watchdog: BUG: soft lockup - CPU#1 stuck for 225s! [syz.3.719:3077]
Modules linked in:
CPU: 1 PID: 3077 Comm: syz.3.719 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:arch_stack_walk+0xf4/0x150 arch/x86/kernel/stacktrace.c:26
Code: 0e 00 00 eb 03 48 89 e9 48 8d bd 78 ff ff ff 4c 89 e6 4c 89 fa e8 fc 99 05 00 83 bd 78 ff ff ff 00 74 40 4c 8d bd 78 ff ff ff <4c> 89 ff e8 44 8a 05 00 48 85 c0 74 2c 48 89 df 48 89 c6 41 ba 4a
RSP: 0018:ffffc900001b0668 EFLAGS: 00000202
RAX: 00000000001b0601 RBX: ffffc900001b0720 RCX: 00000000001b0601
RDX: ffffc900001b08e0 RSI: 1ffff920000360ce RDI: ffffc900001b06c0
RBP: ffffc900001b06f0 R08: ffffc900001b0730 R09: ffffc900001b0728
R10: 0000000000000000 R11: 1ffff920000360cd R12: ffff88813500bcc0
R13: ffff88813abf8e40 R14: ffffffff8160ce50 R15: ffffc900001b0668
FS:  00007f9ece6516c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 000000013bc6b000 CR4: 00000000003506a0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
 ref_tracker_alloc+0x175/0x430 lib/ref_tracker.c:91
 __netdev_tracker_alloc include/linux/netdevice.h:4085 [inline]
 netdev_hold include/linux/netdevice.h:4114 [inline]
 dst_init+0xc4/0x3d0 net/core/dst.c:52
 dst_alloc+0x191/0x1e0 net/core/dst.c:96
 ip6_dst_alloc net/ipv6/route.c:345 [inline]
 icmp6_dst_alloc+0xf9/0x520 net/ipv6/route.c:3308
 ndisc_send_skb+0x289/0xcf0 net/ipv6/ndisc.c:493
 ndisc_send_rs+0x670/0x870 net/ipv6/ndisc.c:723
 addrconf_rs_timer+0x2c7/0x600 net/ipv6/addrconf.c:4006
 call_timer_fn+0x46/0x2a0 kernel/time/timer.c:1510
 expire_timers kernel/time/timer.c:1555 [inline]
 __run_timers+0x639/0x9a0 kernel/time/timer.c:1826
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1839
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:generic_exec_single+0x2ac/0x3a0 kernel/smp.c:-1
Code: 74 71 e8 87 6e 09 00 43 0f b6 04 3e 84 c0 0f 85 c7 00 00 00 41 c7 04 24 00 00 00 00 bb fa ff ff ff eb 11 e8 66 6e 09 00 31 db <49> bf 00 00 00 00 00 fc ff df 48 c7 44 24 20 0e 36 e0 45 4b c7 44
RSP: 0018:ffffc9000077fa20 EFLAGS: 00000293
RAX: ffffffff81669a8e RBX: 0000000000000000 RCX: ffff88813500bcc0
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc9000077fad0 R08: ffff88813500bcc0 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff81963a10 R12: ffffc9000077fb28
R13: 1ffff920000eff48 R14: ffffc9000077fc60 R15: 0000000000000200
 smp_call_function_single+0x1c5/0x470 kernel/smp.c:784
 task_function_call kernel/events/core.c:120 [inline]
 perf_install_in_context+0x49a/0x730 kernel/events/core.c:2935
 __do_sys_perf_event_open kernel/events/core.c:12721 [inline]
 __se_sys_perf_event_open+0x1281/0x1b80 kernel/events/core.c:12315
 __x64_sys_perf_event_open+0xbf/0xd0 kernel/events/core.c:12315
 x64_sys_call+0x385/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:299
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9ecd78eba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9ece651038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f9ecd9d5fa0 RCX: 00007f9ecd78eba9
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000000
RBP: 00007f9ecd811e19 R08: 0000000000000002 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9ecd9d6038 R14: 00007f9ecd9d5fa0 R15: 00007ffe310476c8
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3078 Comm: syz.3.719 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:check_preemption_disabled+0x45/0x120 lib/smp_processor_id.c:55
Code: d8 65 8b 05 9d 0a 15 7b 65 8b 0d fe 66 15 7b f7 c1 ff ff ff 7f 74 20 65 48 8b 0c 25 28 00 00 00 48 3b 4d d8 0f 85 cb 00 00 00 <48> 83 c4 10 5b 41 5c 41 5e 41 5f 5d c3 48 c7 45 d0 00 00 00 00 9c
RSP: 0018:ffffc90000006c48 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 000000525a286a8b RCX: 5287cab90e291100
RDX: 0000000000010100 RSI: ffffffff854b2d40 RDI: ffffffff85aa0a20
RBP: ffffc90000006c78 R08: dffffc0000000000 R09: ffff88811f870168
R10: ffffed1023f0e02f R11: 1ffff11023f0e02d R12: ffff8881f7029d60
R13: 7fffffffffffffff R14: 0000000000000000 R15: 0000000000000002
FS:  00007f9ece6306c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 000000013bc6b000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 __this_cpu_preempt_check+0x13/0x20 lib/smp_processor_id.c:66
 tick_program_event+0x2e/0x120 kernel/time/tick-oneshot.c:25
 hrtimer_interrupt+0x501/0x8c0 kernel/time/hrtimer.c:1829
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline]
 __sysvec_apic_timer_interrupt+0x11e/0x440 arch/x86/kernel/apic/apic.c:1124
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0x53/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:list_empty include/linux/list.h:292 [inline]
RIP: 0010:waitqueue_active include/linux/wait.h:129 [inline]
RIP: 0010:sock_def_write_space_wfree net/core/sock.c:3366 [inline]
RIP: 0010:sock_wfree+0x375/0x500 net/core/sock.c:2441
Code: 45 d0 48 8b 00 48 85 c0 74 4d 4c 89 e1 48 89 45 b8 4c 8d 60 08 4c 89 e0 48 c1 e8 03 80 3c 08 00 74 08 4c 89 e7 e8 7b d8 d2 fd <49> 8b 04 24 4c 39 e0 74 2b e8 7d 72 8e fd ba 04 03 00 00 48 8b 7d
RSP: 0018:ffffc90000006ef8 EFLAGS: 00010246
RAX: 1ffff11022538261 RBX: ffff88811712e1c0 RCX: dffffc0000000000
RDX: ffff8881082da880 RSI: 000000000001c000 RDI: 0000000000000901
RBP: ffffc90000006f40 R08: dffffc0000000000 R09: ffffed1022e25c63
R10: ffffed1022e25c63 R11: 1ffff11022e25c62 R12: ffff8881129c1308
R13: 1ffff11022e25c44 R14: 0000000000000500 R15: ffff88811712e220
 skb_release_head_state+0x10e/0x250 net/core/skbuff.c:846
 skb_release_all net/core/skbuff.c:857 [inline]
 __kfree_skb net/core/skbuff.c:873 [inline]
 kfree_skb_reason+0xa4/0x230 net/core/skbuff.c:896
 kfree_skb include/linux/skbuff.h:1239 [inline]
 ip6gre_tunnel_xmit+0xfd7/0x1630 net/ipv6/ip6_gre.c:953
 __netdev_start_xmit include/linux/netdevice.h:4930 [inline]
 netdev_start_xmit include/linux/netdevice.h:4944 [inline]
 xmit_one net/core/dev.c:3669 [inline]
 dev_hard_start_xmit+0x20b/0x750 net/core/dev.c:3685
 sch_direct_xmit+0x267/0x8d0 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3906 [inline]
 __dev_queue_xmit+0x15f9/0x3420 net/core/dev.c:4311
 dev_queue_xmit include/linux/netdevice.h:3085 [inline]
 neigh_hh_output include/net/neighbour.h:536 [inline]
 neigh_output include/net/neighbour.h:550 [inline]
 ip6_finish_output2+0x15c0/0x1870 net/ipv6/ip6_output.c:138
 __ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
 ip6_finish_output+0x5f9/0xbb0 net/ipv6/ip6_output.c:216
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0x1d1/0x3b0 net/ipv6/ip6_output.c:237
 dst_output include/net/dst.h:453 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x7e3/0xcf0 net/ipv6/ndisc.c:513
 ndisc_send_rs+0x670/0x870 net/ipv6/ndisc.c:723
 addrconf_rs_timer+0x2c7/0x600 net/ipv6/addrconf.c:4006
 call_timer_fn+0x46/0x2a0 kernel/time/timer.c:1510
 expire_timers kernel/time/timer.c:1555 [inline]
 __run_timers+0x639/0x9a0 kernel/time/timer.c:1826
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1839
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:generic_exec_single+0x2ac/0x3a0 kernel/smp.c:-1
Code: 74 71 e8 87 6e 09 00 43 0f b6 04 3e 84 c0 0f 85 c7 00 00 00 41 c7 04 24 00 00 00 00 bb fa ff ff ff eb 11 e8 66 6e 09 00 31 db <49> bf 00 00 00 00 00 fc ff df 48 c7 44 24 20 0e 36 e0 45 4b c7 44
RSP: 0018:ffffc90009f4fa20 EFLAGS: 00000293
RAX: ffffffff81669a8e RBX: 0000000000000000 RCX: ffff8881082da880
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90009f4fad0 R08: ffff8881082da880 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff81963a10 R12: ffffc90009f4fb28
R13: 1ffff920013e9f48 R14: ffffc90009f4fc60 R15: 0000000000000200
 smp_call_function_single+0x1c5/0x470 kernel/smp.c:784
 task_function_call kernel/events/core.c:120 [inline]
 perf_install_in_context+0x49a/0x730 kernel/events/core.c:2935
 __do_sys_perf_event_open kernel/events/core.c:12721 [inline]
 __se_sys_perf_event_open+0x1281/0x1b80 kernel/events/core.c:12315
 __x64_sys_perf_event_open+0xbf/0xd0 kernel/events/core.c:12315
 x64_sys_call+0x385/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:299
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9ecd78eba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9ece630038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f9ecd9d6090 RCX: 00007f9ecd78eba9
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000000
RBP: 00007f9ecd811e19 R08: 0000000000000002 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9ecd9d6128 R14: 00007f9ecd9d6090 R15: 00007ffe310476c8
 </TASK>