syzbot

RBP: 00007f5ffa811e41 R08: 0000000000000002 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ffa9d6038 R14: 00007f5ffa9d5fa0 R15: 00007ffd53654218
 </TASK>
watchdog: BUG: soft lockup - CPU#0 stuck for 226s! [syz.0.1000:3994]
Modules linked in:
CPU: 0 PID: 3994 Comm: syz.0.1000 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:check_kcov_mode kernel/kcov.c:182 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x27/0x60 kernel/kcov.c:216
Code: 67 40 a5 55 48 89 e5 48 8b 45 08 65 48 8b 0d 50 64 92 7e 65 8b 15 51 64 92 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 <83> b9 6c 0b 00 00 00 74 2c 8b 91 48 0b 00 00 83 fa 02 75 21 48 8b
RSP: 0018:ffffc90000007398 EFLAGS: 00000246
RAX: ffffffff81b48ba8 RBX: ffffffff879b4fe0 RCX: ffff88811970d100
RDX: 0000000000000100 RSI: 00000000000000aa RDI: 00000000000000aa
RBP: ffffc90000007398 R08: dffffc0000000000 R09: fffffbfff0f384b1
R10: fffffbfff0f384b1 R11: 1ffffffff0f384b0 R12: 1ffffffff0f36a02
R13: ffff8881f71c26f3 R14: 00000000000000aa R15: ffff8881f71c3000
FS:  00007f5ffb6866c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000014939a000 CR4: 00000000003506b0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000006 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 for_each_canary mm/kfence/core.c:350 [inline]
 kfence_guarded_free+0x3a8/0x7b0 mm/kfence/core.c:500
 __kfence_free+0x115/0x180 mm/kfence/core.c:1092
 kfence_free include/linux/kfence.h:186 [inline]
 __slab_free+0x45/0x280 mm/slub.c:3498
 do_slab_free mm/slub.c:3640 [inline]
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0x15b/0x1b0 mm/slub.c:3702
 kfree+0x6f/0xf0 mm/slab_common.c:990
 skb_free_head net/core/skbuff.c:765 [inline]
 skb_release_data+0x63f/0x890 net/core/skbuff.c:794
 skb_release_all net/core/skbuff.c:859 [inline]
 __kfree_skb net/core/skbuff.c:873 [inline]
 kfree_skb_reason+0xd4/0x230 net/core/skbuff.c:896
 kfree_skb include/linux/skbuff.h:1239 [inline]
 neigh_connected_output+0x47e/0x500 net/core/neighbour.c:1595
 neigh_output include/net/neighbour.h:552 [inline]
 ip6_finish_output2+0x1607/0x1870 net/ipv6/ip6_output.c:138
 __ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
 ip6_finish_output+0x5f9/0xbb0 net/ipv6/ip6_output.c:216
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x1d1/0x3b0 net/ipv6/ip6_output.c:237
 dst_output include/net/dst.h:453 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x7e3/0xcf0 net/ipv6/ndisc.c:513
 ndisc_send_rs+0x670/0x870 net/ipv6/ndisc.c:723
 addrconf_rs_timer+0x2c7/0x600 net/ipv6/addrconf.c:4006
 call_timer_fn+0x46/0x2a0 kernel/time/timer.c:1510
 expire_timers kernel/time/timer.c:1555 [inline]
 __run_timers+0x639/0x9a0 kernel/time/timer.c:1826
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1839
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:generic_exec_single+0x2ac/0x3a0 kernel/smp.c:-1
Code: 74 71 e8 87 6e 09 00 43 0f b6 04 3e 84 c0 0f 85 c7 00 00 00 41 c7 04 24 00 00 00 00 bb fa ff ff ff eb 11 e8 66 6e 09 00 31 db <49> bf 00 00 00 00 00 fc ff df 48 c7 44 24 20 0e 36 e0 45 4b c7 44
RSP: 0018:ffffc90007d0fa20 EFLAGS: 00000283
RAX: ffffffff81669a8e RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc9000598b000 RSI: 00000000000001fd RDI: 00000000000001fe
RBP: ffffc90007d0fad0 R08: ffff88811970d100 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff81963c90 R12: ffffc90007d0fb28
R13: 1ffff92000fa1f48 R14: ffffc90007d0fc60 R15: 0000000000000200
 smp_call_function_single+0x1c5/0x470 kernel/smp.c:784
 task_function_call kernel/events/core.c:120 [inline]
 perf_install_in_context+0x49a/0x730 kernel/events/core.c:2935
 __do_sys_perf_event_open kernel/events/core.c:12721 [inline]
 __se_sys_perf_event_open+0x1281/0x1b80 kernel/events/core.c:12315
 __x64_sys_perf_event_open+0xbf/0xd0 kernel/events/core.c:12315
 x64_sys_call+0x385/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:299
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5ffa78ec29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5ffb686038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f5ffa9d5fa0 RCX: 00007f5ffa78ec29
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000000
RBP: 00007f5ffa811e41 R08: 0000000000000002 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ffa9d6038 R14: 00007f5ffa9d5fa0 R15: 00007ffd53654218
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 357 Comm: kworker/u4:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:453 [inline]
RIP: 0010:smp_call_function_many_cond+0x872/0x960 kernel/smp.c:998
Code: 41 8b 1f 89 de 83 e6 01 31 ff e8 29 66 09 00 83 e3 01 48 bb 00 00 00 00 00 fc ff df 75 0a e8 f5 61 09 00 e9 38 ff ff ff f3 90 <41> 0f b6 44 1d 00 84 c0 75 14 41 f7 07 01 00 00 00 0f 84 1a ff ff
RSP: 0018:ffffc9000dddf840 EFLAGS: 00000293
RAX: ffffffff8166a78e RBX: dffffc0000000000 RCX: ffff888115035100
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000dddf978 R08: dffffc0000000000 R09: ffffed103ee2721b
R10: 0000000000000000 R11: ffffffff81342170 R12: 1ffff1103ee27218
R13: 1ffff1103ee07ae1 R14: 0000000000000000 R15: ffff8881f703d708
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe442f05000 CR3: 0000000006e0f000 CR4: 00000000003506a0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x43/0x80 kernel/smp.c:1166
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1574 [inline]
 text_poke_bp_batch+0x1cc/0x580 arch/x86/kernel/alternative.c:1774
 text_poke_flush arch/x86/kernel/alternative.c:1965 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1972
 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
 __jump_label_update+0x37c/0x3a0 kernel/jump_label.c:451
 jump_label_update+0x39b/0x450 kernel/jump_label.c:797
 static_key_enable_cpuslocked+0x126/0x240 kernel/jump_label.c:173
 static_key_enable+0x1a/0x30 kernel/jump_label.c:186
 toggle_allocation_gate+0xb4/0x400 mm/kfence/core.c:805
 process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
 worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>