watchdog: BUG: soft lockup - CPU#0 stuck for 115s! [syz.1.1549:4211] Modules linked in: CPU: 0 PID: 4211 Comm: syz.1.1549 Not tainted 6.1.115-syzkaller-00012-ge318dc4c06a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__raw_write_unlock_irq include/linux/rwlock_api_smp.h:274 [inline] RIP: 0010:_raw_write_unlock_irq+0x2a/0x60 kernel/locking/spinlock.c:358 Code: 55 48 89 e5 53 48 89 fb 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 23 c6 03 00 fb bf 01 00 00 00 01 e0 2d fc 65 8b 05 c2 af e0 7a 85 c0 74 03 5b 5d c3 e8 92 c9 RSP: 0018:ffffc9001118f968 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffff8700a040 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffffc9001118f970 R08: ffffffff814595bc R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000000000000 R13: 1ffff11022b67ad0 R14: ffff88811ec09400 R15: ffffc9001118fa20 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fffe9980d58 CR3: 000000012d885000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: exit_notify kernel/exit.c:762 [inline] do_exit+0x1b65/0x2b80 kernel/exit.c:897 do_group_exit+0x21a/0x2d0 kernel/exit.c:1027 get_signal+0x169d/0x1820 kernel/signal.c:2888 arch_do_signal_or_restart+0xb0/0x16f0 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x74/0xa0 kernel/entry/common.c:174 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:316 irqentry_exit+0x12/0x40 kernel/entry/common.c:419 sysvec_apic_timer_interrupt+0x64/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0033:0x7f78a6048ef8 Code: Unable to access opcode bytes at 0x7f78a6048ece. RSP: 002b:00007f78a6f9e080 EFLAGS: 00000203 RAX: 00007f78a6f9e668 RBX: 00007f78a6345fa0 RCX: 00007f78a6345fa0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200002c0 RBP: 00007f78a61f3cc8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f78a6345fa0 R15: 00007ffd56ea6198 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.115-syzkaller-00012-ge318dc4c06a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:skb_network_header include/linux/skbuff.h:2881 [inline] RIP: 0010:ipv6_hdr include/linux/ipv6.h:108 [inline] RIP: 0010:ip6_route_input+0x99/0xc50 net/ipv6/route.c:2566 Code: 1e f3 f3 f3 f3 48 89 44 24 58 66 42 c7 44 20 22 f3 f3 e8 da 27 fa fc 49 8d be e0 00 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 <74> 05 e8 b0 96 41 fd 4d 8b ae e0 00 00 00 49 8d be b8 00 00 00 48 RSP: 0018:ffffc900001b0060 EFLAGS: 00000246 RAX: 1ffff1102738730c RBX: 0000000000000000 RCX: ffff888100396540 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff888139c39860 RBP: ffffc900001b0238 R08: ffffffff8476fc35 R09: ffffffff8476fd3b R10: 0000000000000002 R11: ffff888100396540 R12: dffffc0000000000 R13: 1ffff110273872fb R14: ffff888139c39780 R15: ffff888139c39780 FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d4734dc0a8 CR3: 000000000700f000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: ip6_rcv_finish_core net/ipv6/ip6_input.c:66 [inline] ip6_rcv_finish+0x150/0x350 net/ipv6/ip6_input.c:77 NF_HOOK include/linux/netfilter.h:305 [inline] ipv6_rcv+0xeb/0x270 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5552 [inline] __netif_receive_skb+0x1c6/0x530 net/core/dev.c:5666 netif_receive_skb_internal net/core/dev.c:5752 [inline] netif_receive_skb+0xb0/0x480 net/core/dev.c:5811 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] br_pass_frame_up+0x223/0x480 net/bridge/br_input.c:70 br_handle_frame_finish+0x12a4/0x1660 nf_hook_bridge_pre net/bridge/br_input.c:282 [inline] br_handle_frame+0x984/0x1070 net/bridge/br_input.c:406 __netif_receive_skb_core+0x1264/0x43d0 net/core/dev.c:5446 __netif_receive_skb_one_core net/core/dev.c:5550 [inline] __netif_receive_skb+0x11c/0x530 net/core/dev.c:5666 process_backlog+0x32c/0x630 net/core/dev.c:5994 __napi_poll+0xbe/0x5c0 net/core/dev.c:6561 napi_poll net/core/dev.c:6628 [inline] net_rx_action+0x595/0xdd0 net/core/dev.c:6742 handle_softirqs+0x1db/0x650 kernel/softirq.c:617 __do_softirq kernel/softirq.c:655 [inline] invoke_softirq kernel/softirq.c:472 [inline] __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:704 irq_exit_rcu+0x9/0x10 kernel/softirq.c:716 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:csd_lock_wait kernel/smp.c:453 [inline] RIP: 0010:smp_call_function_many_cond+0x84f/0x930 kernel/smp.c:998 Code: 3e 44 89 fe 83 e6 01 31 ff e8 bd 9b 09 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 0a e8 f8 97 09 00 e9 2f ff ff ff f3 90 <42> 0f b6 04 3b 84 c0 75 14 41 f7 06 01 00 00 00 0f 84 12 ff ff ff RSP: 0018:ffffc900000a7840 EFLAGS: 00000293 RAX: ffffffff816beeda RBX: 1ffff1103edc7a99 RCX: ffff888100396540 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc900000a7958 R08: ffffffff816beea3 R09: ffffed103ede71fb R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000 R13: 0000000800000000 R14: ffff8881f6e3d4c8 R15: dffffc0000000000 on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1166 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:1334 [inline] text_poke_bp_batch+0x1e9/0x730 arch/x86/kernel/alternative.c:1534 text_poke_flush arch/x86/kernel/alternative.c:1725 [inline] text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1732 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146 __jump_label_update+0x36a/0x380 kernel/jump_label.c:451 jump_label_update+0x3af/0x450 kernel/jump_label.c:797 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:173 static_key_enable+0x1a/0x30 kernel/jump_label.c:186 toggle_allocation_gate+0xbf/0x450 mm/kfence/core.c:804 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299 worker_thread+0xa60/0x1260 kernel/workqueue.c:2446 kthread+0x26d/0x300 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 net_ratelimit: 42478 callbacks suppressed bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:26:e6:6b:a7:56:d7, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) net_ratelimit: 122462 callbacks suppressed bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:26:e6:6b:a7:56:d7, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:00:20:00:00:00:00, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)