watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz.4.70:998]
Modules linked in:
CPU: 1 PID: 998 Comm: syz.4.70 Not tainted 5.10.228-syzkaller-00608-g0eb852f47fe5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:unwind_next_frame+0x5a9/0x700 arch/x86/kernel/unwind_frame.c:360
Code: f7 e8 eb 05 00 00 48 ba 00 00 00 00 00 fc ff df 41 0f b6 04 17 84 c0 0f 85 b5 00 00 00 41 c7 06 00 00 00 00 31 c0 48 83 c4 50 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 5d ce ae 05 01 48 b9 00 00
RSP: 0000:ffffc9000016fb88 EFLAGS: 00000286
RAX: 000000000016fc01 RBX: ffffc9000016fc30 RCX: 000000000016fc01
RDX: 1ffff9200002df8a RSI: ffffc9000016fcd0 RDI: ffffc9000016fc98
RBP: ffffc9000016fbb0 R08: dffffc0000000000 R09: ffffc9000016fc40
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffc9000016fc90 R14: ffffc9000016fc40 R15: 1ffff9200002df88
FS:  00007fdf86a706c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fd19ff8 CR3: 00000001159b4000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __unwind_start+0x318/0x3a0 arch/x86/kernel/unwind_frame.c:407
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 arch_stack_walk+0xdb/0x140 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x121/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1595 [inline]
 slab_free_freelist_hook+0xc0/0x190 mm/slub.c:1621
 slab_free mm/slub.c:3203 [inline]
 kfree+0xc3/0x270 mm/slub.c:4191
 skb_free_head net/core/skbuff.c:606 [inline]
 skb_release_data+0x5c6/0x6f0 net/core/skbuff.c:626
 skb_release_all net/core/skbuff.c:680 [inline]
 __kfree_skb net/core/skbuff.c:694 [inline]
 kfree_skb+0xb9/0x320 net/core/skbuff.c:713
 vti6_tnl_xmit+0x127a/0x1780 net/ipv6/ip6_vti.c:593
 __netdev_start_xmit include/linux/netdevice.h:4858 [inline]
 netdev_start_xmit include/linux/netdevice.h:4872 [inline]
 xmit_one net/core/dev.c:3607 [inline]
 dev_hard_start_xmit+0x228/0x620 net/core/dev.c:3623
 __dev_queue_xmit+0x154e/0x28a0 net/core/dev.c:4194
 dev_queue_xmit+0x17/0x20 net/core/dev.c:4227
 neigh_connected_output+0x417/0x450 net/core/neighbour.c:1538
 neigh_output include/net/neighbour.h:517 [inline]
 ip6_finish_output2+0xf21/0x1850 net/ipv6/ip6_output.c:145
 __ip6_finish_output+0x5ec/0x780 net/ipv6/ip6_output.c:216
 ip6_finish_output+0x34/0x1e0 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:288 [inline]
 ip6_output+0x1f7/0x4c0 net/ipv6/ip6_output.c:249
 dst_output include/net/dst.h:437 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ndisc_send_skb+0x6e9/0xc00 net/ipv6/ndisc.c:511
 ndisc_send_rs+0x532/0x6a0 net/ipv6/ndisc.c:705
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3964
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1789
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x268/0x5bb kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0033:0x7fdf883fed19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdf86a70038 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007fdf885eefa0 RCX: 00007fdf883fed19
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000007
RBP: 00007fdf8847aa20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fdf885eefa0 R15: 00007ffe2ee11ba8
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 826 Comm: syz.2.54 Not tainted 5.10.228-syzkaller-00608-g0eb852f47fe5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock include/linux/spinlock.h:183 [inline]
RIP: 0010:__raw_spin_lock_irq include/linux/spinlock_api_smp.h:129 [inline]
RIP: 0010:_raw_spin_lock_irq+0xb6/0x1b0 kernel/locking/spinlock.c:167
Code: 89 ef be 04 00 00 00 e8 88 62 f5 fc 4c 89 ff be 04 00 00 00 e8 7b 62 f5 fc 43 0f b6 04 26 84 c0 0f 85 aa 00 00 00 8b 44 24 20 <b9> 01 00 00 00 f0 41 0f b1 4d 00 75 33 48 c7 04 24 0e 36 e0 45 49
RSP: 0018:ffffc90000006800 EFLAGS: 00000097
RAX: 0000000000000000 RBX: 1ffff92000000d00 RCX: ffffc90000006803
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000006820
RBP: ffffc90000006890 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff52000000d04 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881f7049940 R14: 1ffff92000000d04 R15: ffffc90000006820
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2c6219 CR3: 000000000660f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1589 [inline]
 __hrtimer_run_queues+0x3ec/0xa50 kernel/time/hrtimer.c:1649
 hrtimer_interrupt+0x39a/0x8b0 kernel/time/hrtimer.c:1711
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3f0 arch/x86/kernel/apic/apic.c:1112
 run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:91 [inline]
 sysvec_apic_timer_interrupt+0xba/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__sanitizer_cov_trace_switch+0x32/0xe0 kernel/kcov.c:319
Code: 41 54 53 48 8b 46 08 48 83 c0 f8 48 c1 c0 3d 48 83 f8 07 0f 87 ab 00 00 00 b9 8b 00 00 00 0f a3 c1 0f 83 9d 00 00 00 4c 8b 16 <4d> 85 d2 0f 84 91 00 00 00 4c 8b 04 c5 88 53 43 85 4c 8b 4d 08 65
RSP: 0018:ffffc90000006bf0 EFLAGS: 00000297
RAX: 0000000000000001 RBX: 000000000000dd86 RCX: 000000000000008b
RDX: dffffc0000000000 RSI: ffffffff86cd3510 RDI: 000000000000dd86
RBP: ffffc90000006c10 R08: ffffffff83c52c4f R09: ffffffff83c5433e
R10: 0000000000000002 R11: ffff88812f4662c0 R12: 0000000000000000
R13: ffff8881327a6c80 R14: 0000000000000000 R15: 000000000000dd86
 __vlan_get_protocol include/linux/if_vlan.h:599 [inline]
 vlan_get_protocol_and_depth include/linux/if_vlan.h:643 [inline]
 skb_network_protocol+0x1ab/0x7a0 net/core/dev.c:3332
 harmonize_features net/core/dev.c:3496 [inline]
 netif_skb_features+0x774/0xb70 net/core/dev.c:3591
 validate_xmit_skb+0x7f/0xc50 net/core/dev.c:3665
 __dev_queue_xmit+0x10db/0x28a0 net/core/dev.c:4185
 dev_queue_xmit+0x17/0x20 net/core/dev.c:4227
 br_dev_queue_push_xmit+0x580/0x700 net/bridge/br_forward.c:52
 NF_HOOK include/linux/netfilter.h:299 [inline]
 br_forward_finish net/bridge/br_forward.c:65 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 __br_forward+0x281/0x370 net/bridge/br_forward.c:109
 br_flood+0x3c2/0x420 net/bridge/br_forward.c:234
 br_dev_xmit+0xb44/0xea0 net/bridge/br_device.c:99
 __netdev_start_xmit include/linux/netdevice.h:4858 [inline]
 netdev_start_xmit include/linux/netdevice.h:4872 [inline]
 xmit_one net/core/dev.c:3607 [inline]
 dev_hard_start_xmit+0x228/0x620 net/core/dev.c:3623
 __dev_queue_xmit+0x154e/0x28a0 net/core/dev.c:4194
 dev_queue_xmit+0x17/0x20 net/core/dev.c:4227
 neigh_resolve_output+0x6b8/0x760 net/core/neighbour.c:1509
 neigh_output include/net/neighbour.h:517 [inline]
 ip6_finish_output2+0xf21/0x1850 net/ipv6/ip6_output.c:145
 __ip6_finish_output+0x5ec/0x780 net/ipv6/ip6_output.c:216
 ip6_finish_output+0x34/0x1e0 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:288 [inline]
 ip6_output+0x1f7/0x4c0 net/ipv6/ip6_output.c:249
 dst_output include/net/dst.h:437 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ndisc_send_skb+0x6e9/0xc00 net/ipv6/ndisc.c:511
 ndisc_send_rs+0x532/0x6a0 net/ipv6/ndisc.c:705
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3964
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1789
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x268/0x5bb kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:preempt_schedule_irq+0xc2/0x140 kernel/sched/core.c:5065
Code: 4c 89 e7 e8 d0 77 f6 fc f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 24 41 97 fc fb bf 01 00 00 00 <e8> 89 e6 ff ff fa bf 01 00 00 00 e8 ae 42 97 fc 65 48 8b 1d 96 8b
RSP: 0018:ffffc90000e5f300 EFLAGS: 00000246
RAX: 1ffff11025e8cd9e RBX: 1ffff920001cbe64 RCX: ffffffff84b30a00
RDX: 1ffff11025e8cc5c RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000e5f380 R08: ffffffff87087008 R09: ffffffff87087018
R10: ffffffff87087010 R11: ffffffff87087003 R12: ffffc90000e5f320
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920001cbe60
 irqentry_exit_cond_resched kernel/entry/common.c:365 [inline]
 irqentry_exit+0x4f/0x60 kernel/entry/common.c:395
 sysvec_apic_timer_interrupt+0xcb/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__thunk_restore+0x0/0x1c arch/x86/entry/thunk_64.S:45
Code: 52 51 50 41 50 41 51 41 52 41 53 e8 e6 61 b1 03 eb 18 55 48 89 e5 57 56 52 51 50 41 50 41 51 41 52 41 53 e8 9e 63 b1 03 eb 00 <41> 5b 41 5a 41 59 41 58 58 59 5a 5e 5f 5d c3 cc cc cc cc cc cc cc
RSP: 0018:ffffc90000e5f470 EFLAGS: 00000246
RAX: 00862daeb6b99100 RBX: ffffea00045f9d28 RCX: ffffffff84b1df9e
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88812f4662c0
RBP: ffffc90000e5f4b8 R08: dffffc0000000000 R09: ffffed1025e8cc59
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 0400000000000000 R14: 8000000130a6a007 R15: 00007f0b32ff9000
 __raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock+0x60/0x70 kernel/locking/spinlock.c:183
 spin_unlock include/linux/spinlock.h:394 [inline]
 zap_pte_range mm/memory.c:1375 [inline]
 zap_pmd_range mm/memory.c:1435 [inline]
 zap_pud_range mm/memory.c:1464 [inline]
 zap_p4d_range mm/memory.c:1485 [inline]
 unmap_page_range+0x1c54/0x23b0 mm/memory.c:1506
 unmap_single_vma mm/memory.c:1551 [inline]
 unmap_vmas+0x37f/0x4f0 mm/memory.c:1583
 exit_mmap+0x2f2/0x5c0 mm/mmap.c:3355
 __mmput+0x95/0x2d0 kernel/fork.c:1153
 mmput+0x59/0x170 kernel/fork.c:1176
 exit_mm kernel/exit.c:539 [inline]
 do_exit+0xbda/0x2a50 kernel/exit.c:850
 do_group_exit+0x141/0x310 kernel/exit.c:985
 get_signal+0x10a0/0x1410 kernel/signal.c:2793
 arch_do_signal_or_restart+0xbd/0x17c0 arch/x86/kernel/signal.c:805
 handle_signal_work kernel/entry/common.c:145 [inline]
 exit_to_user_mode_loop+0x9b/0xd0 kernel/entry/common.c:169
 exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
 syscall_exit_to_user_mode+0xa2/0x1a0 kernel/entry/common.c:274
 do_syscall_64+0x40/0x70 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f0b33dd9d19
Code: Unable to access opcode bytes at RIP 0x7f0b33dd9cef.
RSP: 002b:00007f0b3242a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f0b33fca088 RCX: 00007f0b33dd9d19
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f0b33fca08c
RBP: 00007f0b33fca080 R08: 00007ffda6f620b0 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f0b33fca08c
R13: 0000000000000000 R14: 00007ffda6f5c2b0 R15: 00007ffda6f5c398