IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.2:9540] Modules linked in: irq event stamp: 3823029 hardirqs last enabled at (3823028): [] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (3823029): [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (10574): [] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (11631): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (11631): [] irq_exit+0x193/0x240 kernel/softirq.c:409 CPU: 0 PID: 9540 Comm: syz-executor.2 Not tainted 4.14.266-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888099ee0640 task.stack: ffff888091900000 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:192 RSP: 0018:ffff8880ba4071d8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e1279 RBX: 0000000000000286 RCX: 1ffff110133dc1e2 RDX: dffffc0000000000 RSI: ffff888099ee0f68 RDI: 0000000000000286 RBP: ffffffff893df300 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000015 R13: ffff8880ba407260 R14: ffff8880ba407260 R15: ffff8880912745c0 FS: 00007fc396aaa700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1e8c0cff8 CR3: 00000000b5787000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: depot_save_stack+0x1d3/0x3f0 lib/stackdepot.c:280 save_stack mm/kasan/kasan.c:453 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0x139/0x160 mm/kasan/kasan.c:551 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] kmem_cache_alloc+0x111/0x3c0 mm/slab.c:3550 kmem_cache_zalloc include/linux/slab.h:651 [inline] fill_pool lib/debugobjects.c:110 [inline] __debug_object_init+0x578/0x7a0 lib/debugobjects.c:341 debug_object_init lib/debugobjects.c:393 [inline] debug_object_activate+0x391/0x490 lib/debugobjects.c:474 debug_rcu_head_queue kernel/rcu/rcu.h:152 [inline] __call_rcu.constprop.0+0x31/0x7d0 kernel/rcu/tree.c:3050 dst_release+0x56/0x80 net/core/dst.c:188 refdst_drop include/net/dst.h:286 [inline] skb_dst_drop include/net/dst.h:298 [inline] skb_release_head_state+0x1e6/0x250 net/core/skbuff.c:621 skb_release_all net/core/skbuff.c:638 [inline] __kfree_skb net/core/skbuff.c:654 [inline] kfree_skb+0xae/0x390 net/core/skbuff.c:672 ipip_tunnel_xmit+0x18f/0x240 net/ipv4/ipip.c:312 __netdev_start_xmit include/linux/netdevice.h:4052 [inline] netdev_start_xmit include/linux/netdevice.h:4061 [inline] xmit_one net/core/dev.c:3005 [inline] dev_hard_start_xmit+0x188/0x890 net/core/dev.c:3021 __dev_queue_xmit+0x1d7f/0x2480 net/core/dev.c:3521 neigh_output include/net/neighbour.h:500 [inline] ip6_finish_output2+0xf48/0x1f10 net/ipv6/ip6_output.c:120 ip6_finish_output+0x5c6/0xd50 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:239 [inline] ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:209 dst_output include/net/dst.h:470 [inline] NF_HOOK include/linux/netfilter.h:250 [inline] ndisc_send_skb+0x82a/0x1390 net/ipv6/ndisc.c:483 ndisc_send_rs+0x125/0x630 net/ipv6/ndisc.c:677 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3769 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:__sanitizer_cov_trace_pc+0x28/0x50 kernel/kcov.c:93 RSP: 0018:ffff8880919077b8 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10 RAX: ffff888099ee0640 RBX: dffffc0000000000 RCX: ffff8880919079d0 RDX: 0000000000000000 RSI: ffff8880919079d0 RDI: ffffea000229d148 RBP: ffff88809b26a080 R08: ffffffff8b9b28a8 R09: 0000000000040412 R10: ffff888099ee0ec8 R11: ffff888099ee0640 R12: ffffea000229d140 R13: ffffea000229d160 R14: 00007fc397411000 R15: ffffea000229d140 __read_once_size include/linux/compiler.h:185 [inline] compound_head include/linux/page-flags.h:147 [inline] PageAnon include/linux/page-flags.h:406 [inline] mm_counter include/linux/mm.h:1549 [inline] zap_pte_range mm/memory.c:1363 [inline] zap_pmd_range mm/memory.c:1466 [inline] zap_pud_range mm/memory.c:1495 [inline] zap_p4d_range mm/memory.c:1516 [inline] unmap_page_range+0xe61/0x1ce0 mm/memory.c:1537 unmap_single_vma+0x147/0x2b0 mm/memory.c:1582 unmap_vmas+0x9d/0x160 mm/memory.c:1612 exit_mmap+0x270/0x4d0 mm/mmap.c:3058 __mmput kernel/fork.c:931 [inline] mmput kernel/fork.c:952 [inline] mmput+0xfa/0x420 kernel/fork.c:947 exit_mm kernel/exit.c:548 [inline] do_exit+0x984/0x2850 kernel/exit.c:855 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fc397335059 RSP: 002b:00007fc396aaa218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007fc397447f68 RCX: 00007fc397335059 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc397447f68 RBP: 00007fc397447f60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc397447f6c R13: 00007ffe26dd68cf R14: 00007fc396aaa300 R15: 0000000000022000 Code: fa 48 c7 c0 c8 93 f0 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d bc 78 cc 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 d5 00 dc f9 eb c0 0f 0b 0f 0b 48 c7 c7 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9560 Comm: syz-executor.3 Not tainted 4.14.266-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88809858a440 task.stack: ffff888091880000 RIP: 0010:trace_hardirqs_off_caller+0xb9/0x2b0 kernel/locking/lockdep.c:2957 RSP: 0018:ffff8880ba507e68 EFLAGS: 00000006 RAX: 0000000000000003 RBX: ffff88809858a440 RCX: 1ffffffff17d9ba8 RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffff88809858acc4 RBP: ffffffff8149281b R08: ffffffff8c03d188 R09: 0000000000000001 R10: 0000000000000000 R11: ffff88809858a440 R12: ffff88809858a440 R13: 1ffffffff11e127a R14: 000000918da9d9b8 R15: 0000009f79ea4bb0 FS: 00007fd4c28c4700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd4c28c3ff8 CR3: 000000009fc71000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: seqcount_lockdep_reader_access include/linux/seqlock.h:80 [inline] read_seqcount_begin include/linux/seqlock.h:164 [inline] ktime_get+0x9b/0x2c0 kernel/time/timekeeping.c:760 clockevents_program_event+0x108/0x2d0 kernel/time/clockevents.c:331 tick_program_event+0x78/0xd0 kernel/time/tick-oneshot.c:47 hrtimer_interrupt+0x336/0x5e0 kernel/time/hrtimer.c:1334 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline] smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1104 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:__read_once_size include/linux/compiler.h:185 [inline] RIP: 0010:csd_lock_wait kernel/smp.c:108 [inline] RIP: 0010:smp_call_function_single+0x181/0x370 kernel/smp.c:302 RSP: 0018:ffff888091887b60 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10 RAX: ffff88809858a440 RBX: 1ffff11012310f70 RCX: 1ffff110130b159d RDX: 0000000000000000 RSI: ffff88809858acc8 RDI: 0000000000000286 RBP: ffff888091887c10 R08: ffffffff8b9c55f0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: ffff8880a9638080 smp_call_function_many+0x60f/0x7a0 kernel/smp.c:434 smp_call_function kernel/smp.c:492 [inline] on_each_cpu+0x40/0x210 kernel/smp.c:602 hardware_enable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3457 [inline] kvm_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:670 [inline] kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:3294 [inline] kvm_dev_ioctl+0xef2/0x1420 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3345 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fd4c3170059 RSP: 002b:00007fd4c28c4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fd4c3283030 RCX: 00007fd4c3170059 RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000005 RBP: 00007fd4c31ca08d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff6b0a567f R14: 00007fd4c28c4300 R15: 0000000000022000 Code: 00 85 f6 0f 85 4c 01 00 00 48 c7 c0 40 dd ec 8b 48 ba 00 00 00 00 00 fc ff df 48 89 c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 <38> d0 7c 08 84 d2 0f 85 76 01 00 00 8b 0d b5 d6 ab 0a 85 c9 75 ---------------- Code disassembly (best guess): 0: fa cli 1: 48 c7 c0 c8 93 f0 88 mov $0xffffffff88f093c8,%rax 8: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx f: fc ff df 12: 48 c1 e8 03 shr $0x3,%rax 16: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) 1a: 75 2f jne 0x4b 1c: 48 83 3d bc 78 cc 01 cmpq $0x0,0x1cc78bc(%rip) # 0x1cc78e0 23: 00 24: 74 15 je 0x3b 26: 48 89 df mov %rbx,%rdi 29: 57 push %rdi 2a: 9d popfq * 2b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) <-- trapping instruction 30: eb b2 jmp 0xffffffe4 32: e8 d5 00 dc f9 callq 0xf9dc010c 37: eb c0 jmp 0xfffffff9 39: 0f 0b ud2 3b: 0f 0b ud2 3d: 48 rex.W 3e: c7 .byte 0xc7 3f: c7 .byte 0xc7