watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz-executor.3:1055]
Modules linked in:
CPU: 1 PID: 1055 Comm: syz-executor.3 Not tainted 5.4.274-syzkaller-00016-gdd432c37afcd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:find_stack lib/stackdepot.c:184 [inline]
RIP: 0010:stack_depot_save+0x144/0x480 lib/stackdepot.c:245
Code: 31 fe c1 c7 18 41 29 fe 44 89 f5 81 e5 ff ff 0f 00 4c 8b 3c ed c0 88 f1 86 44 89 eb eb 03 4d 8b 3f 4d 85 ff 74 29 45 39 77 08 <75> f2 45 39 6f 0c 75 ec 31 c0 49 8b 0c c4 49 3b 4c c7 18 75 df 48
RSP: 0018:ffff8881f6f09910 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 00000000ec03a0b9 RBX: 0000000000000009 RCX: 000000000c4aad52
RDX: 0000000000000a20 RSI: ffff8881f6f099cc RDI: 0000000013b87d41
RBP: 0000000000016e85 R08: 0000000000000003 R09: ffffffff846031dc
R10: ffffffff84800000 R11: dffffc0000000001 R12: ffff8881f6f09990
R13: 0000000000000009 R14: 0000000085016e85 R15: ffff8881f3ecc6c0
FS:  00007f947f7f56c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f948047af3f CR3: 0000000005e0e000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 save_stack mm/kasan/common.c:72 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x1d9/0x210 mm/kasan/common.c:529
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 kmem_cache_alloc+0xd9/0x250 mm/slub.c:2842
 kmem_cache_alloc_node include/linux/slab.h:427 [inline]
 __alloc_skb+0x7a/0x4d0 net/core/skbuff.c:198
 alloc_skb include/linux/skbuff.h:1080 [inline]
 nlmsg_new include/net/netlink.h:888 [inline]
 __neigh_notify+0x7c/0x130 net/core/neighbour.c:3370
 neigh_update_notify net/core/neighbour.c:2533 [inline]
 neigh_timer_handler+0xa7d/0xf00 net/core/neighbour.c:1110
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x45/0x60 kernel/locking/spinlock.c:199
Code: 08 00 74 0c 48 c7 c7 90 3b eb 85 e8 a5 12 43 fd 48 83 3d 1d 2d 9a 01 00 74 29 48 89 df e8 33 e8 fa fc 66 90 fb bf 01 00 00 00 <e8> b6 d4 f3 fc 65 8b 05 fb 7e b1 7b 85 c0 74 02 5b c3 e8 84 45 af
RSP: 0018:ffff8881d4fe7570 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: ffff8881f6f57b40 RCX: dffffc0000000000
RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffff8881d4fe75d0 R08: ffffffff81799989 R09: fffffbfff0c96e5b
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f6f57b40
R13: ffff8881f39e9f80 R14: dffffc0000000000 R15: 0000000000000000
 finish_lock_switch kernel/sched/core.c:3347 [inline]
 finish_task_switch+0x130/0x590 kernel/sched/core.c:3447
 context_switch kernel/sched/core.c:3611 [inline]
 __schedule+0xb0d/0x1320 kernel/sched/core.c:4307
 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:4558
 retint_kernel+0x1b/0x1b
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:22 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:79 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:120 [inline]
RIP: 0010:free_unref_page mm/page_alloc.c:3137 [inline]
RIP: 0010:free_the_page mm/page_alloc.c:4953 [inline]
RIP: 0010:__free_pages+0xb8/0x140 mm/page_alloc.c:4961
Code: f1 ff ff eb 77 49 be 00 00 00 00 00 16 00 00 4d 01 ee 49 c1 fe 06 4c 89 ef 4c 89 f6 e8 61 1b 00 00 84 c0 74 57 48 8d 7c 24 40 <49> 89 ff 49 c1 ef 03 43 80 3c 27 00 74 0f 48 8d 7c 24 40 e8 10 69
RSP: 0018:ffff8881d4fe7820 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: 1ffffd4000ecba01 RBX: 1ffff1103a9fcf08 RCX: 0000000000000029
RDX: 0000000000000200 RSI: 00000000000000ff RDI: ffff8881d4fe7860
RBP: ffff8881d4fe78e0 R08: dffffc0000000000 R09: ffffed103b2e9400
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffea000765d280 R14: 00000000001d974a R15: 1ffff1103ba089f5
 __vunmap+0x75b/0x890 mm/vmalloc.c:2260
 kcov_put kernel/kcov.c:396 [inline]
 kcov_close+0x27/0x50 kernel/kcov.c:495
 __fput+0x262/0x680 fs/file_table.c:281
 task_work_run+0x140/0x170 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xcaf/0x2bc0 kernel/exit.c:859
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xdb1/0x1440 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f948047af69
Code: Bad RIP value.
RSP: 002b:00007f947f7f5178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f94805b1f88 RCX: 00007f948047af69
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94805b1f88
RBP: 00007f94805b1f80 R08: 00007f947f7f56c0 R09: 00007f947f7f56c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94805b1f8c
R13: 000000000000000b R14: 00007ffce734c6e0 R15: 00007ffce734c7c8
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 356 Comm: syz-fuzzer Not tainted 5.4.274-syzkaller-00016-gdd432c37afcd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:copy_init_fpstate_to_fpregs arch/x86/include/asm/fpu/internal.h:334 [inline]
RIP: 0010:fpu__clear+0x151/0x3c0 arch/x86/kernel/fpu/core.c:339
Code: 00 bf 00 02 00 00 e8 0e fe 1b 00 0f 1f 44 00 00 e8 64 58 3b 00 48 c7 c7 40 57 4b 86 b8 ff ff ff ff ba ff ff ff ff 48 0f ae 2f <48> c7 c0 4c 56 4b 86 48 c1 e8 03 42 80 3c 20 00 74 0c 48 c7 c7 4c
RSP: 0018:ffff8881dd25fcc8 EFLAGS: 00000293
RAX: 00000000ffffffff RBX: ffff8881dd254b18 RCX: ffff8881dd253f00
RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff864b5740
RBP: ffff8881dd25fee0 R08: dffffc0000000000 R09: ffff8881dd254b00
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff8881dd254ac0 R15: ffff8881dd254b00
FS:  000000c0005bcc90(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555563c1430 CR3: 00000001e0340000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 handle_signal arch/x86/kernel/signal.c:782 [inline]
 do_signal+0xb17/0x11f0 arch/x86/kernel/signal.c:811
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x473240
Code: 28 48 89 e3 48 83 e4 f0 ff d0 48 89 dc 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <48> 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 89 1c 24 4c 89 64 24
RSP: 002b:000000c00068fab8 EFLAGS: 00000206
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000473523
RDX: 000000c00068fac0 RSI: 000000c00068fbf0 RDI: 000000000000001c
RBP: 000000c000697f48 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 000000c000697f28
R13: 000000c0006c191c R14: 000000c0005d4340 R15: 0000000000000000