UDF-fs: warning (device loop4): udf_load_vrs: No anchor found UDF-fs: Scanning with blocksize 512 failed watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.0:27471] Modules linked in: irq event stamp: 3624209 hardirqs last enabled at (3624208): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (3624209): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (28): [] read_pnet include/net/net_namespace.h:307 [inline] softirqs last enabled at (28): [] sock_net include/net/sock.h:2436 [inline] softirqs last enabled at (28): [] unix_create1+0x458/0x530 net/unix/af_unix.c:833 softirqs last disabled at (3281): [] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (3281): [] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 0 PID: 27471 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:skb_network_header include/linux/skbuff.h:2372 [inline] RIP: 0010:ip_hdr include/linux/ip.h:25 [inline] RIP: 0010:ip_finish_output2+0x333/0x15a0 net/ipv4/ip_output.c:222 Code: ac 11 00 00 48 8d bd c4 00 00 00 48 8b 9d d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 <83> e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 c0 10 00 00 0f b7 85 c4 RSP: 0018:ffff8880ba007838 EFLAGS: 00000a07 ORIG_RAX: ffffffffffffff13 RAX: ffff8880a8afeeec RBX: ffff888060aba1c0 RCX: ffffffff86d4367a RDX: 0000000000000000 RSI: ffffffff86d42ce6 RDI: ffff8880a8afeeec RBP: ffff8880a8afee28 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88805b250140 R13: ffff88809aa3d300 R14: 000000000000010c R15: ffff888066f9cd40 FS: 00007f222da42700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91443e0718 CR3: 00000000b29df000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ip_finish_output+0xae9/0x10b0 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_output+0x203/0x5f0 net/ipv4/ip_output.c:406 dst_output include/net/dst.h:455 [inline] ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125 __ip_queue_xmit+0x91e/0x1c10 net/ipv4/ip_output.c:507 __tcp_transmit_skb+0x1b9c/0x3400 net/ipv4/tcp_output.c:1148 tcp_transmit_skb net/ipv4/tcp_output.c:1164 [inline] tcp_write_wakeup+0x4f1/0x610 net/ipv4/tcp_output.c:3728 tcp_send_probe0+0x46/0x400 net/ipv4/tcp_output.c:3750 tcp_probe_timer net/ipv4/tcp_timer.c:380 [inline] tcp_write_timer_handler+0x8c2/0xa60 net/ipv4/tcp_timer.c:597 tcp_write_timer+0x103/0x1b0 net/ipv4/tcp_timer.c:613 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__raw_read_unlock_irq include/linux/rwlock_api_smp.h:244 [inline] RIP: 0010:_raw_read_unlock_irq+0x50/0x80 kernel/locking/spinlock.c:264 Code: c0 98 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 31 48 83 3d e1 2a d8 01 00 74 25 fb 66 0f 1f 44 00 00 01 00 00 00 e8 06 15 28 f9 65 8b 05 7f 87 e8 77 85 c0 74 02 5d RSP: 0018:ffff888066487558 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e3053 RBX: 0000000000000000 RCX: 1ffff11011e405c5 RDX: dffffc0000000000 RSI: ffff88808f202e08 RDI: ffff88808f202e04 RBP: ffffffff8ad91760 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888235faa608 R14: ffff888235faa5d0 R15: 0000000000008000 __snd_pcm_stream_unlock_mode sound/core/pcm_native.c:145 [inline] __snd_pcm_stream_unlock_mode sound/core/pcm_native.c:131 [inline] snd_pcm_stream_unlock_irq sound/core/pcm_native.c:202 [inline] snd_pcm_prepare+0x2a2/0x8e0 sound/core/pcm_native.c:1744 snd_pcm_kernel_ioctl+0x2f9/0x3c0 sound/core/pcm_native.c:3019 snd_pcm_oss_prepare+0x44/0x220 sound/core/oss/pcm_oss.c:1146 snd_pcm_oss_make_ready+0x161/0x1b0 sound/core/oss/pcm_oss.c:1174 snd_pcm_oss_set_trigger.isra.0+0x30f/0x6e0 sound/core/oss/pcm_oss.c:2071 snd_pcm_oss_poll+0x661/0xb10 sound/core/oss/pcm_oss.c:2852 vfs_poll include/linux/poll.h:90 [inline] do_select+0x8e1/0x1610 fs/select.c:507 core_sys_select+0x3ac/0x7e0 fs/select.c:650 do_pselect fs/select.c:731 [inline] __do_sys_pselect6 fs/select.c:772 [inline] __se_sys_pselect6+0x419/0x480 fs/select.c:757 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f22304edae9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f222da42188 EFLAGS: 00000246 ORIG_RAX: 000000000000010e RAX: ffffffffffffffda RBX: 00007f2230601020 RCX: 00007f22304edae9 RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000040 RBP: 00007f2230547f6d R08: 0000000020000200 R09: 0000000000000000 R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe463674ff R14: 00007f222da42300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 27461 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:trace_hardirqs_on+0x0/0x210 kernel/trace/trace_preemptirq.c:22 Code: 00 00 c7 43 08 00 00 00 00 48 8b 44 24 78 65 48 2b 04 25 28 00 00 00 75 0b 48 83 ec 80 5b 5d 41 5c 41 5d c3 e8 c1 fc cf ff 90 <41> 56 41 55 41 54 55 53 e8 23 dc fa ff 65 8b 1d dc c2 9a 7e 31 ff RSP: 0018:ffff8880ba107830 EFLAGS: 00000006 RAX: ffff88805fea6540 RBX: ffff8880a58bbb40 RCX: ffffffff86d43317 RDX: 0000000000000100 RSI: ffffffff86d439b7 RDI: 0000000000000007 RBP: ffff88809f501368 R08: ffffffff8cd32098 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000206 R13: 0000000000000200 R14: ffff8880a58bbcd8 R15: dffffc0000000000 FS: 00007f0ca825a700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31d2a000 CR3: 000000005fe3b000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline] read_seqcount_begin include/linux/seqlock.h:164 [inline] read_seqbegin include/linux/seqlock.h:440 [inline] neigh_hh_output include/net/neighbour.h:461 [inline] neigh_output include/net/neighbour.h:499 [inline] ip_finish_output2+0xfbc/0x15a0 net/ipv4/ip_output.c:230 ip_finish_output+0xae9/0x10b0 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_output+0x203/0x5f0 net/ipv4/ip_output.c:406 dst_output include/net/dst.h:455 [inline] ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125 __ip_queue_xmit+0x91e/0x1c10 net/ipv4/ip_output.c:507 __tcp_transmit_skb+0x1b9c/0x3400 net/ipv4/tcp_output.c:1148 tcp_transmit_skb net/ipv4/tcp_output.c:1164 [inline] tcp_write_wakeup+0x4f1/0x610 net/ipv4/tcp_output.c:3728 tcp_send_probe0+0x46/0x400 net/ipv4/tcp_output.c:3750 tcp_probe_timer net/ipv4/tcp_timer.c:380 [inline] tcp_write_timer_handler+0x8c2/0xa60 net/ipv4/tcp_timer.c:597 tcp_write_timer+0x103/0x1b0 net/ipv4/tcp_timer.c:613 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:write_comp_data+0x23/0x70 kernel/kcov.c:122 Code: 1f 84 00 00 00 00 00 49 89 f1 49 89 fa 65 48 8b 34 25 c0 df 01 00 65 8b 05 7a 59 9f 7e a9 00 01 1f 00 75 4f 8b 86 60 13 00 00 <83> f8 03 75 44 48 8b 86 68 13 00 00 8b b6 64 13 00 00 48 8b 38 48 RSP: 0018:ffff8880b41f6ed0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000002 RBX: ffff8880b41f6f40 RCX: ffffffff864b15a0 RDX: 0000000000001f40 RSI: ffff88805fea6540 RDI: 0000000000000005 RBP: ffff888099116ec0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000007810df5 R12: ffff888099116ea8 R13: 0000000000001f40 R14: 00000000000f4240 R15: 0000000000000fa0 snd_interval_mulkdiv+0x220/0x550 sound/core/pcm_lib.c:762 snd_pcm_hw_rule_mulkdiv+0x106/0x1c0 sound/core/pcm_native.c:2104 constrain_params_by_rules+0x497/0x10b0 sound/core/pcm_native.c:431 snd_pcm_hw_refine sound/core/pcm_native.c:537 [inline] snd_pcm_hw_refine+0xb9b/0xed0 sound/core/pcm_native.c:515 snd_pcm_hw_param_first+0x276/0x690 sound/core/pcm_lib.c:1634 snd_pcm_hw_param_near.constprop.0+0x6d6/0x810 sound/core/oss/pcm_oss.c:457 snd_pcm_oss_change_params_locked+0x1819/0x39d0 sound/core/oss/pcm_oss.c:954 snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1108 [inline] snd_pcm_oss_make_ready+0xe7/0x1b0 sound/core/oss/pcm_oss.c:1167 snd_pcm_oss_set_trigger.isra.0+0x30f/0x6e0 sound/core/oss/pcm_oss.c:2071 snd_pcm_oss_poll+0x661/0xb10 sound/core/oss/pcm_oss.c:2852 vfs_poll include/linux/poll.h:90 [inline] do_select+0x8e1/0x1610 fs/select.c:507 core_sys_select+0x3ac/0x7e0 fs/select.c:650 do_pselect fs/select.c:731 [inline] __do_sys_pselect6 fs/select.c:772 [inline] __se_sys_pselect6+0x419/0x480 fs/select.c:757 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f0caace4ae9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0ca825a188 EFLAGS: 00000246 ORIG_RAX: 000000000000010e RAX: ffffffffffffffda RBX: 00007f0caadf7f60 RCX: 00007f0caace4ae9 RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000040 RBP: 00007f0caad3ef6d R08: 0000000020000200 R09: 0000000000000000 R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe8d8048bf R14: 00007f0ca825a300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: ac lods %ds:(%rsi),%al 1: 11 00 adc %eax,(%rax) 3: 00 48 8d add %cl,-0x73(%rax) 6: bd c4 00 00 00 mov $0xc4,%ebp b: 48 8b 9d d0 00 00 00 mov 0xd0(%rbp),%rbx 12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 19: fc ff df 1c: 48 89 fa mov %rdi,%rdx 1f: 48 c1 ea 03 shr $0x3,%rdx 23: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx 27: 48 89 f8 mov %rdi,%rax * 2a: 83 e0 07 and $0x7,%eax <-- trapping instruction 2d: 83 c0 01 add $0x1,%eax 30: 38 d0 cmp %dl,%al 32: 7c 08 jl 0x3c 34: 84 d2 test %dl,%dl 36: 0f 85 c0 10 00 00 jne 0x10fc 3c: 0f .byte 0xf 3d: b7 85 mov $0x85,%bh 3f: c4 .byte 0xc4