rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	0-....: (1 GPs behind) idle=487/1/0x4000000000000000 softirq=111602/111603 fqs=1102 
	(t=10501 jiffies g=188813 q=87)
NMI backtrace for cpu 0
CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 5.17.0-rc6-syzkaller-00190-gafb3cc1a397d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1e6/0x230 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
 print_cpu_stall kernel/rcu/tree_stall.h:604 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:688 [inline]
 rcu_pending kernel/rcu/tree.c:3919 [inline]
 rcu_sched_clock_irq.cold+0x402/0x755 kernel/rcu/tree.c:2617
 update_process_times+0x16d/0x200 kernel/time/timer.c:1785
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1097
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__orc_find+0x5e/0xf0 arch/x86/kernel/unwind_orc.c:50
Code: 89 fe 48 89 fd eb 0c 48 8d 6b 04 49 89 de 49 39 ec 72 4d 4c 89 e0 48 29 e8 48 89 c2 48 c1 e8 3f 48 c1 fa 02 48 01 d0 48 d1 f8 <48> 8d 5c 85 00 48 89 d8 48 c1 e8 03 42 0f b6 14 38 48 89 d8 83 e0
RSP: 0018:ffffc90000007520 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff8da19e4c RCX: ffffffff81473112
RDX: 0000000000000000 RSI: ffffffff8e109310 RDI: ffffffff8da19e4c
RBP: ffffffff8da19e50 R08: ffffffff8e109310 R09: 0000000000000001
R10: fffff52000000ed3 R11: 0000000000088078 R12: ffffffff8da19e50
R13: ffffffff8da19e4c R14: ffffffff8da19e4c R15: dffffc0000000000
 orc_find arch/x86/kernel/unwind_orc.c:173 [inline]
 unwind_next_frame+0x32a/0x1ce0 arch/x86/kernel/unwind_orc.c:443
 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track+0x21/0x30 mm/kasan/common.c:45
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
 ____kasan_slab_free mm/kasan/common.c:366 [inline]
 ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:328
 kasan_slab_free include/linux/kasan.h:236 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1754
 slab_free mm/slub.c:3509 [inline]
 kfree+0xd0/0x390 mm/slub.c:4562
 skb_free_head net/core/skbuff.c:655 [inline]
 skb_release_data+0x630/0x760 net/core/skbuff.c:677
 skb_release_all net/core/skbuff.c:742 [inline]
 __kfree_skb net/core/skbuff.c:756 [inline]
 kfree_skb_reason.part.0+0xc3/0x2f0 net/core/skbuff.c:776
 kfree_skb_reason include/linux/refcount.h:279 [inline]
 kfree_skb include/linux/skbuff.h:1114 [inline]
 kfree_skb_list+0xa5/0x150 net/core/skbuff.c:785
 __dev_xmit_skb net/core/dev.c:3768 [inline]
 __dev_queue_xmit+0x214f/0x37b0 net/core/dev.c:4081
 mrp_queue_xmit net/802/mrp.c:364 [inline]
 mrp_join_timer+0x8a/0xc0 net/802/mrp.c:608
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x67c/0xa30 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 8a 90 0e f8 48 89 ef e8 e2 0e 0f f8 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 <e8> 93 c6 01 f8 65 8b 05 dc 87 b3 76 85 c0 74 0a 5b 5d c3 e8 60 03
RSP: 0018:ffffc90000cf76a8 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000200 RCX: 1ffffffff1fff016
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffffff906ad690 R08: 0000000000000001 R09: ffffffff8ffc49cf
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88807e380000
R13: dffffc0000000000 R14: 1ffff9200019eeda R15: ffffffff89adc200
 debug_object_activate+0x1b3/0x3e0 lib/debugobjects.c:695
 debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
 kvfree_call_rcu+0x32/0x990 kernel/rcu/tree.c:3582
 ma_put net/ipv6/mcast.c:869 [inline]
 ma_put+0x11c/0x180 net/ipv6/mcast.c:865
 ipv6_mc_destroy_dev+0x3ba/0x630 net/ipv6/mcast.c:2808
 addrconf_ifdown.isra.0+0x1208/0x1660 net/ipv6/addrconf.c:3877
 addrconf_notify+0xeb/0x1ba0 net/ipv6/addrconf.c:3664
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1919
 call_netdevice_notifiers_extack net/core/dev.c:1931 [inline]
 call_netdevice_notifiers net/core/dev.c:1945 [inline]
 unregister_netdevice_many+0x964/0x18d0 net/core/dev.c:10415
 ip6_tnl_exit_batch_net+0x5f5/0x890 net/ipv6/ip6_tunnel.c:2311
 ops_exit_list+0x125/0x170 net/core/net_namespace.c:173
 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:597
 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
 worker_thread+0x657/0x1110 kernel/workqueue.c:2454
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 fe                	mov    %edi,%esi
   2:	48 89 fd             	mov    %rdi,%rbp
   5:	eb 0c                	jmp    0x13
   7:	48 8d 6b 04          	lea    0x4(%rbx),%rbp
   b:	49 89 de             	mov    %rbx,%r14
   e:	49 39 ec             	cmp    %rbp,%r12
  11:	72 4d                	jb     0x60
  13:	4c 89 e0             	mov    %r12,%rax
  16:	48 29 e8             	sub    %rbp,%rax
  19:	48 89 c2             	mov    %rax,%rdx
  1c:	48 c1 e8 3f          	shr    $0x3f,%rax
  20:	48 c1 fa 02          	sar    $0x2,%rdx
  24:	48 01 d0             	add    %rdx,%rax
  27:	48 d1 f8             	sar    %rax
* 2a:	48 8d 5c 85 00       	lea    0x0(%rbp,%rax,4),%rbx <-- trapping instruction
  2f:	48 89 d8             	mov    %rbx,%rax
  32:	48 c1 e8 03          	shr    $0x3,%rax
  36:	42 0f b6 14 38       	movzbl (%rax,%r15,1),%edx
  3b:	48 89 d8             	mov    %rbx,%rax
  3e:	83                   	.byte 0x83
  3f:	e0                   	.byte 0xe0