From: syzbot <syzbot+300375dfd44665f063a6@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, neganhat@gmail.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [x25?] inconsistent lock state in x25_kill_by_neigh (2)
Date: Wed, 14 Oct 2026 15:59:02 -0700 [thread overview]
Message-ID: <6ad00936.a150a118.27e199.0069.GAE@google.com> (raw)
In-Reply-To: <CAFJkwZxEecAizR2Onef19ss4F8jcig41Robzud4ASpi1J+zxrA@mail.gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
inconsistent lock state in x25_kill_by_neigh
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/1/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff8880270b6260 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
ffff8880270b6260 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x168/0x280 net/x25/af_x25.c:1778
{SOFTIRQ-ON-W} state was registered at:
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
lock_sock_nested+0x41/0xf0 net/core/sock.c:3837
lock_sock include/net/sock.h:1713 [inline]
x25_bind+0x221/0x5c0 net/x25/af_x25.c:694
__sys_bind_socket net/socket.c:1945 [inline]
__sys_bind_socket net/socket.c:1937 [inline]
__sys_bind+0x1a9/0x260 net/socket.c:1976
__do_sys_bind net/socket.c:1981 [inline]
__se_sys_bind net/socket.c:1979 [inline]
__x64_sys_bind+0x72/0xb0 net/socket.c:1979
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
irq event stamp: 688540
hardirqs last enabled at (688540): [<ffffffff81ca5325>] __local_bh_enable_ip+0xa5/0x120 kernel/softirq.c:478
hardirqs last disabled at (688539): [<ffffffff81ca534e>] __local_bh_enable_ip+0xce/0x120 kernel/softirq.c:455
softirqs last enabled at (687752): [<ffffffff81ca4d8a>] __do_softirq kernel/softirq.c:679 [inline]
softirqs last enabled at (687752): [<ffffffff81ca4d8a>] invoke_softirq kernel/softirq.c:519 [inline]
softirqs last enabled at (687752): [<ffffffff81ca4d8a>] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
softirqs last disabled at (688117): [<ffffffff81ca4d8a>] __do_softirq kernel/softirq.c:679 [inline]
softirqs last disabled at (688117): [<ffffffff81ca4d8a>] invoke_softirq kernel/softirq.c:519 [inline]
softirqs last disabled at (688117): [<ffffffff81ca4d8a>] __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
locks held by swapper/1/0: 1, last CPU#1:
#0: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8fdec5e0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x25/0x1a0 net/core/dev.c:6321
stack backtrace:
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_usage_bug.part.0+0x258/0x340 kernel/locking/lockdep.c:4086
print_usage_bug kernel/locking/lockdep.c:4054 [inline]
valid_state kernel/locking/lockdep.c:4100 [inline]
mark_lock_irq kernel/locking/lockdep.c:4311 [inline]
mark_lock+0x956/0x1020 kernel/locking/lockdep.c:4797
mark_usage kernel/locking/lockdep.c:4686 [inline]
__lock_acquire+0x7f1/0x1f40 kernel/locking/lockdep.c:5242
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
lock_sock_nested+0x41/0xf0 net/core/sock.c:3837
lock_sock include/net/sock.h:1713 [inline]
x25_kill_by_neigh+0x168/0x280 net/x25/af_x25.c:1778
x25_lapb_receive_frame+0x4b1/0x1000 net/x25/x25_dev.c:138
__netif_receive_skb_one_core+0x1b2/0x1e0 net/core/dev.c:6297
netif_receive_skb_core+0x5a/0x1a0 net/core/dev.c:6322
lapbeth_napi_poll+0x42/0xc0 drivers/net/wan/lapbether.c:100
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7830
napi_poll net/core/dev.c:7893 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:8050
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: a7 96 02 e9 53 50 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 93 48 17 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 00000246
RAX: 00000000000a7ff3 RBX: ffff888020684b00 RCX: ffffffff8bd47235
RDX: 0000000000000001 RSI: ffffffff8e3e3486 RDI: ffffffff8c625580
RBP: ffffed10040d0960 R08: 0000000000000001 R09: ffffed10170667bd
R10: ffff8880b8333deb R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000034fc4 R15: dffffc0000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:768
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x158
</TASK>
BUG: sleeping function called from invalid context at net/core/sock.c:3839
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
__might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9264
lock_sock_nested+0x52/0xf0 net/core/sock.c:3839
lock_sock include/net/sock.h:1713 [inline]
x25_kill_by_neigh+0x168/0x280 net/x25/af_x25.c:1778
x25_lapb_receive_frame+0x4b1/0x1000 net/x25/x25_dev.c:138
__netif_receive_skb_one_core+0x1b2/0x1e0 net/core/dev.c:6297
netif_receive_skb_core+0x5a/0x1a0 net/core/dev.c:6322
lapbeth_napi_poll+0x42/0xc0 drivers/net/wan/lapbether.c:100
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7830
napi_poll net/core/dev.c:7893 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:8050
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: a7 96 02 e9 53 50 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 93 48 17 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc900001a7e00 EFLAGS: 00000246
RAX: 00000000000a7ff3 RBX: ffff888020684b00 RCX: ffffffff8bd47235
RDX: 0000000000000001 RSI: ffffffff8e3e3486 RDI: ffffffff8c625580
RBP: ffffed10040d0960 R08: 0000000000000001 R09: ffffed10170667bd
R10: ffff8880b8333deb R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000034fc4 R15: dffffc0000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:768
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x158
</TASK>
----------------
Code disassembly (best guess):
0: a7 cmpsl %es:(%rdi),%ds:(%rsi)
1: 96 xchg %eax,%esi
2: 02 e9 add %cl,%ch
4: 53 push %rbx
5: 50 push %rax
6: 03 00 add (%rax),%eax
8: 0f 1f 00 nopl (%rax)
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: f3 0f 1e fa endbr64
1f: 66 90 xchg %ax,%ax
21: 0f 00 2d 93 48 17 00 verw 0x174893(%rip) # 0x1748bb
28: fb sti
29: f4 hlt
* 2a: c3 ret <-- trapping instruction
2b: cc int3
2c: cc int3
2d: cc int3
2e: cc int3
2f: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
36: 00 00 00
39: 66 90 xchg %ax,%ax
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop
3f: 90 nop
Tested on:
commit: 24a19b95 Linux 7.3-rc7
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=124d0235580000
kernel config: https://syzkaller.appspot.com/x/.config?x=129d675874dbf896
dashboard link: https://syzkaller.appspot.com/bug?extid=300375dfd44665f063a6
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
next parent reply other threads:[~2026-10-14 22:59 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAFJkwZxEecAizR2Onef19ss4F8jcig41Robzud4ASpi1J+zxrA@mail.gmail.com>
2026-10-14 22:59 ` syzbot [this message]
[not found] <CAFJkwZyYvooJO5gz0_16L8bFwxnHwHC0ZFbDJL-q_2KPPZ0_kA@mail.gmail.com>
2026-10-14 23:01 ` [syzbot] [x25?] inconsistent lock state in x25_kill_by_neigh (2) syzbot
2026-10-11 0:03 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ad00936.a150a118.27e199.0069.GAE@google.com \
--to=syzbot+300375dfd44665f063a6@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=neganhat@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.