BUG: soft lockup in can

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	INFO: rcu detected stall in can_rcv can				1	459d	459d	0/28	auto-obsoleted due to no activity on 2023/11/30 12:06
upstream	INFO: rcu detected stall in can_rcv (2) can				1	275d	275d	0/28	auto-obsoleted due to no activity on 2024/06/01 19:10

watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.0:6090] Modules linked in: irq event stamp: 2639149 hardirqs last enabled at (2639148): [<ffffffff81003ce4>] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (2639149): [<ffffffff81003d00>] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (2595668): [<ffffffff88400678>] __do_softirq+0x678/0x980 kernel/softirq.c:318 softirqs last disabled at (2595671): [<ffffffff813927d5>] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (2595671): [<ffffffff813927d5>] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 1 PID: 6090 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:334 [inline] RIP: 0010:deref_stack_reg+0x12f/0x1d0 arch/x86/kernel/unwind_orc.c:328 Code: 85 a3 00 00 00 49 8b 74 24 28 4c 89 e2 48 89 ef e8 16 33 f7 ff 41 89 c0 31 c0 45 85 c0 75 32 48 8d 74 24 28 48 89 ef 4c 89 ea <e8> cc fc ff ff 48 c1 ea 03 48 8b 6c 24 28 48 b8 00 00 00 00 00 fc RSP: 0018:ffff8880ba1076a8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 RAX: ffff8880ba108000 RBX: 1ffff11017420ed6 RCX: 0000000000000000 RDX: ffff8880ba1078b0 RSI: ffff8880ba1076d0 RDI: ffff8880ba107cc0 RBP: ffff8880ba107cc0 R08: 0000000000000001 R09: 0000000000000001 R10: ffff8880ba1078cf R11: 0000000000074071 R12: ffff8880ba107870 R13: ffff8880ba1078b0 R14: ffff8880ba100000 R15: ffffffff8c01e86a FS: 00007efd71823700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31026000 CR3: 000000004fb56000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> unwind_next_frame+0xf83/0x1400 arch/x86/kernel/unwind_orc.c:555 __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc mm/slab.c:3397 [inline] kmem_cache_alloc+0x110/0x370 mm/slab.c:3557 skb_clone+0x151/0x3d0 net/core/skbuff.c:1293 can_can_gw_rcv+0x760/0x900 net/can/gw.c:396 deliver net/can/af_can.c:615 [inline] can_rcv_filter+0x170/0x980 net/can/af_can.c:642 can_receive+0x2f0/0x530 net/can/af_can.c:707 can_rcv+0x12f/0x1d0 net/can/af_can.c:738 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066 process_backlog+0x241/0x700 net/core/dev.c:5849 napi_poll net/core/dev.c:6280 [inline] net_rx_action+0x4ac/0xfb0 net/core/dev.c:6346 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 </IRQ> RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744 Code: 00 00 e8 3d 04 29 f9 e8 58 3f 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 9b 18 d9 01 00 74 5b fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 90 82 f1 89 48 c1 e8 03 80 RSP: 0018:ffff88805429f9d0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e3053 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88805847ed08 RDI: ffff88805847ed04 RBP: ffffed100b08fc90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805847e480 R13: ffffffff89f18298 R14: 0000000000000000 R15: 0000000000000000 retint_kernel+0x1b/0x2d RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:qlink_free mm/kasan/quarantine.c:150 [inline] RIP: 0010:qlist_free_all+0xfc/0x140 mm/kasan/quarantine.c:166 Code: 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 4c 8b 70 18 e9 40 ff ff ff e8 a3 36 cf ff 48 83 3d e3 0f 59 08 00 74 38 4c 89 ff 57 9d <0f> 1f 44 00 00 4d 85 e4 75 9e 49 c7 45 08 00 00 00 00 49 c7 45 00 RSP: 0018:ffff88805429faa0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000007 RBX: ffff8880a93a2780 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88805847ed08 RDI: 0000000000000286 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a0052180 R13: ffff88805429fad8 R14: ffff8880b5b8fd80 R15: 0000000000000286 quarantine_reduce+0x1a9/0x230 mm/kasan/quarantine.c:259 kasan_kmalloc+0xa2/0x160 mm/kasan/kasan.c:538 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc mm/slab.c:3397 [inline] kmem_cache_alloc+0x110/0x370 mm/slab.c:3557 sock_alloc_inode+0x19/0x250 net/socket.c:244 alloc_inode+0x5d/0x180 fs/inode.c:211 new_inode_pseudo+0x14/0xe0 fs/inode.c:911 sock_alloc+0x3c/0x260 net/socket.c:567 __sock_create+0xba/0x740 net/socket.c:1329 sock_create net/socket.c:1416 [inline] __sys_socket+0xef/0x200 net/socket.c:1458 __do_sys_socket net/socket.c:1467 [inline] __se_sys_socket net/socket.c:1465 [inline] __x64_sys_socket+0x6f/0xb0 net/socket.c:1465 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7efd72eaf8f7 Code: f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007efd71822078 EFLAGS: 00000293 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007efd72fc0f80 RCX: 00007efd72eaf8f7 RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 RBP: 00007efd72f082e9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000140 R11: 0000000000000293 R12: 0000000020000140 R13: 0000000000000000 R14: 0000000000000006 R15: 0000000020000040 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:__lock_acquire+0x1ef/0x3ff0 kernel/locking/lockdep.c:3295 Code: 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 80 3c 02 00 <0f> 85 b3 2a 00 00 49 81 3e 20 f2 66 8c 0f 84 65 ff ff ff 83 fe 01 RSP: 0018:ffff8880b5a5f240 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 1ffffffff1a8b134 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880b5a4c240 R14: ffffffff8d4589a0 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555556a8c848 CR3: 00000000a5c3a000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000004 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152 __debug_check_no_obj_freed lib/debugobjects.c:776 [inline] debug_check_no_obj_freed+0xb5/0x490 lib/debugobjects.c:817 kmem_cache_free+0xff/0x260 mm/slab.c:3764 kfree_skbmem+0xc1/0x140 net/core/skbuff.c:595 __kfree_skb net/core/skbuff.c:655 [inline] kfree_skb+0x127/0x3d0 net/core/skbuff.c:672 enqueue_to_backlog+0x272/0xe00 net/core/dev.c:4263 netif_rx_internal+0xfd/0x670 net/core/dev.c:4491 netif_rx_ni+0x73/0x350 net/core/dev.c:4527 vxcan_xmit+0x88f/0xd20 drivers/net/can/vxcan.c:76 __netdev_start_xmit include/linux/netdevice.h:4349 [inline] netdev_start_xmit include/linux/netdevice.h:4363 [inline] xmit_one net/core/dev.c:3256 [inline] dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838 can_send+0x4be/0xa00 net/can/af_can.c:297 can_can_gw_rcv+0x6fe/0x900 net/can/gw.c:449 deliver net/can/af_can.c:615 [inline] can_rcv_filter+0x170/0x980 net/can/af_can.c:642 can_receive+0x2f0/0x530 net/can/af_can.c:707 can_rcv+0x12f/0x1d0 net/can/af_can.c:738 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066 process_backlog+0x241/0x700 net/core/dev.c:5849 napi_poll net/core/dev.c:6280 [inline] net_rx_action+0x4ac/0xfb0 net/core/dev.c:6346 __do_softirq+0x265/0x980 kernel/softirq.c:292 run_ksoftirqd+0x57/0x110 kernel/softirq.c:653 smpboot_thread_fn+0x655/0x9e0 kernel/smpboot.c:164 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415