=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
sed/6312 is trying to lock:
ffff888021a8a8e8 (&bond->ipsec_lock){+.+.}-{4:4}, at: spin_lock include/linux/spinlock.h:342 [inline]
ffff888021a8a8e8 (&bond->ipsec_lock){+.+.}-{4:4}, at: tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291
other info that might help us debug this:
context-{3:3}
3 locks held by sed/6312:
#0: ffffffff8eca02d0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#0: ffffffff8eca02d0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294
#1: ffff88801b029540 ((wq_completion)events_bh){+.-.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffff88801b029540 ((wq_completion)events_bh){+.-.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
#2: ffffc90000007de0 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#2: ffffc90000007de0 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
stack backtrace:
CPU: 0 UID: 0 PID: 6312 Comm: sed Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xe39/0x2cf0 kernel/locking/lockdep.c:5187
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
spin_lock include/linux/spinlock.h:342 [inline]
tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291
tcp_tsq_workfn+0x384/0x410 net/ipv4/tcp_output.c:1325
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
bh_worker+0x44e/0x840 kernel/workqueue.c:3708
tasklet_action+0xc/0x70 kernel/softirq.c:965
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:198
Code: f7 e8 8d 6d cf f5 f7 c3 00 02 00 00 74 05 e8 60 4e fb f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 81 c0 f5 65 8b 05 1d 51 99 07 85 c0 74 18 5b 41 5e e9 81 48
RSP: 0018:ffffc9001c527a98 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000282 RCX: 0000000080000001
RDX: 0000000000000007 RSI: ffffffff8e22f141 RDI: 0000000000000001
RBP: ffff88801eabeca8 R08: ffffffff90579e37 R09: 1ffffffff20af3c6
R10: dffffc0000000000 R11: fffffbfff20af3c7 R12: 0000000000000000
R13: ffff888077951000 R14: ffffffff9a985438 R15: 0000000000000000
__debug_check_no_obj_freed lib/debugobjects.c:1180 [inline]
debug_check_no_obj_freed+0x39e/0x450 lib/debugobjects.c:1201
__free_pages_prepare mm/page_alloc.c:1413 [inline]
__free_frozen_pages+0x5cc/0xd10 mm/page_alloc.c:2950
__slab_free+0x274/0x2c0 mm/slub.c:5741
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4931
alloc_filename fs/namei.c:147 [inline]
do_getname+0x2e/0x250 fs/namei.c:187
class_filename_flags_constructor include/linux/fs.h:2566 [inline]
do_sys_openat2+0xcc/0x200 fs/open.c:1367
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feac535c407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcec909a30 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007feac520cc80 RCX: 00007feac535c407
RDX: 0000000000000000 RSI: 00007ffcec90ae71 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007feac555b492
R13: 00007feac555b492 R14: 0000000000000001 R15: 0000000000000000
BUG: workqueue leaked atomic, lock or RCU: sed[6312]
preempt=0x00000101 lock=1->0 RCU=0->0 workfn=tcp_tsq_workfn
INFO: lockdep is turned off.
CPU: 0 UID: 0 PID: 6312 Comm: sed Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
process_one_work kernel/workqueue.c:3343 [inline]
process_scheduled_works+0x1161/0x14e0 kernel/workqueue.c:3405
bh_worker+0x44e/0x840 kernel/workqueue.c:3708
tasklet_action+0xc/0x70 kernel/softirq.c:965
handle_softirqs+0x225/0x840 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:198
Code: f7 e8 8d 6d cf f5 f7 c3 00 02 00 00 74 05 e8 60 4e fb f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 81 c0 f5 65 8b 05 1d 51 99 07 85 c0 74 18 5b 41 5e e9 81 48
RSP: 0018:ffffc9001c527a98 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000282 RCX: 0000000080000001
RDX: 0000000000000007 RSI: ffffffff8e22f141 RDI: 0000000000000001
RBP: ffff88801eabeca8 R08: ffffffff90579e37 R09: 1ffffffff20af3c6
R10: dffffc0000000000 R11: fffffbfff20af3c7 R12: 0000000000000000
R13: ffff888077951000 R14: ffffffff9a985438 R15: 0000000000000000
__debug_check_no_obj_freed lib/debugobjects.c:1180 [inline]
debug_check_no_obj_freed+0x39e/0x450 lib/debugobjects.c:1201
__free_pages_prepare mm/page_alloc.c:1413 [inline]
__free_frozen_pages+0x5cc/0xd10 mm/page_alloc.c:2950
__slab_free+0x274/0x2c0 mm/slub.c:5741
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4931
alloc_filename fs/namei.c:147 [inline]
do_getname+0x2e/0x250 fs/namei.c:187
class_filename_flags_constructor include/linux/fs.h:2566 [inline]
do_sys_openat2+0xcc/0x200 fs/open.c:1367
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feac535c407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcec909a30 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007feac520cc80 RCX: 00007feac535c407
RDX: 0000000000000000 RSI: 00007ffcec90ae71 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007feac555b492
R13: 00007feac555b492 R14: 0000000000000001 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: f7 e8 imul %eax
2: 8d 6d cf lea -0x31(%rbp),%ebp
5: f5 cmc
6: f7 c3 00 02 00 00 test $0x200,%ebx
c: 74 05 je 0x13
e: e8 60 4e fb f5 call 0xf5fb4e73
13: 9c pushf
14: 58 pop %rax
15: a9 00 02 00 00 test $0x200,%eax
1a: 75 27 jne 0x43
1c: f7 c3 00 02 00 00 test $0x200,%ebx
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 24 81 c0 f5 call 0xf5c08153 <-- trapping instruction
2f: 65 8b 05 1d 51 99 07 mov %gs:0x799511d(%rip),%eax # 0x7995153
36: 85 c0 test %eax,%eax
38: 74 18 je 0x52
3a: 5b pop %rbx
3b: 41 5e pop %r14
3d: e9 .byte 0xe9
3e: 81 .byte 0x81
3f: 48 rex.W