watchdog: BUG: soft lockup - CPU#1 stuck for 224s! [syz.2.1591:8589] Modules linked in: CPU: 1 PID: 8589 Comm: syz.2.1591 Tainted: G W 6.1.90-syzkaller-00004-g79436849ef1d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:__stack_depot_save+0x169/0x480 Code: c1 c6 18 41 29 f4 eb 03 45 89 f0 48 8b 05 37 e5 fc 04 8b 0d 2d e5 fc 04 44 21 e1 48 89 45 a8 48 89 4d b0 4c 8b 2c c8 45 89 d6 04 4d 8b 6d 00 4d 85 ed 74 2a 45 39 65 08 75 f1 45 39 55 0c 75 RSP: 0018:ffffc900001b0740 EFLAGS: 00000202 RAX: ffff8881f5c00000 RBX: 0000000000000000 RCX: 0000000000034243 RDX: ffffc900001b0848 RSI: 0000000070ea9443 RDI: 0000000000000001 RBP: ffffc900001b07a0 R08: 0000000000000a20 R09: 0000000000000000 R10: 000000000000000a R11: dffffc0000000001 R12: 00000000fd434243 R13: ffff88812e7638a0 R14: 000000000000000a R15: ffffc900001b0800 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb99965318a CR3: 000000013f52b000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: stack_depot_save+0x13/0x20 lib/stackdepot.c:533 ref_tracker_alloc+0x182/0x450 lib/ref_tracker.c:92 __netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] netdev_hold include/linux/netdevice.h:4092 [inline] dst_init+0xe1/0x400 net/core/dst.c:52 dst_alloc+0x18a/0x1e0 net/core/dst.c:96 ip6_dst_alloc net/ipv6/route.c:345 [inline] icmp6_dst_alloc+0xf8/0x510 net/ipv6/route.c:3266 ndisc_send_skb+0x28b/0xdc0 net/ipv6/ndisc.c:489 ndisc_send_rs+0x47d/0x5f0 net/ipv6/ndisc.c:719 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3984 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1510 expire_timers kernel/time/timer.c:1555 [inline] __run_timers+0x72a/0xa10 kernel/time/timer.c:1826 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1839 __do_softirq+0x1d8/0x661 kernel/softirq.c:617 invoke_softirq kernel/softirq.c:472 [inline] __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700 irq_exit_rcu+0x9/0x10 kernel/softirq.c:712 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653 RIP: 0010:finish_task_switch+0x16f/0x7b0 kernel/sched/core.c:5295 Code: 74 08 4c 89 ff e8 11 5c 6c 00 49 8b 1f 48 85 db 4c 8b 6d c0 0f 85 ce 00 00 00 4c 89 e7 e8 39 ff ce 03 fb 49 8d 9d 48 0b 00 00 <48> 89 d8 48 c1 e8 03 49 be 00 00 00 00 00 fc ff df 42 0f b6 04 30 RSP: 0018:ffffc900015aee20 EFLAGS: 00000282 RAX: 0000000080000001 RBX: ffff88812c15dc48 RCX: 0000000000000002 RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffffc900015aee70 R08: ffffffff819b54a0 R09: fffffbfff0ee5117 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f7137c80 R13: ffff88812c15d100 R14: 1ffff1103ee270fc R15: ffff8881f71387e0 context_switch kernel/sched/core.c:5421 [inline] __schedule+0xcaf/0x1550 kernel/sched/core.c:6744 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:7056 raw_irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:396 irqentry_exit+0x30/0x40 kernel/entry/common.c:439 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653 RIP: 0010:arch_stack_walk+0x114/0x140 arch/x86/kernel/stacktrace.c:24 Code: ff 48 89 df e8 0d 9c 05 00 48 85 c0 74 1e 4c 89 f7 48 89 c6 41 ff d5 84 c0 74 11 48 89 df e8 23 9d 05 00 83 bd 70 ff ff ff 00 <75> d5 65 48 8b 04 25 28 00 00 00 48 3b 45 d0 75 0f 48 83 c4 68 5b RSP: 0018:ffffc900015af120 EFLAGS: 00000202 RAX: 00000000015af101 RBX: ffffc900015af120 RCX: 00000000015af101 RDX: 1ffff920002b5e26 RSI: ffffc900015af530 RDI: ffffc900015af178 RBP: ffffc900015af1b0 R08: ffffc900015af208 R09: 0000000000000001 R10: ffffc900015af210 R11: dffffc0000000001 R12: ffff88812c15d100 R13: ffffffff8165c3e0 R14: ffffc900015af200 R15: 0000000000000000 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122 save_stack+0xf6/0x1e0 mm/page_owner.c:147 __reset_page_owner+0x54/0x190 mm/page_owner.c:168 reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1498 [inline] free_pcp_prepare mm/page_alloc.c:1572 [inline] free_unref_page_prepare+0x83d/0x850 mm/page_alloc.c:3498 free_unref_page_list+0xf1/0x7b0 mm/page_alloc.c:3646 release_pages+0xf7f/0xfe0 mm/swap.c:1063 free_pages_and_swap_cache+0x8a/0xa0 mm/swap_state.c:315 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu mm/mmu_gather.c:261 [inline] tlb_finish_mmu+0x1e0/0x3f0 mm/mmu_gather.c:361 exit_mmap+0x421/0x940 mm/mmap.c:3348 __mmput+0x95/0x310 kernel/fork.c:1298 mmput+0x56/0x170 kernel/fork.c:1321 exit_mm kernel/exit.c:566 [inline] do_exit+0xb29/0x2b80 kernel/exit.c:862 do_group_exit+0x21a/0x2d0 kernel/exit.c:1025 get_signal+0x169d/0x1820 kernel/signal.c:2880 arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:316 irqentry_exit+0x12/0x40 kernel/entry/common.c:419 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653 RIP: 0033:0x7f91662401b8 Code: Unable to access opcode bytes at 0x7f916624018e. RSP: 002b:00007f91671a9048 EFLAGS: 00000217 RAX: 0000000000000000 RBX: 00007f9166516058 RCX: 00007f91663799f9 RDX: 0000000000000000 RSI: 0000000000005452 RDI: 0000000000000007 RBP: 00007f91663e78ee R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f9166516058 R15: 00007fff9ec3ae78 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 6035 Comm: kworker/u4:12 Tainted: G W 6.1.90-syzkaller-00004-g79436849ef1d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:rep_nop arch/x86/include/asm/vdso/processor.h:13 [inline] RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline] RIP: 0010:csd_lock_wait kernel/smp.c:453 [inline] RIP: 0010:smp_call_function_many_cond+0x84f/0x930 kernel/smp.c:998 Code: 45 8b 3e 44 89 fe 83 e6 01 31 ff e8 4b 9f 09 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 0a e8 86 9b 09 00 e9 2f ff ff ff 90 42 0f b6 04 3b 84 c0 75 14 41 f7 06 01 00 00 00 0f 84 12 ff RSP: 0018:ffffc90000ee7840 EFLAGS: 00000293 RAX: ffffffff816c074c RBX: 1ffff1103ee27885 RCX: ffff88814456a880 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90000ee7958 R08: ffffffff816c0715 R09: ffffed103ee071fb R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001 R13: 0000000800000000 R14: ffff8881f713c428 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb99966363f CR3: 0000000006e0f000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1166 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:1334 [inline] text_poke_bp_batch+0x1e9/0x730 arch/x86/kernel/alternative.c:1534 text_poke_flush arch/x86/kernel/alternative.c:1725 [inline] text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1732 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146 __jump_label_update+0x36a/0x380 kernel/jump_label.c:455 jump_label_update+0x3af/0x450 kernel/jump_label.c:801 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177 static_key_enable+0x1a/0x30 kernel/jump_label.c:190 toggle_allocation_gate+0xbf/0x450 mm/kfence/core.c:804 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299 worker_thread+0xa60/0x1260 kernel/workqueue.c:2446 kthread+0x26d/0x300 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308