watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.2:9630] Modules linked in: irq event stamp: 4200841 hardirqs last enabled at (4200840): [] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (4200841): [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (18406): [] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (20661): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (20661): [] irq_exit+0x193/0x240 kernel/softirq.c:409 CPU: 0 PID: 9630 Comm: syz-executor.2 Not tainted 4.14.260-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88804822e080 task.stack: ffff888048230000 RIP: 0010:__read_once_size_nocheck.constprop.0+0x3/0x10 include/linux/compiler.h:203 RSP: 0018:ffff8880ba4071a8 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10 RAX: ffffffff81749257 RBX: 1ffff11017480e37 RCX: ffffffff8a715f0c RDX: ffff8880ba407330 RSI: ffff8880ba4071d8 RDI: ffff888048237910 RBP: ffff888048237910 R08: ffffffff8a715f10 R09: ffffffff8a715f11 R10: 000000000001c1d0 R11: 0000000000000001 R12: ffff8880ba4072e8 R13: ffff8880ba407330 R14: ffff888048230000 R15: ffff8880ba4072e8 FS: 00007f8ced677700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fb225a18e0 CR3: 00000000b2fec000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: deref_stack_reg arch/x86/kernel/unwind_orc.c:289 [inline] deref_stack_reg+0x124/0x1a0 arch/x86/kernel/unwind_orc.c:283 unwind_next_frame+0xc98/0x17d0 arch/x86/kernel/unwind_orc.c:425 __save_stack_trace+0x90/0x160 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc_node mm/slab.c:3333 [inline] kmem_cache_alloc_node+0x133/0x410 mm/slab.c:3640 __alloc_skb+0x5c/0x510 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:980 [inline] alloc_skb_with_frags+0x85/0x500 net/core/skbuff.c:5258 sock_alloc_send_pskb+0x577/0x6d0 net/core/sock.c:2101 __ip6_append_data.isra.0+0x161f/0x2860 net/ipv6/ip6_output.c:1457 ip6_append_data+0x1b8/0x2f0 net/ipv6/ip6_output.c:1620 icmp6_send+0x1564/0x1f60 net/ipv6/icmp.c:579 __icmpv6_send include/linux/icmpv6.h:28 [inline] icmpv6_send include/linux/icmpv6.h:49 [inline] ip6_link_failure+0x2b/0x420 net/ipv6/route.c:1440 dst_link_failure include/net/dst.h:453 [inline] ndisc_error_report+0xa7/0x180 net/ipv6/ndisc.c:687 neigh_invalidate+0x21c/0x520 net/core/neighbour.c:897 neigh_timer_handler+0x820/0xa50 net/core/neighbour.c:983 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:__sanitizer_cov_trace_pc+0x23/0x50 kernel/kcov.c:68 RSP: 0018:ffff888048237730 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: ffff88804822e080 RBX: 800000009fee7007 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 00007f8ceec15000 RDI: 800000009fee7007 RBP: 1ffff11009046ee9 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: ffff88804822e080 R12: 800000009fee7007 R13: ffff88809f32f568 R14: 00007f8ceec15000 R15: ffff888048237768 pte_pfn arch/x86/include/asm/pgtable.h:196 [inline] _vm_normal_page+0xd8/0x3b0 mm/memory.c:855 zap_pte_range mm/memory.c:1337 [inline] zap_pmd_range mm/memory.c:1466 [inline] zap_pud_range mm/memory.c:1495 [inline] zap_p4d_range mm/memory.c:1516 [inline] unmap_page_range+0xcf0/0x1ce0 mm/memory.c:1537 unmap_single_vma+0x147/0x2b0 mm/memory.c:1582 unmap_vmas+0x9d/0x160 mm/memory.c:1612 exit_mmap+0x270/0x4d0 mm/mmap.c:3058 __mmput kernel/fork.c:931 [inline] mmput kernel/fork.c:952 [inline] mmput+0xfa/0x420 kernel/fork.c:947 exit_mm kernel/exit.c:548 [inline] do_exit+0x984/0x2850 kernel/exit.c:855 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f8ceed01e99 RSP: 002b:00007f8ced677218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8ceee14f68 RCX: 00007f8ceed01e99 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8ceee14f68 RBP: 00007f8ceee14f60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8ceee14f6c R13: 00007ffc1f4dcb0f R14: 00007f8ced677300 R15: 0000000000022000 Code: 02 00 75 18 48 8b 43 48 5b 5d c3 e8 38 7c 5b 00 eb a8 48 89 ef e8 9e 7c 5b 00 eb c4 48 89 ef e8 94 7c 5b 00 eb de 66 90 48 8b 07 <48> 89 06 c3 66 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9641 Comm: syz-executor.3 Not tainted 4.14.260-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888094ee8340 task.stack: ffff888048828000 RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:100 RSP: 0018:ffff8880ba507348 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: ffffffff88cc7000 RCX: 0000000000000000 RDX: 1ffffffff1198e1e RSI: 0000000000000000 RDI: 00000000000000b0 RBP: ffff88804882f568 R08: ffff88823fff7058 R09: ffff88823fff704f R10: ffff88823fff7057 R11: 000000518d0a1e33 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fb22591160 CR3: 00000000af97e000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: apic_eoi arch/x86/include/asm/apic.h:390 [inline] ack_APIC_irq arch/x86/include/asm/apic.h:434 [inline] entering_ack_irq arch/x86/include/asm/apic.h:626 [inline] smp_apic_timer_interrupt+0x88/0x5e0 arch/x86/kernel/apic/apic.c:1102 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:unwind_next_frame+0xd67/0x17d0 arch/x86/kernel/unwind_orc.c:467 RSP: 0018:ffff8880ba507438 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff10 RAX: 0000000000000000 RBX: 1ffff110174a0e8e RCX: ffffffff8a6935b0 RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff88804882feb8 RBP: 0000000000000001 R08: ffffffff8a6935b4 R09: 0000000000000005 R10: ffff88804882fec0 R11: 0000000000000001 R12: ffff8880ba50752d R13: ffff8880ba507530 R14: ffff8880ba507548 R15: ffff8880ba5074f8 __save_stack_trace+0x90/0x160 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] kzalloc include/linux/slab.h:661 [inline] neigh_alloc net/core/neighbour.c:324 [inline] __neigh_create+0x1db/0x19b0 net/core/neighbour.c:499 ip6_finish_output2+0x802/0x1f10 net/ipv6/ip6_output.c:117 ip6_finish_output+0x5c6/0xd50 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:239 [inline] ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:209 dst_output include/net/dst.h:470 [inline] NF_HOOK include/linux/netfilter.h:250 [inline] ndisc_send_skb+0x82a/0x1390 net/ipv6/ndisc.c:483 ndisc_send_rs+0x125/0x630 net/ipv6/ndisc.c:677 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3769 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:192 RSP: 0018:ffff88804882f618 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e1279 RBX: 0000000000000286 RCX: 1ffff110129dd17d RDX: dffffc0000000000 RSI: ffff888094ee8bc8 RDI: 0000000000000286 RBP: ffffffff8c041a08 R08: ffffffff8b9b3f78 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a6249000 R13: 0000000000000000 R14: ffffffff8c041a08 R15: 0000000000000000 __debug_check_no_obj_freed lib/debugobjects.c:760 [inline] debug_check_no_obj_freed+0x2c0/0x680 lib/debugobjects.c:776 free_pages_prepare mm/page_alloc.c:1064 [inline] free_pcp_prepare mm/page_alloc.c:1078 [inline] free_hot_cold_page+0x224/0xc80 mm/page_alloc.c:2615 pte_free arch/x86/include/asm/pgalloc.h:65 [inline] zap_deposited_table mm/huge_memory.c:1672 [inline] zap_huge_pmd+0x736/0xa10 mm/huge_memory.c:1726 zap_pmd_range mm/memory.c:1453 [inline] zap_pud_range mm/memory.c:1495 [inline] zap_p4d_range mm/memory.c:1516 [inline] unmap_page_range+0xc07/0x1ce0 mm/memory.c:1537 unmap_single_vma+0x147/0x2b0 mm/memory.c:1582 unmap_vmas+0x9d/0x160 mm/memory.c:1612 exit_mmap+0x270/0x4d0 mm/mmap.c:3058 __mmput kernel/fork.c:931 [inline] mmput kernel/fork.c:952 [inline] mmput+0xfa/0x420 kernel/fork.c:947 exit_mm kernel/exit.c:548 [inline] do_exit+0x984/0x2850 kernel/exit.c:855 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f26f5d6de99 RSP: 002b:00007f26f46e3218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f26f5e80f68 RCX: 00007f26f5d6de99 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f26f5e80f68 RBP: 00007f26f5e80f60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f26f5e80f6c R13: 00007ffc7b6830ef R14: 00007f26f46e3300 R15: 0000000000022000 Code: 83 3d fc 9e 0b 0a 01 7f 02 5d c3 89 ef 5d e9 fd db de 05 48 c7 c7 c0 23 2e 8b e8 14 65 5c 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb ---------------- Code disassembly (best guess): 0: 02 00 add (%rax),%al 2: 75 18 jne 0x1c 4: 48 8b 43 48 mov 0x48(%rbx),%rax 8: 5b pop %rbx 9: 5d pop %rbp a: c3 retq b: e8 38 7c 5b 00 callq 0x5b7c48 10: eb a8 jmp 0xffffffba 12: 48 89 ef mov %rbp,%rdi 15: e8 9e 7c 5b 00 callq 0x5b7cb8 1a: eb c4 jmp 0xffffffe0 1c: 48 89 ef mov %rbp,%rdi 1f: e8 94 7c 5b 00 callq 0x5b7cb8 24: eb de jmp 0x4 26: 66 90 xchg %ax,%ax 28: 48 8b 07 mov (%rdi),%rax * 2b: 48 89 06 mov %rax,(%rsi) <-- trapping instruction 2e: c3 retq 2f: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) 36: 00 00 38: 48 rex.W 39: b8 00 00 00 00 mov $0x0,%eax 3e: 00 fc add %bh,%ah