syzbot

watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [kworker/u4:20:6749]
Modules linked in:
irq event stamp: 189687
hardirqs last  enabled at (189686): [<ffff80008a44626c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (189686): [<ffff80008a44626c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (189687): [<ffff80008a443ea4>] __el1_irq arch/arm64/kernel/entry-common.c:470 [inline]
hardirqs last disabled at (189687): [<ffff80008a443ea4>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:488
softirqs last  enabled at (181972): [<ffff800088af5570>] spin_unlock_bh include/linux/spinlock.h:395 [inline]
softirqs last  enabled at (181972): [<ffff800088af5570>] nf_nat_cleanup_conntrack+0xf8/0x120 net/netfilter/nf_nat_core.c:811
softirqs last disabled at (184333): [<ffff80008002b660>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
CPU: 0 PID: 6749 Comm: kworker/u4:20 Not tainted 6.4.0-rc7-syzkaller-ge40939bbfc68 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
Workqueue: events_power_efficient gc_worker
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : find_entry_to_transmit+0x550/0x6d0
lr : find_entry_to_transmit+0x4c4/0x6d0
sp : ffff8000800066a0
x29: ffff800080006760 x28: 05cef8829883be23 x27: ffff0000c9611140
x26: ffff0000c9611000 x25: 0000000000000000 x24: 0000000000000080
x23: 05cef8831883bd80 x22: 05cef8831883bd80 x21: ffff8000800068b0
x20: dfff800000000000 x19: 7fffffffffffffff x18: ffff800096404080
x17: 0000000000020010 x16: ffff80008050b28c x15: 0000000000000300
x14: 1ffff00011bde0ac x13: ffffffff80000040 x12: 0000000080000040
x11: 0000000000000501 x10: 0000000000000100 x9 : 05cef8831883bd41
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff8000800068b0
x5 : ffff8000800068d0 x4 : 05cef8829883be23 x3 : ffff80008898bde8
x2 : 0000000000000000 x1 : 7fffffffffffffff x0 : 05cef8831883bdc1
Call trace:
 find_entry_to_transmit+0x550/0x6d0
 get_packet_txtime net/sched/sch_taprio.c:505 [inline]
 taprio_enqueue_one+0xdb0/0x146c net/sched/sch_taprio.c:574
 taprio_enqueue+0x328/0x544 net/sched/sch_taprio.c:655
 dev_qdisc_enqueue+0x60/0x35c net/core/dev.c:3773
 __dev_xmit_skb net/core/dev.c:3862 [inline]
 __dev_queue_xmit+0xb24/0x3318 net/core/dev.c:4210
 dev_queue_xmit include/linux/netdevice.h:3088 [inline]
 br_dev_queue_push_xmit+0x570/0x70c net/bridge/br_forward.c:53
 NF_HOOK+0x35c/0x408 include/linux/netfilter.h:303
 br_forward_finish+0xd0/0x118 net/bridge/br_forward.c:66
 NF_HOOK+0x35c/0x408 include/linux/netfilter.h:303
 __br_forward+0x2ec/0x44c net/bridge/br_forward.c:115
 deliver_clone net/bridge/br_forward.c:131 [inline]
 maybe_deliver+0xc8/0x160 net/bridge/br_forward.c:189
 br_flood+0x2d0/0x420 net/bridge/br_forward.c:233
 br_dev_xmit+0xe68/0x14ec
 __netdev_start_xmit include/linux/netdevice.h:4918 [inline]
 netdev_start_xmit include/linux/netdevice.h:4932 [inline]
 xmit_one net/core/dev.c:3578 [inline]
 dev_hard_start_xmit+0x240/0x8ac net/core/dev.c:3594
 __dev_queue_xmit+0x167c/0x3318 net/core/dev.c:4244
 dev_queue_xmit include/linux/netdevice.h:3088 [inline]
 neigh_hh_output include/net/neighbour.h:528 [inline]
 neigh_output include/net/neighbour.h:542 [inline]
 ip6_finish_output2+0xd2c/0x1a1c net/ipv6/ip6_output.c:134
 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
 ip6_finish_output+0x538/0x8c8 net/ipv6/ip6_output.c:206
 NF_HOOK_COND include/linux/netfilter.h:292 [inline]
 ip6_output+0x270/0x594 net/ipv6/ip6_output.c:227
 dst_output include/net/dst.h:458 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ndisc_send_skb+0xc30/0x1790 net/ipv6/ndisc.c:508
 ndisc_solicit+0x3ac/0x590
 neigh_probe+0xc4/0x128 net/core/neighbour.c:1064
 neigh_timer_handler+0x720/0xdf0 net/core/neighbour.c:1146
 call_timer_fn+0x19c/0x8cc kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x55c/0x734 kernel/time/timer.c:2022
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
 __do_softirq+0x2d0/0xd54 kernel/softirq.c:571
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:882
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:650
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:662
 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline]
 el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:488
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:493
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:587
 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:182 [inline]
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:202 [inline]
 seqcount_lockdep_reader_access+0xe4/0x104 include/linux/seqlock.h:104
 nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:343 [inline]
 gc_worker+0x298/0x12c8 net/netfilter/nf_conntrack_core.c:1496
 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
 kthread+0x288/0x310 kernel/kthread.c:379
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853