9pnet_virtio: no channels available for device syz watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.4:26796] Modules linked in: irq event stamp: 2827173 hardirqs last enabled at (2827172): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (2827173): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (48496): [] __do_softirq+0x678/0x980 kernel/softirq.c:318 softirqs last disabled at (50003): [] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (50003): [] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 1 PID: 26796 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:unwind_next_frame+0xb05/0x1400 arch/x86/kernel/unwind_orc.c:548 Code: 95 c0 40 84 c6 0f 85 13 07 00 00 48 89 c8 83 e0 07 38 c2 40 0f 9e c6 84 d2 0f 95 c0 40 84 c6 0f 85 f9 06 00 00 41 0f b6 47 04 e8 04 3c 01 0f 84 fc 03 00 00 3c 04 0f 84 78 04 00 00 84 c0 0f RSP: 0018:ffff8880ba1073f0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000015 RBX: 1ffff11017420e87 RCX: ffffffff8c0218c9 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880ba107578 RBP: 0000000000000001 R08: ffffffff8c0218c8 R09: ffffffff8c0218c4 R10: ffff8880ba10757f R11: 0000000000074071 R12: ffff88804cf0f9f8 R13: ffff8880ba107555 R14: ffff8880ba107520 R15: ffffffff8c0218c4 FS: 00007f572d58b700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fda1bfe6004 CR3: 0000000009e6d000 CR4: 00000000003426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc mm/slab.c:3397 [inline] kmem_cache_alloc+0x110/0x370 mm/slab.c:3557 kmem_cache_zalloc include/linux/slab.h:699 [inline] sctp_chunkify+0x4b/0x2e0 net/sctp/sm_make_chunk.c:1349 _sctp_make_chunk+0x149/0x260 net/sctp/sm_make_chunk.c:1422 sctp_make_control+0x30/0x2d0 net/sctp/sm_make_chunk.c:1458 sctp_make_heartbeat+0x8c/0x270 net/sctp/sm_make_chunk.c:1165 sctp_sf_heartbeat.constprop.0+0x21/0x170 net/sctp/sm_statefuns.c:1015 sctp_sf_sendbeat_8_3+0x36c/0x510 net/sctp/sm_statefuns.c:1059 sctp_do_sm+0x162/0x5110 net/sctp/sm_sideeffect.c:1167 sctp_generate_heartbeat_event+0x2af/0x490 net/sctp/sm_sideeffect.c:406 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:kmem_cache_free+0x11c/0x260 mm/slab.c:3766 Code: 11 48 63 75 74 48 89 df e8 51 21 df 01 e9 68 ff ff ff e8 a7 80 cf ff 48 83 3d e7 59 59 08 00 0f 84 f8 00 00 00 4c 89 e7 57 9d <0f> 1f 44 00 00 eb 86 65 8b 05 76 58 69 7e 83 f8 07 0f 87 e7 00 00 RSP: 0018:ffff88804cf0f798 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000007 RBX: ffff88809c523940 RCX: 1ffff11012eedd7f RDX: 0000000000000000 RSI: ffff88809776ebd8 RDI: 0000000000000286 RBP: ffff88823b33a540 R08: 0000000000400000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000286 R13: ffffffff866fedf1 R14: ffffffff86719184 R15: 0000000000000067 kfree_skbmem+0xc1/0x140 net/core/skbuff.c:595 __kfree_skb net/core/skbuff.c:655 [inline] kfree_skb+0x127/0x3d0 net/core/skbuff.c:672 skb_queue_purge+0x14/0x30 net/core/skbuff.c:2876 hci_chan_del+0x13c/0x1f0 net/bluetooth/hci_conn.c:1697 l2cap_conn_del+0x45e/0x6e0 net/bluetooth/l2cap_core.c:1743 l2cap_disconn_cfm net/bluetooth/l2cap_core.c:7445 [inline] l2cap_disconn_cfm+0x98/0xd0 net/bluetooth/l2cap_core.c:7438 hci_disconn_cfm include/net/bluetooth/hci_core.h:1263 [inline] hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1512 hci_dev_do_close+0x6bc/0x1020 net/bluetooth/hci_core.c:1687 hci_unregister_dev+0x14f/0x460 net/bluetooth/hci_core.c:3288 vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:354 __fput+0x2ce/0x890 fs/file_table.c:278 task_work_run+0x148/0x1c0 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xbf3/0x2be0 kernel/exit.c:870 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f5730015ae9 Code: Bad RIP value. RSP: 002b:00007f572d58b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f5730128f68 RCX: 00007f5730015ae9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5730128f68 RBP: 00007f5730128f60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5730128f6c R13: 00007ffe0193d7df R14: 00007f572d58b300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 28789 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__pvclock_read_cycles arch/x86/include/asm/pvclock.h:87 [inline] RIP: 0010:pvclock_clocksource_read+0x19a/0x520 arch/x86/kernel/pvclock.c:87 Code: 40 84 f6 0f 95 c1 40 84 cf 0f 85 41 02 00 00 89 d1 48 89 c6 f7 d9 48 d3 ee 89 d1 48 d3 e0 85 d2 8b 53 18 4c 89 d1 48 0f 48 c6 <4c> 89 fe 48 c1 e9 03 48 f7 e2 48 0f ac d0 20 4c 89 fa 83 e6 07 0f RSP: 0018:ffff8880ba007578 EFLAGS: 00000086 RAX: 0000009778694908 RBX: ffffffff8c665000 RCX: ffffffff8c665017 RDX: 00000000e8b48cac RSI: 0000009778694908 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffffffff8c665018 R09: ffffffff8c66500f R10: ffffffff8c665017 R11: ffffffff8c66501b R12: ffffffff8c665003 R13: fffffbfff18cca01 R14: ffffffff8c66501d R15: ffffffff8c665010 FS: 00007fef9c7ff700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055555666e848 CR3: 000000003c464000 CR4: 00000000003426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: kvm_clock_read arch/x86/kernel/kvmclock.c:94 [inline] kvm_sched_clock_read+0x14/0x40 arch/x86/kernel/kvmclock.c:106 paravirt_sched_clock arch/x86/include/asm/paravirt.h:175 [inline] sched_clock+0x2a/0x40 arch/x86/kernel/tsc.c:245 sched_clock_cpu+0x18/0x1b0 kernel/sched/clock.c:370 local_clock include/linux/sched/clock.h:84 [inline] cpu_clock_event_update kernel/events/core.c:9338 [inline] cpu_clock_event_read+0x16/0x50 kernel/events/core.c:9371 perf_swevent_hrtimer+0x128/0x3e0 kernel/events/core.c:9254 __run_hrtimer kernel/time/hrtimer.c:1465 [inline] __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1527 hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1585 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline] smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:435 [inline] RIP: 0010:__pv_queued_spin_lock_slowpath+0x3a6/0xae0 kernel/locking/qspinlock.c:474 Code: eb c6 45 01 01 41 bc 00 80 00 00 48 c1 e9 03 83 e3 07 41 be 01 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 2c 01 eb 0c f3 90 <41> 83 ec 01 0f 84 38 04 00 00 41 0f b6 45 00 38 d8 7f 08 84 c0 0f RSP: 0018:ffff8880ba007bc8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000003 RBX: 0000000000000000 RCX: 1ffff11013ae2939 RDX: 0000000000000001 RSI: ffffffff8167a995 RDI: 0000000000000286 RBP: ffff88809d7149c8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000004591 R13: ffffed1013ae2939 R14: 0000000000000001 R15: ffff8880ba02be00 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:679 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:53 [inline] queued_spin_lock include/asm-generic/qspinlock.h:88 [inline] do_raw_spin_lock+0x189/0x220 kernel/locking/spinlock_debug.c:113 spin_lock include/linux/spinlock.h:329 [inline] sctp_generate_heartbeat_event+0xa1/0x490 net/sctp/sm_sideeffect.c:386 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:check_kcov_mode kernel/kcov.c:67 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x14/0x50 kernel/kcov.c:101 Code: 35 00 e9 23 fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 8b 34 24 65 48 8b 04 25 c0 df 01 00 65 8b 15 cc 59 9f 7e <81> e2 00 01 1f 00 75 2b 8b 90 60 13 00 00 83 fa 02 75 20 48 8b 88 RSP: 0018:ffff88804662f8a8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: ffff888047bc0140 RBX: dffffc0000000000 RCX: ffffffff8191f09d RDX: 0000000080000000 RSI: ffffffff8191ee6d RDI: 0000000000000007 RBP: ffffea00016a6f80 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000000 R12: ffffea00016a6f80 R13: ffff888092381648 R14: 00000000000000c7 R15: 000000000000014e __read_once_size include/linux/compiler.h:263 [inline] compound_head include/linux/page-flags.h:142 [inline] PageSwapBacked include/linux/page-flags.h:295 [inline] PageSwapCache include/linux/page-flags.h:340 [inline] free_swap_cache mm/swap_state.c:291 [inline] free_pages_and_swap_cache+0x4d/0x3a0 mm/swap_state.c:319 tlb_flush_mmu_free mm/memory.c:261 [inline] tlb_flush_mmu+0x1dc/0x4f0 mm/memory.c:270 arch_tlb_finish_mmu mm/memory.c:285 [inline] tlb_finish_mmu+0x108/0x200 mm/memory.c:444 exit_mmap+0x2d9/0x530 mm/mmap.c:3095 __mmput kernel/fork.c:1016 [inline] mmput+0x14e/0x4a0 kernel/fork.c:1037 exit_mm kernel/exit.c:549 [inline] do_exit+0xaec/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fef9f289ae9 Code: Bad RIP value. RSP: 002b:00007fef9c7ff188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffe0 RBX: 00007fef9f39cf60 RCX: 00007fef9f289ae9 RDX: 0000000000000938 RSI: 00000000200016c0 RDI: 0000000000000004 RBP: 00007fef9f2e3f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd4c6a9b8f R14: 00007fef9c7ff300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 95 xchg %eax,%ebp 1: c0 40 84 c6 rolb $0xc6,-0x7c(%rax) 5: 0f 85 13 07 00 00 jne 0x71e b: 48 89 c8 mov %rcx,%rax e: 83 e0 07 and $0x7,%eax 11: 38 c2 cmp %al,%dl 13: 40 0f 9e c6 setle %sil 17: 84 d2 test %dl,%dl 19: 0f 95 c0 setne %al 1c: 40 84 c6 test %al,%sil 1f: 0f 85 f9 06 00 00 jne 0x71e 25: 41 0f b6 47 04 movzbl 0x4(%r15),%eax * 2a: c0 e8 04 shr $0x4,%al <-- trapping instruction 2d: 3c 01 cmp $0x1,%al 2f: 0f 84 fc 03 00 00 je 0x431 35: 3c 04 cmp $0x4,%al 37: 0f 84 78 04 00 00 je 0x4b5 3d: 84 c0 test %al,%al 3f: 0f .byte 0xf