================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.1.2226/15572 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888027c1a130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline] ffff888027c1a130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754 lock_sock_nested+0x48/0x100 net/core/sock.c:3544 lock_sock include/net/sock.h:1780 [inline] x25_bind+0x20a/0x460 net/x25/af_x25.c:698 __sys_bind+0x2f0/0x3f0 net/socket.c:1856 __do_sys_bind net/socket.c:1867 [inline] __se_sys_bind net/socket.c:1865 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1865 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 5264 hardirqs last enabled at (5264): [] __local_bh_enable_ip+0x13a/0x1c0 kernel/softirq.c:411 hardirqs last disabled at (5263): [] __local_bh_enable_ip+0xdb/0x1c0 kernel/softirq.c:388 softirqs last enabled at (3926): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last enabled at (3926): [] fpregs_lock arch/x86/include/asm/fpu/api.h:72 [inline] softirqs last enabled at (3926): [] fpu_clone+0x282/0xc00 arch/x86/kernel/fpu/core.c:656 softirqs last disabled at (5125): [] __do_softirq kernel/softirq.c:612 [inline] softirqs last disabled at (5125): [] invoke_softirq kernel/softirq.c:452 [inline] softirqs last disabled at (5125): [] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 1 lock held by syz.1.2226/15572: #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x34/0x230 net/core/dev.c:5670 stack backtrace: CPU: 0 PID: 15572 Comm: syz.1.2226 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:4013 mark_lock_irq+0xad/0x900 kernel/locking/lockdep.c:4216 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4678 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xcfc/0x7d80 kernel/locking/lockdep.c:5091 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754 lock_sock_nested+0x48/0x100 net/core/sock.c:3544 lock_sock include/net/sock.h:1780 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671 lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 fb 4e c6 f6 65 8b 05 5c 1d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc90005a87ba0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 5ccdef73fb8f3700 RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 RBP: ffffc90005a87c30 R08: ffffffff8e8c7aef R09: 1ffffffff1d18f5d R10: dffffc0000000000 R11: fffffbfff1d18f5e R12: dffffc0000000000 R13: ffffc90005a87dc0 R14: ffff8880b8e2b740 R15: 1ffff92000b50f74 hrtimer_start_expires include/linux/hrtimer.h:435 [inline] hrtimer_sleeper_start_expires kernel/time/hrtimer.c:2016 [inline] do_nanosleep+0x17e/0x5e0 kernel/time/hrtimer.c:2092 hrtimer_nanosleep+0x175/0x370 kernel/time/hrtimer.c:2143 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1397 [inline] __se_sys_clock_nanosleep+0x30f/0x3a0 kernel/time/posix-timers.c:1374 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f0da3b5e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffc2f54a0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 000055556d9c8500 RCX: 00007f0da3b5e90e RDX: 00007ffc2f54a150 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f0da3e27da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000e8248 R13: 00007f0da3e2618c R14: 00000000000e80f2 R15: 00007f0da3e26180 BUG: sleeping function called from invalid context at net/core/sock.c:3546 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15572, name: syz.1.2226 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 0 PID: 15572 Comm: syz.1.2226 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 lock_sock_nested+0x5d/0x100 net/core/sock.c:3546 lock_sock include/net/sock.h:1780 [inline] x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782 x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5671 lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 fb 4e c6 f6 65 8b 05 5c 1d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc90005a87ba0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 5ccdef73fb8f3700 RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 RBP: ffffc90005a87c30 R08: ffffffff8e8c7aef R09: 1ffffffff1d18f5d R10: dffffc0000000000 R11: fffffbfff1d18f5e R12: dffffc0000000000 R13: ffffc90005a87dc0 R14: ffff8880b8e2b740 R15: 1ffff92000b50f74 hrtimer_start_expires include/linux/hrtimer.h:435 [inline] hrtimer_sleeper_start_expires kernel/time/hrtimer.c:2016 [inline] do_nanosleep+0x17e/0x5e0 kernel/time/hrtimer.c:2092 hrtimer_nanosleep+0x175/0x370 kernel/time/hrtimer.c:2143 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1397 [inline] __se_sys_clock_nanosleep+0x30f/0x3a0 kernel/time/posix-timers.c:1374 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f0da3b5e90e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffc2f54a0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 000055556d9c8500 RCX: 00007f0da3b5e90e RDX: 00007ffc2f54a150 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f0da3e27da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000e8248 R13: 00007f0da3e2618c R14: 00000000000e80f2 R15: 00007f0da3e26180 ---------------- Code disassembly (best guess): 0: c7 44 24 20 00 00 00 movl $0x0,0x20(%rsp) 7: 00 8: 9c pushf 9: 8f 44 24 20 pop 0x20(%rsp) d: f7 44 24 20 00 02 00 testl $0x200,0x20(%rsp) 14: 00 15: 41 c6 04 07 f8 movb $0xf8,(%r15,%rax,1) 1a: 75 4b jne 0x67 1c: f7 c3 00 02 00 00 test $0x200,%ebx 22: 74 01 je 0x25 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 fb 4e c6 f6 call 0xf6c64f2a <-- trapping instruction 2f: 65 8b 05 5c 1d 6d 75 mov %gs:0x756d1d5c(%rip),%eax # 0x756d1d92 36: 85 c0 test %eax,%eax 38: 74 3c je 0x76 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: 04 24 add $0x24,%al 3e: 0e (bad) 3f: 36 ss