watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [syz-executor.3:6031] Modules linked in: irq event stamp: 2967819 hardirqs last enabled at (2967818): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline] hardirqs last enabled at (2967818): [] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:94 hardirqs last disabled at (2967819): [] __el1_irq arch/arm64/kernel/entry-common.c:470 [inline] hardirqs last disabled at (2967819): [] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (2960028): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (2960295): [] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 CPU: 1 PID: 6031 Comm: syz-executor.3 Not tainted 6.4.0-rc5-syzkaller-gd8b213732169 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_add include/linux/list.h:72 [inline] pc : list_add_tail include/linux/list.h:102 [inline] pc : list_move_tail include/linux/list.h:230 [inline] pc : fq_pie_qdisc_dequeue+0x3dc/0x8ac net/sched/sch_fq_pie.c:248 lr : __list_add include/linux/list.h:72 [inline] lr : list_add_tail include/linux/list.h:102 [inline] lr : list_move_tail include/linux/list.h:230 [inline] lr : fq_pie_qdisc_dequeue+0x3d4/0x8ac net/sched/sch_fq_pie.c:248 sp : ffff800080017210 x29: ffff800080017280 x28: ffff000131e4d560 x27: ffff0000dd351ae8 x26: ffff0000dd351af0 x25: dfff800000000000 x24: ffff0000dd351ae0 x23: ffff000131e4d550 x22: 0000000000000040 x21: ffff0000dd351ae0 x20: ffff0000dd351ae8 x19: ffff0000dd351ae0 x18: ffff800080016e40 x17: 0000000000000000 x16: ffff80008050c16c x15: 0000000000000302 x14: 0000000000000100 x13: 0000000000000000 x12: 0000000000000001 x11: 0000000000000302 x10: 0000000000000100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff80008041c668 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0000dd351ae0 x1 : ffff0000dd351ae0 x0 : 0000000000000001 Call trace: __list_add include/linux/list.h:72 [inline] list_add_tail include/linux/list.h:102 [inline] list_move_tail include/linux/list.h:230 [inline] fq_pie_qdisc_dequeue+0x3dc/0x8ac net/sched/sch_fq_pie.c:248 dequeue_skb net/sched/sch_generic.c:292 [inline] qdisc_restart net/sched/sch_generic.c:397 [inline] __qdisc_run+0x1fc/0x231c net/sched/sch_generic.c:415 __dev_xmit_skb net/core/dev.c:3868 [inline] __dev_queue_xmit+0xc80/0x3318 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_connected_output+0x2f8/0x38c net/core/neighbour.c:1581 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0xd60/0x1a1c net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x538/0x8c8 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ndisc_send_skb+0xc30/0x1790 net/ipv6/ndisc.c:508 ndisc_send_rs+0x47c/0x5d4 net/ipv6/ndisc.c:718 addrconf_rs_timer+0x300/0x58c net/ipv6/addrconf.c:3936 call_timer_fn+0x19c/0x8cc kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x55c/0x734 kernel/time/timer.c:2022 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035 __do_softirq+0x2d0/0xd54 kernel/softirq.c:571 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:882 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:650 irq_exit_rcu+0x14/0x84 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:488 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:493 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:587 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:182 [inline] arch_local_irq_restore arch/arm64/include/asm/irqflags.h:202 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:1033 [inline] debug_check_no_obj_freed+0x50c/0x528 lib/debugobjects.c:1054 slab_free_hook mm/slub.c:1756 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3786 [inline] kmem_cache_free+0x288/0x56c mm/slub.c:3808 jbd2_free_handle include/linux/jbd2.h:1607 [inline] jbd2_journal_stop+0x780/0xc78 fs/jbd2/transaction.c:1964 __ext4_journal_stop+0xe4/0x190 fs/ext4/ext4_jbd2.c:133 ext4_dirty_inode+0xe4/0x104 fs/ext4/inode.c:5949 __mark_inode_dirty+0x2b0/0x10f4 fs/fs-writeback.c:2424 generic_update_time fs/inode.c:1859 [inline] inode_update_time fs/inode.c:1872 [inline] touch_atime+0x5d8/0x8d4 fs/inode.c:1944 file_accessed include/linux/fs.h:2198 [inline] iterate_dir+0x400/0x4e4 fs/readdir.c:70 __do_sys_getdents64 fs/readdir.c:369 [inline] __se_sys_getdents64 fs/readdir.c:354 [inline] __arm64_sys_getdents64+0x1c4/0x4a0 fs/readdir.c:354 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591