=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G             L     
-----------------------------
syz.3.1439/26063 is trying to lock:
ffff88804bde0ee8 (list_mutex){+.+.}-{4:4}, at: spin_lock include/linux/spinlock.h:347 [inline]
ffff88804bde0ee8 (list_mutex){+.+.}-{4:4}, at: tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291
other info that might help us debug this:
context-{3:3}
locks held by syz.3.1439/26063: 4, last CPU#0:
 #0: ffffffff9002df00 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff9002df00 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff9002df00 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_setlink+0x6a7/0xb20 net/core/rtnetlink.c:3535
 #1: ffffffff90114fa8 ((inetaddr_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 kernel/notifier.c:379
 #2: ffff88801b029540 ((wq_completion)events_bh){+.-.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #2: ffff88801b029540 ((wq_completion)events_bh){+.-.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
 #3: ffffc90000007e20 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #3: ffffc90000007e20 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
stack backtrace:
CPU: 0 UID: 0 PID: 26063 Comm: syz.3.1439 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4846 [inline]
 check_wait_context kernel/locking/lockdep.c:4918 [inline]
 __lock_acquire+0xe39/0x2cf0 kernel/locking/lockdep.c:5203
 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
 spin_lock include/linux/spinlock.h:347 [inline]
 tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291
 tcp_tsq_workfn+0x384/0x410 net/ipv4/tcp_output.c:1325
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa88/0x14c0 kernel/workqueue.c:3405
 bh_worker+0x44e/0x840 kernel/workqueue.c:3708
 tasklet_action+0xc/0x70 kernel/softirq.c:997
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 __neigh_ifdown+0x274/0x8c0 net/core/neighbour.c:471
 neigh_ifdown+0x1f/0x30 net/core/neighbour.c:489
 fib_inetaddr_event+0x17c/0x190 net/ipv4/fib_frontend.c:1478
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
 __inet_del_ifa+0xa69/0x1040 net/ipv4/devinet.c:450
 inet_del_ifa net/ipv4/devinet.c:487 [inline]
 inetdev_destroy net/ipv4/devinet.c:328 [inline]
 inetdev_event+0x629/0x15e0 net/ipv4/devinet.c:1655
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_mtu net/core/dev.c:2325 [inline]
 netif_set_mtu_ext+0x5ac/0x830 net/core/dev.c:9902
 do_setlink+0xa81/0x4670 net/core/rtnetlink.c:3178
 rtnl_setlink+0x77d/0xb20 net/core/rtnetlink.c:3545
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 sock_write_iter+0x2de/0x3e0 net/socket.c:1266
 do_iter_readv_writev+0x612/0x8c0 fs/read_write.c:-1
 vfs_writev+0x343/0x990 fs/read_write.c:1058
 do_writev+0x154/0x2e0 fs/read_write.c:1104
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa93679e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa93772e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007fa936a25fa0 RCX: 00007fa93679e0d9
RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000005
RBP: 00007fa936835024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa936a26038 R14: 00007fa936a25fa0 R15: 00007fa936b4fa48
 </TASK>
BUG: workqueue leaked atomic, lock or RCU: syz.3.1439[26063]
     preempt=0x00000101 lock=2->0 RCU=0->0 workfn=tcp_tsq_workfn
INFO: lockdep is turned off.
CPU: 0 UID: 0 PID: 26063 Comm: syz.3.1439 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 process_one_work kernel/workqueue.c:3343 [inline]
 process_scheduled_works+0x114c/0x14c0 kernel/workqueue.c:3405
 bh_worker+0x44e/0x840 kernel/workqueue.c:3708
 tasklet_action+0xc/0x70 kernel/softirq.c:997
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 do_softirq+0x77/0xd0 kernel/softirq.c:546
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 __neigh_ifdown+0x274/0x8c0 net/core/neighbour.c:471
 neigh_ifdown+0x1f/0x30 net/core/neighbour.c:489
 fib_inetaddr_event+0x17c/0x190 net/ipv4/fib_frontend.c:1478
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
 __inet_del_ifa+0xa69/0x1040 net/ipv4/devinet.c:450
 inet_del_ifa net/ipv4/devinet.c:487 [inline]
 inetdev_destroy net/ipv4/devinet.c:328 [inline]
 inetdev_event+0x629/0x15e0 net/ipv4/devinet.c:1655
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_mtu net/core/dev.c:2325 [inline]
 netif_set_mtu_ext+0x5ac/0x830 net/core/dev.c:9902
 do_setlink+0xa81/0x4670 net/core/rtnetlink.c:3178
 rtnl_setlink+0x77d/0xb20 net/core/rtnetlink.c:3545
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 sock_write_iter+0x2de/0x3e0 net/socket.c:1266
 do_iter_readv_writev+0x612/0x8c0 fs/read_write.c:-1
 vfs_writev+0x343/0x990 fs/read_write.c:1058
 do_writev+0x154/0x2e0 fs/read_write.c:1104
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa93679e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa93772e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007fa936a25fa0 RCX: 00007fa93679e0d9
RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000005
RBP: 00007fa936835024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa936a26038 R14: 00007fa936a25fa0 R15: 00007fa936b4fa48
 </TASK>