================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. kworker/0:12/4764 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88805c70e130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x83/0x120 net/x25/af_x25.c:1781 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 lock_sock_nested+0x44/0x100 net/core/sock.c:3505 lock_sock include/net/sock.h:1805 [inline] x25_bind+0x1aa/0x3e0 net/x25/af_x25.c:698 __sys_bind+0x2e9/0x3e0 net/socket.c:1811 __do_sys_bind net/socket.c:1822 [inline] __se_sys_bind net/socket.c:1820 [inline] __x64_sys_bind+0x76/0x80 net/socket.c:1820 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 40448 hardirqs last enabled at (40448): [] __local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:426 hardirqs last disabled at (40447): [] __local_bh_enable_ip+0xd7/0x1c0 kernel/softirq.c:403 softirqs last enabled at (40388): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last enabled at (40388): [] rcu_read_lock_bh include/linux/rcupdate.h:843 [inline] softirqs last enabled at (40388): [] __dev_queue_xmit+0x281/0x3810 net/core/dev.c:4294 softirqs last disabled at (40389): [] do_softirq+0x142/0x210 kernel/softirq.c:497 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 6 locks held by kworker/0:12/4764: #0: ffff88802f575538 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90005ee7d00 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffff88807cf5b538 (&idev->mc_lock){+.+.}-{3:3}, at: mld_ifc_work+0x29/0xab0 net/ipv6/mcast.c:2689 #3: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #3: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #3: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: mld_sendpack+0x205/0xe10 net/ipv6/mcast.c:1825 #4: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #4: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #4: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: ip6_finish_output2+0x58f/0x15c0 net/ipv6/ip6_output.c:123 #5: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #5: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #5: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x30/0x230 net/core/dev.c:5643 stack backtrace: CPU: 0 PID: 4764 Comm: kworker/0:12 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: mld mld_ifc_work Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3974 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4177 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4633 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xce0/0x7c40 kernel/locking/lockdep.c:5017 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 lock_sock_nested+0x44/0x100 net/core/sock.c:3505 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x83/0x120 net/x25/af_x25.c:1781 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 do_softirq+0x142/0x210 kernel/softirq.c:497 __local_bh_enable_ip+0x180/0x1c0 kernel/softirq.c:421 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline] __dev_queue_xmit+0x1d84/0x3810 net/core/dev.c:4411 neigh_output include/net/neighbour.h:545 [inline] ip6_finish_output2+0xdc6/0x15c0 net/ipv6/ip6_output.c:138 dst_output include/net/dst.h:453 [inline] NF_HOOK+0x161/0x4a0 include/linux/netfilter.h:302 mld_sendpack+0x85a/0xe10 net/ipv6/mcast.c:1853 mld_send_cr net/ipv6/mcast.c:2152 [inline] mld_ifc_work+0x83a/0xab0 net/ipv6/mcast.c:2690 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 vkms_vblank_simulate: vblank timer overrun BUG: sleeping function called from invalid context at net/core/sock.c:3507 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4764, name: kworker/0:12 preempt_count: 101, expected: 0 RCU nest depth: 3, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] local_bh_disable include/linux/bottom_half.h:20 [inline] [] rcu_read_lock_bh include/linux/rcupdate.h:843 [inline] [] __dev_queue_xmit+0x28e/0x3810 net/core/dev.c:4294 CPU: 0 PID: 4764 Comm: kworker/0:12 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: mld mld_ifc_work Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 __might_resched+0x489/0x5f0 kernel/sched/core.c:9970 lock_sock_nested+0x59/0x100 net/core/sock.c:3507 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x83/0x120 net/x25/af_x25.c:1781 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 do_softirq+0x142/0x210 kernel/softirq.c:497 __local_bh_enable_ip+0x180/0x1c0 kernel/softirq.c:421 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline] __dev_queue_xmit+0x1d84/0x3810 net/core/dev.c:4411 neigh_output include/net/neighbour.h:545 [inline] ip6_finish_output2+0xdc6/0x15c0 net/ipv6/ip6_output.c:138 dst_output include/net/dst.h:453 [inline] NF_HOOK+0x161/0x4a0 include/linux/netfilter.h:302 mld_sendpack+0x85a/0xe10 net/ipv6/mcast.c:1853 mld_send_cr net/ipv6/mcast.c:2152 [inline] mld_ifc_work+0x83a/0xab0 net/ipv6/mcast.c:2690 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 vkms_vblank_simulate: vblank timer overrun