle_softirqs+0x318/0xc6c kernel/softirq.c:596
       __do_softirq+0x14/0x20 kernel/softirq.c:630
       ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
       call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
       do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
       invoke_softirq kernel/softirq.c:477 [inline]
       __irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
       irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
       __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
       el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
       el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
       el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
       arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
       __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
       _raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
       spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
       __wake_up_common_lock kernel/sched/wait.c:140 [inline]
       __wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
       __unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
       unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
       sock_recvmsg_nosec net/socket.c:1022 [inline]
       ____sys_recvmsg+0x62c/0x71c net/socket.c:2736
       ___sys_recvmsg net/socket.c:2780 [inline]
       do_recvmmsg+0x364/0x96c net/socket.c:2874
       __sys_recvmmsg net/socket.c:2953 [inline]
       __do_sys_recvmmsg net/socket.c:2976 [inline]
       __se_sys_recvmmsg net/socket.c:2969 [inline]
       __arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

other info that might help us debug this:

Chain exists of:
  console_owner --> &rq->__lock --> &base->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&base->lock);
                               lock(&rq->__lock);
                               lock(&base->lock);
  lock(console_owner);

 *** DEADLOCK ***

3 locks held by syz.3.410/6614:
 #0: ffff0000fa88e598 (&u->iolock){+.+.}-{3:3}, at: __unix_dgram_recvmsg+0x16c/0xae8 net/unix/af_unix.c:2448
 #1: ffff00019f6bd798 (&base->lock){-.-.}-{2:2}, at: __run_timers+0xf4/0x6d8 kernel/time/timer.c:2004
 #2: ffff80001528cc40 (console_lock){+.+.}-{0:0}, at: console_trylock_spinning+0x18/0x2e0 kernel/printk/printk.c:1896

stack backtrace:
CPU: 0 PID: 6614 Comm: syz.3.410 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2048
 check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3090 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain kernel/locking/lockdep.c:3825 [inline]
 __lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
 lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
 console_lock_spinning_enable+0xb4/0xec kernel/printk/printk.c:1818
 console_emit_next_record+0x680/0x954 kernel/printk/printk.c:2774
 console_flush_all kernel/printk/printk.c:-1 [inline]
 console_unlock+0x240/0x57c kernel/printk/printk.c:2906
 vprintk_emit+0x14c/0x2dc kernel/printk/printk.c:2303
 vprintk_default+0x54/0x80 kernel/printk/printk.c:2318
 vprintk+0x1e8/0x284 kernel/printk/printk_safe.c:45
 _printk+0xd0/0x118 kernel/printk/printk.c:2328
 __report_bug lib/bug.c:195 [inline]
 report_bug+0x3a8/0x568 lib/bug.c:219
 bug_handler+0x50/0x1fc arch/arm64/kernel/traps.c:983
 call_break_hook arch/arm64/kernel/debug-monitors.c:321 [inline]
 brk_handler+0x174/0x2dc arch/arm64/kernel/debug-monitors.c:328
 do_debug_exception+0x1b8/0x3ac arch/arm64/mm/fault.c:890
 el1_dbg+0x64/0x80 arch/arm64/kernel/entry-common.c:407
 el1h_64_sync_handler+0x40/0xcc arch/arm64/kernel/entry-common.c:447
 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:580
 expire_timers kernel/time/timer.c:1738 [inline]
 __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
 handle_softirqs+0x318/0xc6c kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 _raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:140 [inline]
 __wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
 __unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
 sock_recvmsg_nosec net/socket.c:1022 [inline]
 ____sys_recvmsg+0x62c/0x71c net/socket.c:2736
 ___sys_recvmsg net/socket.c:2780 [inline]
 do_recvmmsg+0x364/0x96c net/socket.c:2874
 __sys_recvmmsg net/socket.c:2953 [inline]
 __do_sys_recvmmsg net/socket.c:2976 [inline]
 __se_sys_recvmmsg net/socket.c:2969 [inline]
 __arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
WARNING: CPU: 0 PID: 6614 at kernel/time/timer.c:1738 expire_timers kernel/time/timer.c:1738 [inline]
WARNING: CPU: 0 PID: 6614 at kernel/time/timer.c:1738 __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
Modules linked in:
CPU: 0 PID: 6614 Comm: syz.3.410 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 424000c5 (nZcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : expire_timers kernel/time/timer.c:1738 [inline]
pc : __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
lr : expire_timers kernel/time/timer.c:1738 [inline]
lr : __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
sp : ffff800008007d20
x29: ffff800008007e50 x28: ffff800008007dd0 x27: 1fffe00033ed7af8
x26: ffff00019f6bd7c0 x25: 00000000ffffba00 x24: ffff0000f53b5a28
x23: 1ffff00001000fba x22: dfff800000000000 x21: ffff00019f6bd7d0
x20: 0000000000000000 x19: ffff00019f6bd780 x18: ffff800011abbcc0
x17: ffff80018a6a7000 x16: ffff8000082e7de8 x15: 0000000000010001
x14: 0000000000000003 x13: 1ffff00002a180b1 x12: 0000000000ff0100
x11: ff008000083af93c x10: 0000000000000000 x9 : ffff8000083af93c
x8 : ffff0000ca068000 x7 : ffff80000a895800 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff8000082e7efc
x2 : 0000000000000001 x1 : ffff800011fa9c20 x0 : 0000000000000001
Call trace:
 expire_timers kernel/time/timer.c:1738 [inline]
 __run_timers+0x4d8/0x6d8 kernel/time/timer.c:2022
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
 handle_softirqs+0x318/0xc6c kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 _raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:140 [inline]
 __wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
 __unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
 sock_recvmsg_nosec net/socket.c:1022 [inline]
 ____sys_recvmsg+0x62c/0x71c net/socket.c:2736
 ___sys_recvmsg net/socket.c:2780 [inline]
 do_recvmmsg+0x364/0x96c net/socket.c:2874
 __sys_recvmmsg net/socket.c:2953 [inline]
 __do_sys_recvmmsg net/socket.c:2976 [inline]
 __se_sys_recvmmsg net/socket.c:2969 [inline]
 __arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 9269
hardirqs last  enabled at (9268): [<ffff8000081a8d64>] handle_softirqs+0x1e0/0xc6c kernel/softirq.c:580
hardirqs last disabled at (9269): [<ffff800011a483b4>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline]
hardirqs last disabled at (9269): [<ffff800011a483b4>] _raw_spin_lock_irq+0x34/0x9c kernel/locking/spinlock.c:170
softirqs last  enabled at (6428): [<ffff8000081a967c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (6428): [<ffff8000081a967c>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (9267): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6614 Comm: syz.3.410 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 424000c5 (nZcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __hlist_del include/linux/list.h:884 [inline]
pc : detach_timer+0x130/0x450 kernel/time/timer.c:880
lr : trace_timer_cancel include/trace/events/timer.h:138 [inline]
lr : debug_deactivate kernel/time/timer.c:832 [inline]
lr : detach_timer+0xf0/0x450 kernel/time/timer.c:878
sp : ffff800008007cd0
x29: ffff800008007cd0 x28: ffff800008007dd0 x27: 1fffe00033ed7af8
x26: 1fffe0001ea76b46 x25: 1fffe0001ea76b45 x24: dfff800000000000
x23: dead000000000122 x22: 0000000000000000 x21: ffff0000f53b5a30
x20: 0000000000000001 x19: ffff0000f53b5a28 x18: ffff800011abbcc0
x17: ffff80018a6a7000 x16: ffff8000082e7de8 x15: 0000000000010001
x14: 0000000000000003 x13: 1ffff00002a180b1 x12: 0000000000ff0100
x11: ff008000083af104 x10: 0000000000000000 x9 : ffff8000083af104
x8 : 0000000000000000 x7 : ffff80000a895800 x6 : ffff80000a895800
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082e7efc
x2 : 0000000000000001 x1 : ffff800011fa9c20 x0 : 0000000000000001
Call trace:
 __hlist_del include/linux/list.h:884 [inline]
 detach_timer+0x130/0x450 kernel/time/timer.c:880
 expire_timers kernel/time/timer.c:1734 [inline]
 __run_timers+0x408/0x6d8 kernel/time/timer.c:2022
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
 handle_softirqs+0x318/0xc6c kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x43c kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 _raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:140 [inline]
 __wake_up_sync_key+0x11c/0x178 kernel/sched/wait.c:208
 __unix_dgram_recvmsg+0x378/0xae8 net/unix/af_unix.c:2478
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2548
 sock_recvmsg_nosec net/socket.c:1022 [inline]
 ____sys_recvmsg+0x62c/0x71c net/socket.c:2736
 ___sys_recvmsg net/socket.c:2780 [inline]
 do_recvmmsg+0x364/0x96c net/socket.c:2874
 __sys_recvmmsg net/socket.c:2953 [inline]
 __do_sys_recvmmsg net/socket.c:2976 [inline]
 __se_sys_recvmmsg net/socket.c:2969 [inline]
 __arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:2969
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 9414a121 f94002b6 d343fec8 (38786908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	aa1503e0 	mov	x0, x21
   4:	9414a121 	bl	0x528488
   8:	f94002b6 	ldr	x22, [x21]
   c:	d343fec8 	lsr	x8, x22, #3
* 10:	38786908 	ldrb	w8, [x8, x24] <-- trapping instruction