INFO: rcu_sched detected stalls on CPUs/tasks:
	0-...: (1 GPs behind) idle=f5e/140000000000001/0 softirq=17698/17700 fqs=5244 
	(detected by 1, t=10502 jiffies, g=2414, c=2413, q=72)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 9008 Comm: syz-executor.4 Not tainted 4.14.142 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88808c24c0c0 task.stack: ffff888056e80000
RIP: 0010:__list_add_valid+0x19/0xa0 lib/list_debug.c:22
RSP: 0018:ffff8880aee07120 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff88809f819cf8 RCX: 0000000000000000
RDX: ffff88809f819d90 RSI: ffff88809f819d90 RDI: ffff88809f819d98
RBP: ffff8880aee07130 R08: 0000000000000000 R09: ffff88808c24cac8
R10: ffff88808c24caa8 R11: ffff88808c24c0c0 R12: dffffc0000000000
R13: ffff88809f819cf8 R14: ffff88809f819d90 R15: ffff88809f819d80
FS:  00007fcba1cb9700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c42695d000 CR3: 00000000a57ef000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __list_add include/linux/list.h:60 [inline]
 list_add_tail include/linux/list.h:93 [inline]
 list_move_tail include/linux/list.h:183 [inline]
 hhf_dequeue+0x61b/0xa60 net/sched/sch_hhf.c:438
 dequeue_skb net/sched/sch_generic.c:148 [inline]
 qdisc_restart net/sched/sch_generic.c:241 [inline]
 __qdisc_run+0x2b8/0xe00 net/sched/sch_generic.c:257
 __dev_xmit_skb net/core/dev.c:3235 [inline]
 __dev_queue_xmit+0x1571/0x25e0 net/core/dev.c:3493
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
 br_dev_queue_push_xmit+0x367/0x530 net/bridge/br_forward.c:55
 NF_HOOK include/linux/netfilter.h:250 [inline]
 NF_HOOK include/linux/netfilter.h:244 [inline]
 br_forward_finish+0xbc/0x320 net/bridge/br_forward.c:67
 NF_HOOK include/linux/netfilter.h:250 [inline]
 NF_HOOK include/linux/netfilter.h:244 [inline]
 __br_forward+0x560/0x9c0 net/bridge/br_forward.c:111
 deliver_clone+0x61/0xc0 net/bridge/br_forward.c:127
 maybe_deliver net/bridge/br_forward.c:168 [inline]
 maybe_deliver net/bridge/br_forward.c:156 [inline]
 br_flood+0x3c8/0x530 net/bridge/br_forward.c:210
 br_dev_xmit+0x9a4/0xd40 net/bridge/br_device.c:83
 __netdev_start_xmit include/linux/netdevice.h:4033 [inline]
 netdev_start_xmit include/linux/netdevice.h:4042 [inline]
 xmit_one net/core/dev.c:3009 [inline]
 dev_hard_start_xmit+0x18c/0x8b0 net/core/dev.c:3025
 __dev_queue_xmit+0x1d95/0x25e0 net/core/dev.c:3525
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
 neigh_hh_output include/net/neighbour.h:490 [inline]
 neigh_output include/net/neighbour.h:498 [inline]
 ip6_finish_output2+0x10bd/0x21b0 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x4f4/0xb50 net/ipv6/ip6_output.c:154
 NF_HOOK_COND include/linux/netfilter.h:239 [inline]
 ip6_output+0x20f/0x6d0 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:462 [inline]
 NF_HOOK include/linux/netfilter.h:250 [inline]
 ndisc_send_skb+0xb56/0x11e0 net/ipv6/ndisc.c:483
 ndisc_send_rs+0x129/0x680 net/ipv6/ndisc.c:677
 addrconf_rs_timer+0x289/0x5a0 net/ipv6/addrconf.c:3757
 call_timer_fn+0x161/0x670 kernel/time/timer.c:1279
 expire_timers kernel/time/timer.c:1318 [inline]
 __run_timers kernel/time/timer.c:1634 [inline]
 __run_timers kernel/time/timer.c:1602 [inline]
 run_timer_softirq+0x5b4/0x1570 kernel/time/timer.c:1647
 __do_softirq+0x244/0x9a0 kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x160/0x1b0 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:648 [inline]
 smp_apic_timer_interrupt+0x146/0x5e0 arch/x86/kernel/apic/apic.c:1102
 apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
 </IRQ>
RIP: 0010:check_preemption_disabled+0x1/0x250 lib/smp_processor_id.c:13
RSP: 0018:ffff888056e87330 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10
RAX: ffff88808c24c0c0 RBX: ffffea0001357740 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff869d2e40 RDI: ffffffff869d2e80
RBP: ffff888056e87340 R08: 0000000000000000 R09: ffff88808c24c988
R10: ffff88808c24c968 R11: ffff88808c24c0c0 R12: 0000000000000001
R13: ffffea00010cb300 R14: dffffc0000000000 R15: ffffea00012ecb20
 rcu_lockdep_current_cpu_online kernel/rcu/tree.c:1186 [inline]
 rcu_lockdep_current_cpu_online+0x3a/0x140 kernel/rcu/tree.c:1177
 rcu_read_lock_held+0x8a/0xd0 kernel/rcu/update.c:330
 radix_tree_deref_slot include/linux/radix-tree.h:238 [inline]
 find_get_pages_tag+0x59e/0x8b0 mm/filemap.c:1803
 pagevec_lookup_tag+0x3a/0x80 mm/swap.c:992
 __filemap_fdatawait_range+0xff/0x360 mm/filemap.c:424
 file_write_and_wait_range+0xb7/0xe0 mm/filemap.c:681
 __generic_file_fsync+0x79/0x1a0 fs/libfs.c:977
 ext4_sync_file+0x755/0x12d0 fs/ext4/fsync.c:120
 vfs_fsync_range+0x10e/0x260 fs/sync.c:196
 generic_write_sync include/linux/fs.h:2677 [inline]
 ext4_file_write_iter+0x68a/0xe90 fs/ext4/file.c:279
 call_write_iter include/linux/fs.h:1777 [inline]
 do_iter_readv_writev+0x418/0x670 fs/read_write.c:675
 do_iter_write fs/read_write.c:954 [inline]
 do_iter_write+0x154/0x540 fs/read_write.c:935
 vfs_iter_write+0x77/0xb0 fs/read_write.c:967
 iter_file_splice_write+0x572/0xad0 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x123/0x190 fs/splice.c:1018
 splice_direct_to_actor+0x29e/0x7b0 fs/splice.c:973
 do_splice_direct+0x18d/0x230 fs/splice.c:1061
 do_sendfile+0x4db/0xbd0 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1502 [inline]
 SyS_sendfile64+0x102/0x110 fs/read_write.c:1488
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4598e9
RSP: 002b:00007fcba1cb8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000800000000024 R11: 0000000000000246 R12: 00007fcba1cb96d4
R13: 00000000004c709e R14: 00000000004dc750 R15: 00000000ffffffff
Code: 5c 5d c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 55 49 89 fd 48 8d 7a 08 41 54 <49> 89 d4 48 89 fa 48 83 ec 08 48 c1 ea 03 80 3c 02 00 75 52 49 
INFO: rcu_preempt detected stalls on CPUs/tasks:
	0-...: (1 GPs behind) idle=f5e/140000000000001/0 softirq=17697/17700 fqs=5243 
	(detected by 1, t=10502 jiffies, g=3960, c=3959, q=2150)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 9008 Comm: syz-executor.4 Not tainted 4.14.142 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88808c24c0c0 task.stack: ffff888056e80000
RIP: 0010:hhf_dequeue+0x4ff/0xa60 net/sched/sch_hhf.c:435
RSP: 0018:ffff8880aee07140 EFLAGS: 00000297
RAX: 0000000000000000 RBX: ffff88809f819cf8 RCX: ffff88809f819cc0
RDX: ffff88809f819ce8 RSI: ffff88809f819d90 RDI: ffff88809f819d08
RBP: ffff8880aee07190 R08: 0000000000000000 R09: ffff88808c24cac8
R10: ffff88808c24caa8 R11: ffff88808c24c0c0 R12: dffffc0000000000
R13: ffff88809f819b00 R14: 0000000000000001 R15: ffff88809f819d80
FS:  00007fcba1cb9700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c42695d000 CR3: 00000000a57ef000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 dequeue_skb net/sched/sch_generic.c:148 [inline]
 qdisc_restart net/sched/sch_generic.c:241 [inline]
 __qdisc_run+0x2b8/0xe00 net/sched/sch_generic.c:257
 __dev_xmit_skb net/core/dev.c:3235 [inline]
 __dev_queue_xmit+0x1571/0x25e0 net/core/dev.c:3493
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
 br_dev_queue_push_xmit+0x367/0x530 net/bridge/br_forward.c:55
 NF_HOOK include/linux/netfilter.h:250 [inline]
 NF_HOOK include/linux/netfilter.h:244 [inline]
 br_forward_finish+0xbc/0x320 net/bridge/br_forward.c:67
 NF_HOOK include/linux/netfilter.h:250 [inline]
 NF_HOOK include/linux/netfilter.h:244 [inline]
 __br_forward+0x560/0x9c0 net/bridge/br_forward.c:111
 deliver_clone+0x61/0xc0 net/bridge/br_forward.c:127
 maybe_deliver net/bridge/br_forward.c:168 [inline]
 maybe_deliver net/bridge/br_forward.c:156 [inline]
 br_flood+0x3c8/0x530 net/bridge/br_forward.c:210
 br_dev_xmit+0x9a4/0xd40 net/bridge/br_device.c:83
 __netdev_start_xmit include/linux/netdevice.h:4033 [inline]
 netdev_start_xmit include/linux/netdevice.h:4042 [inline]
 xmit_one net/core/dev.c:3009 [inline]
 dev_hard_start_xmit+0x18c/0x8b0 net/core/dev.c:3025
 __dev_queue_xmit+0x1d95/0x25e0 net/core/dev.c:3525
 dev_queue_xmit+0x18/0x20 net/core/dev.c:3558
 neigh_hh_output include/net/neighbour.h:490 [inline]
 neigh_output include/net/neighbour.h:498 [inline]
 ip6_finish_output2+0x10bd/0x21b0 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x4f4/0xb50 net/ipv6/ip6_output.c:154
 NF_HOOK_COND include/linux/netfilter.h:239 [inline]
 ip6_output+0x20f/0x6d0 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:462 [inline]
 NF_HOOK include/linux/netfilter.h:250 [inline]
 ndisc_send_skb+0xb56/0x11e0 net/ipv6/ndisc.c:483
 ndisc_send_rs+0x129/0x680 net/ipv6/ndisc.c:677
 addrconf_rs_timer+0x289/0x5a0 net/ipv6/addrconf.c:3757
 call_timer_fn+0x161/0x670 kernel/time/timer.c:1279
 expire_timers kernel/time/timer.c:1318 [inline]
 __run_timers kernel/time/timer.c:1634 [inline]
 __run_timers kernel/time/timer.c:1602 [inline]
 run_timer_softirq+0x5b4/0x1570 kernel/time/timer.c:1647
 __do_softirq+0x244/0x9a0 kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x160/0x1b0 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:648 [inline]
 smp_apic_timer_interrupt+0x146/0x5e0 arch/x86/kernel/apic/apic.c:1102
 apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:792
 </IRQ>
RIP: 0010:check_preemption_disabled+0x1/0x250 lib/smp_processor_id.c:13
RSP: 0018:ffff888056e87330 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10
RAX: ffff88808c24c0c0 RBX: ffffea0001357740 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff869d2e40 RDI: ffffffff869d2e80
RBP: ffff888056e87340 R08: 0000000000000000 R09: ffff88808c24c988
R10: ffff88808c24c968 R11: ffff88808c24c0c0 R12: 0000000000000001
R13: ffffea00010cb300 R14: dffffc0000000000 R15: ffffea00012ecb20
 rcu_lockdep_current_cpu_online kernel/rcu/tree.c:1186 [inline]
 rcu_lockdep_current_cpu_online+0x3a/0x140 kernel/rcu/tree.c:1177
 rcu_read_lock_held+0x8a/0xd0 kernel/rcu/update.c:330
 radix_tree_deref_slot include/linux/radix-tree.h:238 [inline]
 find_get_pages_tag+0x59e/0x8b0 mm/filemap.c:1803
 pagevec_lookup_tag+0x3a/0x80 mm/swap.c:992
 __filemap_fdatawait_range+0xff/0x360 mm/filemap.c:424
 file_write_and_wait_range+0xb7/0xe0 mm/filemap.c:681
 __generic_file_fsync+0x79/0x1a0 fs/libfs.c:977
 ext4_sync_file+0x755/0x12d0 fs/ext4/fsync.c:120
 vfs_fsync_range+0x10e/0x260 fs/sync.c:196
 generic_write_sync include/linux/fs.h:2677 [inline]
 ext4_file_write_iter+0x68a/0xe90 fs/ext4/file.c:279
 call_write_iter include/linux/fs.h:1777 [inline]
 do_iter_readv_writev+0x418/0x670 fs/read_write.c:675
 do_iter_write fs/read_write.c:954 [inline]
 do_iter_write+0x154/0x540 fs/read_write.c:935
 vfs_iter_write+0x77/0xb0 fs/read_write.c:967
 iter_file_splice_write+0x572/0xad0 fs/splice.c:749
 do_splice_from fs/splice.c:851 [inline]
 direct_splice_actor+0x123/0x190 fs/splice.c:1018
 splice_direct_to_actor+0x29e/0x7b0 fs/splice.c:973
 do_splice_direct+0x18d/0x230 fs/splice.c:1061
 do_sendfile+0x4db/0xbd0 fs/read_write.c:1441
 SYSC_sendfile64 fs/read_write.c:1502 [inline]
 SyS_sendfile64+0x102/0x110 fs/read_write.c:1488
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4598e9
RSP: 002b:00007fcba1cb8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000800000000024 R11: 0000000000000246 R12: 00007fcba1cb96d4
R13: 00000000004c709e R14: 00000000004dc750 R15: 00000000ffffffff
Code: fb ff ff 31 c0 e9 a9 02 00 00 89 45 b8 41 be 01 00 00 00 e8 54 51 6d fc 49 8d 8d c0 01 00 00 8b 45 b8 48 8d 53 f0 48 39 d1 74 37 <e8> 3c 51 6d fc 49 8d bd ac 02 00 00 8b 45 b8 48 89 fa 48 c1 ea