BUG: soft lockup in rtnl

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-5.15	INFO: rcu detected stall in rtnl_setlink origin:lts-only	C		inconclusive	16	46d	208d	0/3	upstream: reported C repro on 2023/09/28 05:42
upstream	INFO: rcu detected stall in rtnl_setlink batman				1	965d	965d	0/26	auto-closed as invalid on 2021/11/30 03:45

watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.4:9696] Modules linked in: irq event stamp: 2789563 hardirqs last enabled at (2789562): [<ffffffff87400976>] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (2789563): [<ffffffff874018ae>] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (3744): [<ffffffff8760068b>] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (3750): [<ffffffff85c75f01>] neigh_ifdown+0x41/0x360 net/core/neighbour.c:295 CPU: 1 PID: 9696 Comm: syz-executor.4 Not tainted 4.14.278-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88809e7cc080 task.stack: ffff88805c738000 RIP: 0010:__read_once_size include/linux/compiler.h:185 [inline] RIP: 0010:queued_write_lock_slowpath+0x80/0x1d0 kernel/locking/qrwlock.c:130 RSP: 0018:ffff88805c73eea8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 00000000000000ff RBX: ffffffff89d962f0 RCX: 0000000000000d1e RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff89d962f0 RBP: ffffffff89d962f4 R08: ffffffff8b9ac3b0 R09: 00000000000401a4 R10: ffff88809e7cc930 R11: ffff88809e7cc080 R12: fffffbfff13b2c5e R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 00007efd0847d700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200003c0 CR3: 0000000090cae000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: queued_write_lock include/asm-generic/qrwlock.h:134 [inline] do_raw_write_lock+0xc2/0x1d0 kernel/locking/spinlock_debug.c:203 neigh_ifdown+0x41/0x360 net/core/neighbour.c:295 addrconf_ifdown.isra.0+0xc8/0x1410 net/ipv6/addrconf.c:3589 addrconf_notify+0x116/0x1c50 net/ipv6/addrconf.c:3511 notifier_call_chain+0x108/0x1a0 kernel/notifier.c:93 call_netdevice_notifiers_info net/core/dev.c:1667 [inline] call_netdevice_notifiers_mtu net/core/dev.c:1706 [inline] dev_set_mtu+0x23d/0x3c0 net/core/dev.c:6921 do_setlink+0x4f3/0x2bf0 net/core/rtnetlink.c:2055 rtnl_setlink+0x1f5/0x2e0 net/core/rtnetlink.c:2324 rtnetlink_rcv_msg+0x3be/0xb10 net/core/rtnetlink.c:4322 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2455 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 sock_write_iter+0x22c/0x370 net/socket.c:925 call_write_iter include/linux/fs.h:1780 [inline] do_iter_readv_writev+0x4cf/0x5f0 fs/read_write.c:675 do_iter_write+0x152/0x550 fs/read_write.c:954 vfs_writev+0x125/0x290 fs/read_write.c:999 do_writev+0xfc/0x2c0 fs/read_write.c:1034 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7efd09b290e9 RSP: 002b:00007efd0847d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007efd09c3c030 RCX: 00007efd09b290e9 RDX: 0000000000000001 RSI: 00000000200003c0 RDI: 0000000000000011 RBP: 00007efd09b8308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff0e43fddf R14: 00007efd0847d300 R15: 0000000000022000 Code: 0f 84 d3 00 00 00 49 89 dc 49 89 de 41 bd 01 00 00 00 49 c1 ec 03 41 83 e6 07 48 b8 00 00 00 00 00 fc ff df 49 01 c4 eb 02 f3 90 <41> 0f b6 04 24 44 38 f0 7f 08 84 c0 0f 85 f6 00 00 00 0f b6 03 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 9674 Comm: syz-executor.0 Not tainted 4.14.278-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88805c4ac1c0 task.stack: ffff88805c4b0000 RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:100 RSP: 0018:ffff8880ba4072f0 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: ffffffff88cca000 RCX: 0000000000000020 RDX: 1ffffffff119941d RSI: 00000000000000f1 RDI: 0000000000000380 RBP: ffff8880ba4282c0 R08: ffff88823fff7018 R09: ffff88823fff700f R10: ffff88823fff7017 R11: 0000002238b439d7 R12: 00000000000000f1 R13: 0000000000000003 R14: 00000020d1079784 R15: 000000297df39ea8 FS: 00007f1bd4ec8700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffeed1f29a7 CR3: 000000009b678000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> apic_write arch/x86/include/asm/apic.h:385 [inline] lapic_next_event+0x53/0x80 arch/x86/kernel/apic/apic.c:468 clockevents_program_event+0x1f1/0x2d0 kernel/time/clockevents.c:339 tick_program_event+0x78/0xd0 kernel/time/tick-oneshot.c:47 hrtimer_interrupt+0x336/0x5e0 kernel/time/hrtimer.c:1334 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline] smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:__unwind_start+0x0/0x930 arch/x86/kernel/unwind_orc.c:510 RSP: 0018:ffff8880ba4074e0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: ffff88805c4ac1c0 RBX: ffff88809ab911c0 RCX: ffff8880ba407568 RDX: 0000000000000000 RSI: ffff88805c4ac1c0 RDI: ffff8880ba4074f8 RBP: ffff8880ba407568 R08: ffffed10135721b8 R09: ffffed1013572238 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ba407580 R13: 0000000000000000 R14: ffff88813fe74ac0 R15: 0000000000000400 unwind_start arch/x86/include/asm/unwind.h:60 [inline] __save_stack_trace+0x63/0x160 arch/x86/kernel/stacktrace.c:43 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x144/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] kzalloc include/linux/slab.h:661 [inline] neigh_alloc net/core/neighbour.c:324 [inline] __neigh_create+0x1db/0x19c0 net/core/neighbour.c:499 ip6_finish_output2+0x802/0x1f10 net/ipv6/ip6_output.c:117 ip6_finish_output+0x5c6/0xd50 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:239 [inline] ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:209 dst_output include/net/dst.h:470 [inline] NF_HOOK include/linux/netfilter.h:250 [inline] ndisc_send_skb+0x82a/0x1390 net/ipv6/ndisc.c:483 ndisc_send_rs+0x125/0x630 net/ipv6/ndisc.c:677 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3773 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 </IRQ> RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3614 RSP: 0018:ffff88805c4b7950 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e1313 RBX: dffffc0000000000 RCX: 1ffff1100b89594d RDX: 0000000000000000 RSI: ffff88805c4aca48 RDI: ffff88805c4aca44 RBP: ffffed100b895838 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805c4ac1c0 R13: ffffffff88f09898 R14: 0000000000000000 R15: 0000000000000000 retint_kernel+0x1b/0x2d RIP: 0010:mem_cgroup_uncharge+0x0/0xd0 mm/memcontrol.c:5800 RSP: 0018:ffff88805c4b7a28 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff02 RAX: 0000000000040000 RBX: ffffea000272c1dc RCX: ffffc900067f6000 RDX: 0000000000040000 RSI: ffffffff816c30be RDI: ffffea000272c1c0 RBP: ffffea000272c1c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff88809bdb56a8 R14: ffff88805c4b7b28 R15: ffff88809aa48080 __put_single_page mm/swap.c:78 [inline] __put_page+0x9b/0x2f0 mm/swap.c:113 put_page include/linux/mm.h:875 [inline] generic_pipe_buf_release+0x16c/0x1e0 fs/pipe.c:245 pipe_buf_release include/linux/pipe_fs_i.h:138 [inline] splice_from_pipe_feed fs/splice.c:515 [inline] __splice_from_pipe+0x43d/0x7a0 fs/splice.c:626 splice_from_pipe fs/splice.c:661 [inline] default_file_splice_write+0xc5/0x150 fs/splice.c:809 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x115/0x160 fs/splice.c:1018 splice_direct_to_actor+0x27c/0x730 fs/splice.c:973 do_splice_direct+0x164/0x210 fs/splice.c:1061 do_sendfile+0x47f/0xb30 fs/read_write.c:1441 SYSC_sendfile64 fs/read_write.c:1502 [inline] SyS_sendfile64+0xff/0x110 fs/read_write.c:1488 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f1bd65530e9 RSP: 002b:00007f1bd4ec8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f1bd6665f60 RCX: 00007f1bd65530e9 RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000006 RBP: 00007f1bd65ad08d R08: 0000000000000000 R09: 0000000000000000 R10: 0000800000000035 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc3839b78f R14: 00007f1bd4ec8300 R15: 0000000000022000 Code: 83 3d ec 1a 0c 0a 01 7f 02 5d c3 89 ef 5d e9 e2 51 df 05 48 c7 c7 c0 a3 2e 8b e8 64 75 5c 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff <c3> 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb ---------------- Code disassembly (best guess): 0: 0f 84 d3 00 00 00 je 0xd9 6: 49 89 dc mov %rbx,%r12 9: 49 89 de mov %rbx,%r14 c: 41 bd 01 00 00 00 mov $0x1,%r13d 12: 49 c1 ec 03 shr $0x3,%r12 16: 41 83 e6 07 and $0x7,%r14d 1a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 21: fc ff df 24: 49 01 c4 add %rax,%r12 27: eb 02 jmp 0x2b 29: f3 90 pause * 2b: 41 0f b6 04 24 movzbl (%r12),%eax <-- trapping instruction 30: 44 38 f0 cmp %r14b,%al 33: 7f 08 jg 0x3d 35: 84 c0 test %al,%al 37: 0f 85 f6 00 00 00 jne 0x133 3d: 0f b6 03 movzbl (%rbx),%eax