watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz.2.592:4204]
Modules linked in:
CPU: 0 PID: 4204 Comm: syz.2.592 Tainted: G        W         5.10.225-syzkaller-00513-g8d23314f588a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:jhash2 include/linux/jhash.h:129 [inline]
RIP: 0010:hash_stack lib/stackdepot.c:181 [inline]
RIP: 0010:__stack_depot_save+0xf3/0x4d0 lib/stackdepot.c:297
Code: 44 31 db 45 01 d4 41 29 da 89 d8 c1 c0 06 44 31 d0 44 01 e3 89 c6 c1 c6 08 41 29 c4 44 31 e6 01 d8 29 f3 41 89 f3 41 c1 c3 10 <41> 31 db 01 c6 45 89 da 41 c1 c2 13 44 29 d8 41 31 c2 41 01 f3 44
RSP: 0000:ffffc90000006a08 EFLAGS: 00000282
RAX: 000000008c8cbc52 RBX: 00000000cc0f17a1 RCX: 0000000000000001
RDX: 0000000000000800 RSI: 000000007adaf383 RDI: ffffc90000006a70
RBP: ffffc90000006a60 R08: 000000000000002a R09: ffffc90000006aa0
R10: 00000000737dbd24 R11: 00000000f3837ada R12: 00000000d86bddc6
R13: 000000000000001b R14: 0000000000000800 R15: ffffffff84e005bb
FS:  00007f1523ee26c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1523ec0f98 CR3: 0000000110883000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 kasan_save_stack mm/kasan/common.c:39 [inline]
 kasan_set_track+0x5d/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x121/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1595 [inline]
 slab_free_freelist_hook+0xc0/0x190 mm/slub.c:1621
 slab_free mm/slub.c:3203 [inline]
 kmem_cache_free+0xa9/0x1e0 mm/slub.c:3219
 kfree_skbmem+0x104/0x170
 __kfree_skb net/core/skbuff.c:695 [inline]
 kfree_skb+0xc1/0x320 net/core/skbuff.c:713
 ip6gre_tunnel_xmit+0xcc3/0x1370 net/ipv6/ip6_gre.c:931
 __netdev_start_xmit include/linux/netdevice.h:4858 [inline]
 netdev_start_xmit include/linux/netdevice.h:4872 [inline]
 xmit_one net/core/dev.c:3607 [inline]
 dev_hard_start_xmit+0x228/0x620 net/core/dev.c:3623
 sch_direct_xmit+0x292/0x9b0 net/sched/sch_generic.c:336
 qdisc_restart net/sched/sch_generic.c:401 [inline]
 __qdisc_run+0xa85/0x1df0 net/sched/sch_generic.c:409
 qdisc_run+0x121/0x330 include/net/pkt_sched.h:127
 __dev_xmit_skb net/core/dev.c:3799 [inline]
 __dev_queue_xmit+0xcf0/0x28e0 net/core/dev.c:4155
 dev_queue_xmit+0x17/0x20 net/core/dev.c:4223
 neigh_resolve_output+0x6b8/0x760 net/core/neighbour.c:1509
 neigh_output include/net/neighbour.h:517 [inline]
 ip6_finish_output2+0xf21/0x1850 net/ipv6/ip6_output.c:145
 __ip6_finish_output+0x5ec/0x780 net/ipv6/ip6_output.c:216
 ip6_finish_output+0x34/0x1e0 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:288 [inline]
 ip6_output+0x1f7/0x4c0 net/ipv6/ip6_output.c:249
 dst_output include/net/dst.h:437 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ndisc_send_skb+0x6e9/0xc00 net/ipv6/ndisc.c:511
 ndisc_send_rs+0x532/0x6a0 net/ipv6/ndisc.c:705
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3964
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1789
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x268/0x5bb kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1094
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:preempt_count_add+0x63/0x1a0 kernel/sched/core.c:4462
Code: ff 5a b9 7e 65 01 1d f8 5a b9 7e 48 c7 c0 00 b9 08 87 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 f2 00 00 00 83 3d 4d a6 bf 05 00 <75> 11 65 8b 05 d0 5a b9 7e 0f b6 c0 3d f5 00 00 00 73 6e 65 8b 05
RSP: 0000:ffffc90001b47e80 EFLAGS: 00000246
RAX: 0000000000000004 RBX: 0000000000000001 RCX: ffffffff8708b903
RDX: 1ffffffff0e10800 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc90001b47e98 R08: ffffffff87084008 R09: ffffffff87084018
R10: ffffffff87084010 R11: ffffffff87084003 R12: dffffc0000000000
R13: ffff88810d522780 R14: ffff88810d522790 R15: dffffc0000000000
 schedule+0x136/0x1d0 kernel/sched/core.c:4881
 exit_to_user_mode_loop+0x48/0xd0 kernel/entry/common.c:160
 exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
 irqentry_exit_to_user_mode+0x4e/0x80 kernel/entry/common.c:287
 irqentry_exit+0x12/0x60 kernel/entry/common.c:375
 sysvec_apic_timer_interrupt+0xcb/0xe0 arch/x86/kernel/apic/apic.c:1094
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0033:0x7f1525268ef9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1523ee20e8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f1525420f88 RCX: 00007f1525268ef9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1525420f8c
RBP: 00007f1525420f80 R08: 00007ffcf21d30b0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1525420f8c
R13: 0000000000000000 R14: 00007ffcf21d0340 R15: 00007ffcf21d0428
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3719 Comm: syz.0.552 Tainted: G        W         5.10.225-syzkaller-00513-g8d23314f588a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:__irq_exit_rcu+0x8c/0x150 kernel/softirq.c:438
Code: 80 3c 08 00 74 08 48 89 df e8 80 8b 68 00 48 f7 03 08 00 00 00 75 13 65 8b 05 1c b2 c2 7e a9 00 00 0f 00 75 05 e8 04 db 1e 00 <5b> 41 5c 41 5e 41 5f 5d c3 48 c7 c7 a0 b4 07 85 e8 ef 3d 6d 03 65
RSP: 0018:ffffc90000170350 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff888126c013c0 RCX: 0000000000010102
RDX: 1ffffffff0e10808 RSI: ffffffff85602420 RDI: ffff8881f7156af0
RBP: ffffc90000170370 R08: ffffffff87084048 R09: ffffffff87084058
R10: ffffffff87084050 R11: ffffffff87084043 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b77823b5b0 CR3: 000000011c0b8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1094
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:get_stack_info_noinstr+0x2e/0x120 arch/x86/kernel/dumpstack_64.c:160
Code: 41 57 41 56 41 55 41 54 53 49 89 d7 48 89 f3 49 89 fd e8 05 01 00 00 41 b6 01 84 c0 0f 85 d8 00 00 00 65 48 8b 05 92 95 55 7b <48> 39 d8 74 08 45 31 f6 e9 c3 00 00 00 48 c7 c7 6b f4 d6 85 e8 79
RSP: 0018:ffffc90000170460 EFLAGS: 00000246
RAX: ffff888126c013c0 RBX: ffff888126c013c0 RCX: ffffc90000e90000
RDX: ffffc90000170540 RSI: ffffc90000e98000 RDI: ffffc90000170530
RBP: ffffc90000170488 R08: dffffc0000000000 R09: ffffc90000170540
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffc90000170530 R14: ffffc90000170501 R15: ffffc90000170540
 get_stack_info+0x36/0xa0 arch/x86/kernel/dumpstack_64.c:183
 __unwind_start+0x1e9/0x3a0 arch/x86/kernel/unwind_frame.c:395
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 arch_stack_walk+0xdb/0x140 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:509
 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 kmem_cache_alloc_trace+0x18a/0x2e0 mm/slub.c:2974
 kmalloc include/linux/slab.h:552 [inline]
 dst_cow_metrics_generic+0x55/0x1c0 net/core/dst.c:201
 dst_metrics_write_ptr include/net/dst.h:117 [inline]
 dst_metric_set include/net/dst.h:178 [inline]
 icmp6_dst_alloc+0x385/0x560 net/ipv6/route.c:3177
 ndisc_send_skb+0x25a/0xc00 net/ipv6/ndisc.c:491
 ndisc_send_rs+0x532/0x6a0 net/ipv6/ndisc.c:705
 addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3964
 call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x72a/0xa10 kernel/time/timer.c:1789
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x268/0x5bb kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1094
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x49/0x70 kernel/locking/spinlock.c:199
Code: 08 00 74 0c 48 c7 c7 f0 77 6c 86 e8 c1 de f5 fc 48 83 3d c9 0f ba 01 00 74 2a 48 89 df e8 13 3c 9e fc 66 90 fb bf 01 00 00 00 <e8> b2 ab 96 fc 65 8b 05 47 05 50 7b 85 c0 74 03 5b 5d c3 e8 b3 13
RSP: 0018:ffffc90000e97468 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff8881f7155fc0 RCX: dffffc0000000000
RDX: 0000000040000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000e97470 R08: ffffffff8188e689 R09: fffffbfff0dc7623
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f7155fc0
R13: ffff888126c013c0 R14: dffffc0000000000 R15: 0000000000000000
 finish_lock_switch kernel/sched/core.c:3784 [inline]
 finish_task_switch+0x130/0x5a0 kernel/sched/core.c:3884
 context_switch kernel/sched/core.c:4049 [inline]
 __schedule+0xbee/0x1330 kernel/sched/core.c:4804
 preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:5065
 irqentry_exit_cond_resched kernel/entry/common.c:365 [inline]
 irqentry_exit+0x4f/0x60 kernel/entry/common.c:395
 sysvec_apic_timer_interrupt+0xcb/0xe0 arch/x86/kernel/apic/apic.c:1094
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:free_unref_page mm/page_alloc.c:3415 [inline]
RIP: 0010:free_the_page+0x140/0x370 mm/page_alloc.c:5407
Code: 48 89 df e8 e2 28 04 00 4c 8b 7c 24 60 fa 48 8b 5c 24 18 48 89 df 44 89 ee 31 d2 e8 ca 66 ff ff 4c 89 7c 24 38 ff 74 24 38 9d <84> c0 74 67 48 c7 44 24 40 0e 36 e0 45 4b c7 04 34 00 00 00 00 65
RSP: 0018:ffffc90000e97760 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffffea000463fd00 RCX: 0000000000000001
RDX: ffffea000463fcc8 RSI: ffff8881f715ab60 RDI: 0000000000000001
RBP: ffffc90000e97838 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff520001d2ed0 R11: dffffc0000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: 1ffff920001d2ef4 R15: 0000000000000246
 __free_pages+0x67/0xc0 mm/page_alloc.c:5418
 __vunmap+0x7bc/0x8f0 mm/vmalloc.c:2301
 __vfree mm/vmalloc.c:2349 [inline]
 vfree+0x5c/0x80 mm/vmalloc.c:2380
 kcov_put kernel/kcov.c:408 [inline]
 kcov_close+0x2b/0x50 kernel/kcov.c:510
 __fput+0x33d/0x7b0 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x129/0x190 kernel/task_work.c:189
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0xc83/0x2a50 kernel/exit.c:863
 do_group_exit+0x141/0x310 kernel/exit.c:985
 get_signal+0x10a0/0x1410 kernel/signal.c:2790
 arch_do_signal_or_restart+0xbd/0x17c0 arch/x86/kernel/signal.c:805
 handle_signal_work kernel/entry/common.c:145 [inline]
 exit_to_user_mode_loop+0x9b/0xd0 kernel/entry/common.c:169
 exit_to_user_mode_prepare kernel/entry/common.c:199 [inline]
 syscall_exit_to_user_mode+0xa2/0x1a0 kernel/entry/common.c:274
 do_syscall_64+0x40/0x70 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f254e526ef9
Code: Unable to access opcode bytes at RIP 0x7f254e526ecf.
RSP: 002b:00007f254d1a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f254e6def80 RCX: 00007f254e526ef9
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000004
RBP: 00007f254e599b76 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f254e6def80 R15: 00007ffc7c21a2a8