Extracting prog: 3m20.033554395s
Minimizing prog: 25m5.696444265s
Simplifying prog options: 0s
Extracting C: 29.236666388s
Simplifying C: 12m7.119246078s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-fcntl$setstatus-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
fcntl$setstatus(r0, 0x4, 0x800)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-fcntl$setstatus-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
fcntl$setstatus(r0, 0x4, 0x800)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f net/x25/af_x25.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: inconsistent lock state in x25_kill_by_neigh
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-fcntl$setstatus-ioctl-bind$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
fcntl$setstatus(r0, 0x4, 0x800)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)

program did not crash
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-fcntl$setstatus-ioctl-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
fcntl$setstatus(r0, 0x4, 0x800)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-fcntl$setstatus-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
fcntl$setstatus(r0, 0x4, 0x800)
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
ioctl(0xffffffffffffffff, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(0xffffffffffffffff, &(0x7f0000000080), 0x12)
connect$x25(0xffffffffffffffff, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, 0x0)
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140))
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, 0x0, 0x0)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program did not crash
testing program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=2m39.416251876s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
simplifying C reproducer
testing compiled C program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing compiled C program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
program crashed: inconsistent lock state in x25_kill_by_neigh
testing program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
validation run: crashed=true
testing program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
validation run: crashed=true
testing program (duration=2m39.416251876s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$x25-ioctl-bind$x25-connect$x25
detailed listing:
executing program 0:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl(r0, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
bind$x25(r0, &(0x7f0000000080), 0x12)
connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)

program crashed: inconsistent lock state in x25_kill_by_neigh
validation run: crashed=true
reproducing took 46m29.242881229s
repro crashed as (corrupted=false):
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
kworker/1:1/26 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000d7e22260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
ffff0000d7e22260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x114/0x2a0 net/x25/af_x25.c:1778
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
  lock_sock_nested+0x58/0x110 net/core/sock.c:3837
  lock_sock include/net/sock.h:1713 [inline]
  x25_bind+0x22c/0x34c net/x25/af_x25.c:694
  __sys_bind_socket net/socket.c:1945 [inline]
  __sys_bind+0x1c4/0x268 net/socket.c:1976
  __do_sys_bind net/socket.c:1981 [inline]
  __se_sys_bind net/socket.c:1979 [inline]
  __arm64_sys_bind+0x84/0x9c net/socket.c:1979
  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
  invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
  el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
  do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
  el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
  el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
  el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 11834
hardirqs last  enabled at (11834): [<ffff80008030a118>] __local_bh_enable_ip+0x14c/0x234 kernel/softirq.c:478
hardirqs last disabled at (11833): [<ffff80008030a098>] __local_bh_enable_ip+0xcc/0x234 kernel/softirq.c:455
softirqs last  enabled at (11598): [<ffff800082b748dc>] spin_unlock_bh include/linux/spinlock.h:407 [inline]
softirqs last  enabled at (11598): [<ffff800082b748dc>] ptr_ring_consume_bh include/linux/ptr_ring.h:399 [inline]
softirqs last  enabled at (11598): [<ffff800082b748dc>] wg_packet_encrypt_worker+0x264/0x12a0 drivers/net/wireguard/send.c:293
softirqs last disabled at (11599): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_X25);
  <Interrupt>
    lock(sk_lock-AF_X25);

 *** DEADLOCK ***

locks held by kworker/1:1/26: 3, last CPU#1:
 #0: ffff0000d3a94540 ((wq_completion)wg-crypt-wg0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline]
 #0: ffff0000d3a94540 ((wq_completion)wg-crypt-wg0){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3479
 #1: ffff80008fa07c20 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline]
 #1: ffff80008fa07c20 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3479
 #2: ffff800089981820 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffff800089981820 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffff800089981820 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x38/0x190 net/core/dev.c:6321

stack backtrace:
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: wg-crypt-wg0 wg_packet_encrypt_worker
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_usage_bug+0x2f8/0x33c kernel/locking/lockdep.c:4086
 valid_state kernel/locking/lockdep.c:4100 [inline]
 mark_lock_irq+0x4a0/0x4a8 kernel/locking/lockdep.c:-1
 mark_lock+0x144/0x1a4 kernel/locking/lockdep.c:4797
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0x65c/0x2b08 kernel/locking/lockdep.c:5242
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 lock_sock_nested+0x58/0x110 net/core/sock.c:3837
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x114/0x2a0 net/x25/af_x25.c:1778
 x25_link_terminated+0x60/0x7c net/x25/x25_link.c:257
 x25_lapb_receive_frame+0x144/0xcf8 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6297
 netif_receive_skb_core+0xd8/0x190 net/core/dev.c:6322
 lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:100
 __napi_poll+0xb4/0x328 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0x5b0/0xc14 net/core/dev.c:8050
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:546
 __local_bh_enable_ip+0x190/0x234 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 ptr_ring_consume_bh include/linux/ptr_ring.h:399 [inline]
 wg_packet_encrypt_worker+0x264/0x12a0 drivers/net/wireguard/send.c:293
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
BUG: sleeping function called from invalid context at net/core/sock.c:3839
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 26, name: kworker/1:1
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff800082b74744>] spin_lock_bh include/linux/spinlock.h:353 [inline]
[<ffff800082b74744>] ptr_ring_consume_bh include/linux/ptr_ring.h:397 [inline]
[<ffff800082b74744>] wg_packet_encrypt_worker+0xcc/0x12a0 drivers/net/wireguard/send.c:293
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: wg-crypt-wg0 wg_packet_encrypt_worker
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 __might_resched+0x354/0x4c0 kernel/sched/core.c:9264
 __might_sleep+0x84/0xdc kernel/sched/core.c:9193
 lock_sock_nested+0x68/0x110 net/core/sock.c:3839
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x114/0x2a0 net/x25/af_x25.c:1778
 x25_link_terminated+0x60/0x7c net/x25/x25_link.c:257
 x25_lapb_receive_frame+0x144/0xcf8 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6297
 netif_receive_skb_core+0xd8/0x190 net/core/dev.c:6322
 lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:100
 __napi_poll+0xb4/0x328 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0x5b0/0xc14 net/core/dev.c:8050
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:546
 __local_bh_enable_ip+0x190/0x234 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 ptr_ring_consume_bh include/linux/ptr_ring.h:399 [inline]
 wg_packet_encrypt_worker+0x264/0x12a0 drivers/net/wireguard/send.c:293
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854

final repro crashed as (corrupted=false):
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
kworker/1:1/26 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000d7e22260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
ffff0000d7e22260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x114/0x2a0 net/x25/af_x25.c:1778
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
  lock_sock_nested+0x58/0x110 net/core/sock.c:3837
  lock_sock include/net/sock.h:1713 [inline]
  x25_bind+0x22c/0x34c net/x25/af_x25.c:694
  __sys_bind_socket net/socket.c:1945 [inline]
  __sys_bind+0x1c4/0x268 net/socket.c:1976
  __do_sys_bind net/socket.c:1981 [inline]
  __se_sys_bind net/socket.c:1979 [inline]
  __arm64_sys_bind+0x84/0x9c net/socket.c:1979
  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
  invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
  el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
  do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
  el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
  el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
  el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 11834
hardirqs last  enabled at (11834): [<ffff80008030a118>] __local_bh_enable_ip+0x14c/0x234 kernel/softirq.c:478
hardirqs last disabled at (11833): [<ffff80008030a098>] __local_bh_enable_ip+0xcc/0x234 kernel/softirq.c:455
softirqs last  enabled at (11598): [<ffff800082b748dc>] spin_unlock_bh include/linux/spinlock.h:407 [inline]
softirqs last  enabled at (11598): [<ffff800082b748dc>] ptr_ring_consume_bh include/linux/ptr_ring.h:399 [inline]
softirqs last  enabled at (11598): [<ffff800082b748dc>] wg_packet_encrypt_worker+0x264/0x12a0 drivers/net/wireguard/send.c:293
softirqs last disabled at (11599): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_X25);
  <Interrupt>
    lock(sk_lock-AF_X25);

 *** DEADLOCK ***

locks held by kworker/1:1/26: 3, last CPU#1:
 #0: ffff0000d3a94540 ((wq_completion)wg-crypt-wg0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline]
 #0: ffff0000d3a94540 ((wq_completion)wg-crypt-wg0){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3479
 #1: ffff80008fa07c20 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline]
 #1: ffff80008fa07c20 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3479
 #2: ffff800089981820 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffff800089981820 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffff800089981820 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x38/0x190 net/core/dev.c:6321

stack backtrace:
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: wg-crypt-wg0 wg_packet_encrypt_worker
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_usage_bug+0x2f8/0x33c kernel/locking/lockdep.c:4086
 valid_state kernel/locking/lockdep.c:4100 [inline]
 mark_lock_irq+0x4a0/0x4a8 kernel/locking/lockdep.c:-1
 mark_lock+0x144/0x1a4 kernel/locking/lockdep.c:4797
 mark_usage kernel/locking/lockdep.c:-1 [inline]
 __lock_acquire+0x65c/0x2b08 kernel/locking/lockdep.c:5242
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 lock_sock_nested+0x58/0x110 net/core/sock.c:3837
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x114/0x2a0 net/x25/af_x25.c:1778
 x25_link_terminated+0x60/0x7c net/x25/x25_link.c:257
 x25_lapb_receive_frame+0x144/0xcf8 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6297
 netif_receive_skb_core+0xd8/0x190 net/core/dev.c:6322
 lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:100
 __napi_poll+0xb4/0x328 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0x5b0/0xc14 net/core/dev.c:8050
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:546
 __local_bh_enable_ip+0x190/0x234 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 ptr_ring_consume_bh include/linux/ptr_ring.h:399 [inline]
 wg_packet_encrypt_worker+0x264/0x12a0 drivers/net/wireguard/send.c:293
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
BUG: sleeping function called from invalid context at net/core/sock.c:3839
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 26, name: kworker/1:1
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff800082b74744>] spin_lock_bh include/linux/spinlock.h:353 [inline]
[<ffff800082b74744>] ptr_ring_consume_bh include/linux/ptr_ring.h:397 [inline]
[<ffff800082b74744>] wg_packet_encrypt_worker+0xcc/0x12a0 drivers/net/wireguard/send.c:293
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: wg-crypt-wg0 wg_packet_encrypt_worker
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 __might_resched+0x354/0x4c0 kernel/sched/core.c:9264
 __might_sleep+0x84/0xdc kernel/sched/core.c:9193
 lock_sock_nested+0x68/0x110 net/core/sock.c:3839
 lock_sock include/net/sock.h:1713 [inline]
 x25_kill_by_neigh+0x114/0x2a0 net/x25/af_x25.c:1778
 x25_link_terminated+0x60/0x7c net/x25/x25_link.c:257
 x25_lapb_receive_frame+0x144/0xcf8 net/x25/x25_dev.c:138
 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6297
 netif_receive_skb_core+0xd8/0x190 net/core/dev.c:6322
 lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:100
 __napi_poll+0xb4/0x328 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0x5b0/0xc14 net/core/dev.c:8050
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:546
 __local_bh_enable_ip+0x190/0x234 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 ptr_ring_consume_bh include/linux/ptr_ring.h:399 [inline]
 wg_packet_encrypt_worker+0x264/0x12a0 drivers/net/wireguard/send.c:293
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854