From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88A142F851 for ; Tue, 10 Feb 2026 04:06:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.69 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770696366; cv=none; b=DDtfXije+j4pgNmLJcP2MY9FAQE8krsG6zkaGmBchhO2Pw1NSftiTsIKnbxg7hHzpZRzHGAxAvU+JXVHvIWoeZyqq3AsVX5ZnsNmq5jBQfDDVDHjcEpf+gPP1KtB6JerP1azlgISlHx6oo8mgzblZEtdHHHouiKGzwJKEXz2KMA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770696366; c=relaxed/simple; bh=CWsbPZQdrJ2i4vL7Esx96cr/59siAXf9sQ15R5iV13w=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=YyCeEkO8f1eQq1Kk13kFfGqsH5hn7NUVznBBRqZ1jVzd7D//ob9sBRNVNUsVQxLHKhyln059vVzRu7ly/6eDbYI0BGK84HbD8E5xTWJ+zVLu4UaZxNr+a/K9tOUeMXPA/98pkSFfcQZei4/jsbmn/YLPDBUdyzdAlycrKtN25zg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-66ad005c980so13201185eaf.1 for ; Mon, 09 Feb 2026 20:06:04 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770696363; x=1771301163; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=dNJx08Hl7IblvyRQPS4EOA476x9HjiHaLGPOl/s6fSo=; b=DQEenbtTp+udas78mFC27T6JdIkBMh8QNTJjo6/Rn4HYu3tBlrtDQ5b605qouM108L +h/7Uqlk518GXVtxEcX+L2n6sJU2XJyD0nGSOsDCpekUEyAyWprPgDIlllU+BF+/okcT ApP+QmaQsXEp4CcBMSDIvsLETNHfcS1pjS54p2v3w/4aVLGluiKLxyoBNayfi5LnlIWn f5aW0KFjYPMWHHic4pU0uKS8ROWF+jk1dVkALyyM1PmGosqGDquwtZ/qupnpPWw5BYaH KOzXBrTIrc//KbeDGf1q0pypy+8O+GBBi078d78NVRIRIb4raLztg73Zl8LwAfs9xJz9 g+gg== X-Forwarded-Encrypted: i=1; AJvYcCXpjk0tadnJbj2zFJPu5iZ0278DOWLOs3Pe5EahQpci7SeoIPH4ZKi7TnKkLjTstmrPSMH4bZ7J0g/cfzU=@vger.kernel.org X-Gm-Message-State: AOJu0YzdkjrP/dfmjUEDua5YvsMCBRAUC1nkEas4F8Xjb5OIzLt6eBs6 JhtdyG24njouc4g0FbGN7rSZcTlOY9bOUfYvFZJihITkuRpp3cDNt8usUlWYCjqjrRTclkfuHVb An3VNxWFyk7yMPMJN5YI/cKcJHDR9UKodESgBF6DomfEOmc5EEy4QzEVYW0c= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:4988:b0:66f:49ae:106d with SMTP id 006d021491bc7-66f49ae1653mr3099668eaf.45.1770696363234; Mon, 09 Feb 2026 20:06:03 -0800 (PST) Date: Mon, 09 Feb 2026 20:06:03 -0800 In-Reply-To: <3a571094912e42265974a30b4e1185511a4b81fb.camel@oracle.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <698aaeab.050a0220.3b3015.0087.GAE@google.com> Subject: Re: [syzbot] [rds?] general protection fault in rds_tcp_accept_one From: syzbot To: allison.henderson@oracle.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: inconsistent lock state in lock_sock_nested ================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. kworker/u8:5/1106 [HC0[0]:SC1[3]:HE1:SE0] takes: ffff88801c708260 (k-sk_lock-AF_INET6){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] ffff88801c708260 (k-sk_lock-AF_INET6){+.?.}-{0:0}, at: inet6_getname+0x15d/0x650 net/ipv6/af_inet6.c:533 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868 lock_sock_nested+0x48/0x100 net/core/sock.c:3780 lock_sock include/net/sock.h:1709 [inline] tcp_sock_set_nodelay+0x2a/0x180 net/ipv4/tcp.c:3718 rds_tcp_listen_init+0x168/0x410 net/rds/tcp_listen.c:415 rds_tcp_init_net+0x154/0x380 net/rds/tcp.c:568 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137 __register_pernet_operations net/core/net_namespace.c:1320 [inline] register_pernet_operations+0x343/0x830 net/core/net_namespace.c:1397 register_pernet_device+0x2a/0x80 net/core/net_namespace.c:1484 rds_tcp_init+0xcf/0x170 net/rds/tcp.c:749 do_one_initcall+0x250/0x840 init/main.c:1378 do_initcall_level+0x104/0x190 init/main.c:1440 do_initcalls+0x59/0xa0 init/main.c:1456 kernel_init_freeable+0x2a6/0x3d0 init/main.c:1688 kernel_init+0x1d/0x1d0 init/main.c:1578 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 irq event stamp: 522136 hardirqs last enabled at (522136): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (522136): [] _raw_spin_unlock_irqrestore+0x30/0x80 kernel/locking/spinlock.c:194 hardirqs last disabled at (522135): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (522135): [] _raw_spin_lock_irqsave+0x1a/0x60 kernel/locking/spinlock.c:162 softirqs last enabled at (522108): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last enabled at (522108): [] rcu_read_lock_bh include/linux/rcupdate.h:918 [inline] softirqs last enabled at (522108): [] __dev_queue_xmit+0x274/0x3850 net/core/dev.c:4754 softirqs last disabled at (522109): [] do_softirq+0x76/0xd0 kernel/softirq.c:523 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(k-sk_lock-AF_INET6); lock(k-sk_lock-AF_INET6); *** DEADLOCK *** 12 locks held by kworker/u8:5/1106: #0: ffff88805f5cb148 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88805f5cb148 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90003a5fbc0 ((work_completion)(&(&cp->cp_send_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90003a5fbc0 ((work_completion)(&(&cp->cp_send_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88801c70d1e0 (k-sk_lock-AF_INET6){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #2: ffff88801c70d1e0 (k-sk_lock-AF_INET6){+.?.}-{0:0}, at: tcp_sock_set_cork+0x2c/0x2e0 net/ipv4/tcp.c:3694 #3: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #3: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #3: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: inet6_csk_xmit+0x1ee/0x750 net/ipv6/inet6_connection_sock.c:108 #4: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #4: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #4: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: ip6_xmit+0x283/0x1980 net/ipv6/ip6_output.c:284 #5: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #5: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #5: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x126/0x550 net/ipv6/ip6_output.c:234 #6: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: local_lock_acquire include/linux/local_lock_internal.h:41 [inline] #6: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3eb/0x1950 net/core/dev.c:6610 #7: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #7: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #7: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_internal net/core/dev.c:6335 [inline] #7: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb+0x102/0xbb0 net/core/dev.c:6407 #8: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #8: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #8: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:242 [inline] #8: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:316 #9: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #9: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #9: ffffffff8e75a360 (rcu_read_lock){....}-{1:3}, at: ip6_input+0x23/0x270 net/ipv6/ip6_input.c:499 #10: ffff88801c7081e0 (k-slock-AF_INET6/1){+.-.}-{3:3}, at: tcp_v6_rcv+0x2577/0x2f60 net/ipv6/tcp_ipv6.c:1875 #11: ffff88801c708408 (k-clock-AF_INET6){++.-}-{3:3}, at: rds_tcp_data_ready+0x113/0x950 net/rds/tcp_recv.c:320 stack backtrace: CPU: 1 UID: 0 PID: 1106 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: krds_cp_wq#1/0 rds_send_worker Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_usage_bug+0x28b/0x2e0 kernel/locking/lockdep.c:4042 valid_state kernel/locking/lockdep.c:4056 [inline] mark_lock_irq+0x410/0x420 kernel/locking/lockdep.c:-1 mark_lock+0x115/0x190 kernel/locking/lockdep.c:4753 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0x689/0x2cf0 kernel/locking/lockdep.c:5191 lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868 lock_sock_nested+0x48/0x100 net/core/sock.c:3780 lock_sock include/net/sock.h:1709 [inline] inet6_getname+0x15d/0x650 net/ipv6/af_inet6.c:533 rds_tcp_get_peer_sport net/rds/tcp_listen.c:70 [inline] rds_tcp_conn_slots_available+0x288/0x470 net/rds/tcp_listen.c:149 rds_recv_hs_exthdrs+0x60f/0x7c0 net/rds/recv.c:265 rds_recv_incoming+0x9f6/0x12d0 net/rds/recv.c:389 rds_tcp_data_recv+0x7f1/0xa40 net/rds/tcp_recv.c:243 __tcp_read_sock+0x196/0x970 net/ipv4/tcp.c:1702 rds_tcp_read_sock net/rds/tcp_recv.c:277 [inline] rds_tcp_data_ready+0x369/0x950 net/rds/tcp_recv.c:331 tcp_data_queue+0x1e2e/0x5e50 net/ipv4/tcp_input.c:5719 tcp_rcv_established+0x1270/0x2670 net/ipv4/tcp_input.c:6710 tcp_v6_do_rcv+0x8eb/0x1ba0 net/ipv6/tcp_ipv6.c:1609 tcp_v6_rcv+0x2653/0x2f60 net/ipv6/tcp_ipv6.c:1879 ip6_protocol_deliver_rcu+0xa73/0x1600 net/ipv6/ip6_input.c:438 ip6_input_finish+0x191/0x370 net/ipv6/ip6_input.c:489 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:500 ip_sabotage_in+0x1e1/0x270 net/bridge/br_netfilter_hooks.c:990 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316 __netif_receive_skb_one_core net/core/dev.c:6149 [inline] __netif_receive_skb net/core/dev.c:6262 [inline] netif_receive_skb_internal net/core/dev.c:6348 [inline] netif_receive_skb+0x278/0xbb0 net/core/dev.c:6407 NF_HOOK+0xa4/0x3a0 include/linux/netfilter.h:319 br_handle_frame_finish+0x14b2/0x1b40 net/bridge/br_input.c:-1 br_nf_hook_thresh+0x3dd/0x4c0 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0xa3a/0xd70 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x374/0x6f0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0x1277/0x1510 net/bridge/br_input.c:442 __netif_receive_skb_core+0x98f/0x3150 net/core/dev.c:6036 __netif_receive_skb_one_core net/core/dev.c:6147 [inline] __netif_receive_skb net/core/dev.c:6262 [inline] process_backlog+0x76d/0x1950 net/core/dev.c:6614 __napi_poll+0xae/0x340 net/core/dev.c:7678 napi_poll net/core/dev.c:7741 [inline] net_rx_action+0x627/0xf70 net/core/dev.c:7893 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline] __dev_queue_xmit+0x1e6c/0x3850 net/core/dev.c:4856 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_xmit+0x1149/0x1980 net/ipv6/ip6_output.c:358 inet6_csk_xmit+0x4a5/0x750 net/ipv6/inet6_connection_sock.c:114 __tcp_transmit_skb+0x249b/0x43e0 net/ipv4/tcp_output.c:1693 tcp_transmit_skb net/ipv4/tcp_output.c:1711 [inline] tcp_write_xmit+0x16e8/0x6980 net/ipv4/tcp_output.c:3064 __tcp_push_pending_frames+0x97/0x380 net/ipv4/tcp_output.c:3247 tcp_push_pending_frames include/net/tcp.h:2282 [inline] __tcp_sock_set_cork net/ipv4/tcp.c:3688 [inline] tcp_sock_set_cork+0x186/0x2e0 net/ipv4/tcp.c:3695 rds_send_xmit+0x207e/0x28d0 net/rds/send.c:480 rds_send_worker+0x7d/0x2e0 net/rds/threads.c:200 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 BUG: sleeping function called from invalid context at net/core/sock.c:3782 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1106, name: kworker/u8:5 preempt_count: 303, expected: 0 RCU nest depth: 7, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] local_bh_disable include/linux/bottom_half.h:20 [inline] [] rcu_read_lock_bh include/linux/rcupdate.h:918 [inline] [] __dev_queue_xmit+0x281/0x3850 net/core/dev.c:4754 CPU: 1 UID: 0 PID: 1106 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: krds_cp_wq#1/0 rds_send_worker Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x378/0x4d0 kernel/sched/core.c:8829 lock_sock_nested+0x5d/0x100 net/core/sock.c:3782 lock_sock include/net/sock.h:1709 [inline] inet6_getname+0x15d/0x650 net/ipv6/af_inet6.c:533 rds_tcp_get_peer_sport net/rds/tcp_listen.c:70 [inline] rds_tcp_conn_slots_available+0x288/0x470 net/rds/tcp_listen.c:149 rds_recv_hs_exthdrs+0x60f/0x7c0 net/rds/recv.c:265 rds_recv_incoming+0x9f6/0x12d0 net/rds/recv.c:389 rds_tcp_data_recv+0x7f1/0xa40 net/rds/tcp_recv.c:243 __tcp_read_sock+0x196/0x970 net/ipv4/tcp.c:1702 rds_tcp_read_sock net/rds/tcp_recv.c:277 [inline] rds_tcp_data_ready+0x369/0x950 net/rds/tcp_recv.c:331 tcp_data_queue+0x1e2e/0x5e50 net/ipv4/tcp_input.c:5719 tcp_rcv_established+0x1270/0x2670 net/ipv4/tcp_input.c:6710 tcp_v6_do_rcv+0x8eb/0x1ba0 net/ipv6/tcp_ipv6.c:1609 tcp_v6_rcv+0x2653/0x2f60 net/ipv6/tcp_ipv6.c:1879 ip6_protocol_deliver_rcu+0xa73/0x1600 net/ipv6/ip6_input.c:438 ip6_input_finish+0x191/0x370 net/ipv6/ip6_input.c:489 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:500 ip_sabotage_in+0x1e1/0x270 net/bridge/br_netfilter_hooks.c:990 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316 __netif_receive_skb_one_core net/core/dev.c:6149 [inline] __netif_receive_skb net/core/dev.c:6262 [inline] netif_receive_skb_internal net/core/dev.c:6348 [inline] netif_receive_skb+0x278/0xbb0 net/core/dev.c:6407 NF_HOOK+0xa4/0x3a0 include/linux/netfilter.h:319 br_handle_frame_finish+0x14b2/0x1b40 net/bridge/br_input.c:-1 br_nf_hook_thresh+0x3dd/0x4c0 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0xa3a/0xd70 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x374/0x6f0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0x1277/0x1510 net/bridge/br_input.c:442 __netif_receive_skb_core+0x98f/0x3150 net/core/dev.c:6036 __netif_receive_skb_one_core net/core/dev.c:6147 [inline] __netif_receive_skb net/core/dev.c:6262 [inline] process_backlog+0x76d/0x1950 net/core/dev.c:6614 __napi_poll+0xae/0x340 net/core/dev.c:7678 napi_poll net/core/dev.c:7741 [inline] net_rx_action+0x627/0xf70 net/core/dev.c:7893 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline] __dev_queue_xmit+0x1e6c/0x3850 net/core/dev.c:4856 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_xmit+0x1149/0x1980 net/ipv6/ip6_output.c:358 inet6_csk_xmit+0x4a5/0x750 net/ipv6/inet6_connection_sock.c:114 __tcp_transmit_skb+0x249b/0x43e0 net/ipv4/tcp_output.c:1693 tcp_transmit_skb net/ipv4/tcp_output.c:1711 [inline] tcp_write_xmit+0x16e8/0x6980 net/ipv4/tcp_output.c:3064 __tcp_push_pending_frames+0x97/0x380 net/ipv4/tcp_output.c:3247 tcp_push_pending_frames include/net/tcp.h:2282 [inline] __tcp_sock_set_cork net/ipv4/tcp.c:3688 [inline] tcp_sock_set_cork+0x186/0x2e0 net/ipv4/tcp.c:3695 rds_send_xmit+0x207e/0x28d0 net/rds/send.c:480 rds_send_worker+0x7d/0x2e0 net/rds/threads.c:200 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Tested on: commit: 57be33f8 nfc: nxp-nci: remove interrupt trigger type git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main console output: https://syzkaller.appspot.com/x/log.txt?x=16b8c65a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=7eb827dd875ec07f dashboard link: https://syzkaller.appspot.com/bug?extid=96046021045ffe6d7709 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=10f594aa580000