audit: type=1804 audit(1648009298.808:11): pid=9390 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir991930515/syzkaller.6wgefi/2/bus" dev="sda1" ino=13881 res=1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.2:9390] Modules linked in: irq event stamp: 3894039 hardirqs last enabled at (3894038): [] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (3894039): [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (25298): [] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (26665): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (26665): [] irq_exit+0x193/0x240 kernel/softirq.c:409 CPU: 0 PID: 9390 Comm: syz-executor.2 Not tainted 4.14.272-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888058a6e440 task.stack: ffff888058a70000 RIP: 0010:save_stack_address arch/x86/kernel/stacktrace.c:29 [inline] RIP: 0010:save_stack_address arch/x86/kernel/stacktrace.c:15 [inline] RIP: 0010:__save_stack_trace+0x83/0x160 arch/x86/kernel/stacktrace.c:46 RSP: 0018:ffff8880ba407908 EFLAGS: 00000283 ORIG_RAX: ffffffffffffff10 RAX: 000000000000000e RBX: ffffffff811db290 RCX: 000000000000000f RDX: ffff8880ba4079b8 RSI: ffff8880ba407808 RDI: ffffffff811db290 RBP: ffff8880ba407988 R08: 0000000000000001 R09: 0000000000000001 R10: ffff888058a76ee0 R11: 0000000000000001 R12: ffff8880ba4079a0 R13: 0000000000000000 R14: ffff88813fe74940 R15: 00000000000001c0 FS: 00007f4fa1728700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2de24000 CR3: 000000009f849000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc_node mm/slab.c:3682 [inline] __kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3696 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x96/0x510 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] ndisc_alloc_skb+0x134/0x310 net/ipv6/ndisc.c:402 ndisc_send_rs+0x2ec/0x630 net/ipv6/ndisc.c:661 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3769 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:unwind_next_frame+0xfa6/0x17d0 arch/x86/kernel/unwind_orc.c:474 RSP: 0018:ffff888058a76e30 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff10 RAX: 0000000000000001 RBX: 1ffff1100b14edcd RCX: ffffffff8a745a0e RDX: ffff888058a76f30 RSI: 0000000000000000 RDI: ffffffff8a745a10 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 R10: ffff888058a77d98 R11: 0000000000000001 R12: ffff888058a76f25 R13: ffff888058a76f28 R14: ffff888058a76f40 R15: ffff888058a76ef0 __save_stack_trace+0x90/0x160 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc_node mm/slab.c:3333 [inline] kmem_cache_alloc_node+0x133/0x410 mm/slab.c:3640 create_task_io_context+0x2a/0x3c0 block/blk-ioc.c:278 create_io_context block/blk.h:323 [inline] generic_make_request_checks+0x1350/0x19f0 block/blk-core.c:2127 generic_make_request+0x67/0x850 block/blk-core.c:2185 submit_bio+0x234/0x390 block/blk-core.c:2303 ext4_io_submit+0x16a/0x200 fs/ext4/page-io.c:356 ext4_writepages+0x14d4/0x32a0 fs/ext4/inode.c:2938 do_writepages+0xc3/0x240 mm/page-writeback.c:2361 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 __filemap_fdatawrite_range+0x236/0x310 mm/filemap.c:346 filemap_write_and_wait_range mm/filemap.c:581 [inline] filemap_write_and_wait_range+0x39/0xb0 mm/filemap.c:575 generic_file_read_iter+0xe68/0x21c0 mm/filemap.c:2243 ext4_file_read_iter+0x14b/0x330 fs/ext4/file.c:76 call_read_iter include/linux/fs.h:1774 [inline] generic_file_splice_read+0x3a7/0x5c0 fs/splice.c:307 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 do_splice_to+0xfb/0x140 fs/splice.c:880 splice_direct_to_actor+0x207/0x730 fs/splice.c:952 audit: type=1800 audit(1648009298.838:12): pid=9390 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.2" name="bus" dev="sda1" ino=13881 res=0 audit: type=1804 audit(1648009323.769:13): pid=9398 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.5" name="/root/syzkaller-testdir2587278909/syzkaller.NWAEuX/1/bus" dev="sda1" ino=13892 res=1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! do_splice_direct+0x164/0x210 fs/splice.c:1061 audit: type=1804 audit(1648009323.769:14): pid=9404 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor.5" name="/root/syzkaller-testdir2587278909/syzkaller.NWAEuX/1/bus" dev="sda1" ino=13892 res=1 do_sendfile+0x47f/0xb30 fs/read_write.c:1441 SYSC_sendfile64 fs/read_write.c:1502 [inline] SyS_sendfile64+0xff/0x110 fs/read_write.c:1488 audit: type=1800 audit(1648009323.769:15): pid=9404 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed" comm="syz-executor.5" name="bus" dev="sda1" ino=13892 res=0 audit: type=1800 audit(1648009323.779:16): pid=9398 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.5" name="bus" dev="sda1" ino=13892 res=0 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 RIP: 0033:0x7f4fa2db3049 RSP: 002b:00007f4fa1728168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f4fa2ec5f60 RCX: 00007f4fa2db3049 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 RBP: 00007f4fa2e0d08d R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ee00 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd7dc58f2f R14: 00007f4fa1728300 R15: 0000000000022000 Code: 00 00 48 8d 7d 90 e8 ed d4 05 00 8b 55 90 85 d2 75 2d eb 62 41 8b 04 24 41 3b 44 24 04 73 76 49 8b 54 24 08 8d 48 01 41 89 0c 24 <48> 89 1c c2 48 8d 7d 90 e8 f0 bc 05 00 8b 45 90 85 c0 74 37 48 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9412 Comm: syz-executor.5 Not tainted 4.14.272-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88805827e2c0 task.stack: ffff888058280000 RIP: 0010:__default_send_IPI_shortcut+0x5f/0xa0 arch/x86/kernel/apic/ipi.c:46 RSP: 0018:ffff8880ba507428 EFLAGS: 00000002 RAX: 00000000000400f6 RBX: 0000000000040000 RCX: 0000000000000000 RDX: 0000000000040400 RSI: 00000000000000f6 RDI: 0000000000040000 RBP: ffffffff88cc8000 R08: ffff88809876a000 R09: 1ffff110130ed480 R10: ffff8880b55c7c5f R11: ffff88805827e2c0 R12: ffff8880ac11b078 R13: ffffed10169b5c2b R14: ffff8880b4dae070 R15: dffffc0000000000 FS: 00007f6a786aa700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f62f0c56008 CR3: 00000000986fc000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_irq_work_raise+0xc4/0x150 arch/x86/kernel/irq_work.c:31 irq_work_queue kernel/irq_work.c:100 [inline] irq_work_queue+0x197/0x1e0 kernel/irq_work.c:87 perf_output_wakeup kernel/events/ring_buffer.c:26 [inline] perf_output_put_handle+0x270/0x410 kernel/events/ring_buffer.c:125 perf_output_end+0x11/0x90 kernel/events/ring_buffer.c:293 __perf_event_output kernel/events/core.c:6289 [inline] perf_event_output_forward+0x100/0x1f0 kernel/events/core.c:6300 __perf_event_overflow+0x113/0x310 kernel/events/core.c:7549 perf_swevent_hrtimer+0x220/0x350 kernel/events/core.c:8754 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x30b/0xc80 kernel/time/hrtimer.c:1287 hrtimer_interrupt+0x1e6/0x5e0 kernel/time/hrtimer.c:1321 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline] smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:lock_acquire+0x1ec/0x3f0 kernel/locking/lockdep.c:4001 RSP: 0018:ffff8880ba507ab8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e12f1 RBX: ffff88805827e2c0 RCX: 4ec9851831ca92b4 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286 RBP: ffffffff88f77d40 R08: 0000000000000000 R09: 0000000000022012 R10: ffff88805827eb70 R11: ffff88805827e2c0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:242 [inline] rcu_read_lock include/linux/rcupdate.h:629 [inline] dev_gro_receive+0x74f/0x16d0 net/core/dev.c:4811 napi_gro_receive+0xc3/0x400 net/core/dev.c:4978 receive_buf+0x9f2/0x4d70 drivers/net/virtio_net.c:856 virtnet_receive drivers/net/virtio_net.c:1102 [inline] virtnet_poll+0x4b7/0x960 drivers/net/virtio_net.c:1193 napi_poll net/core/dev.c:5604 [inline] net_rx_action+0x466/0xfd0 net/core/dev.c:5670 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] do_IRQ+0x112/0x1d0 arch/x86/kernel/irq.c:242 common_interrupt+0x93/0x93 arch/x86/entry/entry_64.S:576 RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3614 RSP: 0018:ffff8880582878e0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffffad RAX: 1ffffffff11e12f3 RBX: dffffc0000000000 RCX: 1ffff1100b04fd6d RDX: 0000000000000000 RSI: ffff88805827eb48 RDI: ffff88805827eb44 RBP: ffffed100b04fc58 R08: ffff88823fff7058 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805827e2c0 R13: ffffffff88f09798 R14: 0000000000000000 R15: 0000000000000000 retint_kernel+0x1b/0x2d RIP: 0010:generic_file_read_iter+0x7d/0x21c0 mm/filemap.c:2231 RSP: 0018:ffff8880582879b0 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff10 RAX: 0000000000000000 RBX: 000000000000d000 RCX: ffffc90005fe6000 RDX: 1ffff1100b050f6b RSI: ffffffff8168f32f RDI: ffff888058287b38 RBP: ffff888058287b38 R08: dffffc0000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88805827e2c0 R12: ffff888058287ae8 R13: ffff888059c7083c R14: 0000000000000000 R15: ffff888058287b38 ext4_file_read_iter+0x14b/0x330 fs/ext4/file.c:76 call_read_iter include/linux/fs.h:1774 [inline] generic_file_splice_read+0x3a7/0x5c0 fs/splice.c:307 do_splice_to+0xfb/0x140 fs/splice.c:880 splice_direct_to_actor+0x207/0x730 fs/splice.c:952 do_splice_direct+0x164/0x210 fs/splice.c:1061 do_sendfile+0x47f/0xb30 fs/read_write.c:1441 SYSC_sendfile64 fs/read_write.c:1502 [inline] SyS_sendfile64+0xff/0x110 fs/read_write.c:1488 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f6a79d35049 RSP: 002b:00007f6a786aa168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f6a79e47f60 RCX: 00007f6a79d35049 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 RBP: 00007f6a79d8f08d R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000ee00 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd5cc6b6bf R14: 00007f6a786aa300 R15: 0000000000022000 Code: 00 84 c0 74 04 3c 03 7e 45 8b 04 25 00 c3 5f ff f6 c4 10 75 e6 09 da 89 f0 09 d0 80 ce 04 83 fe 02 0f 44 c2 89 04 25 00 c3 5f ff <48> 83 c4 08 5b 5d c3 48 c7 c7 00 c3 5f ff 89 54 24 04 89 34 24 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 48 8d 7d 90 lea -0x70(%rbp),%rdi 6: e8 ed d4 05 00 callq 0x5d4f8 b: 8b 55 90 mov -0x70(%rbp),%edx e: 85 d2 test %edx,%edx 10: 75 2d jne 0x3f 12: eb 62 jmp 0x76 14: 41 8b 04 24 mov (%r12),%eax 18: 41 3b 44 24 04 cmp 0x4(%r12),%eax 1d: 73 76 jae 0x95 1f: 49 8b 54 24 08 mov 0x8(%r12),%rdx 24: 8d 48 01 lea 0x1(%rax),%ecx 27: 41 89 0c 24 mov %ecx,(%r12) * 2b: 48 89 1c c2 mov %rbx,(%rdx,%rax,8) <-- trapping instruction 2f: 48 8d 7d 90 lea -0x70(%rbp),%rdi 33: e8 f0 bc 05 00 callq 0x5bd28 38: 8b 45 90 mov -0x70(%rbp),%eax 3b: 85 c0 test %eax,%eax 3d: 74 37 je 0x76 3f: 48 rex.W