syzbot
inconsistent lock state in x25_kill_by_neigh
Status:
upstream: reported C repro on 2026/08/29 00:21
Reported-by: syzbot+268ee2c437483f50f7aa@syzkaller.appspotmail.com
First crash: 2d19h, last: 1d14h
Sample crash report:
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/1/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff888025820120 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
ffff888025820120 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
lock_sock_nested+0x44/0x100 net/core/sock.c:3258
lock_sock include/net/sock.h:1744 [inline]
x25_bind+0x18a/0x3b0 net/x25/af_x25.c:698
__sys_bind+0x2e9/0x3e0 net/socket.c:1730
__do_sys_bind net/socket.c:1741 [inline]
__se_sys_bind net/socket.c:1739 [inline]
__x64_sys_bind+0x76/0x80 net/socket.c:1739
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
irq event stamp: 477942
hardirqs last enabled at (477942): [<ffffffff814936e6>] __local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:406
hardirqs last disabled at (477941): [<ffffffff81493687>] __local_bh_enable_ip+0xd7/0x1c0 kernel/softirq.c:383
softirqs last enabled at (477632): [<ffffffff814943fb>] __do_softirq kernel/softirq.c:610 [inline]
softirqs last enabled at (477632): [<ffffffff814943fb>] invoke_softirq kernel/softirq.c:450 [inline]
softirqs last enabled at (477632): [<ffffffff814943fb>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
softirqs last disabled at (477651): [<ffffffff814943fb>] __do_softirq kernel/softirq.c:610 [inline]
softirqs last disabled at (477651): [<ffffffff814943fb>] invoke_softirq kernel/softirq.c:450 [inline]
softirqs last disabled at (477651): [<ffffffff814943fb>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
1 lock held by swapper/1/0:
#0: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
stack backtrace:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3932
mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4135
mark_lock+0x208/0x320 kernel/locking/lockdep.c:4591
mark_usage kernel/locking/lockdep.c:-1 [inline]
__lock_acquire+0xc63/0x7b50 kernel/locking/lockdep.c:4966
lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
lock_sock_nested+0x44/0x100 net/core/sock.c:3258
lock_sock include/net/sock.h:1744 [inline]
x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779
x25_lapb_receive_frame+0x19d/0xf20 net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5551 [inline]
netif_receive_skb_core+0x149/0x210 net/core/dev.c:5576
lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99
__napi_poll+0xbb/0x430 net/core/dev.c:7101
napi_poll net/core/dev.c:7168 [inline]
net_rx_action+0x522/0xa80 net/core/dev.c:7258
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:730
Code: b7 48 89 df e8 56 8f f4 f7 eb ad e8 4f ab f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 00 cc 66 90 0f 00 2d b7 25 5c 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffc90000d67d48 EFLAGS: 000002c2
RAX: cf38a7824ce27400 RBX: ffff888016e98000 RCX: cf38a7824ce27400
RDX: 0000000000000001 RSI: ffffffff8a2b2be0 RDI: ffffffff8a7a43c0
RBP: ffffc90000d67e80 R08: ffff8880b913b30b R09: 1ffff11017227661
R10: dffffc0000000000 R11: ffffed1017227662 R12: 1ffff920001acfb4
R13: dffffc0000000000 R14: 1ffff11002dd3000 R15: 0000000000000000
default_idle_call+0x81/0xc0 kernel/sched/idle.c:112
cpuidle_idle_call kernel/sched/idle.c:202 [inline]
do_idle+0x3a1/0x650 kernel/sched/idle.c:326
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:424
start_secondary+0x32f/0x430 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb
</TASK>
BUG: sleeping function called from invalid context at net/core/sock.c:3260
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1
INFO: lockdep is turned off.
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
___might_sleep+0x493/0x610 kernel/sched/core.c:9658
lock_sock_nested+0x5b/0x100 net/core/sock.c:3260
lock_sock include/net/sock.h:1744 [inline]
x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1779
x25_lapb_receive_frame+0x19d/0xf20 net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5551 [inline]
netif_receive_skb_core+0x149/0x210 net/core/dev.c:5576
lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99
__napi_poll+0xbb/0x430 net/core/dev.c:7101
napi_poll net/core/dev.c:7168 [inline]
net_rx_action+0x522/0xa80 net/core/dev.c:7258
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:730
Code: b7 48 89 df e8 56 8f f4 f7 eb ad e8 4f ab f6 ff 00 00 cc cc 00 00 cc cc 00 00 cc cc 00 00 cc 66 90 0f 00 2d b7 25 5c 00 fb f4 <c3> 0f 1f 40 00 41 57 41 56 53 49 be 00 00 00 00 00 fc ff df 65 48
RSP: 0018:ffffc90000d67d48 EFLAGS: 000002c2
RAX: cf38a7824ce27400 RBX: ffff888016e98000 RCX: cf38a7824ce27400
RDX: 0000000000000001 RSI: ffffffff8a2b2be0 RDI: ffffffff8a7a43c0
RBP: ffffc90000d67e80 R08: ffff8880b913b30b R09: 1ffff11017227661
R10: dffffc0000000000 R11: ffffed1017227662 R12: 1ffff920001acfb4
R13: dffffc0000000000 R14: 1ffff11002dd3000 R15: 0000000000000000
default_idle_call+0x81/0xc0 kernel/sched/idle.c:112
cpuidle_idle_call kernel/sched/idle.c:202 [inline]
do_idle+0x3a1/0x650 kernel/sched/idle.c:326
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:424
start_secondary+0x32f/0x430 arch/x86/kernel/smpboot.c:281
secondary_startup_64_no_verify+0xb1/0xbb
</TASK>
----------------
Code disassembly (best guess):
0: b7 48 mov $0x48,%bh
2: 89 df mov %ebx,%edi
4: e8 56 8f f4 f7 call 0xf7f48f5f
9: eb ad jmp 0xffffffb8
b: e8 4f ab f6 ff call 0xfff6ab5f
10: 00 00 add %al,(%rax)
12: cc int3
13: cc int3
14: 00 00 add %al,(%rax)
16: cc int3
17: cc int3
18: 00 00 add %al,(%rax)
1a: cc int3
1b: cc int3
1c: 00 00 add %al,(%rax)
1e: cc int3
1f: 66 90 xchg %ax,%ax
21: 0f 00 2d b7 25 5c 00 verw 0x5c25b7(%rip) # 0x5c25df
28: fb sti
29: f4 hlt
* 2a: c3 ret <-- trapping instruction
2b: 0f 1f 40 00 nopl 0x0(%rax)
2f: 41 57 push %r15
31: 41 56 push %r14
33: 53 push %rbx
34: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
3b: fc ff df
3e: 65 gs
3f: 48 rex.W
Struck through repros no longer work on HEAD.