watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz.1.2943:11336]
Modules linked in:
CPU: 1 PID: 11336 Comm: syz.1.2943 Not tainted 6.1.90-syzkaller-00002-g7003f6b36a9b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:percpu_counter_add_batch+0xa0/0x160 lib/percpu_counter.c:95
Code: 89 f3 48 f7 db 49 0f 48 de 4c 63 65 d0 48 89 df 4c 89 e6 e8 92 83 d8 fe 4c 39 e3 7d 0f e8 78 81 d8 fe 48 8b 45 c0 65 44 01 38 <eb> 78 e8 69 81 d8 fe 4c 8b 7d b8 4c 89 ff e8 0d 3d 82 02 49 89 c4
RSP: 0018:ffffc900001b08b8 EFLAGS: 00000202
RAX: 0000607e08200b98 RBX: 0000000000000002 RCX: ffff8881296de540
RDX: 0000000000000101 RSI: 0000000000000020 RDI: 0000000000000002
RBP: ffffc900001b0900 R08: ffffffff829d212e R09: ffffed1021ea5831
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000020
R13: 1ffff110240b3bbc R14: 0000000000000002 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffc5d92f88 CR3: 0000000120413000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 dst_entries_add include/net/dst_ops.h:69 [inline]
 dst_init+0x2f0/0x400 net/core/dst.c:74
 dst_alloc+0x18a/0x1e0 net/core/dst.c:96
 ip6_dst_alloc net/ipv6/route.c:345 [inline]
 icmp6_dst_alloc+0xf8/0x510 net/ipv6/route.c:3266
 ndisc_send_skb+0x28b/0xdc0 net/ipv6/ndisc.c:489
 ndisc_send_rs+0x47d/0x5f0 net/ipv6/ndisc.c:719
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3984
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1510
 expire_timers kernel/time/timer.c:1555 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1826
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1839
 __do_softirq+0x1d8/0x661 kernel/softirq.c:617
 invoke_softirq kernel/softirq.c:472 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:712
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:stack_trace_consume_entry+0x0/0x290 kernel/stacktrace.c:83
Code: ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 7b ff ff ff 48 89 df e8 a0 fc 56 00 e9 6e ff ff ff e8 e6 3b b3 03 66 0f 1f 44 00 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 fb 48 ba
RSP: 0018:ffffc90000ad7218 EFLAGS: 00000286
RAX: ffffffff81c25b74 RBX: ffffc90000ad7220 RCX: ffffffff877a1000
RDX: ffffffff87888601 RSI: ffffffff81c25b74 RDI: ffffc90000ad7300
RBP: ffffc90000ad72b0 R08: ffffc90000ad7308 R09: 0000000000000000
R10: ffffc90000ad7310 R11: dffffc0000000001 R12: ffff8881296de540
R13: ffffffff8165c3e0 R14: ffffc90000ad7300 R15: 0000000000000000
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 save_stack+0xf6/0x1e0 mm/page_owner.c:147
 __reset_page_owner+0x54/0x190 mm/page_owner.c:168
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1498 [inline]
 free_pcp_prepare mm/page_alloc.c:1572 [inline]
 free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3498
 free_unref_page+0xb2/0x5c0 mm/page_alloc.c:3594
 free_the_page mm/page_alloc.c:798 [inline]
 __free_pages+0x61/0xf0 mm/page_alloc.c:5803
 __vunmap+0x9f3/0xb60 mm/vmalloc.c:2728
 __vfree mm/vmalloc.c:2776 [inline]
 vfree+0x5c/0x80 mm/vmalloc.c:2807
 kcov_put kernel/kcov.c:428 [inline]
 kcov_close+0x2b/0x50 kernel/kcov.c:524
 __fput+0x3ab/0x870 fs/file_table.c:320
 ____fput+0x15/0x20 fs/file_table.c:348
 task_work_run+0x24d/0x2e0 kernel/task_work.c:179
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0xbd5/0x2b80 kernel/exit.c:875
 do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
 get_signal+0x169d/0x1820 kernel/signal.c:2880
 arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:316
 irqentry_exit+0x12/0x40 kernel/entry/common.c:419
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0033:0x7f9045d779f9
Code: Unable to access opcode bytes at 0x7f9045d779cf.
RSP: 002b:00007f9046b170e8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f9045f05f88 RCX: 00007f9045d779f9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f9045f05f88
RBP: 00007f9045f05f80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9045f05f8c
R13: 0000000000000000 R14: 00007ffd8d66b810 R15: 00007ffd8d66b8f8
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 15 Comm: rcub/0 Not tainted 6.1.90-syzkaller-00002-g7003f6b36a9b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:check_region_inline mm/kasan/generic.c:172 [inline]
RIP: 0010:kasan_check_range+0x1b/0x2a0 mm/kasan/generic.c:189
Code: ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 41 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 fb <48> 01 f3 0f 82 68 02 00 00 48 89 fb 48 c1 eb 2f 81 fb ff ff 01 00
RSP: 0018:ffffc900000f7ba8 EFLAGS: 00000202
RAX: ffff8881f7100001 RBX: ffff8881003a5100 RCX: ffffffff851ee7e3
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881003a5100
RBP: ffffc900000f7bd0 R08: dffffc0000000000 R09: ffffed1020074a21
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881003a5100 R14: ffffffff86fb5c70 R15: ffffc900000f7ce0
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7084c35000 CR3: 0000000006e0f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
 instrument_atomic_read include/linux/instrumented.h:72 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 test_ti_thread_flag include/linux/thread_info.h:118 [inline]
 need_resched include/linux/sched.h:2255 [inline]
 rtmutex_spin_on_owner kernel/locking/rtmutex.c:1434 [inline]
 rt_mutex_slowlock_block+0x353/0x5a0 kernel/locking/rtmutex.c:1567
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1637 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1673 [inline]
 rt_mutex_slowlock+0x19c/0x480 kernel/locking/rtmutex.c:1702
 __rt_mutex_lock kernel/locking/rtmutex.c:1714 [inline]
 __rt_mutex_lock_common kernel/locking/rtmutex_api.c:31 [inline]
 rt_mutex_lock+0x145/0x210 kernel/locking/rtmutex_api.c:73
 rcu_boost kernel/rcu/tree_plugin.h:1099 [inline]
 rcu_boost_kthread+0x231/0x6e0 kernel/rcu/tree_plugin.h:1124
 kthread+0x26d/0x300 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>