netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. IPv6: ADDRCONF(NETDEV_UP): vlan483: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan63: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan64: link is not ready watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.3:27847] Modules linked in: irq event stamp: 2810185 hardirqs last enabled at (2810184): [] __local_bh_enable_ip+0x159/0x270 kernel/softirq.c:194 hardirqs last disabled at (2810185): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (91290): [] __do_softirq+0x678/0x980 kernel/softirq.c:318 softirqs last disabled at (91347): [] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (91347): [] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 0 PID: 27847 Comm: syz-executor.3 Not tainted 4.19.204-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:skb_dequeue+0x0/0x180 net/core/skbuff.c:2833 Code: fb e9 71 fe ff ff e8 4f ba 28 fb eb ae e8 98 bc 28 fb e9 5c ff ff ff e8 8e bc 28 fb e9 ae fe ff ff 66 0f 1f 84 00 00 00 00 00 <41> 56 41 55 41 54 55 53 48 89 fb e8 e0 e7 f2 fa 4c 8d 6b 18 4c 89 RSP: 0018:ffff8880ba007cf0 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: ffff88802736a280 RBX: ffff8880b41933d8 RCX: 1ffff11004e6d565 RDX: 0000000000000100 RSI: ffffffff868925bf RDI: ffff8880b41933d8 RBP: ffff888031e31440 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880b4193300 R13: ffff8880b41933a0 R14: ffff888098f43180 R15: 0000000000000000 FS: 00007f7f87c7d700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000100000000 CR3: 000000000fddd000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mrp_queue_xmit net/802/mrp.c:366 [inline] mrp_join_timer+0x97/0xc0 net/802/mrp.c:611 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:futex_wake+0x0/0x480 kernel/futex.c:1666 Code: 63 40 00 e9 ef f8 ff ff e8 bd 63 40 00 e9 d9 f6 ff ff e8 23 63 40 00 e9 f2 f6 ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <41> 57 41 56 41 89 ce 41 55 41 54 49 89 fc 55 48 bd 00 00 00 00 00 RSP: 0018:ffff88803d6cfc28 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 RAX: ffff88802736a280 RBX: 0000000000000000 RCX: 00000000ffffffff RDX: 00000000000f4240 RSI: 0000000000000000 RDI: 000000000056bf8c RBP: 0000000000000001 R08: 0000000000000009 R09: 000000000000000c R10: 0000000000000005 R11: 0000000000000000 R12: 00000000ffffffff R13: 0000000000000000 R14: 0000000000000080 R15: 0000000000000001 do_futex+0x2ca/0x1880 kernel/futex.c:3894 __do_sys_futex kernel/futex.c:3950 [inline] __se_sys_futex+0x28f/0x3b0 kernel/futex.c:3918 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665e9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f7f87c7d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 000000000056bf88 RCX: 00000000004665e9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000056bf8c RBP: 000000000056bf80 R08: 0000000000000009 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000056bf8c R13: 00007ffe4267f51f R14: 00007f7f87c7d300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 8104 Comm: syz-fuzzer Not tainted 4.19.204-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mark_held_locks+0xc0/0xf0 kernel/locking/lockdep.c:2815 Code: 03 0f 45 d5 a8 04 74 0c 4c 89 ef e8 fa ed ff ff 85 c0 74 11 83 c3 01 41 39 9d 80 08 00 00 7f af b8 01 00 00 00 48 83 c4 08 5b <5d> 41 5c 41 5d 41 5e 41 5f c3 89 34 24 e8 6e 60 4d 00 8b 34 24 e9 RSP: 0018:ffff88809338faa8 EFLAGS: 00000096 RAX: 0000000000000001 RBX: ffff8880b4194140 RCX: 0000000000000000 RDX: 1ffff11016832938 RSI: 0000000000000001 RDI: ffff8880b41949c0 RBP: ffffffff817e9d6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff8880b4194140 R14: ffffea00008a4000 R15: 0000000000022900 FS: 000000c00002e090(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c023b0eb70 CR3: 00000000a8df6000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __trace_hardirqs_on_caller kernel/locking/lockdep.c:2839 [inline] lockdep_hardirqs_on+0x3a8/0x5c0 kernel/locking/lockdep.c:2884 __free_pages_ok+0x54d/0xd30 mm/page_alloc.c:1286 free_thread_stack kernel/fork.c:270 [inline] release_task_stack kernel/fork.c:385 [inline] put_task_stack+0xd2/0x1f0 kernel/fork.c:396 finish_task_switch+0x523/0x760 kernel/sched/core.c:2710 context_switch kernel/sched/core.c:2831 [inline] __schedule+0x88f/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 freezable_schedule include/linux/freezer.h:172 [inline] do_nanosleep+0x264/0x6c0 kernel/time/hrtimer.c:1709 hrtimer_nanosleep+0x24d/0x570 kernel/time/hrtimer.c:1763 __do_sys_nanosleep kernel/time/hrtimer.c:1797 [inline] __se_sys_nanosleep kernel/time/hrtimer.c:1784 [inline] __x64_sys_nanosleep+0x19d/0x220 kernel/time/hrtimer.c:1784 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x46dabd Code: 8b 44 24 20 b9 40 42 0f 00 f7 f1 48 89 04 24 b8 e8 03 00 00 f7 e2 48 89 44 24 08 48 89 e7 be 00 00 00 00 b8 23 00 00 00 0f 05 <48> 8b 6c 24 10 48 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc RSP: 002b:000000c00003df18 EFLAGS: 00000202 ORIG_RAX: 0000000000000023 RAX: ffffffffffffffda RBX: 0000000000000014 RCX: 000000000046dabd RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000c00003df18 RBP: 000000c00003df28 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000043b6a0 R13: 0000000000000000 R14: 000000000094d6b8 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: fb sti 1: e9 71 fe ff ff jmpq 0xfffffe77 6: e8 4f ba 28 fb callq 0xfb28ba5a b: eb ae jmp 0xffffffbb d: e8 98 bc 28 fb callq 0xfb28bcaa 12: e9 5c ff ff ff jmpq 0xffffff73 17: e8 8e bc 28 fb callq 0xfb28bcaa 1c: e9 ae fe ff ff jmpq 0xfffffecf 21: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) 28: 00 00 2a: 41 56 push %r14 <-- trapping instruction 2c: 41 55 push %r13 2e: 41 54 push %r12 30: 55 push %rbp 31: 53 push %rbx 32: 48 89 fb mov %rdi,%rbx 35: e8 e0 e7 f2 fa callq 0xfaf2e81a 3a: 4c 8d 6b 18 lea 0x18(%rbx),%r13 3e: 4c rex.WR 3f: 89 .byte 0x89