watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz-executor.1:787]
Modules linked in:
CPU: 1 PID: 787 Comm: syz-executor.1 Not tainted 5.4.274-syzkaller-00002-g6f97bd951d82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:arch_stack_walk+0x118/0x140 arch/x86/kernel/stacktrace.c:24
Code: 89 df e8 cb e6 05 00 48 85 c0 74 20 4c 89 f7 48 89 c6 31 d2 41 ff d5 84 c0 74 11 48 89 df e8 cf e7 05 00 83 bd 70 ff ff ff 00 <75> d3 65 48 8b 04 25 28 00 00 00 48 3b 45 d0 75 0f 48 83 c4 68 5b
RSP: 0018:ffff8881f6f08f60 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000501 RBX: ffff8881f6f08f60 RCX: 7482d8706a81c700
RDX: ffff8881f6f08fa0 RSI: ffff8881f6f08be0 RDI: 0000000000000001
RBP: ffff8881f6f08ff0 R08: dffffc0000000000 R09: ffff8881f6f08fb0
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881e2358fc0
R13: ffffffff8153b310 R14: ffff8881f6f09040 R15: 0000000000000000
FS:  00007f7c21b1a6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7c21af9d58 CR3: 00000001e119a000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 stack_trace_save+0x118/0x1c0 kernel/stacktrace.c:123
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kfree+0x123/0x370 mm/slub.c:4071
 skb_release_all net/core/skbuff.c:675 [inline]
 __kfree_skb net/core/skbuff.c:689 [inline]
 kfree_skb+0xb8/0x3c0 net/core/skbuff.c:708
 xfrmi_xmit+0x9db/0x1130 net/xfrm/xfrm_interface_core.c:402
 __netdev_start_xmit include/linux/netdevice.h:4538 [inline]
 netdev_start_xmit include/linux/netdevice.h:4552 [inline]
 xmit_one net/core/dev.c:3221 [inline]
 dev_hard_start_xmit+0x1b7/0x6b0 net/core/dev.c:3237
 __dev_queue_xmit+0x14da/0x27e0 net/core/dev.c:3802
 neigh_output include/net/neighbour.h:518 [inline]
 ip6_finish_output2+0xf9e/0x18e0 net/ipv6/ip6_output.c:144
 NF_HOOK_COND include/linux/netfilter.h:292 [inline]
 ip6_output+0x1b3/0x430 net/ipv6/ip6_output.c:248
 dst_output include/net/dst.h:438 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ndisc_send_skb+0x702/0xc30 net/ipv6/ndisc.c:509
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3953
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xc2/0x140 kernel/sched/core.c:4558
Code: 4c 89 e7 e8 90 e1 43 fd f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 04 a2 f4 fc fb bf 01 00 00 00 <e8> b9 e6 ff ff fa bf 01 00 00 00 e8 6e a3 f4 fc 65 48 8b 1d a6 4d
RSP: 0018:ffff8881e1297b80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 1ffff1103c46b327 RBX: 1ffff1103c252f74 RCX: ffffffff84511c00
RDX: ffffc90002f6b000 RSI: 0000000000000987 RDI: 0000000000000001
RBP: ffff8881e1297c08 R08: ffffffff82316d59 R09: ffffed103edeb135
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881e1297ba0
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff1103c252f70
 retint_kernel+0x1b/0x1b
RIP: 0010:do_vfs_ioctl+0x120a/0x1720 fs/ioctl.c:731
Code: e8 ab f0 f3 ff 49 bd 00 00 00 00 00 fc ff df 48 c7 44 24 60 0e 36 e0 45 43 c7 44 25 00 00 00 00 00 43 c7 44 25 0a 00 00 00 00 <43> c7 44 25 12 00 00 00 00 4b c7 44 25 1a 00 00 00 00 4b c7 44 25
RSP: 0018:ffff8881e1297cc0 EFLAGS: 00000283 ORIG_RAX: ffffffffffffff13
RAX: ffffffff819f98df RBX: 0000000000000000 RCX: 0000000000040000
RDX: ffffc90002f6b000 RSI: 00000000000008eb RDI: 00000000000008ec
RBP: ffff8881e1297ed8 R08: ffffffff819f98d1 R09: ffffed103e22276e
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103c252fa4
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e1330c00
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f7c2279ff29
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7c21b1a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7c228d6f80 RCX: 00007f7c2279ff29
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000004
RBP: 00007f7c2280f074 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f7c228d6f80 R15: 00007ffc2400b3b8
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 745 Comm: syz-executor.0 Not tainted 5.4.274-syzkaller-00002-g6f97bd951d82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x50 kernel/kcov.c:183
Code: 1f 84 00 00 00 00 00 0f 1f 00 be 0c 00 00 00 48 c7 c7 a0 a7 f1 85 e8 3f de 2f 00 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <48> 8b 04 24 65 48 8b 0d 54 51 9e 7e 65 8b 15 59 51 9e 7e f7 c2 00
RSP: 0018:ffff8881f6e099b8 EFLAGS: 00000002
RAX: ffff8881e4cb2f40 RBX: 0000000000000000 RCX: 0000000000000301
RDX: 0000000000000301 RSI: 0000000000000301 RDI: 0000000000000000
RBP: ffff8881f6e09a80 R08: ffffffff82316ca1 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff84fa4620
R13: 1ffff1103edc133c R14: 0000000000000301 R15: ffffffff84fa4660
FS:  00007f776d4386c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f776e0bdeff CR3: 0000000005e0e000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 check_preemption_disabled+0x9f/0x320 lib/smp_processor_id.c:16
 rcu_nmi_enter_common kernel/rcu/tree.c:811 [inline]
 rcu_irq_enter+0xf/0x2b0 kernel/rcu/tree.c:879
 irq_enter+0x8/0xa0 kernel/softirq.c:347
 ipi_entering_ack_irq arch/x86/include/asm/apic.h:531 [inline]
 smp_irq_work_interrupt+0xc/0x250 arch/x86/kernel/irq_work.c:18
 irq_work_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:865
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:91 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:108 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:134 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:181 [inline]
RIP: 0010:check_memory_region+0x6f/0x280 mm/kasan/generic.c:191
Code: 00 00 00 00 fc ff df 4f 8d 34 1a 4c 89 f5 4c 29 cd 48 83 fd 10 7f 26 48 85 ed 0f 84 3a 01 00 00 49 f7 d2 49 01 da 41 80 39 00 <0f> 85 c4 01 00 00 49 ff c1 49 ff c2 75 ee e9 1d 01 00 00 45 89 cf
RSP: 0018:ffff8881f6e09bc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff09
RAX: ffff8881f6e09c01 RBX: 1ffff1103e4fa520 RCX: ffffffff845112ae
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff8881f27d2900
RBP: 0000000000000001 R08: dffffc0000000000 R09: ffffed103e4fa520
R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000000000040
R13: dffffc0000000000 R14: ffffed103e4fa521 R15: ffff8881f27d2900
 atomic_sub_return include/asm-generic/atomic-instrumented.h:159 [inline]
 queued_read_unlock include/asm-generic/qrwlock.h:107 [inline]
 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:250 [inline]
 _raw_read_unlock_bh+0xe/0x30 kernel/locking/spinlock.c:279
 ipv6_get_lladdr+0x1a9/0x1e0 net/ipv6/addrconf.c:1893
 addrconf_rs_timer+0x26b/0x600 net/ipv6/addrconf.c:3952
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:release_pages+0x158/0xb20 mm/swap.c:777
Code: 00 e8 dc f3 e1 ff 48 83 c3 08 49 8d 3c 1c 48 89 f8 48 c1 e8 03 42 80 3c 30 00 74 05 e8 d1 d8 11 00 48 89 5c 24 38 4d 8b 3c 1c <4d> 85 ed 74 2d 4c 89 eb 4c 8b 6c 24 40 41 ff c5 bf 20 00 00 00 44
RSP: 0018:ffff8881e4ca7440 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 1ffff1103af9201f RBX: 00000000000000e8 RCX: ffff8881e4cb2f40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881d7c900f8
RBP: ffff8881e4ca7550 R08: ffffffff81824954 R09: fffff94000ece7af
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881d7c90010
R13: 0000000000000000 R14: dffffc0000000000 R15: ffffea0007673d80
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:189 [inline]
 tlb_flush_mmu+0xc8/0x170 mm/mmu_gather.c:196
 zap_pte_range mm/memory.c:1173 [inline]
 zap_pmd_range mm/memory.c:1222 [inline]
 zap_pud_range mm/memory.c:1251 [inline]
 zap_p4d_range mm/memory.c:1272 [inline]
 unmap_page_range+0x1d29/0x2620 mm/memory.c:1293
 unmap_single_vma mm/memory.c:1338 [inline]
 unmap_vmas+0x355/0x4b0 mm/memory.c:1370
 exit_mmap+0x2bc/0x520 mm/mmap.c:3191
 __mmput+0x8e/0x2c0 kernel/fork.c:1101
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xdb1/0x1440 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 ret_from_intr+0x1c/0x1c
RIP: 0033:0x7f776e0bdf29
Code: Bad RIP value.
RSP: 002b:00007f776d4380c8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 00007f776e1f4f80 RCX: 00007f776e0bdf29
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000004
RBP: 00007f776e12d074 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f776e1f4f80 R15: 00007fffbafef968