watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz.2.398:1457]
Modules linked in:
CPU: 1 PID: 1457 Comm: syz.2.398 Not tainted 6.1.84-syzkaller-00005-g96d66062d076 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:sk_filter_trim_cap+0x170/0x770 net/core/filter.c:138
Code: fd 48 8b 03 65 48 ff 80 28 02 00 00 bb f4 ff ff ff e9 1e 03 00 00 e8 5f 7f 64 fd 44 8b 6c 24 20 49 bf 00 00 00 00 00 fc ff df <0f> 1f 44 00 00 e8 46 7f 64 fd 4c 89 f7 48 8b 74 24 18 e8 09 7e 35
RSP: 0018:ffffc900001afe40 EFLAGS: 00000246
RAX: ffffffff841105c2 RBX: 0000000000000000 RCX: ffff888115905100
RDX: 0000000000000101 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001aff50 R08: ffffffff841105b8 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff92000035fd4
R13: 0000000000000020 R14: ffff88811e318a00 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa36f6f5ff8 CR3: 0000000006e0f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tcp_filter net/ipv4/tcp_ipv4.c:1896 [inline]
 tcp_v4_rcv+0x1b65/0x2a30 net/ipv4/tcp_ipv4.c:2078
 ip_protocol_deliver_rcu+0x32f/0x720 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x24b/0x430 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ip_local_deliver+0x1b3/0x3b0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:454 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline]
 ip_sublist_rcv+0x7e5/0x990 net/ipv4/ip_input.c:639
 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:674
 __netif_receive_skb_list_ptype net/core/dev.c:5578 [inline]
 __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5626
 __netif_receive_skb_list net/core/dev.c:5678 [inline]
 netif_receive_skb_list_internal+0x967/0xcc0 net/core/dev.c:5769
 gro_normal_list include/net/gro.h:433 [inline]
 gro_normal_one include/net/gro.h:446 [inline]
 napi_skb_finish net/core/gro.c:627 [inline]
 napi_gro_receive+0x45f/0x920 net/core/gro.c:657
 receive_buf+0x22e4/0x4ef0 drivers/net/virtio_net.c:1297
 virtnet_receive drivers/net/virtio_net.c:1562 [inline]
 virtnet_poll+0x6d3/0x1470 drivers/net/virtio_net.c:1680
 __napi_poll+0xbe/0x5c0 net/core/dev.c:6544
 napi_poll net/core/dev.c:6611 [inline]
 net_rx_action+0x595/0xdd0 net/core/dev.c:6725
 __do_softirq+0x1d8/0x661 kernel/softirq.c:617
 invoke_softirq kernel/softirq.c:472 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:712
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:finish_task_switch+0x172/0x7b0 kernel/sched/core.c:5295
Code: 89 ff e8 71 51 6c 00 49 8b 1f 48 85 db 4c 8b 6d c0 0f 85 ce 00 00 00 4c 89 e7 e8 b9 a8 b0 03 fb 49 8d 9d 48 0b 00 00 48 89 d8 <48> c1 e8 03 49 be 00 00 00 00 00 fc ff df 42 0f b6 04 30 84 c0 0f
RSP: 0018:ffffc9000a0e7020 EFLAGS: 00000282
RAX: ffff888115905c48 RBX: ffff888115905c48 RCX: 0000000000000002
RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc9000a0e7070 R08: ffffffff819b3560 R09: fffffbfff0ede45f
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f7137c80
R13: ffff888115905100 R14: 1ffff1103ee270fc R15: ffff8881f71387e0
 context_switch kernel/sched/core.c:5421 [inline]
 __schedule+0xcaf/0x1550 kernel/sched/core.c:6744
 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:7056
 raw_irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:396
 irqentry_exit+0x30/0x40 kernel/entry/common.c:439
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:zap_pte_range mm/memory.c:1433 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1589 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1618 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1639 [inline]
RIP: 0010:unmap_page_range+0xaef/0x2480 mm/memory.c:1660
Code: e0 01 00 00 31 f6 e8 70 53 0c 00 48 8b 84 24 c0 00 00 00 42 80 3c 30 00 48 8b 5c 24 50 74 08 48 89 df e8 34 51 0c 00 4c 8b 3b <31> c0 48 89 84 24 00 01 00 00 31 ff 4c 89 fe e8 ad 48 c5 ff 4d 85
RSP: 0018:ffffc9000a0e7320 EFLAGS: 00000246
RAX: 1ffff1102643e461 RBX: ffff8881321f2308 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc9000a0e7510
RBP: ffffc9000a0e7570 R08: dffffc0000000000 R09: ffffc9000a0e7500
R10: 0000000000000000 R11: dffffc0000000001 R12: 000000110c27b000
R13: ffffc9000a0e7630 R14: dffffc0000000000 R15: 00000001321f3067
 unmap_single_vma mm/memory.c:1706 [inline]
 unmap_vmas+0x4e4/0x660 mm/memory.c:1746
 exit_mmap+0x2d1/0x940 mm/mmap.c:3336
 __mmput+0x95/0x310 kernel/fork.c:1298
 mmput+0x56/0x170 kernel/fork.c:1321
 exit_mm kernel/exit.c:566 [inline]
 do_exit+0xb29/0x2b80 kernel/exit.c:862
 do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
 get_signal+0x169d/0x1820 kernel/signal.c:2880
 arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x26/0x130 kernel/entry/common.c:303
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5128375bd9
Code: Unable to access opcode bytes at 0x7f5128375baf.
RSP: 002b:00007f51291220f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f5128503f68 RCX: 00007f5128375bd9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5128503f6c
RBP: 00007f5128503f60 R08: 00007ffdd20a80b0 R09: 00007f51291226c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5128503f6c
R13: 000000000000000b R14: 00007ffdd2070c30 R15: 00007ffdd2070d18
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 378 Comm: kworker/u4:4 Not tainted 6.1.84-syzkaller-00005-g96d66062d076 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:453 [inline]
RIP: 0010:smp_call_function_many_cond+0x856/0x930 kernel/smp.c:998
Code: e6 01 31 ff e8 4b 9f 09 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 0a e8 86 9b 09 00 e9 2f ff ff ff f3 90 42 0f b6 04 3b <84> c0 75 14 41 f7 06 01 00 00 00 0f 84 12 ff ff ff e8 64 9b 09 00
RSP: 0018:ffffc900094bf840 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 1ffff1103ee27885 RCX: ffff888113669440
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900094bf958 R08: ffffffff816bea35 R09: ffffed103ee071fb
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 0000000800000000 R14: ffff8881f713c428 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa366e00000 CR3: 0000000006e0f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1166
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1334 [inline]
 text_poke_bp_batch+0x1e9/0x730 arch/x86/kernel/alternative.c:1534
 text_poke_flush arch/x86/kernel/alternative.c:1725 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1732
 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
 __jump_label_update+0x36a/0x380 kernel/jump_label.c:455
 jump_label_update+0x3af/0x450 kernel/jump_label.c:801
 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177
 static_key_enable+0x1a/0x30 kernel/jump_label.c:190
 toggle_allocation_gate+0xbf/0x450 mm/kfence/core.c:804
 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299
 worker_thread+0xa60/0x1260 kernel/workqueue.c:2446
 kthread+0x26d/0x300 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
 </TASK>
NMI backtrace for cpu 0
CPU: 0 PID: 1457 Comm: syz.2.398 Tainted: G             L     6.1.84-syzkaller-00005-g96d66062d076 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:perf_prepare_sample+0x13d1/0x1ca0
Code: 00 4c 89 33 48 8b 5c 24 18 48 89 de 48 81 e6 00 00 40 00 31 ff e8 3f b6 d9 ff 48 89 d8 48 25 00 00 40 00 75 07 e8 ef b1 d9 ff <eb> 4b e8 e8 b1 d9 ff 49 8d 7c 24 30 48 89 f8 48 c1 e8 03 42 80 3c
RSP: 0018:ffffc90000006e00 EFLAGS: 00000046
RAX: ffffffff819bd3e1 RBX: 0000000000000000 RCX: ffff888115905100
RDX: 0000000000010101 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000006ef0 R08: ffffffff819bd3d1 R09: ffffc90000006f40
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90000007100
R13: ffffc90000006fa6 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa36c61e0fd CR3: 000000011e286000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 __perf_event_output kernel/events/core.c:7641 [inline]
 perf_event_output_forward+0xdb/0x1b0 kernel/events/core.c:7661
 __perf_event_overflow+0x458/0x630 kernel/events/core.c:9409
 perf_swevent_hrtimer+0x38e/0x4f0 kernel/events/core.c:10817
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x41a/0xad0 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x40c/0xaa0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x44/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:update_stack_state+0x349/0x460 arch/x86/kernel/unwind_frame.c:243
Code: 45 d0 4c 8d 70 38 4c 89 f0 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 74 08 4c 89 f7 e8 3b dc 84 00 48 8b 45 c0 <49> 89 06 48 8b 4d 90 42 80 3c 39 00 48 8b 5d c8 4c 8b 75 b8 74 0c
RSP: 0018:ffffc90000007630 EFLAGS: 00000246
RAX: ffffc9000a0e7570 RBX: ffffc900000077a8 RCX: ffffc9000a0e7580
RDX: 1ffff92000000ef2 RSI: ffffc9000a0e7570 RDI: ffffc900000077d8
RBP: ffffc900000076e8 R08: ffffc90000007868 R09: 0000000000000019
R10: ffffc90000007870 R11: dffffc0000000001 R12: 1ffff92000000ef8
R13: 0000000000000000 R14: ffffc900000077b8 R15: dffffc0000000000
 unwind_next_frame+0x3cb/0x700 arch/x86/kernel/unwind_frame.c:315
 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:249
 kasan_slab_free include/linux/kasan.h:178 [inline]
 slab_free_hook mm/slub.c:1745 [inline]
 slab_free_freelist_hook mm/slub.c:1771 [inline]
 slab_free mm/slub.c:3684 [inline]
 kmem_cache_free+0x291/0x510 mm/slub.c:3706
 file_free_rcu+0x9f/0xb0 fs/file_table.c:51
 rcu_do_batch+0x518/0xb70 kernel/rcu/tree.c:2296
 rcu_core+0x4ee/0xf10 kernel/rcu/tree.c:2556
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2573
 __do_softirq+0x1d8/0x661 kernel/softirq.c:617
 invoke_softirq kernel/softirq.c:472 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:712
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:preempt_schedule_irq+0xc2/0x140 kernel/sched/core.c:7056
Code: 4c 89 e7 e8 40 72 bd fc f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 b4 3b 50 fc fb bf 01 00 00 00 <e8> a9 e4 ff ff fa bf 01 00 00 00 e8 3e 3d 50 fc 65 48 8b 1d 46 4d
RSP: 0018:ffffc9000a0e7020 EFLAGS: 00000246
RAX: 1ffff11022b20b79 RBX: 1ffff9200141ce08 RCX: ffffffff85011f00
RDX: 1ffff11022b20a25 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc9000a0e70b8 R08: ffffffff87930000 R09: ffffffff87930008
R10: ffffffff87930018 R11: ffffffff87930010 R12: ffffc9000a0e7040
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200141ce04
 raw_irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:396
 irqentry_exit+0x30/0x40 kernel/entry/common.c:439
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:kasan_check_range+0x1bd/0x2a0 mm/kasan/generic.c:189
Code: 4d 89 d5 49 8d 5d 07 4d 85 ed 49 0f 49 dd 48 83 e3 f8 49 29 dd 74 12 41 80 39 00 0f 85 a6 00 00 00 49 ff c1 49 ff cd 75 ee 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 45 84 f6 75 61 41 f7 c6 00 ff 00 00
RSP: 0018:ffffc9000a0e71b8 EFLAGS: 00000256
RAX: 0000000080000001 RBX: ffff888115905100 RCX: ffffffff84ff1e2e
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888115905100
RBP: ffffc9000a0e71d8 R08: dffffc0000000000 R09: ffffed1022b20a21
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff11022b20a20
R13: 0000000000000001 R14: ffffed1022b20a21 R15: dffffc0000000000
 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
 instrument_atomic_read include/linux/instrumented.h:72 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 test_ti_thread_flag include/linux/thread_info.h:118 [inline]
 need_resched include/linux/sched.h:2255 [inline]
 preempt_schedule_common+0xbe/0xf0 kernel/sched/core.c:6921
 preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6937
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x5f/0x70 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 zap_pte_range mm/memory.c:1530 [inline]
 zap_pmd_range mm/memory.c:1589 [inline]
 zap_pud_range mm/memory.c:1618 [inline]
 zap_p4d_range mm/memory.c:1639 [inline]
 unmap_page_range+0xaae/0x2480 mm/memory.c:1660
 unmap_single_vma mm/memory.c:1706 [inline]
 unmap_vmas+0x4e4/0x660 mm/memory.c:1746
 exit_mmap+0x2d1/0x940 mm/mmap.c:3336
 __mmput+0x95/0x310 kernel/fork.c:1298
 mmput+0x56/0x170 kernel/fork.c:1321
 exit_mm kernel/exit.c:566 [inline]
 do_exit+0xb29/0x2b80 kernel/exit.c:862
 do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
 get_signal+0x169d/0x1820 kernel/signal.c:2880
 arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x26/0x130 kernel/entry/common.c:303
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5128375bd9
Code: Unable to access opcode bytes at 0x7f5128375baf.
RSP: 002b:00007f51291220f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f5128503f68 RCX: 00007f5128375bd9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5128503f6c
RBP: 00007f5128503f60 R08: 00007ffdd20a80b0 R09: 00007f51291226c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5128503f6c
R13: 000000000000000b R14: 00007ffdd2070c30 R15: 00007ffdd2070d18
 </TASK>