IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready Bluetooth: hci1 command 0x0419 tx timeout Bluetooth: hci0 command 0x0419 tx timeout Bluetooth: hci3 command 0x0419 tx timeout Bluetooth: hci5 command 0x0419 tx timeout watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.1:9390] Modules linked in: irq event stamp: 4427319 hardirqs last enabled at (4427318): [] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (4427319): [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (174348): [] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (175905): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (175905): [] irq_exit+0x193/0x240 kernel/softirq.c:409 CPU: 0 PID: 9390 Comm: syz-executor.1 Not tainted 4.14.257-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88809eb4e200 task.stack: ffff88809ef28000 RIP: 0010:addrconf_rs_timer+0xa8/0x5a0 net/ipv6/addrconf.c:3756 RSP: 0018:ffff8880ba407cd0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: 0000000000000000 RBX: 1ffff11017480f9c RCX: 0000000000001fbe RDX: 1ffff11012d43cc8 RSI: 0000000000000001 RDI: ffff888096a1e640 RBP: ffff888096a1e480 R08: ffffffff8b9ad8b0 R09: 0000000000042385 R10: ffff88809eb4eab0 R11: ffff88809eb4e200 R12: ffff888096a1e600 R13: 1ffff11017480fae R14: 1ffff11017480fd3 R15: ffff888093c28ec0 FS: 00007ffb885a4700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff1bee3ff8 CR3: 000000009fee7000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:memset_erms+0xb/0x10 arch/x86/lib/memset_64.S:67 RSP: 0018:ffff88809ef2f610 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff10 RAX: dffffc00000000ff RBX: ffffea00022944e0 RCX: 0000000000000000 RDX: 0000000000000200 RSI: 00000000000000ff RDI: ffffed10114ac800 RBP: ffff88808a563000 R08: ffffed10114ac600 R09: ffffed10114ac600 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000008a563 R13: ffffea00022958e0 R14: ffffea00022958c0 R15: ffff88813fffb000 free_pages_prepare mm/page_alloc.c:1070 [inline] free_pcp_prepare mm/page_alloc.c:1078 [inline] free_hot_cold_page+0x23d/0xc80 mm/page_alloc.c:2615 free_hot_cold_page_list+0x93/0x300 mm/page_alloc.c:2663 release_pages+0x828/0xbf0 mm/swap.c:820 tlb_flush_mmu_free+0xc1/0x1a0 mm/memory.c:272 zap_pte_range mm/memory.c:1431 [inline] zap_pmd_range mm/memory.c:1466 [inline] zap_pud_range mm/memory.c:1495 [inline] zap_p4d_range mm/memory.c:1516 [inline] unmap_page_range+0x1533/0x1ce0 mm/memory.c:1537 unmap_single_vma+0x147/0x2b0 mm/memory.c:1582 unmap_vmas+0x9d/0x160 mm/memory.c:1612 exit_mmap+0x270/0x4d0 mm/mmap.c:3058 __mmput kernel/fork.c:931 [inline] mmput kernel/fork.c:952 [inline] mmput+0xfa/0x420 kernel/fork.c:947 exit_mm kernel/exit.c:548 [inline] do_exit+0x984/0x2850 kernel/exit.c:855 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7ffb88e2ee99 RSP: 002b:00007ffb885a4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 RAX: 0000000000f5c000 RBX: 00007ffb88f41f60 RCX: 00007ffb88e2ee99 RDX: 000000000000000a RSI: 0000000020001900 RDI: 0000000000000005 RBP: 00007ffb88e88ff1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd1538925f R14: 00007ffb885a4300 R15: 0000000000022000 Code: c0 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e c0 03 00 00 8b 85 c0 01 00 00 <85> c0 0f 85 61 01 00 00 e8 eb 78 1e fb 48 8d bd bc 01 00 00 48 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9405 Comm: syz-executor.0 Not tainted 4.14.257-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8880911a65c0 task.stack: ffff88808f9b8000 RIP: 0010:perf_exclude_event+0x77/0x140 kernel/events/core.c:7673 RSP: 0018:ffff8880ba506d60 EFLAGS: 00000806 RAX: 0000000000000000 RBX: ffff8880a1844480 RCX: 0000000000000001 RDX: 1ffff110143088af RSI: ffff8880ba507198 RDI: ffff8880a1844578 RBP: ffff8880ba507198 R08: ffff88823fff7058 R09: ffff88823fff704f R10: ffff88823fff7057 R11: 000000b9c89a5667 R12: 0000000000000000 R13: ffff8880ba507198 R14: ffff8880a1844480 R15: 0000000000000001 FS: 00007f22d0253700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020ea3000 CR3: 000000009e2f4000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: perf_swevent_hrtimer+0x187/0x350 kernel/events/core.c:8752 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x30b/0xc80 kernel/time/hrtimer.c:1287 hrtimer_interrupt+0x1e6/0x5e0 kernel/time/hrtimer.c:1321 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline] smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:in_irqentry_text mm/kasan/kasan.c:419 [inline] RIP: 0010:filter_irq_stacks mm/kasan/kasan.c:430 [inline] RIP: 0010:save_stack mm/kasan/kasan.c:448 [inline] RIP: 0010:set_track mm/kasan/kasan.c:459 [inline] RIP: 0010:kasan_kmalloc+0x14a/0x160 mm/kasan/kasan.c:551 RSP: 0018:ffff8880ba507240 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff10 RAX: 000000000000002a RBX: ffff8880a584ef08 RCX: 0000000000000014 RDX: ffffffff8760024d RSI: ffff8880ba507260 RDI: 0000000000000286 RBP: ffff8880a584ef08 R08: 0000000000000000 R09: 0000000000000005 R10: 0000000000000000 R11: ffff8880911a65c0 R12: 0000000001089220 R13: 0000000000000000 R14: ffff88813fe6adc0 R15: 0000000000000028 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] kmem_cache_alloc+0x111/0x3c0 mm/slab.c:3550 kmem_cache_zalloc include/linux/slab.h:651 [inline] fill_pool lib/debugobjects.c:110 [inline] __debug_object_init+0x578/0x7a0 lib/debugobjects.c:341 debug_object_init lib/debugobjects.c:393 [inline] debug_object_activate+0x391/0x490 lib/debugobjects.c:474 debug_rcu_head_queue kernel/rcu/rcu.h:152 [inline] __call_rcu.constprop.0+0x31/0x7d0 kernel/rcu/tree.c:3050 dst_release+0x56/0x80 net/core/dst.c:188 refdst_drop include/net/dst.h:286 [inline] skb_dst_drop include/net/dst.h:298 [inline] skb_release_head_state+0x1e6/0x250 net/core/skbuff.c:621 skb_release_all net/core/skbuff.c:638 [inline] __kfree_skb net/core/skbuff.c:654 [inline] kfree_skb+0xae/0x390 net/core/skbuff.c:672 ipip_tunnel_xmit+0x18f/0x240 net/ipv4/ipip.c:312 __netdev_start_xmit include/linux/netdevice.h:4051 [inline] netdev_start_xmit include/linux/netdevice.h:4060 [inline] xmit_one net/core/dev.c:3005 [inline] dev_hard_start_xmit+0x188/0x890 net/core/dev.c:3021 __dev_queue_xmit+0x1d7f/0x2480 net/core/dev.c:3521 neigh_output include/net/neighbour.h:500 [inline] ip6_finish_output2+0xf48/0x1f10 net/ipv6/ip6_output.c:120 ip6_finish_output+0x5c6/0xd50 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:239 [inline] ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:209 dst_output include/net/dst.h:470 [inline] NF_HOOK include/linux/netfilter.h:250 [inline] ndisc_send_skb+0x82a/0x1390 net/ipv6/ndisc.c:483 ndisc_send_rs+0x125/0x630 net/ipv6/ndisc.c:677 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3769 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:rmqueue_pcplist mm/page_alloc.c:2807 [inline] RIP: 0010:rmqueue mm/page_alloc.c:2824 [inline] RIP: 0010:get_page_from_freelist+0xad7/0x2560 mm/page_alloc.c:3173 RSP: 0018:ffff88808f9bf3e0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e1279 RBX: 0000000000000000 RCX: 1ffff11012234dcd RDX: 0000000000000000 RSI: ffff8880911a6e48 RDI: 0000000000000286 RBP: 0000000000000004 R08: ffffea00021e0200 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00021e0200 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88813fffb6c0 __alloc_pages_nodemask+0x365/0x2720 mm/page_alloc.c:4185 alloc_pages_vma+0xd2/0x6d0 mm/mempolicy.c:2077 alloc_zeroed_user_highpage_movable include/linux/highmem.h:184 [inline] do_anonymous_page mm/memory.c:3236 [inline] handle_pte_fault mm/memory.c:4090 [inline] __handle_mm_fault+0x25fa/0x4620 mm/memory.c:4216 handle_mm_fault+0x455/0x9c0 mm/memory.c:4253 __do_page_fault+0x549/0xad0 arch/x86/mm/fault.c:1442 page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1123 RIP: 0010:__clear_user+0x3d/0x60 arch/x86/lib/usercopy_64.c:23 RSP: 0018:ffff88808f9bfa18 EFLAGS: 00050206 RAX: 0000000000000000 RBX: 0000000000000200 RCX: 000000000000008b RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000020e18fff RBP: 0000000020e18457 R08: ffffffff8b9a0dc0 R09: 0000000000000000 R10: 0000000000000000 R11: ffff8880911a65c0 R12: 0000000020e18457 R13: 0000000020e19457 R14: 0000000000000000 R15: 0000000000001000 clear_user+0x74/0xb0 arch/x86/lib/usercopy_64.c:53 iov_iter_zero+0x1c7/0xcc0 lib/iov_iter.c:776 read_iter_zero+0xb8/0x180 drivers/char/mem.c:710 call_read_iter include/linux/fs.h:1774 [inline] do_iter_readv_writev+0x41d/0x5f0 fs/read_write.c:673 do_iter_read+0x21d/0x5b0 fs/read_write.c:917 vfs_readv+0xc8/0x120 fs/read_write.c:981 do_readv+0xfc/0x2c0 fs/read_write.c:1014 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f22d0adde99 RSP: 002b:00007f22d0253168 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 RAX: ffffffffffffffda RBX: 00007f22d0bf0f60 RCX: 00007f22d0adde99 RDX: 000000000000000a RSI: 0000000020001900 RDI: 0000000000000005 RBP: 00007f22d0b37ff1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd9a69e79f R14: 00007f22d0253300 R15: 0000000000022000 Code: ff 48 85 ed 0f 84 9e 00  Lost 56 message(s)! ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 00 00 add %al,(%rax) 2: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 9: fc ff df c: 48 89 fa mov %rdi,%rdx f: 48 c1 ea 03 shr $0x3,%rdx 13: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax 17: 84 c0 test %al,%al 19: 74 08 je 0x23 1b: 3c 03 cmp $0x3,%al 1d: 0f 8e c0 03 00 00 jle 0x3e3 23: 8b 85 c0 01 00 00 mov 0x1c0(%rbp),%eax * 29: 85 c0 test %eax,%eax <-- trapping instruction 2b: 0f 85 61 01 00 00 jne 0x192 31: e8 eb 78 1e fb callq 0xfb1e7921 36: 48 8d bd bc 01 00 00 lea 0x1bc(%rbp),%rdi 3d: 48 rex.W