watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.0:21903]
Modules linked in:
irq event stamp: 3608937
hardirqs last enabled at (3608936): [<ffffffff81003ce4>] trace_hardirqs_on_thunk+0x1a/0x1c
hardirqs last disabled at (3608937): [<ffffffff81003d00>] trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last enabled at (2641878): [<ffffffff88400678>] __do_softirq+0x678/0x980 kernel/softirq.c:318
softirqs last disabled at (2641881): [<ffffffff81393705>] invoke_softirq kernel/softirq.c:372 [inline]
softirqs last disabled at (2641881): [<ffffffff81393705>] irq_exit+0x215/0x260 kernel/softirq.c:412
CPU: 0 PID: 21903 Comm: syz-executor.0 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:geneve_xmit+0x1a24/0x2e60 drivers/net/geneve.c:949
Code: e8 61 97 22 02 e9 7b f2 ff ff e8 17 4d 11 fd 48 89 ef e8 4f 97 22 02 e9 86 ec ff ff e8 05 4d 11 fd 49 83 c7 30 e9 99 e7 ff ff <e8> f7 4c 11 fd 48 89 ef e8 1f 6b 1f 02 89 de bf d8 ff ff ff e8 53
RSP: 0018:ffff8880ba0077f0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000301 RBX: 00000000ffffff9b RCX: ffffffff845141f2
RDX: 00000000ffffff9b RSI: ffff888233204200 RDI: 0000000000000005
RBP: ffff8880a5f7ab28 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: 000000000000000e R14: ffff8880a5f7aba8 R15: ffff88804547ee80
FS: 00007f7696442700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a5be851538 CR3: 000000004675b000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__netdev_start_xmit include/linux/netdevice.h:4349 [inline]
netdev_start_xmit include/linux/netdevice.h:4363 [inline]
xmit_one net/core/dev.c:3256 [inline]
dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
__dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
tipc_l2_send_msg+0x29e/0x450 net/tipc/bearer.c:476
tipc_bearer_xmit_skb+0x15b/0x330 net/tipc/bearer.c:518
tipc_disc_timeout+0x855/0xc90 net/tipc/discover.c:332
call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1696 [inline]
run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
__do_softirq+0x265/0x980 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
</IRQ>
RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744
Code: 00 00 e8 2d 42 29 f9 e8 38 7c 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 6b 48 d9 01 00 74 5b fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 d0 82 f1 89 48 c1 e8 03 80
RSP: 0018:ffff888222eb7da0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e305b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888233204a84
RBP: ffffed1046640840 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888233204200
R13: ffffffff89f182d8 R14: 0000000000000000 R15: 0000000000000000
retint_kernel+0x1b/0x2d
RIP: 0010:__sanitizer_cov_trace_pc+0x40/0x50 kernel/kcov.c:108
Code: 00 01 1f 00 75 2b 8b 90 60 13 00 00 83 fa 02 75 20 48 8b 88 68 13 00 00 8b 80 64 13 00 00 48 8b 11 48 83 c2 01 48 39 d0 76 07 <48> 89 34 d1 48 89 11 c3 0f 1f 84 00 00 00 00 00 49 89 f1 49 89 fa
RSP: 0018:ffff888222eb7e78 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13
RAX: 0000000000040000 RBX: 0000000000000708 RCX: ffffc90005c50000
RDX: 0000000000002046 RSI: ffffffff81ab2af0 RDI: 0000000000000005
RBP: ffff888097caf5b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 00000000f105088f R12: 00007f7696442000
R13: 00007f7696443040 R14: 0000000000001000 R15: 0000000000000000
exact_copy_from_user fs/namespace.c:2685 [inline]
copy_mount_options+0x190/0x380 fs/namespace.c:2714
ksys_mount+0x9b/0x130 fs/namespace.c:3033
__do_sys_mount fs/namespace.c:3052 [inline]
__se_sys_mount fs/namespace.c:3049 [inline]
__x64_sys_mount+0xba/0x150 fs/namespace.c:3049
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f7698eccc5a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7696441fa8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7698eccc5a
RDX: 0000000020000080 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 00007f7696442040 R08: 00007f7696442040 R09: 0000000020000080
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000080
R13: 0000000020000180 R14: 00007f7696442000 R15: 00000000200001c0
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 21929 Comm: syz-executor.2 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__lock_release kernel/locking/lockdep.c:3714 [inline]
RIP: 0010:lock_release+0x38d/0x8b0 kernel/locking/lockdep.c:3927
Code: 00 4d 89 ae 78 08 00 00 8d 55 01 44 89 fe 4c 89 f7 e8 67 ea ff ff 85 c0 75 35 48 b8 00 00 00 00 00 fc ff df 48 89 da 83 e3 07 <48> c1 ea 03 83 c3 03 0f b6 04 02 38 c3 7c 08 84 c0 0f 85 d3 02 00
RSP: 0018:ffff8880ba1070b8 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff1100945cd63
RDX: ffffffff8d242760 RSI: 0000000000000003 RDI: ffff88804a2e6240
RBP: 0000000000000002 R08: ffffffff8cd53e80 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000074071 R12: 1ffff11017420e1a
R13: 600fd093b2ff9a58 R14: ffff88804a2e6240 R15: 0000000000000003
FS: 00007fe7e1e59700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100000000 CR3: 000000009012a000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
seqcount_lockdep_reader_access include/linux/seqlock.h:82 [inline]
read_seqcount_begin include/linux/seqlock.h:164 [inline]
ktime_get+0xe6/0x2f0 kernel/time/timekeeping.c:756
hrtimer_forward_now include/linux/hrtimer.h:479 [inline]
perf_swevent_hrtimer+0x318/0x3e0 kernel/events/core.c:9266
__run_hrtimer kernel/time/hrtimer.c:1419 [inline]
__hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1481
hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1539
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline]
smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:unwind_next_frame+0xa12/0x1400 arch/x86/kernel/unwind_orc.c:508
Code: f7 4c 89 44 24 30 48 8d 70 f8 48 89 44 24 28 e8 34 f4 ff ff 84 c0 0f 84 72 fa ff ff 48 b8 00 00 00 00 00 fc ff df 48 8b 14 24 <4c> 8b 64 24 68 4c 8b 44 24 30 48 c1 ea 03 80 3c 02 00 0f 85 8c 09
RSP: 0018:ffff8880ba107708 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 1ffff11017420eea RCX: 0000000000000000
RDX: ffff8880ba107870 RSI: ffff8880ba107698 RDI: ffff8880ba107dd0
RBP: 0000000000000002 R08: ffffffff8c0906f2 R09: ffffffff8c090688
R10: ffff8880ba107897 R11: 0000000000074071 R12: ffff8880ba107880
R13: ffff8880ba10786d R14: ffff8880ba107838 R15: ffffffff8c0906ee
__save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44
save_stack mm/kasan/kasan.c:448 [inline]
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc_node mm/slab.c:3340 [inline]
kmem_cache_alloc_node_trace+0x13c/0x3b0 mm/slab.c:3666
__do_kmalloc_node mm/slab.c:3688 [inline]
__kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0xae/0x560 net/core/skbuff.c:205
__netdev_alloc_skb+0x76/0x460 net/core/skbuff.c:407
netdev_alloc_skb include/linux/skbuff.h:2680 [inline]
dev_alloc_skb include/linux/skbuff.h:2693 [inline]
__ieee80211_beacon_get+0xc7d/0x1a30 net/mac80211/tx.c:4338
ieee80211_beacon_get_tim+0x88/0x890 net/mac80211/tx.c:4449
ieee80211_beacon_get include/net/mac80211.h:4484 [inline]
mac80211_hwsim_beacon_tx+0xff/0x680 drivers/net/wireless/mac80211_hwsim.c:1577
__iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614
ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650
mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615
__tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601
tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522
__do_softirq+0x265/0x980 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
</IRQ>
RIP: 0010:__x64_sys_futex+0x1/0x1b0 kernel/futex.c:3918
Code: d5 1a 0a 00 45 8d 75 fd bf 02 00 00 00 45 31 ff 44 89 f6 e8 31 1c 0a 00 41 83 fe 02 0f 86 be fe ff ff e9 5c ff ff ff 66 90 53 <48> 89 fb 48 83 ec 28 e8 a3 1a 0a 00 48 8d 7b 40 48 b8 00 00 00 00
RSP: 0018:ffff88821bbc7f18 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 00000000000000ca RCX: ffffc90013001000
RDX: 1ffffffff10c09ca RSI: ffffffff810076df RDI: ffff88821bbc7f58
RBP: ffff88821bbc7f58 R08: 0000000000000000 R09: 0000000000000223
R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff89f182d8 R14: 0000000000000000 R15: 0000000000000000
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fe7e48e2739
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe7e1e59218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007fe7e49e6f88 RCX: 00007fe7e48e2739
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7e49e6f8c
RBP: 00007fe7e49e6f80 R08: 000000000000000e R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7e49e6f8c
R13: 00007ffcea55766f R14: 00007fe7e1e59300 R15: 0000000000022000
----------------
Code disassembly (best guess):
0: e8 61 97 22 02 callq 0x2229766
5: e9 7b f2 ff ff jmpq 0xfffff285
a: e8 17 4d 11 fd callq 0xfd114d26
f: 48 89 ef mov %rbp,%rdi
12: e8 4f 97 22 02 callq 0x2229766
17: e9 86 ec ff ff jmpq 0xffffeca2
1c: e8 05 4d 11 fd callq 0xfd114d26
21: 49 83 c7 30 add $0x30,%r15
25: e9 99 e7 ff ff jmpq 0xffffe7c3
* 2a: e8 f7 4c 11 fd callq 0xfd114d26 <-- trapping instruction
2f: 48 89 ef mov %rbp,%rdi
32: e8 1f 6b 1f 02 callq 0x21f6b56
37: 89 de mov %ebx,%esi
39: bf d8 ff ff ff mov $0xffffffd8,%edi
3e: e8 .byte 0xe8
3f: 53 push %rbx