watchdog: BUG: soft lockup - CPU#0 stuck for 245s! [syz-executor345:293] Modules linked in: CPU: 0 PID: 293 Comm: syz-executor345 Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] RIP: 0010:arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] RIP: 0010:kvm_wait+0x147/0x180 arch/x86/kernel/kvm.c:918 Code: 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0 44 8b 74 24 1c 75 34 41 0f b6 45 00 44 38 f0 75 10 66 90 0f 00 2d 5b 03 f3 03 fb f4 24 ff ff ff fb e9 1e ff ff ff 44 89 e9 80 e1 07 38 c1 7c a3 4c RSP: 0018:ffffc900007bf620 EFLAGS: 00000246 RAX: 0000000000000001 RBX: 1ffff920000f7ec8 RCX: 1ffffffff0d1aa9c RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff8881f7037ed4 RBP: ffffc900007bf6d0 R08: dffffc0000000000 R09: ffffed103ee06fdb R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 R13: ffff8881f7037ed4 R14: 0000000000000001 R15: 1ffff920000f7ecc FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f44d2970130 CR3: 000000011eafe000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pv_wait arch/x86/include/asm/paravirt.h:597 [inline] pv_wait_node kernel/locking/qspinlock_paravirt.h:325 [inline] __pv_queued_spin_lock_slowpath+0x41b/0xc40 kernel/locking/qspinlock.c:473 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock include/linux/spinlock.h:187 [inline] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline] _raw_spin_lock_bh+0x139/0x1b0 kernel/locking/spinlock.c:178 __sock_map_delete net/core/sock_map.c:416 [inline] sock_map_delete_elem+0x99/0x130 net/core/sock_map.c:448 bpf_prog_346bdb13810e5499+0x42/0xd90 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline] __bpf_prog_run include/linux/filter.h:625 [inline] bpf_prog_run include/linux/filter.h:632 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline] bpf_trace_run3+0x11e/0x250 kernel/trace/bpf_trace.c:1921 __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138 trace_kmem_cache_free include/trace/events/kmem.h:138 [inline] kmem_cache_free+0x2c3/0x2e0 mm/slub.c:3536 anon_vma_free mm/rmap.c:136 [inline] __put_anon_vma+0xdd/0x1f0 mm/rmap.c:2340 put_anon_vma include/linux/rmap.h:128 [inline] unlink_anon_vmas+0x445/0x590 mm/rmap.c:445 free_pgtables+0x137/0x280 mm/memory.c:485 exit_mmap+0x3e7/0x6f0 mm/mmap.c:3210 __mmput+0x95/0x310 kernel/fork.c:1179 mmput+0x5b/0x170 kernel/fork.c:1202 exit_mm kernel/exit.c:552 [inline] do_exit+0xb9c/0x2ca0 kernel/exit.c:865 do_group_exit+0x141/0x310 kernel/exit.c:1000 __do_sys_exit_group kernel/exit.c:1011 [inline] __se_sys_exit_group kernel/exit.c:1009 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1009 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f44d28fbeb9 Code: Unable to access opcode bytes at RIP 0x7f44d28fbe8f. RSP: 002b:00007fffab4b63c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f44d28fbeb9 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007f44d296f2d0 R08: ffffffffffffffb8 R09: 00007f44d293f09e R10: 0000000000000000 R11: 0000000000000246 R12: 00007f44d296f2d0 R13: 0000000000000000 R14: 00007f44d296fd20 R15: 00007f44d28c56e0 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 287 Comm: sshd Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] RIP: 0010:arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] RIP: 0010:kvm_wait+0x147/0x180 arch/x86/kernel/kvm.c:918 Code: 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0 44 8b 74 24 1c 75 34 41 0f b6 45 00 44 38 f0 75 10 66 90 0f 00 2d 5b 03 f3 03 fb f4 24 ff ff ff fb e9 1e ff ff ff 44 89 e9 80 e1 07 38 c1 7c a3 4c RSP: 0018:ffffc90000a46180 EFLAGS: 00000246 RAX: 0000000000000003 RBX: 1ffff92000148c34 RCX: ffffffff8154f88f RDX: dffffc0000000000 RSI: 0000000000000003 RDI: ffff88811e2fd528 RBP: ffffc90000a46230 R08: dffffc0000000000 R09: ffffed1023c5faa6 R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 R13: ffff88811e2fd528 R14: 0000000000000003 R15: 1ffff92000148c38 FS: 00007f0a1e35b800(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0a1e563304 CR3: 000000011e168000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pv_wait arch/x86/include/asm/paravirt.h:597 [inline] pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:470 [inline] __pv_queued_spin_lock_slowpath+0x6bc/0xc40 kernel/locking/qspinlock.c:508 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock include/linux/spinlock.h:187 [inline] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline] _raw_spin_lock_bh+0x139/0x1b0 kernel/locking/spinlock.c:178 __sock_map_delete net/core/sock_map.c:416 [inline] sock_map_delete_elem+0x99/0x130 net/core/sock_map.c:448 bpf_prog_346bdb13810e5499+0x42/0xd90 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline] __bpf_prog_run include/linux/filter.h:625 [inline] bpf_prog_run include/linux/filter.h:632 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline] bpf_trace_run3+0x11e/0x250 kernel/trace/bpf_trace.c:1921 __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138 trace_kmem_cache_free include/trace/events/kmem.h:138 [inline] kmem_cache_free+0x2c3/0x2e0 mm/slub.c:3536 kfree_skbmem+0x104/0x170 __kfree_skb net/core/skbuff.c:758 [inline] consume_skb+0xb4/0x250 net/core/skbuff.c:930 __sk_msg_free+0x2dd/0x370 net/core/skmsg.c:205 sk_msg_free net/core/skmsg.c:218 [inline] __sk_psock_purge_ingress_msg net/core/skmsg.c:768 [inline] __sk_psock_zap_ingress net/core/skmsg.c:786 [inline] sk_psock_stop+0x44c/0x4d0 net/core/skmsg.c:804 sk_psock_drop+0x219/0x310 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:458 [inline] sock_map_unref+0x48f/0x4d0 net/core/sock_map.c:183 __sock_map_delete net/core/sock_map.c:422 [inline] sock_map_delete_elem+0xc1/0x130 net/core/sock_map.c:448 bpf_prog_346bdb13810e5499+0x42/0xd90 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline] __bpf_prog_run include/linux/filter.h:625 [inline] bpf_prog_run include/linux/filter.h:632 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1883 [inline] bpf_trace_run3+0x11e/0x250 kernel/trace/bpf_trace.c:1921 __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138 trace_kmem_cache_free include/trace/events/kmem.h:138 [inline] kmem_cache_free+0x2c3/0x2e0 mm/slub.c:3536 kfree_skbmem+0x104/0x170 __kfree_skb net/core/skbuff.c:758 [inline] consume_skb+0xb4/0x250 net/core/skbuff.c:930 packet_rcv+0x160/0x1150 net/packet/af_packet.c:2196 dev_queue_xmit_nit+0x9a4/0xa40 net/core/dev.c:2349 xmit_one net/core/dev.c:3619 [inline] dev_hard_start_xmit+0x149/0x620 net/core/dev.c:3640 sch_direct_xmit+0x298/0x9b0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3851 [inline] __dev_queue_xmit+0x161e/0x2e70 net/core/dev.c:4220 dev_queue_xmit+0x17/0x20 net/core/dev.c:4288 neigh_hh_output include/net/neighbour.h:501 [inline] neigh_output include/net/neighbour.h:515 [inline] ip_finish_output2+0xb9f/0xf60 net/ipv4/ip_output.c:228 __ip_finish_output+0x162/0x360 ip_finish_output+0x31/0x210 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip_output+0x1d6/0x420 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] __ip_queue_xmit+0x1105/0x1c20 net/ipv4/ip_output.c:532 ip_queue_xmit+0x4c/0x70 net/ipv4/ip_output.c:546 __tcp_transmit_skb+0x1e84/0x3920 net/ipv4/tcp_output.c:1402 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] tcp_write_xmit+0x144a/0x5e80 net/ipv4/tcp_output.c:2705 __tcp_push_pending_frames+0x98/0x2f0 net/ipv4/tcp_output.c:2890 tcp_push+0x477/0x620 net/ipv4/tcp.c:736 tcp_sendmsg_locked+0x315c/0x3a90 net/ipv4/tcp.c:1427 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1455 inet_sendmsg+0xa1/0xc0 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] sock_write_iter+0x39b/0x530 net/socket.c:1079 call_write_iter include/linux/fs.h:2202 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0xd5d/0x1110 fs/read_write.c:594 ksys_write+0x199/0x2c0 fs/read_write.c:647 __do_sys_write fs/read_write.c:659 [inline] __se_sys_write fs/read_write.c:656 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:656 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f0a1e487bf2 Code: 89 c7 48 89 44 24 08 e8 7b 34 fa ff 48 8b 44 24 08 48 83 c4 28 c3 c3 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 6f 48 8b 15 07 a2 0d 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffd084c4d38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000036c RCX: 00007f0a1e487bf2 RDX: 000000000000036c RSI: 0000560e808b8680 RDI: 0000000000000004 RBP: 0000560e808b7290 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000560e7ed9daa4 R13: 0000000000000015 R14: 0000560e7ed9e3e8 R15: 00007ffd084c4da8