RBP: 00007f1ff4105f80 R08: 00007ffd009330b0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1ff4105f8c
R13: 0000000000000000 R14: 00007ffd00823b80 R15: 00007ffd00823c68
 </TASK>
watchdog: BUG: soft lockup - CPU#1 stuck for 241s! [syz.3.130:1319]
Modules linked in:
CPU: 1 PID: 1319 Comm: syz.3.130 Not tainted 6.1.90-syzkaller-00004-g79436849ef1d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:filter_irq_stacks+0x0/0xa0 kernel/stacktrace.c:393
Code: f9 80 e1 07 80 c1 03 38 c1 0f 8c 61 ff ff ff 4c 89 ff e8 c3 ef 56 00 e9 54 ff ff ff e8 09 2f b3 03 66 0f 1f 84 00 00 00 00 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 85 f6 74 72 49 89 fe 41 89
RSP: 0018:ffffc900001b0058 EFLAGS: 00000286
RAX: c770d3237dd4a200 RBX: 0000000000000000 RCX: 0000000000000800
RDX: 0000000000000000 RSI: 000000000000001e RDI: ffffc900001b00d0
RBP: ffffc900001b00c0 R08: 0000000000000000 R09: 000000000000001d
R10: ffffc900001b0030 R11: dffffc0000000001 R12: ffff888143b9b7d8
R13: 0000000000000000 R14: 0000000000000800 R15: ffffc900001b00d0
FS:  00007f1ff4d4b6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3131dff8 CR3: 0000000143bea000 CR4: 00000000003506a0
DR0: 0000000020000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 kasan_save_stack+0x4d/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb4/0xc0 mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496
 __call_rcu_common kernel/rcu/tree.c:2806 [inline]
 call_rcu+0xee/0x1340 kernel/rcu/tree.c:2925
 call_rcu_hurry include/linux/rcupdate.h:117 [inline]
 dst_release+0x9b/0xe0 net/core/dst.c:177
 refdst_drop include/net/dst.h:256 [inline]
 skb_dst_drop include/net/dst.h:268 [inline]
 __dev_queue_xmit+0xa42/0x36e0 net/core/dev.c:4255
 dev_queue_xmit include/linux/netdevice.h:3076 [inline]
 neigh_hh_output include/net/neighbour.h:536 [inline]
 neigh_output include/net/neighbour.h:550 [inline]
 ip6_finish_output2+0x11f1/0x1840 net/ipv6/ip6_output.c:134
 __ip6_finish_output net/ipv6/ip6_output.c:201 [inline]
 ip6_finish_output+0x50f/0xa60 net/ipv6/ip6_output.c:212
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x1f7/0x4d0 net/ipv6/ip6_output.c:233
 dst_output include/net/dst.h:444 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x7cf/0xdc0 net/ipv6/ndisc.c:509
 ndisc_send_rs+0x47d/0x5f0 net/ipv6/ndisc.c:719
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3984
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1510
 expire_timers kernel/time/timer.c:1555 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1826
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1839
 __do_softirq+0x1d8/0x661 kernel/softirq.c:617
 invoke_softirq kernel/softirq.c:472 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:712
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:finish_task_switch+0x16f/0x7b0 kernel/sched/core.c:5295
Code: 74 08 4c 89 ff e8 11 5c 6c 00 49 8b 1f 48 85 db 4c 8b 6d c0 0f 85 ce 00 00 00 4c 89 e7 e8 39 ff ce 03 fb 49 8d 9d 48 0b 00 00 <48> 89 d8 48 c1 e8 03 49 be 00 00 00 00 00 fc ff df 42 0f b6 04 30
RSP: 0018:ffffc90000b07be0 EFLAGS: 00000282
RAX: 0000000080000001 RBX: ffff888114bbc808 RCX: 0000000000000002
RDX: 0000000040000002 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000b07c30 R08: ffffffff819b54a0 R09: fffffbfff0ee5117
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f7137c80
R13: ffff888114bbbcc0 R14: 1ffff1103ee270fc R15: ffff8881f71387e0
 context_switch kernel/sched/core.c:5421 [inline]
 __schedule+0xcaf/0x1550 kernel/sched/core.c:6744
 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:7056
 raw_irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:396
 irqentry_exit+0x30/0x40 kernel/entry/common.c:439
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:__syscall_enter_from_user_work kernel/entry/common.c:97 [inline]
RIP: 0010:syscall_enter_from_user_mode+0x19/0x190 kernel/entry/common.c:118
Code: cc 55 48 89 e5 5d c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 49 89 f4 fb 65 4c 8b 3d b7 6d e9 7a <49> 8b 5f 08 f6 c3 3f 0f 84 b0 00 00 00 49 89 fe f6 c3 20 74 17 4c
RSP: 0018:ffffc90000b07ef8 EFLAGS: 00000286
RAX: 0000000000000000 RBX: ffffc90000b07f30 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 00000000000000ca RDI: ffffc90000b07f58
RBP: ffffc90000b07f20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000000ca
R13: 0000000000000000 R14: ffffc90000b07f58 R15: ffff888114bbbcc0
 do_syscall_64+0x1e/0xb0 arch/x86/entry/common.c:77
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1ff3f779f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1ff4d4b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007f1ff4105f88 RCX: 00007f1ff3f779f9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1ff4105f8c
RBP: 00007f1ff4105f80 R08: 00007ffd009330b0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1ff4105f8c
R13: 0000000000000000 R14: 00007ffd00823b80 R15: 00007ffd00823c68
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1064 Comm: syz.0.104 Not tainted 6.1.90-syzkaller-00004-g79436849ef1d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:230 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:147 [inline]
RIP: 0010:wrmsr arch/x86/include/asm/msr.h:254 [inline]
RIP: 0010:native_apic_msr_write+0x39/0x50 arch/x86/include/asm/apic.h:206
Code: 74 05 83 ff 30 75 12 5d c3 81 ff d0 00 00 00 74 f6 81 ff e0 00 00 00 74 ee c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 eb d9 89 f6 31 d2 e8 0a d1 6a 01 5d c3 0f 1f 84 00 00 00 00
RSP: 0018:ffffc90000007028 EFLAGS: 00000046
RAX: 0000000000000083 RBX: ffffffff86541a40 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 0000000000000083 RDI: 0000000000000838
RBP: ffffc90000007028 R08: ffffffff816a14fb R09: ffffffff816a13ed
R10: 0000000000000002 R11: ffff88811bdb9440 R12: 0000000000000020
R13: dffffc0000000000 R14: 0000000000000083 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562f635cf990 CR3: 000000010ed27000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:394 [inline]
 lapic_next_event+0x5f/0x70 arch/x86/kernel/apic/apic.c:478
 clockevents_program_event+0x1c1/0x300 kernel/time/clockevents.c:334
 tick_program_event+0x9f/0x120 kernel/time/tick-oneshot.c:44
 hrtimer_interrupt+0x625/0xaa0 kernel/time/hrtimer.c:1824
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x44/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:unwind_next_frame+0x3bc/0x700 arch/x86/kernel/unwind_frame.c:315
Code: 98 74 0b 48 8b 7d d0 e8 62 03 00 00 eb 1c 48 8b 5d d0 48 89 d8 48 c1 e8 03 80 3c 10 00 74 08 48 89 df e8 47 ec 84 00 48 8b 03 <4c> 89 f7 48 89 45 d0 48 89 c6 e8 45 03 00 00 89 c1 b0 01 84 c9 0f
RSP: 0018:ffffc900000072f8 EFLAGS: 00000246
RAX: ffffc90000cf7af8 RBX: ffffc90000cf7970 RCX: ffffffff877a1000
RDX: dffffc0000000000 RSI: ffffffff814576b5 RDI: ffffc90000cf7f48
RBP: ffffc90000007370 R08: ffffc90000007468 R09: 0000000000000023
R10: ffffc90000007470 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffc900000073d0 R14: ffffc90000007380 R15: 1ffff92000000e70
 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:379 [inline]
 __kasan_kmalloc+0x9c/0xb0 mm/kasan/common.c:388
 kasan_kmalloc include/linux/kasan.h:212 [inline]
 kmalloc_trace+0x44/0xa0 mm/slab_common.c:1052
 kmalloc include/linux/slab.h:556 [inline]
 kzalloc include/linux/slab.h:692 [inline]
 ref_tracker_alloc+0x138/0x450 lib/ref_tracker.c:85
 __netdev_tracker_alloc include/linux/netdevice.h:4063 [inline]
 netdev_hold include/linux/netdevice.h:4092 [inline]
 dst_init+0xe1/0x400 net/core/dst.c:52
 dst_alloc+0x18a/0x1e0 net/core/dst.c:96
 ip6_dst_alloc net/ipv6/route.c:345 [inline]
 icmp6_dst_alloc+0xf8/0x510 net/ipv6/route.c:3266
 ndisc_send_skb+0x28b/0xdc0 net/ipv6/ndisc.c:489
 ndisc_send_rs+0x47d/0x5f0 net/ipv6/ndisc.c:719
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3984
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1510
 expire_timers kernel/time/timer.c:1555 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1826
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1839
 __do_softirq+0x1d8/0x661 kernel/softirq.c:617
 invoke_softirq kernel/softirq.c:472 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:712
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:finish_task_switch+0x16f/0x7b0 kernel/sched/core.c:5295
Code: 74 08 4c 89 ff e8 11 5c 6c 00 49 8b 1f 48 85 db 4c 8b 6d c0 0f 85 ce 00 00 00 4c 89 e7 e8 39 ff ce 03 fb 49 8d 9d 48 0b 00 00 <48> 89 d8 48 c1 e8 03 49 be 00 00 00 00 00 fc ff df 42 0f b6 04 30
RSP: 0018:ffffc90000cf7220 EFLAGS: 00000282
RAX: 0000000080000001 RBX: ffff88811bdb9f88 RCX: 0000000000000002
RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000cf7270 R08: ffffffff819b54a0 R09: fffffbfff0ee5117
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f7037c80
R13: ffff88811bdb9440 R14: 1ffff1103ee070fc R15: ffff8881f70387e0
 context_switch kernel/sched/core.c:5421 [inline]
 __schedule+0xcaf/0x1550 kernel/sched/core.c:6744
 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:7056
 raw_irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:396
 irqentry_exit+0x30/0x40 kernel/entry/common.c:439
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:section_to_usemap include/linux/mmzone.h:1809 [inline]
RIP: 0010:get_pageblock_bitmap mm/page_alloc.c:523 [inline]
RIP: 0010:__get_pfnblock_flags_mask mm/page_alloc.c:572 [inline]
RIP: 0010:get_pfnblock_migratetype mm/page_alloc.c:620 [inline]
RIP: 0010:free_unref_page_prepare+0x6df/0x850 mm/page_alloc.c:3501
Code: 48 85 db 74 13 4c 89 f0 48 c1 e8 0f 83 e0 7f 48 c1 e0 05 48 01 c3 eb 02 31 db 48 83 c3 08 48 89 d8 48 c1 e8 03 42 80 3c 20 00 <74> 08 48 89 df e8 97 31 05 00 48 8b 03 4c 89 f3 48 c1 eb 08 49 c1
RSP: 0018:ffffc90000cf7538 EFLAGS: 00000246
RAX: 1ffff11047ffea91 RBX: ffff88823fff5488 RCX: 0000000000000000
RDX: 0000000000000200 RSI: 00000000000000ff RDI: ffffed1024ae5400
RBP: ffffc90000cf75b0 R08: dffffc0000000000 R09: ffffed1024ae5200
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffea000495ca40 R14: 0000000000125729 R15: 0000000000000000
 free_unref_page+0xb2/0x5c0 mm/page_alloc.c:3594
 free_the_page mm/page_alloc.c:798 [inline]
 __free_pages+0x61/0xf0 mm/page_alloc.c:5803
 __vunmap+0x9f3/0xb60 mm/vmalloc.c:2728
 __vfree mm/vmalloc.c:2776 [inline]
 vfree+0x5c/0x80 mm/vmalloc.c:2807
 kcov_put kernel/kcov.c:428 [inline]
 kcov_close+0x2b/0x50 kernel/kcov.c:524
 __fput+0x3ab/0x870 fs/file_table.c:320
 ____fput+0x15/0x20 fs/file_table.c:348
 task_work_run+0x24d/0x2e0 kernel/task_work.c:179
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0xbd5/0x2b80 kernel/exit.c:875
 do_group_exit+0x21a/0x2d0 kernel/exit.c:1025
 get_signal+0x169d/0x1820 kernel/signal.c:2880
 arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:316
 irqentry_exit+0x12/0x40 kernel/entry/common.c:419
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0033:0x7f6e7cd779f9
Code: Unable to access opcode bytes at 0x7f6e7cd779cf.
RSP: 002b:00007f6e7da89038 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f6e7cf06058 RCX: 00007f6e7cd779f9
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000005
RBP: 00007f6e7cde58ee R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6e7cf06058 R15: 00007ffdb1999a48
 </TASK>