watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.0:13877] Modules linked in: irq event stamp: 3338083 hardirqs last enabled at (3338082): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (3338083): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (0): [] copy_process.part.0+0x15b9/0x8260 kernel/fork.c:1856 softirqs last disabled at (953): [] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (953): [] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 0 PID: 13877 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:lock_release+0x429/0x8b0 kernel/locking/lockdep.c:3930 Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 95 03 00 00 48 83 3d 7b 34 a6 08 00 0f 84 cc 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00 RSP: 0018:ffff8880ba007c38 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e3051 RBX: ffff88804e488000 RCX: 1ffff11009c91120 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000286 RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff11017400f8a R13: ff4efeb9a64d4256 R14: ffff88804e488000 R15: 0000000000000004 FS: 00007f6cfdb42700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556e82ad3a40 CR3: 00000000914b1000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline] _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:176 spin_unlock include/linux/spinlock.h:369 [inline] mrp_join_timer+0x7b/0xc0 net/802/mrp.c:609 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x50 kernel/kcov.c:107 Code: 59 9f 7e 81 e2 00 01 1f 00 75 2b 8b 90 60 13 00 00 83 fa 02 75 20 48 8b 88 68 13 00 00 8b 80 64 13 00 00 48 8b 11 48 83 c2 01 <48> 39 d0 76 07 48 89 34 d1 48 89 11 c3 0f 1f 84 00 00 00 00 00 49 RSP: 0018:ffff8880433a78a8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000040000 RBX: 000000006543a025 RCX: ffffc90005c04000 RDX: 00000000000022e1 RSI: ffffffff819b61b5 RDI: 0000000000000006 RBP: 0000000000000025 R08: 0000000000000001 R09: 0000000000000025 R10: 0000000000000006 R11: 0000000000000000 R12: 0000000000000025 R13: ffffffffffffffff R14: dffffc0000000000 R15: 0000000000000000 __pte arch/x86/include/asm/paravirt.h:374 [inline] pfn_pte arch/x86/include/asm/pgtable.h:555 [inline] __split_huge_pmd_locked mm/huge_memory.c:2234 [inline] __split_huge_pmd+0x2845/0x45b0 mm/huge_memory.c:2342 split_huge_pmd_address+0x207/0x280 mm/huge_memory.c:2386 vma_adjust_trans_huge+0x262/0x2f0 mm/huge_memory.c:2412 __vma_adjust+0x16f/0x17f0 mm/mmap.c:784 vma_adjust include/linux/mm.h:2256 [inline] __split_vma+0x2bd/0x560 mm/mmap.c:2653 do_munmap+0x2f0/0xde0 mm/mmap.c:2733 mmap_region+0x2a3/0x16b0 mm/mmap.c:1700 do_mmap+0x8e8/0x1080 mm/mmap.c:1530 do_mmap_pgoff include/linux/mm.h:2329 [inline] do_shmat+0xd85/0xff0 ipc/shm.c:1535 __do_sys_shmat ipc/shm.c:1570 [inline] __se_sys_shmat ipc/shm.c:1565 [inline] __x64_sys_shmat+0xcc/0x160 ipc/shm.c:1565 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f6cff1cd109 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6cfdb42168 EFLAGS: 00000246 ORIG_RAX: 000000000000001e RAX: ffffffffffffffda RBX: 00007f6cff2dff60 RCX: 00007f6cff1cd109 RDX: 0000000000007000 RSI: 000000002000d000 RDI: 00000000000c8018 RBP: 00007f6cff22705d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe3b253a8f R14: 00007f6cfdb42300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 13920 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 RIP: 0010:rcu_lockdep_current_cpu_online+0x27/0x1b0 kernel/rcu/tree.c:1069 Code: cd 66 90 65 8b 05 d9 a0 b0 7e a9 00 00 10 00 75 0a 8b 05 b0 a1 d5 09 85 c0 75 06 b8 01 00 00 00 c3 41 55 bf 01 00 00 00 41 54 <55> 53 48 83 ec 08 e8 7e 2f f0 ff 48 8b 05 f7 4d a7 08 4c 8d a0 f8 RSP: 0018:ffff8880ba107480 EFLAGS: 00000002 RAX: 0000000000000001 RBX: ffffffff8a45f160 RCX: ffffffff81518c83 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff888042344680 R08: 0000000000000000 R09: ffffed101742455a R10: ffff8880ba122ad3 R11: ffffffff8c66505b R12: 0000000000010101 R13: ffff8880491824d8 R14: ffff8880ba124d40 R15: dffffc0000000000 FS: 00007f5006664700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f886b65a000 CR3: 00000000b5371000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_read_lock_sched_held+0xd3/0x1d0 kernel/rcu/update.c:115 trace_hrtimer_expire_entry include/trace/events/timer.h:228 [inline] __run_hrtimer kernel/time/hrtimer.c:1464 [inline] __hrtimer_run_queues+0xc67/0xe60 kernel/time/hrtimer.c:1527 hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1585 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline] smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:unwind_next_frame+0x7c7/0x1400 arch/x86/kernel/unwind_orc.c:492 Code: f7 0f 85 59 09 00 00 83 e0 07 38 c2 40 0f 9e c6 84 d2 0f 95 c0 40 84 c6 0f 85 42 09 00 00 49 0f bf 07 48 01 c8 48 89 44 24 68 a8 fe ff ff 49 8d 7e 40 48 b8 00 00 00 00 00 fc ff df 48 89 fa RSP: 0018:ffff8880ba107760 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: ffff8880ba107ff8 RBX: 1ffff11017420ef5 RCX: ffff8880ba107fc8 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 RBP: 0000000000000002 R08: ffffffff8c11ce90 R09: ffffffff8c11ce8c R10: ffff8880ba1078ef R11: 0000000000074071 R12: ffff8880ba1078d8 R13: ffff8880ba1078c5 R14: ffff8880ba107890 R15: ffffffff8c11ce8c __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slab.c:3340 [inline] kmem_cache_alloc_node_trace+0x13c/0x3b0 mm/slab.c:3666 __do_kmalloc_node mm/slab.c:3688 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0xae/0x560 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:995 [inline] mrp_pdu_init net/802/mrp.c:316 [inline] mrp_pdu_append_vecattr_event+0x7d2/0x1050 net/802/mrp.c:415 mrp_attr_event+0x15d/0x220 net/802/mrp.c:510 mrp_mad_event net/802/mrp.c:590 [inline] mrp_join_timer+0x5a/0xc0 net/802/mrp.c:607 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:compound_head include/linux/page-flags.h:144 [inline] RIP: 0010:PageAnon include/linux/page-flags.h:418 [inline] RIP: 0010:zap_pte_range mm/memory.c:1340 [inline] RIP: 0010:zap_pmd_range mm/memory.c:1463 [inline] RIP: 0010:zap_pud_range mm/memory.c:1492 [inline] RIP: 0010:zap_p4d_range mm/memory.c:1513 [inline] RIP: 0010:unmap_page_range+0x1254/0x2c50 mm/memory.c:1534 Code: ed 48 89 41 18 0f 84 36 fe ff ff e8 36 e7 d6 ff 49 8d 6d 08 48 89 e8 48 c1 e8 03 42 80 3c 30 00 0f 85 df 16 00 00 49 8b 45 08 <31> ff 4d 89 ec 48 89 c3 48 89 84 24 c0 00 00 00 83 e3 01 48 89 de RSP: 0018:ffff888066087770 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dead000000000100 RBX: 0000000000000001 RCX: ffff8880660879b0 RDX: 0000000000000000 RSI: ffffffff818b9e3a RDI: ffff8880660879c8 RBP: ffffea0002753488 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 800000009d4d2007 R13: ffffea0002753480 R14: dffffc0000000000 R15: 00007f5007488000 unmap_single_vma+0x198/0x300 mm/memory.c:1579 unmap_vmas+0xa9/0x180 mm/memory.c:1609 exit_mmap+0x2b9/0x530 mm/mmap.c:3093 __mmput kernel/fork.c:1016 [inline] mmput+0x14e/0x4a0 kernel/fork.c:1037 exit_mm kernel/exit.c:549 [inline] do_exit+0xaec/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f5007cef109 Code: Bad RIP value. RSP: 002b:00007f5006664168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffef RBX: 00007f5007e01f60 RCX: 00007f5007cef109 RDX: 0000000020000040 RSI: 00000000000089f1 RDI: 0000000000000004 RBP: 00007f5007d4905d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffda892247f R14: 00007f5006664300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 84 08 test %cl,(%rax) 2: 00 00 add %al,(%rax) 4: 00 00 add %al,(%rax) 6: 00 00 add %al,(%rax) 8: 48 c1 e8 03 shr $0x3,%rax c: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) 10: 0f 85 95 03 00 00 jne 0x3ab 16: 48 83 3d 7b 34 a6 08 cmpq $0x0,0x8a6347b(%rip) # 0x8a63499 1d: 00 1e: 0f 84 cc 01 00 00 je 0x1f0 24: 48 8b 3c 24 mov (%rsp),%rdi 28: 57 push %rdi 29: 9d popfq * 2a: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) <-- trapping instruction 2f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 36: fc ff df 39: 49 rex.WB 3a: c7 .byte 0xc7 3b: 04 04 add $0x4,%al 3d: 00 00 add %al,(%rax)