================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.1.1302/11138 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff8880242ba130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline] ffff8880242ba130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754 lock_sock_nested+0x48/0x100 net/core/sock.c:3544 lock_sock include/net/sock.h:1780 [inline] x25_bind+0x20a/0x460 net/x25/af_x25.c:698 __sys_bind+0x2f0/0x3f0 net/socket.c:1856 __do_sys_bind net/socket.c:1867 [inline] __se_sys_bind net/socket.c:1865 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1865 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 27078 hardirqs last enabled at (27078): [] __local_bh_enable_ip+0x13a/0x1c0 kernel/softirq.c:411 hardirqs last disabled at (27077): [] __local_bh_enable_ip+0xdb/0x1c0 kernel/softirq.c:388 softirqs last enabled at (23056): [] __do_softirq kernel/softirq.c:612 [inline] softirqs last enabled at (23056): [] invoke_softirq kernel/softirq.c:452 [inline] softirqs last enabled at (23056): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 softirqs last disabled at (27005): [] __do_softirq kernel/softirq.c:612 [inline] softirqs last disabled at (27005): [] invoke_softirq kernel/softirq.c:452 [inline] softirqs last disabled at (27005): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 3 locks held by syz.1.1302/11138: #0: ffff88807db23aa0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:146 [inline] #0: ffff88807db23aa0 (&mm->mmap_lock){++++}-{3:3}, at: __mm_populate+0x183/0x390 mm/gup.c:1675 #1: ffff8880b8e36c78 (lock#4){+.+.}-{2:2}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline] #1: ffff8880b8e36c78 (lock#4){+.+.}-{2:2}, at: folio_add_lru+0x323/0xce0 mm/swap.c:507 #2: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #2: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #2: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x34/0x230 net/core/dev.c:5670 stack backtrace: CPU: 0 PID: 11138 Comm: syz.1.1302 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:4013 mark_lock_irq+0xad/0x900 kernel/locking/lockdep.c:4216 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4678 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xcfc/0x7d80 kernel/locking/lockdep.c:5091 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754 lock_sock_nested+0x48/0x100 net/core/sock.c:3544 lock_sock include/net/sock.h:1780 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671 lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 fb 4e c6 f6 65 8b 05 5c 1d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc9000436f4c0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 4a688f20556bea00 RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 RBP: ffffc9000436f550 R08: ffffffff911eb547 R09: 1ffffffff223d6a8 R10: dffffc0000000000 R11: fffffbfff223d6a9 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff8880782b8050 R15: 1ffff9200086de98 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] unlock_page_lruvec_irqrestore include/linux/memcontrol.h:1618 [inline] folio_batch_move_lru+0x546/0x660 mm/swap.c:215 folio_add_lru+0x41c/0xce0 mm/swap.c:509 shmem_get_folio_gfp+0x1124/0x2b40 mm/shmem.c:2077 shmem_fault+0x1b8/0x820 mm/shmem.c:2248 __do_fault+0x13b/0x4d0 mm/memory.c:4244 do_read_fault mm/memory.c:4638 [inline] do_fault mm/memory.c:4775 [inline] do_pte_missing mm/memory.c:3689 [inline] handle_pte_fault mm/memory.c:5047 [inline] __handle_mm_fault mm/memory.c:5188 [inline] handle_mm_fault+0x3945/0x4a50 mm/memory.c:5353 faultin_page mm/gup.c:868 [inline] __get_user_pages+0x604/0x1580 mm/gup.c:1167 populate_vma_page_range+0x2c1/0x380 mm/gup.c:1593 __mm_populate+0x260/0x390 mm/gup.c:1696 mm_populate include/linux/mm.h:3383 [inline] vm_mmap_pgoff+0x2da/0x3f0 mm/util.c:561 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fa69c59e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa69d455028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007fa69c825fa0 RCX: 00007fa69c59e0d9 RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 RBP: 00007fa69c635024 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa69c826038 R14: 00007fa69c825fa0 R15: 00007ffd3f63adc8 BUG: sleeping function called from invalid context at net/core/sock.c:3546 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 11138, name: syz.1.1302 preempt_count: 102, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] folio_add_lru+0x2d0/0xce0 mm/swap.c:507 CPU: 0 PID: 11138 Comm: syz.1.1302 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 lock_sock_nested+0x5d/0x100 net/core/sock.c:3546 lock_sock include/net/sock.h:1780 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671 lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 fb 4e c6 f6 65 8b 05 5c 1d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc9000436f4c0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 4a688f20556bea00 RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 RBP: ffffc9000436f550 R08: ffffffff911eb547 R09: 1ffffffff223d6a8 R10: dffffc0000000000 R11: fffffbfff223d6a9 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff8880782b8050 R15: 1ffff9200086de98 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] unlock_page_lruvec_irqrestore include/linux/memcontrol.h:1618 [inline] folio_batch_move_lru+0x546/0x660 mm/swap.c:215 folio_add_lru+0x41c/0xce0 mm/swap.c:509 shmem_get_folio_gfp+0x1124/0x2b40 mm/shmem.c:2077 shmem_fault+0x1b8/0x820 mm/shmem.c:2248 __do_fault+0x13b/0x4d0 mm/memory.c:4244 do_read_fault mm/memory.c:4638 [inline] do_fault mm/memory.c:4775 [inline] do_pte_missing mm/memory.c:3689 [inline] handle_pte_fault mm/memory.c:5047 [inline] __handle_mm_fault mm/memory.c:5188 [inline] handle_mm_fault+0x3945/0x4a50 mm/memory.c:5353 faultin_page mm/gup.c:868 [inline] __get_user_pages+0x604/0x1580 mm/gup.c:1167 populate_vma_page_range+0x2c1/0x380 mm/gup.c:1593 __mm_populate+0x260/0x390 mm/gup.c:1696 mm_populate include/linux/mm.h:3383 [inline] vm_mmap_pgoff+0x2da/0x3f0 mm/util.c:561 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fa69c59e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa69d455028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007fa69c825fa0 RCX: 00007fa69c59e0d9 RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 RBP: 00007fa69c635024 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa69c826038 R14: 00007fa69c825fa0 R15: 00007ffd3f63adc8 ---------------- Code disassembly (best guess): 0: c7 44 24 20 00 00 00 movl $0x0,0x20(%rsp) 7: 00 8: 9c pushf 9: 8f 44 24 20 pop 0x20(%rsp) d: f7 44 24 20 00 02 00 testl $0x200,0x20(%rsp) 14: 00 15: 41 c6 04 07 f8 movb $0xf8,(%r15,%rax,1) 1a: 75 4b jne 0x67 1c: f7 c3 00 02 00 00 test $0x200,%ebx 22: 74 01 je 0x25 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 fb 4e c6 f6 call 0xf6c64f2a <-- trapping instruction 2f: 65 8b 05 5c 1d 6d 75 mov %gs:0x756d1d5c(%rip),%eax # 0x756d1d92 36: 85 c0 test %eax,%eax 38: 74 3c je 0x76 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: 04 24 add $0x24,%al 3e: 0e (bad) 3f: 36 ss