syzbot

watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz.6.1713:6406]
Modules linked in:
CPU: 1 PID: 6406 Comm: syz.6.1713 Not tainted 5.4.289-syzkaller-00011-g39762b7a60e9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:434 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x5a1/0xc70 kernel/locking/qspinlock.c:507
Code: 85 ba 01 00 00 c6 03 00 48 8b 44 24 28 42 0f b6 04 30 84 c0 0f 85 bf 01 00 00 48 8b 04 24 c6 00 01 bb 00 80 ff ff eb 06 f3 90 <ff> c3 74 50 43 0f b6 44 35 00 84 c0 75 32 41 80 3c 24 00 75 e9 4c
RSP: 0018:ffff8881e6ea7480 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000004 RBX: 00000000ffffd025 RCX: 0000000086ee2100
RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffffff86ee21e0
RBP: ffff8881e6ea7570 R08: dffffc0000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: dffffc0000000001 R12: ffffffff86ee21e0
R13: 1ffffffff0ddc43c R14: dffffc0000000000 R15: ffff88823fe9eac0
FS:  00007f04d2fe36c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb14c562866 CR3: 00000001e2104000 CR4: 00000000003406a0
DR0: 0000400000000300 DR1: 0000400000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 </IRQ>
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:642 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:50 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:81 [inline]
 do_raw_spin_lock include/linux/spinlock.h:181 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0x139/0x1b0 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:338 [inline]
 alloc_vmap_area+0x29a/0x1ac0 mm/vmalloc.c:1106
 __get_vm_area_node+0x1c7/0x310 mm/vmalloc.c:2066
 __vmalloc_node_range+0xee/0x710 mm/vmalloc.c:2494
 __vmalloc_node mm/vmalloc.c:2554 [inline]
 __vmalloc+0x40/0x50 mm/vmalloc.c:2560
 bpf_prog_alloc_no_stats+0x6b/0x240 kernel/bpf/core.c:88
 bpf_prog_alloc+0x1a/0x1e0 kernel/bpf/core.c:114
 bpf_prog_load kernel/bpf/syscall.c:1678 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x5e76/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f04d4978de9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f04d2fe3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f04d4b91fa0 RCX: 00007f04d4978de9
RDX: 00000000000000a0 RSI: 0000400000000680 RDI: 0000000000000005
RBP: 00007f04d49fa2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f04d4b91fa0 R15: 00007fff4ed04d28
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6390 Comm: syz.5.1708 Not tainted 5.4.289-syzkaller-00011-g39762b7a60e9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:__hrtimer_run_queues+0x1/0xb90 kernel/time/hrtimer.c:1615
Code: 00 48 c7 c7 e0 d0 ef 85 48 89 de e8 79 ac f3 00 e9 c0 f7 ff ff e8 5f 23 0f 00 0f 0b 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 <48> 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec 20 01 00
RSP: 0018:ffff8881f6e08fb0 EFLAGS: 00000006
RAX: ffffffff815521aa RBX: ffff8881f6e4b610 RCX: 000000000000000f
RDX: 0000000000000046 RSI: 0000004336e57665 RDI: ffff8881f6e4b600
RBP: 0000000000000001 R08: ffffffff815521a0 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff8881f6e4b600
R13: 0000000000000001 R14: dffffc0000000000 R15: 0000000000000046
FS:  00007f2532b7c6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f58dbac1f98 CR3: 00000001c6e9d000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000602
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 hrtimer_interrupt+0x38a/0x890 kernel/time/hrtimer.c:1707
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1134 [inline]
 smp_apic_timer_interrupt+0x110/0x490 arch/x86/kernel/apic/apic.c:1159
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:46 [inline]
RIP: 0010:stack_access_ok arch/x86/kernel/unwind_orc.c:337 [inline]
RIP: 0010:deref_stack_reg+0xa7/0x1f0 arch/x86/kernel/unwind_orc.c:347
Code: 00 74 05 e8 1b 57 64 00 4c 8b 73 08 48 8d 7b 10 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 00 57 64 00 4c 8b 63 10 48 89 d8 <48> c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 0f 85
RSP: 0018:ffff8881f6e091a0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff8881f6e09560 RBX: ffff8881f6e09560 RCX: 0000000000000000
RDX: ffff8881f6e095a0 RSI: ffff8881db40f0b8 RDI: ffff8881f6e09570
RBP: ffff8881f6e09250 R08: dffffc0000000000 R09: ffff8881f6e095b0
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881db410000
R13: 1ffff1103edc1238 R14: ffff8881db408000 R15: ffff8881db40f0b8
 unwind_next_frame+0x1681/0x1ea0 arch/x86/kernel/unwind_orc.c:579
 arch_stack_walk+0x111/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1c0 kernel/stacktrace.c:123
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc_trace+0xdc/0x260 mm/slub.c:2854
 kmalloc include/linux/slab.h:556 [inline]
 dst_cow_metrics_generic+0x52/0x1b0 net/core/dst.c:201
 dst_metrics_write_ptr include/net/dst.h:118 [inline]
 dst_metric_set include/net/dst.h:179 [inline]
 icmp6_dst_alloc+0x349/0x550 net/ipv6/route.c:3200
 ndisc_send_skb+0x262/0xc30 net/ipv6/ndisc.c:491
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3955
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:539 [inline]
 smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:preempt_count_add+0x4/0x180 kernel/sched/core.c:4003
Code: ff ff ff 48 c7 c7 e0 a7 ed 85 48 89 de e8 54 e3 03 01 e9 22 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 57 41 56 <53> 89 fb 48 c7 c0 c0 49 eb 86 48 c1 e8 03 49 bf 00 00 00 00 00 fc
RSP: 0018:ffff8881db40e828 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: ffffed103b681d1c RCX: ffff8881db40f1e0
RDX: ffffc90008159000 RSI: 0000000000000040 RDI: 0000000000000001
RBP: ffff8881db40eb30 R08: ffffffff8153c572 R09: ffff8881db40eb90
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103b681d68
R13: ffffffff816dad17 R14: ffff8881db40eb40 R15: dffffc0000000000
 unwind_next_frame+0x17c/0x1ea0 arch/x86/kernel/unwind_orc.c:423
 arch_stack_walk+0x111/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1c0 kernel/stacktrace.c:123
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kmem_cache_free+0x10b/0x2c0 mm/slub.c:3096
 adjust_va_to_fit_type mm/vmalloc.c:934 [inline]
 __alloc_vmap_area mm/vmalloc.c:1037 [inline]
 alloc_vmap_area+0x175e/0x1ac0 mm/vmalloc.c:1113
 __get_vm_area_node+0x1c7/0x310 mm/vmalloc.c:2066
 __vmalloc_node_range+0xee/0x710 mm/vmalloc.c:2494
 __vmalloc_node mm/vmalloc.c:2554 [inline]
 __vmalloc_node_flags mm/vmalloc.c:2568 [inline]
 vmalloc+0x70/0x80 mm/vmalloc.c:2593
 bpf_prog_calc_tag+0xd7/0x8f0 kernel/bpf/core.c:280
 replace_map_fd_with_map_ptr kernel/bpf/verifier.c:8218 [inline]
 bpf_check+0x91a/0xb3e0 kernel/bpf/verifier.c:9608
 bpf_prog_load kernel/bpf/syscall.c:1724 [inline]
 __do_sys_bpf kernel/bpf/syscall.c:2891 [inline]
 __se_sys_bpf+0x8139/0xbcb0 kernel/bpf/syscall.c:2849
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f2534511de9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2532b7c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f253472afa0 RCX: 00007f2534511de9
RDX: 0000000000000048 RSI: 000040000000e000 RDI: 0000000000000005
RBP: 00007f25345932a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f253472afa0 R15: 00007ffe756bff68