BUG: soft lockup in can

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	INFO: rcu detected stall in can_rcv can				1	231d	231d	0/26	auto-obsoleted due to no activity on 2023/11/30 12:06
watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.0:6090]
Modules linked in:
irq event stamp: 2639149
hardirqs last  enabled at (2639148): [<ffffffff81003ce4>] trace_hardirqs_on_thunk+0x1a/0x1c
hardirqs last disabled at (2639149): [<ffffffff81003d00>] trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last  enabled at (2595668): [<ffffffff88400678>] __do_softirq+0x678/0x980 kernel/softirq.c:318
softirqs last disabled at (2595671): [<ffffffff813927d5>] invoke_softirq kernel/softirq.c:372 [inline]
softirqs last disabled at (2595671): [<ffffffff813927d5>] irq_exit+0x215/0x260 kernel/softirq.c:412
CPU: 1 PID: 6090 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:334 [inline]
RIP: 0010:deref_stack_reg+0x12f/0x1d0 arch/x86/kernel/unwind_orc.c:328
Code: 85 a3 00 00 00 49 8b 74 24 28 4c 89 e2 48 89 ef e8 16 33 f7 ff 41 89 c0 31 c0 45 85 c0 75 32 48 8d 74 24 28 48 89 ef 4c 89 ea <e8> cc fc ff ff 48 c1 ea 03 48 8b 6c 24 28 48 b8 00 00 00 00 00 fc
RSP: 0018:ffff8880ba1076a8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff8880ba108000 RBX: 1ffff11017420ed6 RCX: 0000000000000000
RDX: ffff8880ba1078b0 RSI: ffff8880ba1076d0 RDI: ffff8880ba107cc0
RBP: ffff8880ba107cc0 R08: 0000000000000001 R09: 0000000000000001
R10: ffff8880ba1078cf R11: 0000000000074071 R12: ffff8880ba107870
R13: ffff8880ba1078b0 R14: ffff8880ba100000 R15: ffffffff8c01e86a
FS:  00007efd71823700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31026000 CR3: 000000004fb56000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 unwind_next_frame+0xf83/0x1400 arch/x86/kernel/unwind_orc.c:555
 __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc mm/slab.c:3397 [inline]
 kmem_cache_alloc+0x110/0x370 mm/slab.c:3557
 skb_clone+0x151/0x3d0 net/core/skbuff.c:1293
 can_can_gw_rcv+0x760/0x900 net/can/gw.c:396
 deliver net/can/af_can.c:615 [inline]
 can_rcv_filter+0x170/0x980 net/can/af_can.c:642
 can_receive+0x2f0/0x530 net/can/af_can.c:707
 can_rcv+0x12f/0x1d0 net/can/af_can.c:738
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954
 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066
 process_backlog+0x241/0x700 net/core/dev.c:5849
 napi_poll net/core/dev.c:6280 [inline]
 net_rx_action+0x4ac/0xfb0 net/core/dev.c:6346
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744
Code: 00 00 e8 3d 04 29 f9 e8 58 3f 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 9b 18 d9 01 00 74 5b fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 90 82 f1 89 48 c1 e8 03 80
RSP: 0018:ffff88805429f9d0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3053 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88805847ed08 RDI: ffff88805847ed04
RBP: ffffed100b08fc90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805847e480
R13: ffffffff89f18298 R14: 0000000000000000 R15: 0000000000000000
 retint_kernel+0x1b/0x2d
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:qlink_free mm/kasan/quarantine.c:150 [inline]
RIP: 0010:qlist_free_all+0xfc/0x140 mm/kasan/quarantine.c:166
Code: 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 4c 8b 70 18 e9 40 ff ff ff e8 a3 36 cf ff 48 83 3d e3 0f 59 08 00 74 38 4c 89 ff 57 9d <0f> 1f 44 00 00 4d 85 e4 75 9e 49 c7 45 08 00 00 00 00 49 c7 45 00
RSP: 0018:ffff88805429faa0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: ffff8880a93a2780 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88805847ed08 RDI: 0000000000000286
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a0052180
R13: ffff88805429fad8 R14: ffff8880b5b8fd80 R15: 0000000000000286
 quarantine_reduce+0x1a9/0x230 mm/kasan/quarantine.c:259
 kasan_kmalloc+0xa2/0x160 mm/kasan/kasan.c:538
 slab_post_alloc_hook mm/slab.h:445 [inline]
 slab_alloc mm/slab.c:3397 [inline]
 kmem_cache_alloc+0x110/0x370 mm/slab.c:3557
 sock_alloc_inode+0x19/0x250 net/socket.c:244
 alloc_inode+0x5d/0x180 fs/inode.c:211
 new_inode_pseudo+0x14/0xe0 fs/inode.c:911
 sock_alloc+0x3c/0x260 net/socket.c:567
 __sock_create+0xba/0x740 net/socket.c:1329
 sock_create net/socket.c:1416 [inline]
 __sys_socket+0xef/0x200 net/socket.c:1458
 __do_sys_socket net/socket.c:1467 [inline]
 __se_sys_socket net/socket.c:1465 [inline]
 __x64_sys_socket+0x6f/0xb0 net/socket.c:1465
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7efd72eaf8f7
Code: f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efd71822078 EFLAGS: 00000293 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007efd72fc0f80 RCX: 00007efd72eaf8f7
RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010
RBP: 00007efd72f082e9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000140 R11: 0000000000000293 R12: 0000000020000140
R13: 0000000000000000 R14: 0000000000000006 R15: 0000000020000040
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
RIP: 0010:__lock_acquire+0x1ef/0x3ff0 kernel/locking/lockdep.c:3295
Code: 48 81 c4 98 01 00 00 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 80 3c 02 00 <0f> 85 b3 2a 00 00 49 81 3e 20 f2 66 8c 0f 84 65 ff ff ff 83 fe 01
RSP: 0018:ffff8880b5a5f240 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 1ffffffff1a8b134 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880b5a4c240 R14: ffffffff8d4589a0 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556a8c848 CR3: 00000000a5c3a000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000004
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
 __debug_check_no_obj_freed lib/debugobjects.c:776 [inline]
 debug_check_no_obj_freed+0xb5/0x490 lib/debugobjects.c:817
 kmem_cache_free+0xff/0x260 mm/slab.c:3764
 kfree_skbmem+0xc1/0x140 net/core/skbuff.c:595
 __kfree_skb net/core/skbuff.c:655 [inline]
 kfree_skb+0x127/0x3d0 net/core/skbuff.c:672
 enqueue_to_backlog+0x272/0xe00 net/core/dev.c:4263
 netif_rx_internal+0xfd/0x670 net/core/dev.c:4491
 netif_rx_ni+0x73/0x350 net/core/dev.c:4527
 vxcan_xmit+0x88f/0xd20 drivers/net/can/vxcan.c:76
 __netdev_start_xmit include/linux/netdevice.h:4349 [inline]
 netdev_start_xmit include/linux/netdevice.h:4363 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 can_send+0x4be/0xa00 net/can/af_can.c:297
 can_can_gw_rcv+0x6fe/0x900 net/can/gw.c:449
 deliver net/can/af_can.c:615 [inline]
 can_rcv_filter+0x170/0x980 net/can/af_can.c:642
 can_receive+0x2f0/0x530 net/can/af_can.c:707
 can_rcv+0x12f/0x1d0 net/can/af_can.c:738
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954
 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066
 process_backlog+0x241/0x700 net/core/dev.c:5849
 napi_poll net/core/dev.c:6280 [inline]
 net_rx_action+0x4ac/0xfb0 net/core/dev.c:6346
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 run_ksoftirqd+0x57/0x110 kernel/softirq.c:653
 smpboot_thread_fn+0x655/0x9e0 kernel/smpboot.c:164
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415