================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.5.409/5900 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888066ec6130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] ffff888066ec6130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 lock_sock_nested+0x44/0x100 net/core/sock.c:3504 lock_sock include/net/sock.h:1805 [inline] x25_bind+0x1aa/0x3e0 net/x25/af_x25.c:698 __sys_bind+0x2e9/0x3e0 net/socket.c:1811 __do_sys_bind net/socket.c:1822 [inline] __se_sys_bind net/socket.c:1820 [inline] __x64_sys_bind+0x76/0x80 net/socket.c:1820 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 irq event stamp: 5966 hardirqs last enabled at (5966): [] __local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:426 hardirqs last disabled at (5965): [] __local_bh_enable_ip+0xd7/0x1c0 kernel/softirq.c:403 softirqs last enabled at (1506): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last enabled at (1506): [] fpregs_lock arch/x86/include/asm/fpu/api.h:72 [inline] softirqs last enabled at (1506): [] fpu_clone+0x274/0xc70 arch/x86/kernel/fpu/core.c:628 softirqs last disabled at (5839): [] __do_softirq kernel/softirq.c:630 [inline] softirqs last disabled at (5839): [] invoke_softirq kernel/softirq.c:470 [inline] softirqs last disabled at (5839): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_X25); lock(sk_lock-AF_X25); *** DEADLOCK *** 1 lock held by syz.5.409/5900: #0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_core+0x30/0x230 net/core/dev.c:5643 stack backtrace: CPU: 1 PID: 5900 Comm: syz.5.409 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3974 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4177 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4633 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xce0/0x7c40 kernel/locking/lockdep.c:5017 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676 lock_sock_nested+0x44/0x100 net/core/sock.c:3504 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 df a9 1d f7 65 8b 05 e0 5a c7 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc900033c7ba0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 10935a5670cfd900 RDX: dffffc0000000000 RSI: ffffffff8a8c1820 RDI: 0000000000000001 RBP: ffffc900033c7c30 R08: ffff8880b8f2a5c3 R09: 1ffff110171e54b8 R10: dffffc0000000000 R11: ffffed10171e54b9 R12: dffffc0000000000 R13: ffffc900033c7dc0 R14: ffff8880b8f2a5c0 R15: 1ffff92000678f74 hrtimer_start_expires include/linux/hrtimer.h:435 [inline] hrtimer_sleeper_start_expires kernel/time/hrtimer.c:2013 [inline] do_nanosleep+0x17a/0x5e0 kernel/time/hrtimer.c:2089 hrtimer_nanosleep+0x171/0x370 kernel/time/hrtimer.c:2140 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1314 [inline] __se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1291 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f2d0535e98e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffef10e4e28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000555582507500 RCX: 00007f2d0535e98e RDX: 00007ffef10e4e80 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f2d05627da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000026d8b R13: 00007f2d05625fac R14: 0000000000026ab3 R15: 00007ffef10e4fb0 BUG: sleeping function called from invalid context at net/core/sock.c:3506 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5900, name: syz.5.409 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 PID: 5900 Comm: syz.5.409 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 __might_resched+0x489/0x5f0 kernel/sched/core.c:9970 lock_sock_nested+0x59/0x100 net/core/sock.c:3506 lock_sock include/net/sock.h:1805 [inline] x25_kill_by_neigh+0x109/0x250 net/x25/af_x25.c:1783 x25_lapb_receive_frame+0x1a3/0xf20 net/x25/x25_dev.c:138 __netif_receive_skb_one_core net/core/dev.c:5619 [inline] netif_receive_skb_core+0x166/0x230 net/core/dev.c:5644 lapbeth_napi_poll+0x3e/0x80 drivers/net/wan/lapbether.c:99 __napi_poll+0xbb/0x460 net/core/dev.c:6628 napi_poll net/core/dev.c:6695 [inline] net_rx_action+0x622/0xbc0 net/core/dev.c:6809 handle_softirqs+0x291/0x910 kernel/softirq.c:596 __do_softirq kernel/softirq.c:630 [inline] invoke_softirq kernel/softirq.c:470 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 df a9 1d f7 65 8b 05 e0 5a c7 75 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc900033c7ba0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 10935a5670cfd900 RDX: dffffc0000000000 RSI: ffffffff8a8c1820 RDI: 0000000000000001 RBP: ffffc900033c7c30 R08: ffff8880b8f2a5c3 R09: 1ffff110171e54b8 R10: dffffc0000000000 R11: ffffed10171e54b9 R12: dffffc0000000000 R13: ffffc900033c7dc0 R14: ffff8880b8f2a5c0 R15: 1ffff92000678f74 hrtimer_start_expires include/linux/hrtimer.h:435 [inline] hrtimer_sleeper_start_expires kernel/time/hrtimer.c:2013 [inline] do_nanosleep+0x17a/0x5e0 kernel/time/hrtimer.c:2089 hrtimer_nanosleep+0x171/0x370 kernel/time/hrtimer.c:2140 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1314 [inline] __se_sys_clock_nanosleep+0x30b/0x3a0 kernel/time/posix-timers.c:1291 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f2d0535e98e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffef10e4e28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000555582507500 RCX: 00007f2d0535e98e RDX: 00007ffef10e4e80 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f2d05627da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000026d8b R13: 00007f2d05625fac R14: 0000000000026ab3 R15: 00007ffef10e4fb0 ---------------- Code disassembly (best guess): 0: c7 44 24 20 00 00 00 movl $0x0,0x20(%rsp) 7: 00 8: 9c pushf 9: 8f 44 24 20 pop 0x20(%rsp) d: f7 44 24 20 00 02 00 testl $0x200,0x20(%rsp) 14: 00 15: 41 c6 04 07 f8 movb $0xf8,(%r15,%rax,1) 1a: 75 4b jne 0x67 1c: f7 c3 00 02 00 00 test $0x200,%ebx 22: 74 01 je 0x25 24: fb sti 25: bf 01 00 00 00 mov $0x1,%edi * 2a: e8 df a9 1d f7 call 0xf71daa0e <-- trapping instruction 2f: 65 8b 05 e0 5a c7 75 mov %gs:0x75c75ae0(%rip),%eax # 0x75c75b16 36: 85 c0 test %eax,%eax 38: 74 3c je 0x76 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: 04 24 add $0x24,%al 3e: 0e (bad) 3f: 36 ss