Extracting prog: 3m58.39050106s
Minimizing prog: 23m16.996213215s
Simplifying prog options: 0s
Extracting C: 3m38.329410506s
Simplifying C: 12m14.627029954s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)

program did not crash
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program did not crash
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
ioctl(0xffffffffffffffff, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(0xffffffffffffffff, &(0x7f0000000080), 0x12)
connect$x25(0xffffffffffffffff, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, 0x0)
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140))
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, 0x0, 0x0)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=2m29.276507382s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
simplifying C reproducer
testing compiled C program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
validation run: crashed=true
testing program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
validation run: crashed=true
testing program (duration=2m29.276507382s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
validation run: crashed=true
reproducing took 49m50.695691132s
repro crashed as (corrupted=false):
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
kworker/u8:1/13 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff88807f38a260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
ffff88807f38a260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
  lock_sock_nested+0x41/0x100 net/core/sock.c:3830
  lock_sock include/net/sock.h:1713 [inline]
  x25_bind+0x209/0x450 net/x25/af_x25.c:694
  __sys_bind_socket net/socket.c:1944 [inline]
  __sys_bind+0x2e3/0x410 net/socket.c:1975
  __do_sys_bind net/socket.c:1980 [inline]
  __se_sys_bind net/socket.c:1978 [inline]
  __x64_sys_bind+0x7a/0x90 net/socket.c:1978
  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
irq event stamp: 126118
hardirqs last  enabled at (126118): [<ffffffff8188ee86>] __local_bh_enable_ip+0xd6/0x140 kernel/softirq.c:478
hardirqs last disabled at (126117): [<ffffffff8188ee22>] __local_bh_enable_ip+0x72/0x140 kernel/softirq.c:455
softirqs last  enabled at (125458): [<ffffffff87584864>] spin_unlock_bh include/linux/spinlock.h:407 [inline]
softirqs last  enabled at (125458): [<ffffffff87584864>] nsim_dev_trap_report drivers/net/netdevsim/dev.c:816 [inline]
softirqs last  enabled at (125458): [<ffffffff87584864>] nsim_dev_trap_report_work+0x7a4/0xb40 drivers/net/netdevsim/dev.c:847
softirqs last disabled at (126059): [<ffffffff8188fb2b>] __do_softirq kernel/softirq.c:679 [inline]
softirqs last disabled at (126059): [<ffffffff8188fb2b>] invoke_softirq kernel/softirq.c:519 [inline]
softirqs last disabled at (126059): [<ffffffff8188fb2b>] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_X25);
  <Interrupt>
    lock(sk_lock-AF_X25);

 *** DEADLOCK ***

locks held by kworker/u8:1/13: 7, last CPU#1:
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #2: ffff88807fe4e0e8 (&type->s_umount_key#35){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 fs/super.c:688
 #3: ffff88807fe4cc98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: percpu_down_read include/linux/percpu-rwsem.h:77 [inline]
 #3: ffff88807fe4cc98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1887 [inline]
 #3: ffff88807fe4cc98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x205/0x3b0 fs/ext4/inode.c:3031
 #4: ffff88807fe4a938 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fbf/0x2200 fs/jbd2/transaction.c:444
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: filemap_get_folios_tag+0x118/0x720 mm/filemap.c:2352
 #6: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #6: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #6: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x33/0x2b0 net/core/dev.c:6288

stack backtrace:
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_usage_bug+0x28c/0x2e0 kernel/locking/lockdep.c:4086
 valid_state+0xbe/0xf0 kernel/locking/lockdep.c:4100
 mark_lock_irq+0x36/0x380 kernel/locking/lockdep.c:4311
 mark_lock+0x117/0x190 kernel/locking/lockdep.c:4797
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0x71e/0x2de0 kernel/locking/lockdep.c:5242
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 lock_sock_nested+0x41/0x100 net/core/sock.c:3830
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778
 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6289
 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100
 __napi_poll+0xaa/0x330 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8007
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:folio_batch_add include/linux/folio_batch.h:77 [inline]
RIP: 0010:filemap_get_folios_tag+0x349/0x720 mm/filemap.c:2361
Code: 89 f7 e8 1a d2 ff ff 49 39 c7 8b 5c 24 1c 0f 85 b5 00 00 00 4d 85 ff 4d 89 ec 0f 84 7d 01 00 00 48 8b 44 24 48 42 0f b6 04 20 <84> c0 0f 85 da 00 00 00 48 8b 44 24 20 0f b6 18 44 8d 73 01 44 88
RSP: 0018:ffffc90000126860 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88801e2a5dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000126990 R08: ffffea00004c70f7 R09: 1ffffd4000098e1e
R10: dffffc0000000000 R11: fffff94000098e1f R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffc900001268e0 R15: ffffea00004c70c0
 mpage_prepare_extent_to_map+0x507/0x1890 fs/ext4/inode.c:2634
 ext4_do_writepages+0x105d/0x4770 fs/ext4/inode.c:2936
 ext4_writepages+0x241/0x3b0 fs/ext4/inode.c:3032
 do_writepages+0x338/0x560 mm/page-writeback.c:2560
 __writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1788
 writeback_sb_inodes+0x9de/0x1b00 fs/fs-writeback.c:2099
 __writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2175
 wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2286
 wb_check_old_data_flush fs/fs-writeback.c:2390 [inline]
 wb_do_writeback fs/fs-writeback.c:2469 [inline]
 wb_workfn+0xc92/0x10f0 fs/fs-writeback.c:2497
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
BUG: sleeping function called from invalid context at net/core/sock.c:3832
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 13, name: kworker/u8:1
preempt_count: 100, expected: 0
RCU nest depth: 2, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff8188f08b>] softirq_handle_begin kernel/softirq.c:486 [inline]
[<ffffffff8188f08b>] handle_softirqs+0xab/0x860 kernel/softirq.c:621
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9256
 lock_sock_nested+0x56/0x100 net/core/sock.c:3832
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778
 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6289
 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100
 __napi_poll+0xaa/0x330 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8007
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:folio_batch_add include/linux/folio_batch.h:77 [inline]
RIP: 0010:filemap_get_folios_tag+0x349/0x720 mm/filemap.c:2361
Code: 89 f7 e8 1a d2 ff ff 49 39 c7 8b 5c 24 1c 0f 85 b5 00 00 00 4d 85 ff 4d 89 ec 0f 84 7d 01 00 00 48 8b 44 24 48 42 0f b6 04 20 <84> c0 0f 85 da 00 00 00 48 8b 44 24 20 0f b6 18 44 8d 73 01 44 88
RSP: 0018:ffffc90000126860 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88801e2a5dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000126990 R08: ffffea00004c70f7 R09: 1ffffd4000098e1e
R10: dffffc0000000000 R11: fffff94000098e1f R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffc900001268e0 R15: ffffea00004c70c0
 mpage_prepare_extent_to_map+0x507/0x1890 fs/ext4/inode.c:2634
 ext4_do_writepages+0x105d/0x4770 fs/ext4/inode.c:2936
 ext4_writepages+0x241/0x3b0 fs/ext4/inode.c:3032
 do_writepages+0x338/0x560 mm/page-writeback.c:2560
 __writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1788
 writeback_sb_inodes+0x9de/0x1b00 fs/fs-writeback.c:2099
 __writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2175
 wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2286
 wb_check_old_data_flush fs/fs-writeback.c:2390 [inline]
 wb_do_writeback fs/fs-writeback.c:2469 [inline]
 wb_workfn+0xc92/0x10f0 fs/fs-writeback.c:2497
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 f7                	mov    %esi,%edi
   2:	e8 1a d2 ff ff       	call   0xffffd221
   7:	49 39 c7             	cmp    %rax,%r15
   a:	8b 5c 24 1c          	mov    0x1c(%rsp),%ebx
   e:	0f 85 b5 00 00 00    	jne    0xc9
  14:	4d 85 ff             	test   %r15,%r15
  17:	4d 89 ec             	mov    %r13,%r12
  1a:	0f 84 7d 01 00 00    	je     0x19d
  20:	48 8b 44 24 48       	mov    0x48(%rsp),%rax
  25:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	0f 85 da 00 00 00    	jne    0x10c
  32:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
  37:	0f b6 18             	movzbl (%rax),%ebx
  3a:	44 8d 73 01          	lea    0x1(%rbx),%r14d
  3e:	44                   	rex.R
  3f:	88                   	.byte 0x88

final repro crashed as (corrupted=false):
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
kworker/u8:1/13 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff88807f38a260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
ffff88807f38a260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
  lock_sock_nested+0x41/0x100 net/core/sock.c:3830
  lock_sock include/net/sock.h:1713 [inline]
  x25_bind+0x209/0x450 net/x25/af_x25.c:694
  __sys_bind_socket net/socket.c:1944 [inline]
  __sys_bind+0x2e3/0x410 net/socket.c:1975
  __do_sys_bind net/socket.c:1980 [inline]
  __se_sys_bind net/socket.c:1978 [inline]
  __x64_sys_bind+0x7a/0x90 net/socket.c:1978
  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
irq event stamp: 126118
hardirqs last  enabled at (126118): [<ffffffff8188ee86>] __local_bh_enable_ip+0xd6/0x140 kernel/softirq.c:478
hardirqs last disabled at (126117): [<ffffffff8188ee22>] __local_bh_enable_ip+0x72/0x140 kernel/softirq.c:455
softirqs last  enabled at (125458): [<ffffffff87584864>] spin_unlock_bh include/linux/spinlock.h:407 [inline]
softirqs last  enabled at (125458): [<ffffffff87584864>] nsim_dev_trap_report drivers/net/netdevsim/dev.c:816 [inline]
softirqs last  enabled at (125458): [<ffffffff87584864>] nsim_dev_trap_report_work+0x7a4/0xb40 drivers/net/netdevsim/dev.c:847
softirqs last disabled at (126059): [<ffffffff8188fb2b>] __do_softirq kernel/softirq.c:679 [inline]
softirqs last disabled at (126059): [<ffffffff8188fb2b>] invoke_softirq kernel/softirq.c:519 [inline]
softirqs last disabled at (126059): [<ffffffff8188fb2b>] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_X25);
  <Interrupt>
    lock(sk_lock-AF_X25);

 *** DEADLOCK ***

locks held by kworker/u8:1/13: 7, last CPU#1:
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff888020ad7940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc90000127c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #2: ffff88807fe4e0e8 (&type->s_umount_key#35){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 fs/super.c:688
 #3: ffff88807fe4cc98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: percpu_down_read include/linux/percpu-rwsem.h:77 [inline]
 #3: ffff88807fe4cc98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1887 [inline]
 #3: ffff88807fe4cc98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x205/0x3b0 fs/ext4/inode.c:3031
 #4: ffff88807fe4a938 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fbf/0x2200 fs/jbd2/transaction.c:444
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #5: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: filemap_get_folios_tag+0x118/0x720 mm/filemap.c:2352
 #6: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #6: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #6: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x33/0x2b0 net/core/dev.c:6288

stack backtrace:
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_usage_bug+0x28c/0x2e0 kernel/locking/lockdep.c:4086
 valid_state+0xbe/0xf0 kernel/locking/lockdep.c:4100
 mark_lock_irq+0x36/0x380 kernel/locking/lockdep.c:4311
 mark_lock+0x117/0x190 kernel/locking/lockdep.c:4797
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0x71e/0x2de0 kernel/locking/lockdep.c:5242
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 lock_sock_nested+0x41/0x100 net/core/sock.c:3830
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778
 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6289
 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100
 __napi_poll+0xaa/0x330 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8007
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:folio_batch_add include/linux/folio_batch.h:77 [inline]
RIP: 0010:filemap_get_folios_tag+0x349/0x720 mm/filemap.c:2361
Code: 89 f7 e8 1a d2 ff ff 49 39 c7 8b 5c 24 1c 0f 85 b5 00 00 00 4d 85 ff 4d 89 ec 0f 84 7d 01 00 00 48 8b 44 24 48 42 0f b6 04 20 <84> c0 0f 85 da 00 00 00 48 8b 44 24 20 0f b6 18 44 8d 73 01 44 88
RSP: 0018:ffffc90000126860 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88801e2a5dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000126990 R08: ffffea00004c70f7 R09: 1ffffd4000098e1e
R10: dffffc0000000000 R11: fffff94000098e1f R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffc900001268e0 R15: ffffea00004c70c0
 mpage_prepare_extent_to_map+0x507/0x1890 fs/ext4/inode.c:2634
 ext4_do_writepages+0x105d/0x4770 fs/ext4/inode.c:2936
 ext4_writepages+0x241/0x3b0 fs/ext4/inode.c:3032
 do_writepages+0x338/0x560 mm/page-writeback.c:2560
 __writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1788
 writeback_sb_inodes+0x9de/0x1b00 fs/fs-writeback.c:2099
 __writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2175
 wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2286
 wb_check_old_data_flush fs/fs-writeback.c:2390 [inline]
 wb_do_writeback fs/fs-writeback.c:2469 [inline]
 wb_workfn+0xc92/0x10f0 fs/fs-writeback.c:2497
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
BUG: sleeping function called from invalid context at net/core/sock.c:3832
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 13, name: kworker/u8:1
preempt_count: 100, expected: 0
RCU nest depth: 2, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff8188f08b>] softirq_handle_begin kernel/softirq.c:486 [inline]
[<ffffffff8188f08b>] handle_softirqs+0xab/0x860 kernel/softirq.c:621
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9256
 lock_sock_nested+0x56/0x100 net/core/sock.c:3832
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1778
 x25_lapb_receive_frame+0x1b0/0xfb0 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 netif_receive_skb_core+0x2a6/0x2b0 net/core/dev.c:6289
 lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:100
 __napi_poll+0xaa/0x330 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:8007
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:folio_batch_add include/linux/folio_batch.h:77 [inline]
RIP: 0010:filemap_get_folios_tag+0x349/0x720 mm/filemap.c:2361
Code: 89 f7 e8 1a d2 ff ff 49 39 c7 8b 5c 24 1c 0f 85 b5 00 00 00 4d 85 ff 4d 89 ec 0f 84 7d 01 00 00 48 8b 44 24 48 42 0f b6 04 20 <84> c0 0f 85 da 00 00 00 48 8b 44 24 20 0f b6 18 44 8d 73 01 44 88
RSP: 0018:ffffc90000126860 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88801e2a5dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000126990 R08: ffffea00004c70f7 R09: 1ffffd4000098e1e
R10: dffffc0000000000 R11: fffff94000098e1f R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffc900001268e0 R15: ffffea00004c70c0
 mpage_prepare_extent_to_map+0x507/0x1890 fs/ext4/inode.c:2634
 ext4_do_writepages+0x105d/0x4770 fs/ext4/inode.c:2936
 ext4_writepages+0x241/0x3b0 fs/ext4/inode.c:3032
 do_writepages+0x338/0x560 mm/page-writeback.c:2560
 __writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1788
 writeback_sb_inodes+0x9de/0x1b00 fs/fs-writeback.c:2099
 __writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2175
 wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2286
 wb_check_old_data_flush fs/fs-writeback.c:2390 [inline]
 wb_do_writeback fs/fs-writeback.c:2469 [inline]
 wb_workfn+0xc92/0x10f0 fs/fs-writeback.c:2497
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 f7                	mov    %esi,%edi
   2:	e8 1a d2 ff ff       	call   0xffffd221
   7:	49 39 c7             	cmp    %rax,%r15
   a:	8b 5c 24 1c          	mov    0x1c(%rsp),%ebx
   e:	0f 85 b5 00 00 00    	jne    0xc9
  14:	4d 85 ff             	test   %r15,%r15
  17:	4d 89 ec             	mov    %r13,%r12
  1a:	0f 84 7d 01 00 00    	je     0x19d
  20:	48 8b 44 24 48       	mov    0x48(%rsp),%rax
  25:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	0f 85 da 00 00 00    	jne    0x10c
  32:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
  37:	0f b6 18             	movzbl (%rax),%ebx
  3a:	44 8d 73 01          	lea    0x1(%rbx),%r14d
  3e:	44                   	rex.R
  3f:	88                   	.byte 0x88