================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. kworker/0:0/7 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff8880563c4130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] ffff8880563c4130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678 lock_sock_nested+0x44/0x100 net/core/sock.c:3504 lock_sock include/net/sock.h:1805 [inline] x25_listen+0x43/0x170 net/x25/af_x25.c:484 __sys_listen+0x19d/0x220 net/socket.c:1845 __do_sys_listen net/socket.c:1854 [inline] __se_sys_listen net/socket.c:1852 [inline] __x64_sys_listen+0x56/0x60 net/socket.c:1852 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 465812 hardirqs last enabled at (465812): [] __local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:426 hardirqs last disabled at (465811): [] __local_bh_enable_ip+0xd7/0x1c0 kernel/softirq.c:403 softirqs last enabled at (465542): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (465542): [] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] softirqs last enabled at (465542): [] wg_packet_encrypt_worker+0x2d2/0x1550 drivers/net/wireguard/send.c:293 softirqs last disabled at (465547): [] __do_softirq kernel/softirq.c:630 [inline] softirqs last disabled at (465547): [] invoke_softirq kernel/softirq.c:470 [inline] softirqs last disabled at (465547): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 3 locks held by kworker/0:0/7: #0: ffff8880277b6538 ((wq_completion)wg-crypt-wg1#23){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc900000c7d00 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((typeof(*((worker))) *)((worker))); (typeof((typeof(*((worker))) *)((worker)))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8cb2d7e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #2: ffffffff8cb2d7e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #2: ffffffff8cb2d7e0 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x30/0x230 net/core/dev.c:5643 stack backtrace: CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: wg-crypt-wg1 wg_packet_encrypt_worker Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3974 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4177 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4633 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xce0/0x7c40 kernel/locking/lockdep.c:5017 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678 lock_sock_nested+0x44/0x100 net/core/sock.c:3504 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:queue_work_on+0x1a0/0x1f0 kernel/workqueue.c:1553 Code: 4d 85 e4 75 16 e8 90 0e 2e 00 eb 15 e8 89 0e 2e 00 e8 04 64 de 08 4d 85 e4 74 ea e8 7a 0e 2e 00 fb 48 c7 44 24 20 0e 36 e0 45 <48> b8 00 00 00 00 00 fc ff df 49 c7 44 05 00 00 00 00 00 41 c7 44 RSP: 0018:ffffc900000c75e0 EFLAGS: 00000293 RAX: ffffffff81542466 RBX: 0000000000000000 RCX: ffff88813fe93c00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900000c76a8 R08: ffffffff90b0f337 R09: 1ffffffff2161e66 R10: dffffc0000000000 R11: fffffbfff2161e67 R12: 0000000000000200 R13: 1ffff92000018ec0 R14: 0000000000000000 R15: 0000000000000001 wg_queue_enqueue_per_peer_tx+0x1e9/0x490 drivers/net/wireguard/queueing.h:188 wg_packet_encrypt_worker+0x1195/0x1550 drivers/net/wireguard/send.c:305 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 BUG: sleeping function called from invalid context at net/core/sock.c:3506 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 7, name: kworker/0:0 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:434 [inline] [] handle_softirqs+0xfd/0x910 kernel/softirq.c:572 CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: wg-crypt-wg1 wg_packet_encrypt_worker Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 __might_resched+0x489/0x5f0 kernel/sched/core.c:9970 lock_sock_nested+0x59/0x100 net/core/sock.c:3506 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:queue_work_on+0x1a0/0x1f0 kernel/workqueue.c:1553 Code: 4d 85 e4 75 16 e8 90 0e 2e 00 eb 15 e8 89 0e 2e 00 e8 04 64 de 08 4d 85 e4 74 ea e8 7a 0e 2e 00 fb 48 c7 44 24 20 0e 36 e0 45 <48> b8 00 00 00 00 00 fc ff df 49 c7 44 05 00 00 00 00 00 41 c7 44 RSP: 0018:ffffc900000c75e0 EFLAGS: 00000293 RAX: ffffffff81542466 RBX: 0000000000000000 RCX: ffff88813fe93c00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900000c76a8 R08: ffffffff90b0f337 R09: 1ffffffff2161e66 R10: dffffc0000000000 R11: fffffbfff2161e67 R12: 0000000000000200 R13: 1ffff92000018ec0 R14: 0000000000000000 R15: 0000000000000001 wg_queue_enqueue_per_peer_tx+0x1e9/0x490 drivers/net/wireguard/queueing.h:188 wg_packet_encrypt_worker+0x1195/0x1550 drivers/net/wireguard/send.c:305 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 4d 85 e4 test %r12,%r12 3: 75 16 jne 0x1b 5: e8 90 0e 2e 00 call 0x2e0e9a a: eb 15 jmp 0x21 c: e8 89 0e 2e 00 call 0x2e0e9a 11: e8 04 64 de 08 call 0x8de641a 16: 4d 85 e4 test %r12,%r12 19: 74 ea je 0x5 1b: e8 7a 0e 2e 00 call 0x2e0e9a 20: fb sti 21: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp) 28: e0 45 * 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction 31: fc ff df 34: 49 c7 44 05 00 00 00 movq $0x0,0x0(%r13,%rax,1) 3b: 00 00 3d: 41 rex.B 3e: c7 .byte 0xc7 3f: 44 rex.R