RBP: 00007f88476ae296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f88477f4130 R15: 00007fff6bba1638
watchdog: BUG: soft lockup - CPU#1 stuck for 246s! [syz.3.1256:5974]
Modules linked in:
CPU: 1 PID: 5974 Comm: syz.3.1256 Tainted: G W 5.15.167-syzkaller-02003-g5e4635681cf1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:skb_scrub_packet+0x0/0x3a0 net/core/skbuff.c:5572
Code: 7c 96 4c 89 f7 e8 60 25 cf fd eb 8c 89 d9 80 e1 07 80 c1 03 38 c1 7c a5 48 89 df e8 4a 25 cf fd eb 9b 0f 1f 84 00 00 00 00 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 89 75 d4 49 89
RSP: 0018:ffffc900001d0280 EFLAGS: 00000246
RAX: 1ffff11022afcc9f RBX: ffff8881157e64f8 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8881132eec80
RBP: ffffc900001d02b8 R08: ffffffff83e6d61b R09: ffffffff83e74f3c
R10: 0000000000000002 R11: ffff88810e9f13c0 R12: ffff88811c0db000
R13: ffff8881132eec80 R14: ffff88810af34000 R15: ffff8881132eec90
FS: 00007f88462736c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001ef14a000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000020000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__dev_forward_skb+0x22/0x30 net/core/dev.c:2201
veth_forward_skb drivers/net/veth.c:295 [inline]
veth_xmit+0x315/0x930 drivers/net/veth.c:350
__netdev_start_xmit include/linux/netdevice.h:5059 [inline]
netdev_start_xmit include/linux/netdevice.h:5073 [inline]
xmit_one net/core/dev.c:3624 [inline]
dev_hard_start_xmit+0x228/0x620 net/core/dev.c:3640
__dev_queue_xmit+0x18b4/0x2e70 net/core/dev.c:4255
dev_queue_xmit+0x17/0x20 net/core/dev.c:4288
neigh_resolve_output+0x6b8/0x760 net/core/neighbour.c:1504
neigh_output include/net/neighbour.h:517 [inline]
ip6_finish_output2+0xf95/0x16f0 net/ipv6/ip6_output.c:130
__ip6_finish_output+0x60f/0x7c0 net/ipv6/ip6_output.c:201
ip6_finish_output+0x31/0x210 net/ipv6/ip6_output.c:211
NF_HOOK_COND include/linux/netfilter.h:294 [inline]
ip6_output+0x1f7/0x4c0 net/ipv6/ip6_output.c:234
dst_output include/net/dst.h:444 [inline]
NF_HOOK include/linux/netfilter.h:305 [inline]
ndisc_send_skb+0x73e/0xc90 net/ipv6/ndisc.c:511
ndisc_send_rs+0x532/0x6a0 net/ipv6/ndisc.c:705
addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3979
call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1457
expire_timers kernel/time/timer.c:1502 [inline]
__run_timers+0x72a/0xa10 kernel/time/timer.c:1773
run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1786
handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
__do_softirq kernel/softirq.c:603 [inline]
invoke_softirq kernel/softirq.c:425 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:652
irq_exit_rcu+0x9/0x10 kernel/softirq.c:664
sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1096
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:finish_task_switch+0x16f/0x7b0 kernel/sched/core.c:5024
Code: 74 08 4c 89 ff e8 b1 6c 65 00 49 8b 1f 48 85 db 4c 8b 6d c0 0f 85 ce 00 00 00 4c 89 e7 e8 e9 b3 99 03 fb 49 8d 9d 38 0b 00 00 <48> 89 d8 48 c1 e8 03 49 be 00 00 00 00 00 fc ff df 42 0f b6 04 30
RSP: 0018:ffffc9000188fba0 EFLAGS: 00000282
RAX: 0000000080000001 RBX: ffff88810e9f1ef8 RCX: 0000000000000002
RDX: 0000000040000002 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc9000188fbf0 R08: ffffffff8191f919 R09: fffffbfff0e53363
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f71378c0
R13: ffff88810e9f13c0 R14: 1ffff1103ee27081 R15: ffff8881f7138408
context_switch kernel/sched/core.c:5155 [inline]
__schedule+0xcd4/0x1590 kernel/sched/core.c:6512
preempt_schedule_irq+0xc7/0x140 kernel/sched/core.c:6916
irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:398
irqentry_exit+0x30/0x40 kernel/entry/common.c:432
sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1096
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60 kernel/kcov.c:206
Code: f0 15 92 7e 65 8b 15 f1 15 92 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 5c 0b 00 00 00 74 2c 8b 91 38 0b 00 00 <83> fa 02 75 21 48 8b 91 40 0b 00 00 48 8b 32 48 8d 7e 01 8b 89 3c
RSP: 0018:ffffc9000188fe80 EFLAGS: 00000246
RAX: ffffffff81bb328d RBX: ffff88811bfa0a80 RCX: ffff88810e9f13c0
RDX: 0000000000000002 RSI: 0000000000000029 RDI: ffff88811bfa0a80
RBP: ffffc9000188fe80 R08: ffffffff81bfc74d R09: ffffed102124c883
R10: 0000000000000000 R11: dffffc0000000001 R12: 00000000200006c0
R13: ffff88811bfa0a80 R14: ffff88811bfa0a81 R15: 0000000000005452
fput+0xd/0x20 fs/file_table.c:351
fdput include/linux/file.h:46 [inline]
__do_sys_ioctl fs/ioctl.c:877 [inline]
__se_sys_ioctl+0x177/0x190 fs/ioctl.c:860
__x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:860
x64_sys_call+0x98/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f884763bff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8846273038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f88477f4130 RCX: 00007f884763bff9
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000007
RBP: 00007f88476ae296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f88477f4130 R15: 00007fff6bba1638
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 4757 Comm: syz.3.1022 Tainted: G W 5.15.167-syzkaller-02003-g5e4635681cf1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:perf_prepare_sample+0x8e8/0x1a80 kernel/events/core.c:7526
Code: e8 dd 5c a2 ff eb 14 e8 d6 ce dd ff ba 10 00 00 00 4c 89 f7 31 f6 e8 c7 22 20 00 49 bf 00 00 00 00 00 fc ff df 4c 8b 74 24 20 <4c> 89 f6 48 81 e6 00 10 00 00 31 ff e8 e7 d2 dd ff 4c 89 f0 48 25
RSP: 0018:ffffc90000006bc0 EFLAGS: 00000006
RAX: ffffffff81928852 RBX: 1ffff92000000dac RCX: ffff888118698000
RDX: 0000000000010100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000006cb0 R08: ffffffff81928798 R09: ffffc90000006d00
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90000006d66
R13: ffffc90000006ec0 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8846273d58 CR3: 0000000181be7000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__perf_event_output kernel/events/core.c:7648 [inline]
perf_event_output_forward+0xdb/0x1b0 kernel/events/core.c:7668
__perf_event_overflow+0x20b/0x390 kernel/events/core.c:9336
perf_swevent_hrtimer+0x3fd/0x560 kernel/events/core.c:10732
__run_hrtimer kernel/time/hrtimer.c:1687 [inline]
__hrtimer_run_queues+0x41a/0xad0 kernel/time/hrtimer.c:1751
hrtimer_interrupt+0x40c/0xaa0 kernel/time/hrtimer.c:1813
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1102
sysvec_apic_timer_interrupt+0x44/0xc0 arch/x86/kernel/apic/apic.c:1096
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:update_stack_state+0x3a1/0x460 arch/x86/kernel/unwind_frame.c:242
Code: 89 c3 eb 08 48 8b 5d 88 48 83 eb 80 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 27 a0 7d 00 65 48 8b 05 3f 64 cd 7e <49> 39 06 74 0d 48 89 df e8 42 fc ff ff 49 89 c6 eb 19 48 89 d8 48
RSP: 0018:ffffc900000073f0 EFLAGS: 00000246
RAX: ffff888118698000 RBX: ffffc90000b67bc8 RCX: 1ffff92000000eb3
RDX: 1ffff92000000eaa RSI: ffffc90000b67bc0 RDI: ffffc90000007598
RBP: ffffc900000074a8 R08: ffffc90000007628 R09: 0000000000000020
R10: ffffc90000007630 R11: dffffc0000000001 R12: 1ffff92000000eb0
R13: 0000000000000000 R14: ffffc90000007568 R15: dffffc0000000000
unwind_next_frame+0x3cb/0x700 arch/x86/kernel/unwind_frame.c:305
arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:433 [inline]
____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:512
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
kasan_kmalloc include/linux/kasan.h:227 [inline]
kmem_cache_alloc_trace+0x115/0x210 mm/slub.c:3267
kmalloc include/linux/slab.h:603 [inline]
dst_cow_metrics_generic+0x55/0x1c0 net/core/dst.c:199
dst_metrics_write_ptr include/net/dst.h:118 [inline]
dst_metric_set include/net/dst.h:179 [inline]
icmp6_dst_alloc+0x385/0x560 net/ipv6/route.c:3288
ndisc_send_skb+0x27f/0xc90 net/ipv6/ndisc.c:491
ndisc_send_rs+0x532/0x6a0 net/ipv6/ndisc.c:705
addrconf_rs_timer+0x2d1/0x600 net/ipv6/addrconf.c:3979
call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1457
expire_timers kernel/time/timer.c:1502 [inline]
__run_timers+0x72a/0xa10 kernel/time/timer.c:1773
run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1786
handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
__do_softirq kernel/softirq.c:603 [inline]
invoke_softirq kernel/softirq.c:425 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:652
irq_exit_rcu+0x9/0x10 kernel/softirq.c:664
sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1096
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:decode_frame_pointer arch/x86/kernel/unwind_frame.c:169 [inline]
RIP: 0010:update_stack_state+0xae/0x460 arch/x86/kernel/unwind_frame.c:201
Code: 30 00 74 08 48 89 df e8 30 a3 7d 00 48 8b 03 48 83 c0 10 48 89 45 98 48 8b 45 c0 89 c2 83 e2 01 48 f7 da 48 89 c1 48 83 e1 fe <48> 89 4d 88 48 21 ca 48 89 95 78 ff ff ff 74 26 49 8d 5f 35 48 89
RSP: 0018:ffffc90000b67210 EFLAGS: 00000282
RAX: ffffc90000b67ee0 RBX: ffffc90000b67398 RCX: ffffc90000b67ee0
RDX: 0000000000000000 RSI: ffffc90000b67ee0 RDI: ffffc90000b673b8
RBP: ffffc90000b672c8 R08: ffffc90000b67448 R09: 000000000000000d
R10: ffffc90000b67450 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffc90000b673b0 R14: dffffc0000000000 R15: ffffc90000b67360
unwind_next_frame+0x3cb/0x700 arch/x86/kernel/unwind_frame.c:305
arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
save_stack+0xf6/0x1e0 mm/page_owner.c:139
__reset_page_owner+0x36/0x190 mm/page_owner.c:156
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1472 [inline]
free_pcp_prepare mm/page_alloc.c:1544 [inline]
free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3534
free_unref_page+0xe8/0x750 mm/page_alloc.c:3616
free_the_page mm/page_alloc.c:805 [inline]
__free_pages+0x61/0xf0 mm/page_alloc.c:5855
__vunmap+0x7bc/0x8f0 mm/vmalloc.c:2652
__vfree mm/vmalloc.c:2700 [inline]
vfree+0x7f/0xb0 mm/vmalloc.c:2731
kcov_put kernel/kcov.c:417 [inline]
kcov_close+0x2b/0x50 kernel/kcov.c:519
__fput+0x228/0x8c0 fs/file_table.c:280
____fput+0x15/0x20 fs/file_table.c:308
task_work_run+0x129/0x190 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0xc48/0x2ca0 kernel/exit.c:880
do_group_exit+0x141/0x310 kernel/exit.c:1002
get_signal+0x7a3/0x1630 kernel/signal.c:2904
arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:178
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:214
irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:320
irqentry_exit+0x12/0x40 kernel/entry/common.c:411
sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1096
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0033:0x7f5f48f88ff9
Code: Unable to access opcode bytes at RIP 0x7f5f48f88fcf.
RSP: 002b:00007f5f47c02038 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f5f49140f80 RCX: 00007f5f48f88ff9
RDX: 00000000200006c0 RSI: 0000000000005452 RDI: 0000000000000003
RBP: 00007f5f48ffb296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f5f49140f80 R15: 00007fff5ea426d8