syzbot
inconsistent lock state in x25_kill_by_neigh
Status:
upstream: reported C repro on 2026/08/29 16:35
Reported-by: syzbot+628a7c9a2093bde0446b@syzkaller.appspotmail.com
First crash: 3d02h, last: 2d17h
Sample crash report:
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff888025eb2130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
ffff888025eb2130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3543
lock_sock include/net/sock.h:1780 [inline]
x25_bind+0x20a/0x460 net/x25/af_x25.c:698
__sys_bind+0x2f0/0x3f0 net/socket.c:1856
__do_sys_bind net/socket.c:1867 [inline]
__se_sys_bind net/socket.c:1865 [inline]
__x64_sys_bind+0x7a/0x90 net/socket.c:1865
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
irq event stamp: 433934
hardirqs last enabled at (433934): [<ffffffff8152ccba>] __local_bh_enable_ip+0x13a/0x1c0 kernel/softirq.c:411
hardirqs last disabled at (433933): [<ffffffff8152cc5b>] __local_bh_enable_ip+0xdb/0x1c0 kernel/softirq.c:388
softirqs last enabled at (433798): [<ffffffff8152d8f3>] __do_softirq kernel/softirq.c:612 [inline]
softirqs last enabled at (433798): [<ffffffff8152d8f3>] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last enabled at (433798): [<ffffffff8152d8f3>] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
softirqs last disabled at (433817): [<ffffffff8152d8f3>] __do_softirq kernel/softirq.c:612 [inline]
softirqs last disabled at (433817): [<ffffffff8152d8f3>] invoke_softirq kernel/softirq.c:452 [inline]
softirqs last disabled at (433817): [<ffffffff8152d8f3>] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
1 lock held by swapper/0/0:
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x34/0x230 net/core/dev.c:5688
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:4013
mark_lock_irq+0xad/0x900 kernel/locking/lockdep.c:4216
mark_lock+0x208/0x320 kernel/locking/lockdep.c:4678
mark_usage kernel/locking/lockdep.c:-1 [inline]
__lock_acquire+0xcfc/0x7d80 kernel/locking/lockdep.c:5091
lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
lock_sock_nested+0x48/0x100 net/core/sock.c:3543
lock_sock include/net/sock.h:1780 [inline]
x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782
x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5664 [inline]
netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5689
lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99
__napi_poll+0xbb/0x460 net/core/dev.c:6668
napi_poll net/core/dev.c:6735 [inline]
net_rx_action+0x65f/0xcc0 net/core/dev.c:6871
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:pv_native_safe_halt+0xf/0x10 arch/x86/kernel/paravirt.c:148
Code: d9 19 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d a3 a5 38 00 fb f4 <c3> 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9
RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c2
RAX: 0168b3148895ce00 RBX: ffffffff81630d54 RCX: 0168b3148895ce00
RDX: 0000000000000001 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d3360
RBP: ffffffff8ce07eb8 R08: ffff8880b8e36b6b R09: 1ffff110171c6d6d
R10: dffffc0000000000 R11: ffffed10171c6d6e R12: 1ffffffff19c0fbc
R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:753
default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:178 [inline]
do_idle+0x334/0x5c0 kernel/sched/idle.c:302
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:401
rest_init+0x2e2/0x300 init/main.c:705
arch_call_rest_init+0xe/0x10 init/main.c:801
start_kernel+0x461/0x4e0 init/main.c:1046
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:555
x86_64_start_kernel+0x60/0x60 arch/x86/kernel/head64.c:536
secondary_startup_64_no_verify+0x179/0x17b
</TASK>
BUG: sleeping function called from invalid context at net/core/sock.c:3545
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffffffff8a97e91d>] schedule_preempt_disabled+0x1d/0x20 kernel/sched/core.c:6835
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
__might_resched+0x48d/0x5f0 kernel/sched/core.c:10212
lock_sock_nested+0x5d/0x100 net/core/sock.c:3545
lock_sock include/net/sock.h:1780 [inline]
x25_kill_by_neigh+0x10d/0x250 net/x25/af_x25.c:1782
x25_lapb_receive_frame+0x1a7/0xef0 net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5664 [inline]
netif_receive_skb_core+0x16a/0x230 net/core/dev.c:5689
lapbeth_napi_poll+0x42/0x80 drivers/net/wan/lapbether.c:99
__napi_poll+0xbb/0x460 net/core/dev.c:6668
napi_poll net/core/dev.c:6735 [inline]
net_rx_action+0x65f/0xcc0 net/core/dev.c:6871
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:pv_native_safe_halt+0xf/0x10 arch/x86/kernel/paravirt.c:148
Code: d9 19 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d a3 a5 38 00 fb f4 <c3> 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9
RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c2
RAX: 0168b3148895ce00 RBX: ffffffff81630d54 RCX: 0168b3148895ce00
RDX: 0000000000000001 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d3360
RBP: ffffffff8ce07eb8 R08: ffff8880b8e36b6b R09: 1ffff110171c6d6d
R10: dffffc0000000000 R11: ffffed10171c6d6e R12: 1ffffffff19c0fbc
R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:753
default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:178 [inline]
do_idle+0x334/0x5c0 kernel/sched/idle.c:302
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:401
rest_init+0x2e2/0x300 init/main.c:705
arch_call_rest_init+0xe/0x10 init/main.c:801
start_kernel+0x461/0x4e0 init/main.c:1046
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:555
x86_64_start_kernel+0x60/0x60 arch/x86/kernel/head64.c:536
secondary_startup_64_no_verify+0x179/0x17b
</TASK>
----------------
Code disassembly (best guess):
0: d9 19 fstps (%rcx)
2: 02 c3 add %bl,%al
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: f3 0f 1e fa endbr64
f: 0f 0b ud2
11: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
18: 00 00 00
1b: f3 0f 1e fa endbr64
1f: 66 90 xchg %ax,%ax
21: 0f 00 2d a3 a5 38 00 verw 0x38a5a3(%rip) # 0x38a5cb
28: fb sti
29: f4 hlt
* 2a: c3 ret <-- trapping instruction
2b: 66 0f 1f 00 nopw (%rax)
2f: 55 push %rbp
30: 41 57 push %r15
32: 41 56 push %r14
34: 41 54 push %r12
36: 53 push %rbx
37: 50 push %rax
38: 8b 2f mov (%rdi),%ebp
3a: eb 2c jmp 0x68
3c: 89 cb mov %ecx,%ebx
3e: 80 .byte 0x80
3f: f9 stc
Struck through repros no longer work on HEAD.