watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [syz-executor.5:20220] Modules linked in: irq event stamp: 2264019 hardirqs last enabled at (2264018): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (2264019): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (67684): [] __do_softirq+0x678/0x980 kernel/softirq.c:318 softirqs last disabled at (67687): [] invoke_softirq kernel/softirq.c:372 [inline] softirqs last disabled at (67687): [] irq_exit+0x215/0x260 kernel/softirq.c:412 CPU: 1 PID: 20220 Comm: syz-executor.5 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__in6_dev_get include/net/addrconf.h:340 [inline] RIP: 0010:fib6_ignore_linkdown net/ipv6/route.c:655 [inline] RIP: 0010:find_match.part.0+0xb61/0x1530 net/ipv6/route.c:673 Code: f6 ff ff e8 e1 20 5b fa e8 ac d2 72 ff 31 ff 89 c6 88 45 a8 e8 00 22 5b fa 0f b6 45 a8 84 c0 0f 85 71 f5 ff ff e8 bf 20 5b fa fa 49 49 fa 31 ff 89 c6 89 45 a8 e8 1e 22 5b fa 8b 45 a8 85 c0 RSP: 0018:ffff8880ba106d38 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: ffff88805046c2c0 RBX: ffff8880b24bd040 RCX: ffffffff870771f0 RDX: 0000000000000100 RSI: ffffffff87077201 RDI: 0000000000000001 RBP: ffff8880ba106de0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000001 R14: ffff8880b521db40 R15: dffffc0000000000 FS: 00007fd3e46aa700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000970004 CR3: 00000000afb96000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: find_match net/ipv6/route.c:670 [inline] find_rr_leaf net/ipv6/route.c:719 [inline] rt6_select net/ipv6/route.c:769 [inline] fib6_table_lookup+0x4c2/0xf40 net/ipv6/route.c:1876 ip6_pol_route+0x180/0x1270 net/ipv6/route.c:1909 __fib6_rule_action net/ipv6/fib6_rules.c:233 [inline] fib6_rule_action+0x35f/0x9f0 net/ipv6/fib6_rules.c:264 fib_rules_lookup+0x393/0xbf0 net/core/fib_rules.c:304 fib6_rule_lookup+0x2fa/0x4e0 net/ipv6/fib6_rules.c:110 ip6_route_output_flags+0x2b0/0x350 net/ipv6/route.c:2163 ip6_dst_lookup_tail+0x566/0x19b0 net/ipv6/ip6_output.c:1019 ip6_dst_lookup_flow+0x8c/0x1d0 net/ipv6/ip6_output.c:1120 sctp_v6_get_dst+0x120e/0x1c90 net/sctp/ipv6.c:349 sctp_transport_route+0x125/0x350 net/sctp/transport.c:312 sctp_packet_config+0xbd8/0xe50 net/sctp/output.c:118 sctp_outq_select_transport+0x1e4/0x740 net/sctp/outqueue.c:878 sctp_outq_flush_ctrl.constprop.0+0x291/0xc40 net/sctp/outqueue.c:912 sctp_outq_flush net/sctp/outqueue.c:1205 [inline] sctp_outq_uncork+0x10b/0x200 net/sctp/outqueue.c:777 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1815 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x72a/0x5110 net/sctp/sm_sideeffect.c:1170 sctp_generate_timeout_event+0x1bb/0x3a0 net/sctp/sm_sideeffect.c:310 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1696 [inline] run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:preempt_schedule_irq+0xa6/0x140 kernel/sched/core.c:3744 Code: 00 00 e8 2d 42 29 f9 e8 38 7c 4f f9 4c 89 e8 48 c1 e8 03 80 3c 18 00 75 69 48 83 3d 6b 48 d9 01 00 74 5b fb 66 0f 1f 44 00 00 01 00 00 00 e8 40 d1 ff ff 48 c7 c0 d0 82 f1 89 48 c1 e8 03 80 RSP: 0018:ffff88809aa6f080 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e305b RBX: dffffc0000000000 RCX: 1ffff1100a08d96d RDX: 0000000000000000 RSI: ffff88805046cb98 RDI: ffff88805046cb44 RBP: ffffed100a08d858 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805046c2c0 R13: ffffffff89f182d8 R14: 0000000000000000 R15: 0000000000000000 retint_kernel+0x1b/0x2d RIP: 0010:fib6_ignore_linkdown net/ipv6/route.c:657 [inline] RIP: 0010:find_match.part.0+0xee/0x1530 net/ipv6/route.c:673 Code: a8 84 c0 0f 84 6d 0a 00 00 e8 4e 2b 5b fa 49 8d be 3c 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 5d 0e 00 00 45 RSP: 0018:ffff88809aa6f158 EFLAGS: 00000a03 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: ffff8880b4156e40 RCX: ffffc90010779000 RDX: 0000000000000000 RSI: ffffffff87076772 RDI: ffff88809b87747c RBP: ffff88809aa6f200 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000001 R14: ffff88809b877240 R15: dffffc0000000000 find_match net/ipv6/route.c:670 [inline] find_rr_leaf net/ipv6/route.c:719 [inline] rt6_select net/ipv6/route.c:769 [inline] fib6_table_lookup+0x4c2/0xf40 net/ipv6/route.c:1876 ip6_pol_route+0x180/0x1270 net/ipv6/route.c:1909 fib6_rule_lookup+0x22d/0x4e0 net/ipv6/fib6_rules.c:122 ip6_route_output_flags+0x2b0/0x350 net/ipv6/route.c:2163 ip6_dst_lookup_tail+0x566/0x19b0 net/ipv6/ip6_output.c:1019 ip6_dst_lookup_flow+0x8c/0x1d0 net/ipv6/ip6_output.c:1120 sctp_v6_get_dst+0x120e/0x1c90 net/sctp/ipv6.c:349 sctp_transport_route+0x125/0x350 net/sctp/transport.c:312 sctp_assoc_add_peer+0x5bf/0x1050 net/sctp/associola.c:677 sctp_sendmsg_new_asoc+0x580/0x1040 net/sctp/socket.c:1789 sctp_sendmsg+0x1146/0x1580 net/sctp/socket.c:2122 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xc3/0x120 net/socket.c:661 __sys_sendto+0x21a/0x320 net/socket.c:1899 __do_sys_sendto net/socket.c:1911 [inline] __se_sys_sendto net/socket.c:1907 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1907 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd3e46aa188 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9 RDX: 00000000000000e6 RSI: 0000000020000840 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 00000000200000c0 R09: 000000000000001c R10: 0000000000004840 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007ffe9206697f R14: 00007fd3e46aa300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 20222 Comm: syz-executor.2 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:arch_local_save_flags arch/x86/include/asm/paravirt.h:784 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/paravirt.h:806 [inline] RIP: 0010:lock_release+0xd1/0x8b0 kernel/locking/lockdep.c:3923 Code: 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 c3 06 00 00 48 83 3d a6 29 a6 08 00 0f 84 1b 05 00 00 9c <58> 0f 1f 44 00 00 48 ba 00 00 00 00 00 fc ff df 48 89 04 24 48 c7 RSP: 0018:ffff8880ba0069c0 EFLAGS: 00000086 RAX: 1ffffffff13e3058 RBX: ffff8880a4820180 RCX: ffffffff814bed1b RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8880a4820a04 RBP: ffffffff8d46bea0 R08: ffffffff8d46be88 R09: 0000000000000086 R10: 0000000000000000 R11: ffffffff8c66401b R12: 1ffff11017400d3c R13: ffffffff837748a5 R14: 1ffff11017400d54 R15: ffffffff89f94760 FS: 00007f7519e9c700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2f733000 CR3: 0000000098508000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ---------------- Code disassembly (best guess), 3 bytes skipped: 0: e8 e1 20 5b fa callq 0xfa5b20e6 5: e8 ac d2 72 ff callq 0xff72d2b6 a: 31 ff xor %edi,%edi c: 89 c6 mov %eax,%esi e: 88 45 a8 mov %al,-0x58(%rbp) 11: e8 00 22 5b fa callq 0xfa5b2216 16: 0f b6 45 a8 movzbl -0x58(%rbp),%eax 1a: 84 c0 test %al,%al 1c: 0f 85 71 f5 ff ff jne 0xfffff593 22: e8 bf 20 5b fa callq 0xfa5b20e6 * 27: e8 fa 49 49 fa callq 0xfa494a26 <-- trapping instruction 2c: 31 ff xor %edi,%edi 2e: 89 c6 mov %eax,%esi 30: 89 45 a8 mov %eax,-0x58(%rbp) 33: e8 1e 22 5b fa callq 0xfa5b2256 38: 8b 45 a8 mov -0x58(%rbp),%eax 3b: 85 c0 test %eax,%eax