watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.0:21903] Modules linked in: irq event stamp: 3608937 hardirqs last enabled at (3608936): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (3608937): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (2641878): [] __do_softirq+0x678/0x980 kernel/softirq.c:318 softirqs last disabled at (2641881): [] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (2641881): [] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 0 PID: 21903 Comm: syz-executor.0 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:geneve_xmit+0x1a24/0x2e60 drivers/net/geneve.c:949 Code: e8 61 97 22 02 e9 7b f2 ff ff e8 17 4d 11 fd 48 89 ef e8 4f 97 22 02 e9 86 ec ff ff e8 05 4d 11 fd 49 83 c7 30 e9 99 e7 ff ff f7 4c 11 fd 48 89 ef e8 1f 6b 1f 02 89 de bf d8 ff ff ff e8 53 RSP: 0018:ffff8880ba0077f0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000301 RBX: 00000000ffffff9b RCX: ffffffff845141f2 RDX: 00000000ffffff9b RSI: ffff888233204200 RDI: 0000000000000005 RBP: ffff8880a5f7ab28 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001 R13: 000000000000000e R14: ffff8880a5f7aba8 R15: ffff88804547ee80 FS: 00007f7696442700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a5be851538 CR3: 000000004675b000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __netdev_start_xmit include/linux/netdevice.h:4349 [inline] netdev_start_xmit include/linux/netdevice.h:4363 [inline] xmit_one net/core/dev.c:3256 [inline] dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838 tipc_l2_send_msg+0x29e/0x450 net/tipc/bearer.c:476 tipc_bearer_xmit_skb+0x15b/0x330 net/tipc/bearer.c:518 tipc_disc_timeout+0x855/0xc90 net/tipc/discover.c:332 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744 Code: 00 00 e8 2d 42 29 f9 e8 38 7c 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 6b 48 d9 01 00 74 5b fb 66 0f 1f 44 00 00 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 d0 82 f1 89 48 c1 e8 03 80 RSP: 0018:ffff888222eb7da0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e305b RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888233204a84 RBP: ffffed1046640840 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888233204200 R13: ffffffff89f182d8 R14: 0000000000000000 R15: 0000000000000000 retint_kernel+0x1b/0x2d RIP: 0010:__sanitizer_cov_trace_pc+0x40/0x50 kernel/kcov.c:108 Code: 00 01 1f 00 75 2b 8b 90 60 13 00 00 83 fa 02 75 20 48 8b 88 68 13 00 00 8b 80 64 13 00 00 48 8b 11 48 83 c2 01 48 39 d0 76 07 <48> 89 34 d1 48 89 11 c3 0f 1f 84 00 00 00 00 00 49 89 f1 49 89 fa RSP: 0018:ffff888222eb7e78 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13 RAX: 0000000000040000 RBX: 0000000000000708 RCX: ffffc90005c50000 RDX: 0000000000002046 RSI: ffffffff81ab2af0 RDI: 0000000000000005 RBP: ffff888097caf5b8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000005 R11: 00000000f105088f R12: 00007f7696442000 R13: 00007f7696443040 R14: 0000000000001000 R15: 0000000000000000 exact_copy_from_user fs/namespace.c:2685 [inline] copy_mount_options+0x190/0x380 fs/namespace.c:2714 ksys_mount+0x9b/0x130 fs/namespace.c:3033 __do_sys_mount fs/namespace.c:3052 [inline] __se_sys_mount fs/namespace.c:3049 [inline] __x64_sys_mount+0xba/0x150 fs/namespace.c:3049 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f7698eccc5a Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f7696441fa8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7698eccc5a RDX: 0000000020000080 RSI: 0000000020000180 RDI: 0000000000000000 RBP: 00007f7696442040 R08: 00007f7696442040 R09: 0000000020000080 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000080 R13: 0000000020000180 R14: 00007f7696442000 R15: 00000000200001c0 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 21929 Comm: syz-executor.2 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__lock_release kernel/locking/lockdep.c:3714 [inline] RIP: 0010:lock_release+0x38d/0x8b0 kernel/locking/lockdep.c:3927 Code: 00 4d 89 ae 78 08 00 00 8d 55 01 44 89 fe 4c 89 f7 e8 67 ea ff ff 85 c0 75 35 48 b8 00 00 00 00 00 fc ff df 48 89 da 83 e3 07 <48> c1 ea 03 83 c3 03 0f b6 04 02 38 c3 7c 08 84 c0 0f 85 d3 02 00 RSP: 0018:ffff8880ba1070b8 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff1100945cd63 RDX: ffffffff8d242760 RSI: 0000000000000003 RDI: ffff88804a2e6240 RBP: 0000000000000002 R08: ffffffff8cd53e80 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000074071 R12: 1ffff11017420e1a R13: 600fd093b2ff9a58 R14: ffff88804a2e6240 R15: 0000000000000003 FS: 00007fe7e1e59700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000100000000 CR3: 000000009012a000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: seqcount_lockdep_reader_access include/linux/seqlock.h:82 [inline] read_seqcount_begin include/linux/seqlock.h:164 [inline] ktime_get+0xe6/0x2f0 kernel/time/timekeeping.c:756 hrtimer_forward_now include/linux/hrtimer.h:479 [inline] perf_swevent_hrtimer+0x318/0x3e0 kernel/events/core.c:9266 __run_hrtimer kernel/time/hrtimer.c:1419 [inline] __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1481 hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1539 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline] smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:unwind_next_frame+0xa12/0x1400 arch/x86/kernel/unwind_orc.c:508 Code: f7 4c 89 44 24 30 48 8d 70 f8 48 89 44 24 28 e8 34 f4 ff ff 84 c0 0f 84 72 fa ff ff 48 b8 00 00 00 00 00 fc ff df 48 8b 14 24 <4c> 8b 64 24 68 4c 8b 44 24 30 48 c1 ea 03 80 3c 02 00 0f 85 8c 09 RSP: 0018:ffff8880ba107708 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 1ffff11017420eea RCX: 0000000000000000 RDX: ffff8880ba107870 RSI: ffff8880ba107698 RDI: ffff8880ba107dd0 RBP: 0000000000000002 R08: ffffffff8c0906f2 R09: ffffffff8c090688 R10: ffff8880ba107897 R11: 0000000000074071 R12: ffff8880ba107880 R13: ffff8880ba10786d R14: ffff8880ba107838 R15: ffffffff8c0906ee __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slab.c:3340 [inline] kmem_cache_alloc_node_trace+0x13c/0x3b0 mm/slab.c:3666 __do_kmalloc_node mm/slab.c:3688 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0xae/0x560 net/core/skbuff.c:205 __netdev_alloc_skb+0x76/0x460 net/core/skbuff.c:407 netdev_alloc_skb include/linux/skbuff.h:2680 [inline] dev_alloc_skb include/linux/skbuff.h:2693 [inline] __ieee80211_beacon_get+0xc7d/0x1a30 net/mac80211/tx.c:4338 ieee80211_beacon_get_tim+0x88/0x890 net/mac80211/tx.c:4449 ieee80211_beacon_get include/net/mac80211.h:4484 [inline] mac80211_hwsim_beacon_tx+0xff/0x680 drivers/net/wireless/mac80211_hwsim.c:1577 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__x64_sys_futex+0x1/0x1b0 kernel/futex.c:3918 Code: d5 1a 0a 00 45 8d 75 fd bf 02 00 00 00 45 31 ff 44 89 f6 e8 31 1c 0a 00 41 83 fe 02 0f 86 be fe ff ff e9 5c ff ff ff 66 90 53 <48> 89 fb 48 83 ec 28 e8 a3 1a 0a 00 48 8d 7b 40 48 b8 00 00 00 00 RSP: 0018:ffff88821bbc7f18 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 00000000000000ca RCX: ffffc90013001000 RDX: 1ffffffff10c09ca RSI: ffffffff810076df RDI: ffff88821bbc7f58 RBP: ffff88821bbc7f58 R08: 0000000000000000 R09: 0000000000000223 R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000 R13: ffffffff89f182d8 R14: 0000000000000000 R15: 0000000000000000 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fe7e48e2739 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe7e1e59218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 00007fe7e49e6f88 RCX: 00007fe7e48e2739 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7e49e6f8c RBP: 00007fe7e49e6f80 R08: 000000000000000e R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7e49e6f8c R13: 00007ffcea55766f R14: 00007fe7e1e59300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: e8 61 97 22 02 callq 0x2229766 5: e9 7b f2 ff ff jmpq 0xfffff285 a: e8 17 4d 11 fd callq 0xfd114d26 f: 48 89 ef mov %rbp,%rdi 12: e8 4f 97 22 02 callq 0x2229766 17: e9 86 ec ff ff jmpq 0xffffeca2 1c: e8 05 4d 11 fd callq 0xfd114d26 21: 49 83 c7 30 add $0x30,%r15 25: e9 99 e7 ff ff jmpq 0xffffe7c3 * 2a: e8 f7 4c 11 fd callq 0xfd114d26 <-- trapping instruction 2f: 48 89 ef mov %rbp,%rdi 32: e8 1f 6b 1f 02 callq 0x21f6b56 37: 89 de mov %ebx,%esi 39: bf d8 ff ff ff mov $0xffffffd8,%edi 3e: e8 .byte 0xe8 3f: 53 push %rbx