RBP: 00007f0f0ad0c6fe R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f0f0ade5f80 R15: 00007ffc62103c38 watchdog: BUG: soft lockup - CPU#1 stuck for 226s! [syz-executor.2:4387] Modules linked in: CPU: 1 PID: 4387 Comm: syz-executor.2 Tainted: G W 5.15.149-syzkaller-00131-g79bd336c7a94 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:434 [inline] RIP: 0010:__pv_queued_spin_lock_slowpath+0x5ba/0xc40 kernel/locking/qspinlock.c:508 Code: 00 00 49 89 dc c6 03 00 48 8b 44 24 10 0f b6 04 10 84 c0 0f 85 48 01 00 00 48 8b 44 24 08 c6 00 01 bb 00 80 ff ff eb 06 f3 90 c3 74 5e 41 0f b6 44 15 00 84 c0 75 36 41 80 3f 00 75 ea 4c 89 RSP: 0018:ffffc900001d0b80 EFLAGS: 00000206 RAX: 0000000000000000 RBX: 00000000fffff431 RCX: ffffffff8154fa3f RDX: dffffc0000000000 RSI: 0000000000000003 RDI: ffff888118e92788 RBP: ffffc900001d0c70 R08: dffffc0000000000 R09: ffffed10231d24f2 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f7138ad4 R13: 1ffff110231d24f1 R14: 1ffff1103ee20001 R15: ffff888118e92788 FS: 00007f0f0a0296c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001254b0000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock include/linux/spinlock.h:187 [inline] __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_lock+0x139/0x1b0 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:363 [inline] tcp_write_timer+0x25/0x1d0 net/ipv4/tcp_timer.c:662 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1427 expire_timers kernel/time/timer.c:1472 [inline] __run_timers+0x72a/0xa10 kernel/time/timer.c:1743 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1756 __do_softirq+0x26d/0x5bf kernel/softirq.c:565 invoke_softirq kernel/softirq.c:425 [inline] __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:648 irq_exit_rcu+0x9/0x10 kernel/softirq.c:660 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:__text_poke+0x704/0x7b0 arch/x86/kernel/alternative.c:1143 Code: e8 d1 4a 5a 01 85 c0 48 8d bc 24 20 01 00 00 0f 85 b6 00 00 00 f7 44 24 40 00 02 00 00 48 8b 44 24 50 74 01 fb 42 80 3c 28 00 <74> 05 e8 15 ba 84 00 48 8b bc 24 20 01 00 00 e8 78 73 9b 03 48 c7 RSP: 0018:ffffc90000b9f6c0 EFLAGS: 00000246 RAX: 1ffff92000173efc RBX: 00002aaaaaaac000 RCX: 0000000000b9f800 RDX: dffffc0000000000 RSI: ffffc90000b9f8c0 RDI: ffffc90000b9f7e0 RBP: ffffc90000b9f850 R08: ffffffff8285c5d0 R09: ffffed102000c456 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffff8160f3f6 R13: dffffc0000000000 R14: ffff88812bfbbb40 R15: 0000000000000001 text_poke arch/x86/kernel/alternative.c:1167 [inline] text_poke_bp_batch+0x147/0x5d0 arch/x86/kernel/alternative.c:1384 text_poke_flush arch/x86/kernel/alternative.c:1555 [inline] text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1562 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146 __jump_label_update+0x36a/0x380 kernel/jump_label.c:459 jump_label_update+0x3af/0x450 kernel/jump_label.c:830 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177 static_key_enable+0x1a/0x30 kernel/jump_label.c:190 tracepoint_add_func+0x8b2/0x940 kernel/tracepoint.c:361 tracepoint_probe_register_prio_may_exist+0x11c/0x180 kernel/tracepoint.c:482 tracepoint_probe_register_may_exist include/linux/tracepoint.h:52 [inline] __bpf_probe_register kernel/trace/bpf_trace.c:1943 [inline] bpf_probe_register+0x152/0x1e0 kernel/trace/bpf_trace.c:1949 bpf_raw_tracepoint_open+0x610/0x950 kernel/bpf/syscall.c:3093 __sys_bpf+0x489/0x760 kernel/bpf/syscall.c:4675 __do_sys_bpf kernel/bpf/syscall.c:4737 [inline] __se_sys_bpf kernel/bpf/syscall.c:4735 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4735 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f0f0acaef69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0f0a0290c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f0f0ade5f80 RCX: 00007f0f0acaef69 RDX: 000000000000003d RSI: 0000000020000000 RDI: 0000000000000011 RBP: 00007f0f0ad0c6fe R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f0f0ade5f80 R15: 00007ffc62103c38 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4381 Comm: syz-executor.0 Tainted: G W 5.15.149-syzkaller-00131-g79bd336c7a94 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:native_halt arch/x86/include/asm/irqflags.h:57 [inline] RIP: 0010:halt arch/x86/include/asm/irqflags.h:98 [inline] RIP: 0010:kvm_wait+0x117/0x180 arch/x86/kernel/kvm.c:912 Code: 48 c1 e8 03 42 0f b6 04 20 84 c0 44 8b 74 24 1c 75 53 41 0f b6 45 00 44 38 f0 0f 85 63 ff ff ff 66 90 0f 00 2d fa 03 f3 03 f4 54 ff ff ff fa 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0 44 8b RSP: 0018:ffffc90000006c80 EFLAGS: 00000046 RAX: 0000000000000003 RBX: 1ffff92000000d94 RCX: ffffffff8154fa3f RDX: dffffc0000000000 RSI: 0000000000000003 RDI: ffff8881f7029a00 RBP: ffffc90000006d30 R08: dffffc0000000000 R09: ffffed103ee05341 R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 R13: ffff8881f7029a00 R14: 0000000000000003 R15: 1ffff92000000d98 FS: 0000555556e37480(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2ed24000 CR3: 000000012b5f8000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: pv_wait arch/x86/include/asm/paravirt.h:597 [inline] pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:470 [inline] __pv_queued_spin_lock_slowpath+0x6bc/0xc40 kernel/locking/qspinlock.c:508 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock_flags include/linux/spinlock.h:199 [inline] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irqsave+0x1a0/0x210 kernel/locking/spinlock.c:162 hrtimer_interrupt+0x111/0xaa0 kernel/time/hrtimer.c:1792 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline] __sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1102 sysvec_apic_timer_interrupt+0x44/0xc0 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:run_filter+0x1/0x1f0 net/packet/af_packet.c:2048 Code: ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c b7 fd ff ff 4c 89 e7 e8 7f c4 46 fd e9 aa fd ff ff e8 a5 79 57 00 0f 1f 44 00 00 55 <48> 89 e5 41 57 41 56 41 55 41 54 53 50 41 89 d7 48 89 f3 49 89 fe RSP: 0018:ffffc90000007148 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811849c000 RCX: ffff8881160c4f00 RDX: 0000000000000042 RSI: ffff88811849c000 RDI: ffff888139bd4640 RBP: ffffc900000071d8 R08: ffffffff846a4df7 R09: ffffed102144d555 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1102737a8d6 R13: 0000000000000042 R14: ffff888139bd4640 R15: 1ffff1102737a8e4 dev_queue_xmit_nit+0x9a4/0xa40 net/core/dev.c:2349 xmit_one net/core/dev.c:3619 [inline] dev_hard_start_xmit+0x149/0x620 net/core/dev.c:3640 sch_direct_xmit+0x298/0x9b0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3851 [inline] __dev_queue_xmit+0x161e/0x2e70 net/core/dev.c:4220 dev_queue_xmit+0x17/0x20 net/core/dev.c:4288 neigh_hh_output include/net/neighbour.h:501 [inline] neigh_output include/net/neighbour.h:515 [inline] ip_finish_output2+0xb9f/0xf60 net/ipv4/ip_output.c:228 __ip_finish_output+0x162/0x360 ip_finish_output+0x31/0x210 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip_output+0x1d6/0x420 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] __ip_queue_xmit+0x1105/0x1c20 net/ipv4/ip_output.c:532 ip_queue_xmit+0x4c/0x70 net/ipv4/ip_output.c:546 __tcp_transmit_skb+0x1e84/0x3920 net/ipv4/tcp_output.c:1402 __tcp_send_ack+0x303/0x710 net/ipv4/tcp_output.c:4007 tcp_send_ack+0x3b/0x60 net/ipv4/tcp_output.c:4013 tcp_delack_timer_handler+0x469/0x7b0 net/ipv4/tcp_timer.c:318 tcp_delack_timer+0x111/0x230 net/ipv4/tcp_timer.c:345 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1427 expire_timers kernel/time/timer.c:1472 [inline] __run_timers+0x72a/0xa10 kernel/time/timer.c:1743 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1756 __do_softirq+0x26d/0x5bf kernel/softirq.c:565 do_softirq+0xf6/0x150 kernel/softirq.c:452 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:379 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x51/0x60 kernel/locking/spinlock.c:210 sock_hash_delete_elem+0x2a2/0x2f0 net/core/sock_map.c:945 bpf_prog_2c29ac5cdc6b1842+0x3a/0xb70 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline] __bpf_prog_run include/linux/filter.h:625 [inline] bpf_prog_run include/linux/filter.h:632 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run2+0xec/0x210 kernel/trace/bpf_trace.c:1917 __bpf_trace_hrtimer_start+0x23/0x30 include/trace/events/timer.h:199 trace_hrtimer_start include/trace/events/timer.h:199 [inline] debug_activate kernel/time/hrtimer.c:476 [inline] enqueue_hrtimer+0x1e7/0x240 kernel/time/hrtimer.c:1084 __hrtimer_start_range_ns kernel/time/hrtimer.c:1258 [inline] hrtimer_start_range_ns+0x9f4/0xb80 kernel/time/hrtimer.c:1298 hrtimer_start_expires include/linux/hrtimer.h:435 [inline] hrtimer_sleeper_start_expires kernel/time/hrtimer.c:1965 [inline] do_nanosleep+0x12d/0x6a0 kernel/time/hrtimer.c:2041 hrtimer_nanosleep+0x1c5/0x3f0 kernel/time/hrtimer.c:2097 common_nsleep+0x91/0xb0 kernel/time/posix-timers.c:1267 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1308 [inline] __se_sys_clock_nanosleep+0x323/0x3b0 kernel/time/posix-timers.c:1285 __x64_sys_clock_nanosleep+0x9b/0xb0 kernel/time/posix-timers.c:1285 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fbc16561375 Code: 24 0c 89 3c 24 48 89 4c 24 18 e8 f6 b9 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 8b 74 24 0c 8b 3c 24 b8 e6 00 00 00 0f 05 <44> 89 c7 48 89 04 24 e8 4f ba ff ff 48 8b 04 24 48 83 c4 28 f7 d8 RSP: 002b:00007ffe9d1011e0 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 00007fbc1666cf80 RCX: 00007fbc16561375 RDX: 00007ffe9d101220 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fbc1666e980 R08: 0000000000000000 R09: 00007ffe9d1db0b0 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000016ae9 R13: 00007fbc1666cf8c R14: 0000000000000032 R15: 00007fbc1666e980