netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.3:7224] Modules linked in: irq event stamp: 4453295 hardirqs last enabled at (4453294): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (4453295): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (0): [] copy_process.part.0+0x15b9/0x8260 kernel/fork.c:1855 softirqs last disabled at (81): [] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (81): [] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 0 PID: 7224 Comm: syz-executor.3 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184 Code: 48 c7 c0 c8 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d fc 5e d8 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 3b 19 e7 f8 eb c0 0f 0b 0f 0b 48 c7 c7 c8 RSP: 0018:ffff8880ba007c28 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e3059 RBX: 0000000000000286 RCX: 1ffff110058509a5 RDX: dffffc0000000000 RSI: ffff88802c284d08 RDI: 0000000000000286 RBP: ffff8880ba022b40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000022b40 R14: 0000000000000000 R15: ffff8880ba022b40 FS: 00007fbdfedfd700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000422330 CR3: 0000000028e76000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mod_timer kernel/time/timer.c:1071 [inline] mod_timer+0x4ea/0x1010 kernel/time/timer.c:1114 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744 Code: 00 00 e8 2d 42 29 f9 e8 38 7c 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 6b 48 d9 01 00 74 5b fb 66 0f 1f 44 00 00 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 d0 82 f1 89 48 c1 e8 03 80 RSP: 0018:ffff888025047a60 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e305b RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88802c284d04 RBP: ffffed1005850890 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802c284480 R13: ffffffff89f182d8 R14: 0000000000000000 R15: 0000000000000000 retint_kernel+0x1b/0x2d RIP: 0010:futex_wake+0x138/0x480 kernel/futex.c:1683 Code: 48 89 c7 e8 6a 4d 40 00 48 89 d8 48 c1 e8 03 0f b6 14 28 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f7 02 00 00 8b 2b <31> ff 89 ee e8 3f 8f 0a 00 85 ed 75 5f e8 c6 8d 0a 00 48 8d 7c 24 RSP: 0018:ffff888025047b30 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000003 RBX: ffffc90000c7b980 RCX: ffffffff815804c6 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc90000c7b980 RBP: 0000000000000001 R08: 0000000000000000 R09: fffff5200018f730 R10: ffffc90000c7b983 R11: 0000000000000000 R12: 000000000056c0fc R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000001 do_futex+0x2ca/0x1880 kernel/futex.c:3894 __do_sys_futex kernel/futex.c:3950 [inline] __se_sys_futex+0x28f/0x3b0 kernel/futex.c:3918 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbdfedfd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 000000000056c0f8 RCX: 00000000004665f9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000056c0fc RBP: 000000000056c0f0 R08: 000000000000000e R09: 0000000000000000 R10: 0000000000000006 R11: 0000000000000246 R12: 000000000056c0fc R13: 00007ffcfdb44fdf R14: 00007fbdfedfd300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 7216 Comm: syz-executor.0 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:109 Code: 3d 1c 04 3d 0b 01 7f 02 5d c3 89 ef 5d e9 10 cd c9 06 48 c7 c7 00 87 65 8c e8 24 e2 6f 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb 48 RSP: 0018:ffff8880ba1076d8 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: ffffffff89cfa1a0 RCX: 0000000000000020 RDX: 1ffffffff139f436 RSI: 00000000000000f9 RDI: 0000000000000380 RBP: ffff8880ba11e2c0 R08: ffffffff8c664058 R09: 0000000000000000 R10: 0000000000000007 R11: ffffffff8c66405b R12: 00000000000000f9 R13: 0000000000000000 R14: ffff8880ba124cc0 R15: ffff8880ba124d30 FS: 00007f29fa2e3700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000056c030 CR3: 0000000028db4000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: apic_write arch/x86/include/asm/apic.h:389 [inline] lapic_next_event+0x4d/0x80 arch/x86/kernel/apic/apic.c:460 clockevents_program_event+0x234/0x350 kernel/time/clockevents.c:344 tick_program_event+0xac/0x140 kernel/time/tick-oneshot.c:48 hrtimer_interrupt+0x40a/0x9e0 kernel/time/hrtimer.c:1552 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline] smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:in_irqentry_text mm/kasan/kasan.c:419 [inline] RIP: 0010:filter_irq_stacks mm/kasan/kasan.c:431 [inline] RIP: 0010:save_stack mm/kasan/kasan.c:449 [inline] RIP: 0010:set_track mm/kasan/kasan.c:460 [inline] RIP: 0010:kasan_kmalloc+0x141/0x160 mm/kasan/kasan.c:553 Code: c0 89 44 24 08 74 0e 8d 50 ff 48 83 3c d6 ff 75 04 89 54 24 08 48 8d 7c 24 08 44 89 e6 e8 17 47 f0 01 89 45 04 e9 4a ff ff ff <48> 81 fa 00 00 40 88 72 09 48 81 fa 80 09 40 88 72 c0 83 c1 01 39 RSP: 0018:ffff8880ba1078f0 EFLAGS: 00000283 ORIG_RAX: ffffffffffffff13 RAX: 000000000000001f RBX: ffff88804eb692c0 RCX: 0000000000000002 RDX: ffffffff867086be RSI: ffff8880ba107910 RDI: 0000000000000286 RBP: ffff88804eb692c0 R08: 0000000000000000 R09: 0000000000000004 R10: 0000000000000000 R11: 0000000000074071 R12: 0000000000490220 R13: 0000000000000000 R14: ffff88813bff0940 R15: 0000000000000200 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slab.c:3340 [inline] kmem_cache_alloc_node_trace+0x13c/0x3b0 mm/slab.c:3666 __do_kmalloc_node mm/slab.c:3688 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0xae/0x560 net/core/skbuff.c:205 skb_copy+0x139/0x2f0 net/core/skbuff.c:1358 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb8a/0x1330 drivers/net/wireless/mac80211_hwsim.c:1353 mac80211_hwsim_tx_frame+0x12b/0x210 drivers/net/wireless/mac80211_hwsim.c:1556 mac80211_hwsim_beacon_tx+0x3f8/0x680 drivers/net/wireless/mac80211_hwsim.c:1595 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:free_the_page mm/page_alloc.c:4458 [inline] RIP: 0010:__free_pages+0x5c/0xa0 mm/page_alloc.c:4467 Code: 89 e0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 53 8b 45 34 85 c0 74 3b be 04 00 00 00 4c 89 e7 e8 1a 64 19 00 f0 ff 4d 34 75 12 <45> 85 ed 75 13 48 89 ef 5d 41 5c 41 5d e9 22 fe ff ff 5d 41 5c 41 RSP: 0018:ffff8880257778b0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: fffff940004a2a87 RBX: ffff8880950b4600 RCX: ffffffff817eee26 RDX: fffff940004a2a87 RSI: 0000000000000004 RDI: ffffea0002515434 RBP: ffffea0002515400 R08: 0000000000000001 R09: fffff940004a2a86 R10: ffffea0002515437 R11: 0000000000000000 R12: ffffea0002515434 R13: 0000000000000003 R14: ffff8880ab08d840 R15: 0000000000000000 free_thread_stack kernel/fork.c:270 [inline] release_task_stack kernel/fork.c:385 [inline] put_task_stack+0xd2/0x1f0 kernel/fork.c:396 finish_task_switch+0x523/0x760 kernel/sched/core.c:2710 context_switch kernel/sched/core.c:2831 [inline] __schedule+0x88f/0x2040 kernel/sched/core.c:3517 preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:3744 retint_kernel+0x1b/0x2d RIP: 0010:preempt_schedule_common+0x0/0xc0 kernel/sched/core.c:3624 Code: 00 5b 5d c3 e8 f1 2f 80 f9 eb df e8 ea 2f 80 f9 e9 61 ff ff ff e8 70 2c 80 f9 e9 1c ff ff ff e8 b6 2e 80 f9 e9 7b ff ff ff 90 <41> 55 41 54 49 bc 00 00 00 00 00 fc ff df 55 65 48 8b 2c 25 c0 df RSP: 0018:ffff888025777ae0 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000286 RBX: 1ffff11004aeef6c RCX: ffffffff81588f79 RDX: dffffc0000000000 RSI: ffffffff81589116 RDI: 0000000000000005 RBP: ffff888025777b30 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: ffff88802fad82bc ___preempt_schedule+0x16/0x18 smp_call_function_single+0x3bb/0x420 kernel/smp.c:304 task_function_call+0xe0/0x170 kernel/events/core.c:115 perf_install_in_context+0x238/0x3c0 kernel/events/core.c:2623 __do_sys_perf_event_open kernel/events/core.c:10924 [inline] __se_sys_perf_event_open+0xe5d/0x2720 kernel/events/core.c:10549 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f29fa2e3188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 000000000056c0f0 RCX: 00000000004665f9 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020003640 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000056c0f0 R13: 00007ffe57e30b8f R14: 00007f29fa2e3300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 48 c7 c0 c8 82 f1 89 mov $0xffffffff89f182c8,%rax 7: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx e: fc ff df 11: 48 c1 e8 03 shr $0x3,%rax 15: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) 19: 75 2f jne 0x4a 1b: 48 83 3d fc 5e d8 01 cmpq $0x0,0x1d85efc(%rip) # 0x1d85f1f 22: 00 23: 74 15 je 0x3a 25: 48 89 df mov %rbx,%rdi 28: 57 push %rdi 29: 9d popfq * 2a: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) <-- trapping instruction 2f: eb b2 jmp 0xffffffe3 31: e8 3b 19 e7 f8 callq 0xf8e71971 36: eb c0 jmp 0xfffffff8 38: 0f 0b ud2 3a: 0f 0b ud2 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: c7 (bad) 3f: c8 .byte 0xc8