=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
syz.2.1109/9805 is trying to lock:
ffff88805463b5e8 (rdma_nets_rwsem){+.+.}-{4:4}, at: spin_lock include/linux/spinlock.h:347 [inline]
ffff88805463b5e8 (rdma_nets_rwsem){+.+.}-{4:4}, at: tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291
other info that might help us debug this:
context-{3:3}
locks held by syz.2.1109/9805: 2, last CPU#0:
#0: ffff88801b02d540 ((wq_completion)events_bh){+.-.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88801b02d540 ((wq_completion)events_bh){+.-.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88801b02d540 ((wq_completion)events_bh){+.-.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#0: ffff88801b02d540 ((wq_completion)events_bh){+.-.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#1: ffffc90000007de0 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90000007de0 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90000007de0 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#1: ffffc90000007de0 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
stack backtrace:
CPU: 0 UID: 0 PID: 9805 Comm: syz.2.1109 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4846 [inline]
check_wait_context kernel/locking/lockdep.c:4918 [inline]
__lock_acquire+0xef0/0x2e50 kernel/locking/lockdep.c:5204
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
__raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
spin_lock include/linux/spinlock.h:347 [inline]
tcp_tsq_handler+0x29/0x200 net/ipv4/tcp_output.c:1291
tcp_tsq_workfn+0x384/0x410 net/ipv4/tcp_output.c:1325
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
bh_worker+0x451/0x870 kernel/workqueue.c:3773
tasklet_action+0xc/0x70 kernel/softirq.c:997
handle_softirqs+0x226/0x860 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767
irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:tcp_wfree+0x4ab/0x580 net/ipv4/tcp_output.c:1429
Code: 00 75 79 e8 97 f0 7d f7 48 bb 00 00 00 00 00 fc ff df 4d 85 ed 75 07 e8 83 f0 7d f7 eb 06 e8 7c f0 7d f7 fb 41 c6 44 1e 04 f8 <48> c7 44 24 40 0e 36 e0 45 49 c7 04 1e 00 00 00 00 65 48 8b 05 b4
RSP: 0018:ffffc9000572eea0 EFLAGS: 00000283
RAX: ffffffff8a49b954 RBX: dffffc0000000000 RCX: 0000000000080000
RDX: ffffc90012024000 RSI: 000000000000a7df RDI: 000000000000a7e0
RBP: ffffc9000572ef70 R08: ffffffff9059037f R09: 1ffffffff20b206f
R10: dffffc0000000000 R11: fffffbfff20b2070 R12: ffff88805463be98
R13: 0000000000000200 R14: 1ffff92000ae5ddc R15: ffff8880b863a030
skb_release_head_state+0x11b/0x370 net/core/skbuff.c:1176
skb_release_all net/core/skbuff.c:1195 [inline]
__kfree_skb+0x24/0x210 net/core/skbuff.c:1211
kfree_skb_reason include/linux/skbuff.h:1323 [inline]
kfree_skb include/linux/skbuff.h:1332 [inline]
__rtnl_unlock+0x95/0xf0 net/core/rtnetlink.c:148
netdev_run_todo+0x2e5/0x1060 net/core/dev.c:11754
rtnl_unlock net/core/rtnetlink.c:157 [inline]
rtnl_nets_unlock net/core/rtnetlink.c:379 [inline]
rtnl_setlink+0x653/0x810 net/core/rtnetlink.c:3600
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
__sock_sendmsg net/socket.c:815 [inline]
sock_write_iter+0x2de/0x3e0 net/socket.c:1266
do_iter_readv_writev+0x612/0x8c0 fs/read_write.c:-1
vfs_writev+0x343/0x990 fs/read_write.c:1058
do_writev+0x154/0x2e0 fs/read_write.c:1104
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f45f6f9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f45f7ea5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f45f7226180 RCX: 00007f45f6f9e0d9
RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 000000000000000a
RBP: 00007f45f7035024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f45f7226218 R14: 00007f45f7226180 R15: 00007fff80a74fb8
----------------
Code disassembly (best guess):
0: 00 75 79 add %dh,0x79(%rbp)
3: e8 97 f0 7d f7 call 0xf77df09f
8: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx
f: fc ff df
12: 4d 85 ed test %r13,%r13
15: 75 07 jne 0x1e
17: e8 83 f0 7d f7 call 0xf77df09f
1c: eb 06 jmp 0x24
1e: e8 7c f0 7d f7 call 0xf77df09f
23: fb sti
24: 41 c6 44 1e 04 f8 movb $0xf8,0x4(%r14,%rbx,1)
* 2a: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp) <-- trapping instruction
31: e0 45
33: 49 c7 04 1e 00 00 00 movq $0x0,(%r14,%rbx,1)
3a: 00
3b: 65 gs
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 05 .byte 0x5
3f: b4 .byte 0xb4