EXT4-fs (loop4): mount failed watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.4:9534] Modules linked in: irq event stamp: 4448975 hardirqs last enabled at (4448974): [] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (4448975): [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (73848): [] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (78123): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (78123): [] irq_exit+0x193/0x240 kernel/softirq.c:409 CPU: 0 PID: 9534 Comm: syz-executor.4 Not tainted 4.14.275-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88809f1d01c0 task.stack: ffff88805e190000 RIP: 0010:unwind_get_return_address arch/x86/kernel/unwind_orc.c:252 [inline] RIP: 0010:unwind_get_return_address+0x3e/0x90 arch/x86/kernel/unwind_orc.c:247 RSP: 0018:ffff8880ba407700 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff10 RAX: dffffc0000000000 RBX: ffff8880ba407728 RCX: 0000000000000000 RDX: ffff8880ba407770 RSI: ffff88805e197708 RDI: ffff8880ba407728 RBP: ffff8880ba407770 R08: 0000000000000000 R09: ffffffff8ae1a959 R10: 0000000000146b45 R11: 0000000000000001 R12: ffff8880ba4077b0 R13: 0000000000000000 R14: ffff8880a5d7a040 R15: 0000000000000180 FS: 00007f7da1905700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e6a44e62f7 CR3: 000000009a7f5000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __save_stack_trace+0xa0/0x160 arch/x86/kernel/stacktrace.c:45 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 kmem_cache_alloc+0x124/0x3c0 mm/slab.c:3552 dst_alloc+0xed/0x6d0 net/core/dst.c:107 __ip6_dst_alloc net/ipv6/route.c:357 [inline] ip6_dst_alloc+0x39/0x2d0 net/ipv6/route.c:370 icmp6_dst_alloc+0x155/0x580 net/ipv6/route.c:1768 ndisc_send_skb+0xace/0x1390 net/ipv6/ndisc.c:463 ndisc_send_rs+0x125/0x630 net/ipv6/ndisc.c:677 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3769 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:__sanitizer_cov_trace_pc+0x23/0x50 kernel/kcov.c:68 RSP: 0018:ffff88805e1977b8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: ffff88809f1d01c0 RBX: dffffc0000000000 RCX: ffff88805e1979d0 RDX: 0000000000000000 RSI: ffff88805e1979d0 RDI: ffffea0002592848 RBP: ffff88809fd75898 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: ffff88809f1d01c0 R12: ffffea0002592840 R13: ffffea0002592860 R14: 00007f7da2314000 R15: dead000000000100 PageAnon include/linux/page-flags.h:407 [inline] mm_counter include/linux/mm.h:1549 [inline] zap_pte_range mm/memory.c:1363 [inline] zap_pmd_range mm/memory.c:1466 [inline] zap_pud_range mm/memory.c:1495 [inline] zap_p4d_range mm/memory.c:1516 [inline] unmap_page_range+0xe91/0x1ce0 mm/memory.c:1537 unmap_single_vma+0x147/0x2b0 mm/memory.c:1582 unmap_vmas+0x9d/0x160 mm/memory.c:1612 exit_mmap+0x270/0x4d0 mm/mmap.c:3058 __mmput kernel/fork.c:931 [inline] mmput kernel/fork.c:952 [inline] mmput+0xfa/0x420 kernel/fork.c:947 exit_mm kernel/exit.c:548 [inline] do_exit+0x984/0x2850 kernel/exit.c:855 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f7da2f9157a RSP: 002b:00007f7da1904f88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: fffffffffffffff4 RBX: 0000000020000200 RCX: 00007f7da2f9157a RDX: 0000000020000000 RSI: 0000000020000140 RDI: 00007f7da1904fe0 RBP: 00007f7da1905020 R08: 00007f7da1905020 R09: 0000000020000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000 R13: 0000000020000140 R14: 00007f7da1904fe0 R15: 0000000020000300 Code: 48 89 fb 0f b6 04 02 84 c0 74 04 3c 03 7e 51 8b 03 85 c0 75 05 5b 31 c0 5d c3 48 8d 6b 48 48 b8 00 00 00 00 00 fc ff df 48 89 ea <48> c1 ea 03 80 3c 02 00 75 32 48 8b 7b 48 e8 cf a7 13 00 85 c0 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9565 Comm: syz-executor.2 Not tainted 4.14.275-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88805c7d8280 task.stack: ffff88805c040000 RIP: 0010:hlock_class kernel/locking/lockdep.c:148 [inline] RIP: 0010:mark_lock+0x4b/0x1050 kernel/locking/lockdep.c:3168 RSP: 0018:ffff8880ba507bc8 EFLAGS: 00000046 RAX: 0000000000004051 RBX: 0000000000000040 RCX: 0000000000000000 RDX: 1ffff1100b8fb17e RSI: ffff88805c7d8bd0 RDI: ffff88805c7d8280 RBP: ffff88805c7d8bd0 R08: 0000000000000001 R09: 00000000000c4051 R10: ffff88805c7d8bd0 R11: ffff88805c7d8280 R12: 0000000000000001 R13: ffff88805c7d8280 R14: ffff88805c7d8bf0 R15: 0000000000000000 FS: 00007f33454e2700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002025c000 CR3: 000000009ee92000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mark_irqflags kernel/locking/lockdep.c:3069 [inline] __lock_acquire+0xfb2/0x3f20 kernel/locking/lockdep.c:3448 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:152 __run_hrtimer kernel/time/hrtimer.c:1225 [inline] __hrtimer_run_queues+0x353/0xc80 kernel/time/hrtimer.c:1287 hrtimer_interrupt+0x1e6/0x5e0 kernel/time/hrtimer.c:1321 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline] smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:csd_lock_wait kernel/smp.c:108 [inline] RIP: 0010:smp_call_function_single+0x185/0x370 kernel/smp.c:302 RSP: 0018:ffff88805c047960 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: 0000000000000003 RBX: 1ffff1100b808f30 RCX: ffffc90007012000 RDX: 0000000000040000 RSI: ffffffff814c78df RDI: 0000000000000286 RBP: ffff88805c047a20 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 smp_call_function_many+0x60f/0x7a0 kernel/smp.c:434 smp_call_function kernel/smp.c:492 [inline] on_each_cpu+0x40/0x210 kernel/smp.c:602 text_poke_bp+0x90/0x110 arch/x86/kernel/alternative.c:796 __jump_label_transform+0x269/0x300 arch/x86/kernel/jump_label.c:102 arch_jump_label_transform+0x26/0x40 arch/x86/kernel/jump_label.c:110 __jump_label_update+0x113/0x170 kernel/jump_label.c:374 jump_label_update kernel/jump_label.c:741 [inline] jump_label_update+0x140/0x2d0 kernel/jump_label.c:720 static_key_slow_inc_cpuslocked+0x10e/0x170 kernel/jump_label.c:109 static_key_slow_inc+0x16/0x20 kernel/jump_label.c:124 perf_swevent_init+0x329/0x4b0 kernel/events/core.c:7989 perf_try_init_event+0x15b/0x1f0 kernel/events/core.c:9371 perf_init_event kernel/events/core.c:9409 [inline] perf_event_alloc.part.0+0xe2d/0x2640 kernel/events/core.c:9669 perf_event_alloc kernel/events/core.c:10022 [inline] SYSC_perf_event_open kernel/events/core.c:10126 [inline] SyS_perf_event_open+0x67f/0x24b0 kernel/events/core.c:10012 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f3346b6d049 RSP: 002b:00007f33454e2168 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f3346c7ff60 RCX: 00007f3346b6d049 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 000000002025c000 RBP: 00007f3346bc708d R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd871a25bf R14: 00007f33454e2300 R15: 0000000000022000 Code: 54 48 c1 ea 03 41 bc 01 00 00 00 55 41 d3 e4 48 89 f5 53 48 83 ec 18 0f b6 04 02 84 c0 74 08 3c 01 0f 8e d6 07 00 00 0f b7 45 20 <66> a9 ff 1f 74 7c 48 ba 00 00 00 00 00 fc ff df 4c 89 f1 48 c1 ---------------- Code disassembly (best guess): 0: 48 89 fb mov %rdi,%rbx 3: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax 7: 84 c0 test %al,%al 9: 74 04 je 0xf b: 3c 03 cmp $0x3,%al d: 7e 51 jle 0x60 f: 8b 03 mov (%rbx),%eax 11: 85 c0 test %eax,%eax 13: 75 05 jne 0x1a 15: 5b pop %rbx 16: 31 c0 xor %eax,%eax 18: 5d pop %rbp 19: c3 retq 1a: 48 8d 6b 48 lea 0x48(%rbx),%rbp 1e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 25: fc ff df 28: 48 89 ea mov %rbp,%rdx * 2b: 48 c1 ea 03 shr $0x3,%rdx <-- trapping instruction 2f: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 33: 75 32 jne 0x67 35: 48 8b 7b 48 mov 0x48(%rbx),%rdi 39: e8 cf a7 13 00 callq 0x13a80d 3e: 85 c0 test %eax,%eax