watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz.2.398:1457]
Modules linked in:
CPU: 1 PID: 1457 Comm: syz.2.398 Not tainted 6.1.84-syzkaller-00005-g96d66062d076 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:sk_filter_trim_cap+0x170/0x770 net/core/filter.c:138
Code: fd 48 8b 03 65 48 ff 80 28 02 00 00 bb f4 ff ff ff e9 1e 03 00 00 e8 5f 7f 64 fd 44 8b 6c 24 20 49 bf 00 00 00 00 00 fc ff df <0f> 1f 44 00 00 e8 46 7f 64 fd 4c 89 f7 48 8b 74 24 18 e8 09 7e 35
RSP: 0018:ffffc900001afe40 EFLAGS: 00000246
RAX: ffffffff841105c2 RBX: 0000000000000000 RCX: ffff888115905100
RDX: 0000000000000101 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001aff50 R08: ffffffff841105b8 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff92000035fd4
R13: 0000000000000020 R14: ffff88811e318a00 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa36f6f5ff8 CR3: 0000000006e0f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
tcp_filter net/ipv4/tcp_ipv4.c:1896 [inline]
tcp_v4_rcv+0x1b65/0x2a30 net/ipv4/tcp_ipv4.c:2078
ip_protocol_deliver_rcu+0x32f/0x720 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x24b/0x430 net/ipv4/ip_input.c:233
NF_HOOK include/linux/netfilter.h:305 [inline]
ip_local_deliver+0x1b3/0x3b0 net/ipv4/ip_input.c:254
dst_input include/net/dst.h:454 [inline]
ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline]
ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline]
ip_sublist_rcv+0x7e5/0x990 net/ipv4/ip_input.c:639
ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:674
__netif_receive_skb_list_ptype net/core/dev.c:5578 [inline]
__netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5626
__netif_receive_skb_list net/core/dev.c:5678 [inline]
netif_receive_skb_list_internal+0x967/0xcc0 net/core/dev.c:5769
gro_normal_list include/net/gro.h:433 [inline]
gro_normal_one include/net/gro.h:446 [inline]
napi_skb_finish net/core/gro.c:627 [inline]
napi_gro_receive+0x45f/0x920 net/core/gro.c:657
receive_buf+0x22e4/0x4ef0 drivers/net/virtio_net.c:1297
virtnet_receive drivers/net/virtio_net.c:1562 [inline]
virtnet_poll+0x6d3/0x1470 drivers/net/virtio_net.c:1680
__napi_poll+0xbe/0x5c0 net/core/dev.c:6544
napi_poll net/core/dev.c:6611 [inline]
net_rx_action+0x595/0xdd0 net/core/dev.c:6725
__do_softirq+0x1d8/0x661 kernel/softirq.c:617
invoke_softirq kernel/softirq.c:472 [inline]
__irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700
irq_exit_rcu+0x9/0x10 kernel/softirq.c:712
sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:finish_task_switch+0x172/0x7b0 kernel/sched/core.c:5295
Code: 89 ff e8 71 51 6c 00 49 8b 1f 48 85 db 4c 8b 6d c0 0f 85 ce 00 00 00 4c 89 e7 e8 b9 a8 b0 03 fb 49 8d 9d 48 0b 00 00 48 89 d8 <48> c1 e8 03 49 be 00 00 00 00 00 fc ff df 42 0f b6 04 30 84 c0 0f
RSP: 0018:ffffc9000a0e7020 EFLAGS: 00000282
RAX: ffff888115905c48 RBX: ffff888115905c48 RCX: 0000000000000002
RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc9000a0e7070 R08: ffffffff819b3560 R09: fffffbfff0ede45f
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f7137c80
R13: ffff888115905100 R14: 1ffff1103ee270fc R15: ffff8881f71387e0
context_switch kernel/sched/core.c:5421 [inline]
__schedule+0xcaf/0x1550 kernel/sched/core.c:6744
preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:7056
raw_irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:396
irqentry_exit+0x30/0x40 kernel/entry/common.c:439
sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:zap_pte_range mm/memory.c:1433 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1589 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1618 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1639 [inline]
RIP: 0010:unmap_page_range+0xaef/0x2480 mm/memory.c:1660
Code: e0 01 00 00 31 f6 e8 70 53 0c 00 48 8b 84 24 c0 00 00 00 42 80 3c 30 00 48 8b 5c 24 50 74 08 48 89 df e8 34 51 0c 00 4c 8b 3b <31> c0 48 89 84 24 00 01 00 00 31 ff 4c 89 fe e8 ad 48 c5 ff 4d 85
RSP: 0018:ffffc9000a0e7320 EFLAGS: 00000246
RAX: 1ffff1102643e461 RBX: ffff8881321f2308 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc9000a0e7510
RBP: ffffc9000a0e7570 R08: dffffc0000000000 R09: ffffc9000a0e7500
R10: 0000000000000000 R11: dffffc0000000001 R12: 000000110c27b000
R13: ffffc9000a0e7630 R14: dffffc0000000000 R15: 00000001321f3067
unmap_single_vma mm/memory.c:1706 [inline]
unmap_vmas+0x4e4/0x660 mm/memory.c:1746
exit_mmap+0x2d1/0x940 mm/mmap.c:3336
__mmput+0x95/0x310 kernel/fork.c:1298
mmput+0x56/0x170 kernel/fork.c:1321
exit_mm kernel/exit.c:566 [inline]
do_exit+0xb29/0x2b80 kernel/exit.c:862
do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
get_signal+0x169d/0x1820 kernel/signal.c:2880
arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x26/0x130 kernel/entry/common.c:303
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5128375bd9
Code: Unable to access opcode bytes at 0x7f5128375baf.
RSP: 002b:00007f51291220f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f5128503f68 RCX: 00007f5128375bd9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5128503f6c
RBP: 00007f5128503f60 R08: 00007ffdd20a80b0 R09: 00007f51291226c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5128503f6c
R13: 000000000000000b R14: 00007ffdd2070c30 R15: 00007ffdd2070d18
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 378 Comm: kworker/u4:4 Not tainted 6.1.84-syzkaller-00005-g96d66062d076 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:453 [inline]
RIP: 0010:smp_call_function_many_cond+0x856/0x930 kernel/smp.c:998
Code: e6 01 31 ff e8 4b 9f 09 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 0a e8 86 9b 09 00 e9 2f ff ff ff f3 90 42 0f b6 04 3b <84> c0 75 14 41 f7 06 01 00 00 00 0f 84 12 ff ff ff e8 64 9b 09 00
RSP: 0018:ffffc900094bf840 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 1ffff1103ee27885 RCX: ffff888113669440
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900094bf958 R08: ffffffff816bea35 R09: ffffed103ee071fb
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 0000000800000000 R14: ffff8881f713c428 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa366e00000 CR3: 0000000006e0f000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1166
on_each_cpu include/linux/smp.h:71 [inline]
text_poke_sync arch/x86/kernel/alternative.c:1334 [inline]
text_poke_bp_batch+0x1e9/0x730 arch/x86/kernel/alternative.c:1534
text_poke_flush arch/x86/kernel/alternative.c:1725 [inline]
text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1732
arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
__jump_label_update+0x36a/0x380 kernel/jump_label.c:455
jump_label_update+0x3af/0x450 kernel/jump_label.c:801
static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177
static_key_enable+0x1a/0x30 kernel/jump_label.c:190
toggle_allocation_gate+0xbf/0x450 mm/kfence/core.c:804
process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299
worker_thread+0xa60/0x1260 kernel/workqueue.c:2446
kthread+0x26d/0x300 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
NMI backtrace for cpu 0
CPU: 0 PID: 1457 Comm: syz.2.398 Tainted: G L 6.1.84-syzkaller-00005-g96d66062d076 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:perf_prepare_sample+0x13d1/0x1ca0
Code: 00 4c 89 33 48 8b 5c 24 18 48 89 de 48 81 e6 00 00 40 00 31 ff e8 3f b6 d9 ff 48 89 d8 48 25 00 00 40 00 75 07 e8 ef b1 d9 ff 4b e8 e8 b1 d9 ff 49 8d 7c 24 30 48 89 f8 48 c1 e8 03 42 80 3c
RSP: 0018:ffffc90000006e00 EFLAGS: 00000046
RAX: ffffffff819bd3e1 RBX: 0000000000000000 RCX: ffff888115905100
RDX: 0000000000010101 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000006ef0 R08: ffffffff819bd3d1 R09: ffffc90000006f40
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90000007100
R13: ffffc90000006fa6 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa36c61e0fd CR3: 000000011e286000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__perf_event_output kernel/events/core.c:7641 [inline]
perf_event_output_forward+0xdb/0x1b0 kernel/events/core.c:7661
__perf_event_overflow+0x458/0x630 kernel/events/core.c:9409
perf_swevent_hrtimer+0x38e/0x4f0 kernel/events/core.c:10817
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x41a/0xad0 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x40c/0xaa0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1112
sysvec_apic_timer_interrupt+0x44/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:update_stack_state+0x349/0x460 arch/x86/kernel/unwind_frame.c:243
Code: 45 d0 4c 8d 70 38 4c 89 f0 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 74 08 4c 89 f7 e8 3b dc 84 00 48 8b 45 c0 <49> 89 06 48 8b 4d 90 42 80 3c 39 00 48 8b 5d c8 4c 8b 75 b8 74 0c
RSP: 0018:ffffc90000007630 EFLAGS: 00000246
RAX: ffffc9000a0e7570 RBX: ffffc900000077a8 RCX: ffffc9000a0e7580
RDX: 1ffff92000000ef2 RSI: ffffc9000a0e7570 RDI: ffffc900000077d8
RBP: ffffc900000076e8 R08: ffffc90000007868 R09: 0000000000000019
R10: ffffc90000007870 R11: dffffc0000000001 R12: 1ffff92000000ef8
R13: 0000000000000000 R14: ffffc900000077b8 R15: dffffc0000000000
unwind_next_frame+0x3cb/0x700 arch/x86/kernel/unwind_frame.c:315
arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:249
kasan_slab_free include/linux/kasan.h:178 [inline]
slab_free_hook mm/slub.c:1745 [inline]
slab_free_freelist_hook mm/slub.c:1771 [inline]
slab_free mm/slub.c:3684 [inline]
kmem_cache_free+0x291/0x510 mm/slub.c:3706
file_free_rcu+0x9f/0xb0 fs/file_table.c:51
rcu_do_batch+0x518/0xb70 kernel/rcu/tree.c:2296
rcu_core+0x4ee/0xf10 kernel/rcu/tree.c:2556
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2573
__do_softirq+0x1d8/0x661 kernel/softirq.c:617
invoke_softirq kernel/softirq.c:472 [inline]
__irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700
irq_exit_rcu+0x9/0x10 kernel/softirq.c:712
sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:preempt_schedule_irq+0xc2/0x140 kernel/sched/core.c:7056
Code: 4c 89 e7 e8 40 72 bd fc f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 b4 3b 50 fc fb bf 01 00 00 00 a9 e4 ff ff fa bf 01 00 00 00 e8 3e 3d 50 fc 65 48 8b 1d 46 4d
RSP: 0018:ffffc9000a0e7020 EFLAGS: 00000246
RAX: 1ffff11022b20b79 RBX: 1ffff9200141ce08 RCX: ffffffff85011f00
RDX: 1ffff11022b20a25 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc9000a0e70b8 R08: ffffffff87930000 R09: ffffffff87930008
R10: ffffffff87930018 R11: ffffffff87930010 R12: ffffc9000a0e7040
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200141ce04
raw_irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:396
irqentry_exit+0x30/0x40 kernel/entry/common.c:439
sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:kasan_check_range+0x1bd/0x2a0 mm/kasan/generic.c:189
Code: 4d 89 d5 49 8d 5d 07 4d 85 ed 49 0f 49 dd 48 83 e3 f8 49 29 dd 74 12 41 80 39 00 0f 85 a6 00 00 00 49 ff c1 49 ff cd 75 ee 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 45 84 f6 75 61 41 f7 c6 00 ff 00 00
RSP: 0018:ffffc9000a0e71b8 EFLAGS: 00000256
RAX: 0000000080000001 RBX: ffff888115905100 RCX: ffffffff84ff1e2e
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888115905100
RBP: ffffc9000a0e71d8 R08: dffffc0000000000 R09: ffffed1022b20a21
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff11022b20a20
R13: 0000000000000001 R14: ffffed1022b20a21 R15: dffffc0000000000
__kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
instrument_atomic_read include/linux/instrumented.h:72 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
test_ti_thread_flag include/linux/thread_info.h:118 [inline]
need_resched include/linux/sched.h:2255 [inline]
preempt_schedule_common+0xbe/0xf0 kernel/sched/core.c:6921
preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6937
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
__raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
_raw_spin_unlock+0x5f/0x70 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:391 [inline]
zap_pte_range mm/memory.c:1530 [inline]
zap_pmd_range mm/memory.c:1589 [inline]
zap_pud_range mm/memory.c:1618 [inline]
zap_p4d_range mm/memory.c:1639 [inline]
unmap_page_range+0xaae/0x2480 mm/memory.c:1660
unmap_single_vma mm/memory.c:1706 [inline]
unmap_vmas+0x4e4/0x660 mm/memory.c:1746
exit_mmap+0x2d1/0x940 mm/mmap.c:3336
__mmput+0x95/0x310 kernel/fork.c:1298
mmput+0x56/0x170 kernel/fork.c:1321
exit_mm kernel/exit.c:566 [inline]
do_exit+0xb29/0x2b80 kernel/exit.c:862
do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
get_signal+0x169d/0x1820 kernel/signal.c:2880
arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x26/0x130 kernel/entry/common.c:303
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5128375bd9
Code: Unable to access opcode bytes at 0x7f5128375baf.
RSP: 002b:00007f51291220f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f5128503f68 RCX: 00007f5128375bd9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5128503f6c
RBP: 00007f5128503f60 R08: 00007ffdd20a80b0 R09: 00007f51291226c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5128503f6c
R13: 000000000000000b R14: 00007ffdd2070c30 R15: 00007ffdd2070d18