watchdog: BUG: soft lockup - CPU#1 stuck for 225s! [syz.4.369:1639]
Modules linked in:
CPU: 1 PID: 1639 Comm: syz.4.369 Not tainted 5.15.165-syzkaller-01568-g80dd36dca275 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:trylock_clear_pending kernel/locking/qspinlock_paravirt.h:121 [inline]
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:435 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x604/0xc40 kernel/locking/qspinlock.c:508
Code: 00 48 ba 00 00 00 00 00 fc ff df 66 b8 00 01 f0 66 45 0f b1 37 0f b7 c0 3d 00 01 00 00 75 bf e9 9c 01 00 00 44 89 f9 80 e1 07 <38> c1 7c c0 4c 89 ff e8 60 90 5d 00 48 ba 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000fa6dc0 EFLAGS: 00000246
RAX: 0000000000000004 RBX: 00000000ffffff86 RCX: 0000000087507600
RDX: dffffc0000000000 RSI: 0000000000000003 RDI: ffffffff87507640
RBP: ffffc90000fa6eb0 R08: dffffc0000000000 R09: 0000000000000000
R10: fffffbfff0ea0ec8 R11: dffffc0000000001 R12: ffff8881f7138ad4
R13: 1ffffffff0ea0ec8 R14: 1ffff1103ee20001 R15: ffffffff87507640
FS:  00007f07fa47f6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1990ffdf98 CR3: 0000000118d02000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 </IRQ>
 <TASK>
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0x139/0x1b0 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:363 [inline]
 preload_this_cpu_lock mm/vmalloc.c:1511 [inline]
 alloc_vmap_area+0x22d/0x1a80 mm/vmalloc.c:1553
 __get_vm_area_node+0x158/0x360 mm/vmalloc.c:2439
 __vmalloc_node_range+0xe2/0x8d0 mm/vmalloc.c:3051
 __vmalloc_node mm/vmalloc.c:3151 [inline]
 vmalloc+0x78/0x90 mm/vmalloc.c:3184
 bpf_prog_calc_tag+0xd7/0x8f0 kernel/bpf/core.c:281
 resolve_pseudo_ldimm64+0xe0/0x1240 kernel/bpf/verifier.c:11783
 bpf_check+0x3174/0x12bf0 kernel/bpf/verifier.c:14073
 bpf_prog_load+0x12ac/0x1b50 kernel/bpf/syscall.c:2333
 __sys_bpf+0x4bc/0x760 kernel/bpf/syscall.c:4633
 __do_sys_bpf kernel/bpf/syscall.c:4737 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4735 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4735
 x64_sys_call+0x87f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f07fb805ff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f07fa47f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f07fb9bdf80 RCX: 00007f07fb805ff9
RDX: 0000000000000090 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00007f07fb878296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f07fb9bdf80 R15: 00007ffd90120008
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 1640 Comm: syz.1.370 Not tainted 5.15.165-syzkaller-01568-g80dd36dca275 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:hrtimer_forward+0x6/0x2c0 kernel/time/hrtimer.c:1038
Code: 48 c7 c2 e0 85 bb 86 e8 c8 45 e7 ff 5d c3 66 0f 1f 44 00 00 55 48 89 e5 e8 97 a8 0f 00 e8 52 f9 ff ff 5d c3 55 48 89 e5 41 57 <41> 56 41 55 41 54 53 48 83 ec 30 49 89 d7 49 89 f5 49 89 fc 49 be
RSP: 0018:ffffc90000006628 EFLAGS: 00000002
RAX: 000000481aa7d50b RBX: ffff8881f7029a70 RCX: 0000000000000018
RDX: 0000000000002710 RSI: 000000481aa7d50b RDI: ffff888113750f10
RBP: ffffc90000006630 R08: ffffffff81613671 R09: ffffed103ee065e7
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000002710
R13: 1ffff92000000cd0 R14: 0000000000000001 R15: ffff888113750f10
FS:  00007fb88fee66c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff281af588 CR3: 000000010de8c000 CR4: 00000000003506b0
DR0: 0000000020000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 hrtimer_forward_now include/linux/hrtimer.h:509 [inline]
 perf_swevent_hrtimer+0x4b8/0x560 kernel/events/core.c:10737
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x41a/0xad0 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x40c/0xaa0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline]
 __sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1102
 sysvec_apic_timer_interrupt+0x44/0xc0 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__should_failslab+0x36/0xe0
Code: 89 fe 48 c7 c0 88 73 50 87 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 74 0c 48 c7 c7 88 73 50 87 e8 8a 96 ff ff <31> c0 f7 c3 00 80 00 00 75 64 4c 39 35 41 54 9d 05 74 5b f7 c3 00
RSP: 0018:ffffc90000006bf8 EFLAGS: 00000246
RAX: 1ffffffff0ea0e71 RBX: 0000000000000a20 RCX: 0000000000000a20
RDX: 0000000000000001 RSI: 0000000000000a20 RDI: ffff8881081b3800
RBP: ffffc90000006c10 R08: ffffffff83e14b14 R09: 0000000000000003
R10: fffff52000000dbc R11: dffffc0000000001 R12: 0000000000000001
R13: 1ffff1102341699f R14: ffff8881081b3800 R15: dffffc0000000000
 should_failslab+0x9/0x20 mm/slab_common.c:1351
 slab_pre_alloc_hook+0x37/0xd0 mm/slab.h:525
 slab_alloc_node mm/slub.c:3154 [inline]
 slab_alloc mm/slub.c:3248 [inline]
 kmem_cache_alloc+0x44/0x200 mm/slub.c:3253
 skb_clone+0x1d1/0x360 net/core/skbuff.c:1547
 dev_queue_xmit_nit+0x25b/0xa40 net/core/dev.c:2317
 xmit_one net/core/dev.c:3619 [inline]
 dev_hard_start_xmit+0x149/0x620 net/core/dev.c:3640
 sch_direct_xmit+0x298/0x9b0 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3851 [inline]
 __dev_queue_xmit+0x161e/0x2e70 net/core/dev.c:4220
 dev_queue_xmit+0x17/0x20 net/core/dev.c:4288
 arp_xmit_finish net/ipv4/arp.c:632 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 arp_xmit+0xc5/0x280 net/ipv4/arp.c:641
 arp_send_dst+0x1d0/0x260 net/ipv4/arp.c:319
 arp_process+0x16cf/0x2150 net/ipv4/arp.c:830
 nf_hook_state_init include/linux/netfilter.h:160 [inline]
 nf_hook include/linux/netfilter.h:257 [inline]
 NF_HOOK+0x207/0x280 include/linux/netfilter.h:303
 arp_rcv+0x2dd/0x480 net/ipv4/arp.c:967
 __netif_receive_skb_list_ptype net/core/dev.c:5540 [inline]
 __netif_receive_skb_list_core+0x818/0x890 net/core/dev.c:5583
 __netif_receive_skb_list net/core/dev.c:5635 [inline]
 netif_receive_skb_list_internal+0x967/0xcc0 net/core/dev.c:5726
 gro_normal_list net/core/dev.c:5880 [inline]
 gro_normal_one net/core/dev.c:5893 [inline]
 napi_skb_finish net/core/dev.c:6230 [inline]
 napi_gro_receive+0x45f/0x920 net/core/dev.c:6260
 receive_buf+0x38d9/0x58c0 drivers/net/virtio_net.c:1208
 virtnet_receive drivers/net/virtio_net.c:1472 [inline]
 virtnet_poll+0x628/0x1260 drivers/net/virtio_net.c:1585
 __napi_poll+0xc4/0x5a0 net/core/dev.c:7042
 napi_poll net/core/dev.c:7109 [inline]
 net_rx_action+0x47d/0xc50 net/core/dev.c:7199
 handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
 __do_softirq kernel/softirq.c:603 [inline]
 invoke_softirq kernel/softirq.c:425 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:652
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:664
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:arch_stack_walk+0xee/0x140 arch/x86/kernel/stacktrace.c:26
Code: eb 03 48 89 e9 48 8d bd 70 ff ff ff 4c 89 e6 4c 89 fa e8 05 9d 05 00 83 bd 70 ff ff ff 00 74 32 48 8d 9d 70 ff ff ff 48 89 df <e8> 1d 8d 05 00 48 85 c0 74 1e 4c 89 f7 48 89 c6 41 ff d5 84 c0 74
RSP: 0018:ffffc90000957380 EFLAGS: 00000202
RAX: 0000000000957301 RBX: ffffc90000957380 RCX: 0000000000957301
RDX: 1ffff9200012ae72 RSI: ffffc900009577a8 RDI: ffffc90000957380
RBP: ffffc90000957410 R08: ffffc90000957468 R09: 0000000000000003
R10: ffffc90000957470 R11: dffffc0000000001 R12: ffff88810c0193c0
R13: ffffffff815f7d50 R14: ffffc90000957460 R15: 0000000000000000
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1723 [inline]
 slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749
 slab_free mm/slub.c:3519 [inline]
 kmem_cache_free+0x116/0x2e0 mm/slub.c:3535
 adjust_va_to_fit_type mm/vmalloc.c:1347 [inline]
 __alloc_vmap_area mm/vmalloc.c:1463 [inline]
 alloc_vmap_area+0x1748/0x1a80 mm/vmalloc.c:1554
 __get_vm_area_node+0x158/0x360 mm/vmalloc.c:2439
 __vmalloc_node_range+0xe2/0x8d0 mm/vmalloc.c:3051
 __vmalloc_node mm/vmalloc.c:3151 [inline]
 __vmalloc+0x7a/0x90 mm/vmalloc.c:3165
 bpf_prog_alloc_no_stats+0x3b/0x2f0 kernel/bpf/core.c:90
 bpf_prog_alloc+0x1f/0x1e0 kernel/bpf/core.c:124
 bpf_prog_load+0x800/0x1b50 kernel/bpf/syscall.c:2280
 __sys_bpf+0x4bc/0x760 kernel/bpf/syscall.c:4633
 __do_sys_bpf kernel/bpf/syscall.c:4737 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4735 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4735
 x64_sys_call+0x87f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fb89126cff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb88fee6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fb891424f80 RCX: 00007fb89126cff9
RDX: 0000000000000090 RSI: 0000000020000bc0 RDI: 0000000000000005
RBP: 00007fb8912df296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fb891424f80 R15: 00007ffeef886108
 </TASK>