RBP: 00007f5eae5f093e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f5eae71ef80 R15: 00007ffeb525b3d8
 </TASK>
watchdog: BUG: soft lockup - CPU#1 stuck for 286s! [syz.4.890:4454]
Modules linked in:
CPU: 1 PID: 4454 Comm: syz.4.890 Not tainted 5.15.156-syzkaller-00821-g29d153aabd54 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:memset_erms+0x0/0x10 arch/x86/lib/memset_64.S:61
Code: 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 <49> 89 f9 40 88 f0 48 89 d1 f3 aa 4c 89 c8 c3 90 49 89 fa 40 0f b6
RSP: 0018:ffffc900001d06b0 EFLAGS: 00000202
RAX: ffff8881170d9301 RBX: ffffc900001d0760 RCX: ffffffff81350944
RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffffc900001d0760
RBP: ffffc900001d06d0 R08: dffffc0000000000 R09: fffff5200003a0f8
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff8881170d93c0 R14: 0000000000000000 R15: 0000000000000060
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002005b000 CR3: 000000010bd0a000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 __unwind_start+0x34/0x3a0 arch/x86/kernel/unwind_frame.c:368
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 arch_stack_walk+0xdb/0x140 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 ____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:512
 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
 kasan_kmalloc include/linux/kasan.h:227 [inline]
 __kmalloc_track_caller+0x139/0x260 mm/slub.c:4950
 kmalloc_reserve net/core/skbuff.c:357 [inline]
 __alloc_skb+0x10c/0x550 net/core/skbuff.c:428
 alloc_skb include/linux/skbuff.h:1183 [inline]
 ndisc_alloc_skb+0xf3/0x2d0 net/ipv6/ndisc.c:421
 ndisc_send_rs+0x26c/0x6a0 net/ipv6/ndisc.c:687
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3978
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1457
 expire_timers kernel/time/timer.c:1502 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1773
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1786
 __do_softirq+0x26d/0x5bf kernel/softirq.c:565
 invoke_softirq kernel/softirq.c:425 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:648
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:660
 sysvec_irq_work+0x97/0xb0 arch/x86/kernel/irq_work.c:17
 </IRQ>
 <TASK>
 asm_sysvec_irq_work+0x1b/0x20 arch/x86/include/asm/idtentry.h:664
RIP: 0010:account_kernel_stack+0x59b/0x750
Code: 00 02 00 00 4c 21 fe 31 ff e8 21 24 2f 00 4c 21 fb 75 07 e8 d7 1f 2f 00 eb 06 e8 d0 1f 2f 00 fb 49 bf 00 00 00 00 00 fc ff df <48> 8b 44 24 10 42 80 3c 38 00 74 08 4c 89 e7 e8 c1 62 71 00 49 8b
RSP: 0018:ffffc90000ddefa0 EFLAGS: 00000293
RAX: ffffffff81414a70 RBX: 0000000000000200 RCX: ffff8881170d93c0
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000ddf080 R08: ffffffff81414a5f R09: ffffed103ee265e7
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88812073f5a0
R13: 1ffff920001bbe00 R14: ffffea000487ca80 R15: dffffc0000000000
 release_task_stack kernel/fork.c:474 [inline]
 put_task_stack+0x95/0x140 kernel/fork.c:486
 finish_task_switch+0x33b/0x7b0 kernel/sched/core.c:5063
 context_switch kernel/sched/core.c:5155 [inline]
 __schedule+0xcd4/0x1590 kernel/sched/core.c:6512
 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:6916
 irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:398
 irqentry_exit+0x30/0x40 kernel/entry/common.c:432
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:fsnotify_grab_connector fs/notify/mark.c:554 [inline]
RIP: 0010:fsnotify_destroy_marks+0x9d/0x4f0 fs/notify/mark.c:801
Code: 03 4c 89 7c 24 10 43 0f b6 04 37 84 c0 0f 85 02 04 00 00 c7 44 24 40 00 00 00 00 48 c7 c7 80 a2 52 87 e8 56 25 8f ff 41 89 c4 <48> 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 bd b9 e5 ff
RSP: 0018:ffffc90000ddf3a0 EFLAGS: 00000286
RAX: 0000000000000001 RBX: ffff888118ce7ad0 RCX: ffffc90000ddf303
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8752a358
RBP: ffffc90000ddf450 R08: dffffc0000000000 R09: ffffed103ee27182
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 1ffff920001bbe78 R14: dffffc0000000000 R15: 1ffff920001bbe7c
 fsnotify_clear_marks_by_inode fs/notify/fsnotify.h:60 [inline]
 __fsnotify_inode_delete+0x1c/0x20 fs/notify/fsnotify.c:22
 fsnotify_inode_delete include/linux/fsnotify.h:193 [inline]
 __destroy_inode+0x181/0x4e0 fs/inode.c:262
 destroy_inode fs/inode.c:284 [inline]
 evict+0x538/0x630 fs/inode.c:602
 iput_final fs/inode.c:1705 [inline]
 iput+0x63b/0x7e0 fs/inode.c:1731
 dentry_unlink_inode+0x34f/0x440 fs/dcache.c:376
 __dentry_kill+0x447/0x660 fs/dcache.c:582
 shrink_dentry_list+0x35e/0x4b0 fs/dcache.c:1177
 shrink_dcache_parent+0xc9/0x340
 do_one_tree+0x27/0xe0 fs/dcache.c:1658
 shrink_dcache_for_umount+0x7d/0x120 fs/dcache.c:1675
 generic_shutdown_super+0x69/0x2e0 fs/super.c:447
 kill_anon_super+0x3d/0x70 fs/super.c:1076
 proc_kill_sb+0x8d/0xd0 fs/proc/root.c:275
 deactivate_locked_super+0xad/0x110 fs/super.c:335
 deactivate_super+0xbe/0xf0 fs/super.c:366
 cleanup_mnt+0x45c/0x510 fs/namespace.c:1143
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1150
 task_work_run+0x129/0x190 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0xc48/0x2ca0 kernel/exit.c:878
 do_group_exit+0x141/0x310 kernel/exit.c:1000
 get_signal+0x7a3/0x1630 kernel/signal.c:2896
 arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:214
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:320
 irqentry_exit+0x12/0x40 kernel/entry/common.c:411
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0033:0x7f5eae582e79
Code: Unable to access opcode bytes at RIP 0x7f5eae582e4f.
RSP: 002b:00007f5ead200038 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f5eae71ef80 RCX: 00007f5eae582e79
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000003
RBP: 00007f5eae5f093e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f5eae71ef80 R15: 00007ffeb525b3d8
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 5.15.156-syzkaller-00821-g29d153aabd54 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:rep_nop arch/x86/include/asm/vdso/processor.h:13 [inline]
RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline]
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_many_cond+0x841/0x9b0 kernel/smp.c:969
Code: 00 00 45 8b 7d 00 44 89 fe 83 e6 01 31 ff e8 f6 a8 0a 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 07 e8 31 a5 0a 00 eb 38 <f3> 90 42 0f b6 04 3b 84 c0 75 11 41 f7 45 00 01 00 00 00 74 1e e8
RSP: 0018:ffffc900000a7840 EFLAGS: 00000293
RAX: ffffffff8165c52b RBX: 1ffff1103ee2784d RCX: ffff88810026e2c0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900000a7958 R08: ffffffff8165c4fa R09: ffffed103ee071d3
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: ffff8881f713c268 R14: ffff8881f7038e80 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee8a63ff8 CR3: 0000000006a0f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1135
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1207 [inline]
 text_poke_bp_batch+0x1db/0x720 arch/x86/kernel/alternative.c:1407
 text_poke_flush arch/x86/kernel/alternative.c:1598 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1605
 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
 __jump_label_update+0x36a/0x380 kernel/jump_label.c:459
 jump_label_update+0x3af/0x450 kernel/jump_label.c:830
 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177
 static_key_enable+0x1a/0x30 kernel/jump_label.c:190
 toggle_allocation_gate+0xbf/0x460 mm/kfence/core.c:729
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300
 </TASK>