rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-....: (8340 ticks this GP) idle=f3a/1/0x4000000000000000 softirq=11027/11028 fqs=5119 (t=10500 jiffies g=7369 q=926) NMI backtrace for cpu 0 CPU: 0 PID: 10162 Comm: syz-executor.1 Not tainted 5.12.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x93/0xc2 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x30/0x99 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x11f/0x170 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x211/0x295 kernel/rcu/tree_stall.h:341 print_cpu_stall kernel/rcu/tree_stall.h:622 [inline] check_cpu_stall kernel/rcu/tree_stall.h:697 [inline] rcu_pending kernel/rcu/tree.c:3830 [inline] rcu_sched_clock_irq.cold+0x4dc/0x11c4 kernel/rcu/tree.c:2650 update_process_times+0x13b/0x1c0 kernel/time/timer.c:1796 tick_sched_handle+0x6f/0x130 kernel/time/tick-sched.c:226 tick_sched_timer+0x132/0x210 kernel/time/tick-sched.c:1369 __run_hrtimer kernel/time/hrtimer.c:1537 [inline] __hrtimer_run_queues+0x19e/0xb90 kernel/time/hrtimer.c:1601 hrtimer_interrupt+0x2f9/0x920 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0x146/0x540 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x2e/0x50 kernel/locking/spinlock.c:191 Code: 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 ca f1 1c f9 48 89 ef e8 02 a7 1d f9 80 e7 02 74 06 e8 d8 e4 38 f9 fb bf 01 00 00 00 0d ad 11 f9 65 8b 05 86 ba cd 77 85 c0 74 03 5b 5d c3 e8 a1 06 RSP: 0018:ffffc900000076a0 EFLAGS: 00000202 RAX: 000000000238e1c8 RBX: 0000000000000212 RCX: 1ffffffff1bee1a2 RDX: 0000000000000000 RSI: ffffffff888ad920 RDI: 0000000000000001 RBP: ffffffff8e4a9178 R08: 0000000000000001 R09: ffffffff8df2991f R10: fffffbfff1be5323 R11: 0000000000000001 R12: ffff88801a31c558 R13: 1ffff92000000ee6 R14: ffffffff8e4a9178 R15: ffffffff8e4a9170 __debug_object_init+0x409/0xd10 lib/debugobjects.c:600 debug_object_init lib/debugobjects.c:615 [inline] debug_object_activate+0x32c/0x3e0 lib/debugobjects.c:701 debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline] __call_rcu kernel/rcu/tree.c:3023 [inline] call_rcu+0x2c/0x700 kernel/rcu/tree.c:3114 refdst_drop include/net/dst.h:261 [inline] skb_dst_drop include/net/dst.h:273 [inline] __dev_queue_xmit+0x167c/0x26a0 net/core/dev.c:4153 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x69b/0x1410 net/ipv6/ip6_output.c:117 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ndisc_send_skb+0x96e/0x1480 net/ipv6/ndisc.c:508 addrconf_rs_timer+0x24b/0x720 net/ipv6/addrconf.c:3877 call_timer_fn+0x163/0x4b0 kernel/time/timer.c:1431 expire_timers kernel/time/timer.c:1476 [inline] __run_timers.part.0+0x52a/0x8b0 kernel/time/timer.c:1745 __run_timers kernel/time/timer.c:1726 [inline] run_timer_softirq+0x9c/0x190 kernel/time/timer.c:1758 __do_softirq+0x291/0x9d2 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu kernel/softirq.c:422 [inline] irq_exit_rcu+0x134/0x200 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 RIP: 0010:__orc_find+0x3f/0xf0 arch/x86/kernel/unwind_orc.c:53 Code: 85 d2 0f 84 95 00 00 00 4c 39 e7 49 89 fd 0f 87 9a 00 00 00 49 bf 00 00 00 00 00 fc ff df 49 89 fe 48 89 fd eb 0c 48 8d 6b 04 <49> 89 de 49 39 ec 72 4d 4c 89 e0 48 29 e8 48 89 c2 48 c1 e8 3f 48 RSP: 0018:ffffc9000aa17368 EFLAGS: 00000212 RAX: ffffffff88321a5e RBX: ffffffff8c945c7c RCX: ffffffff88321ad8 RDX: 0000000000000000 RSI: ffffffff8d34494e RDI: ffffffff8c945c50 RBP: ffffffff8c945c80 R08: 0000000000000000 R09: ffffffff8d34494e R10: fffff52001542e9c R11: 0000000000076086 R12: ffffffff8c945ca8 R13: ffffffff8c945c50 R14: ffffffff8c945c50 R15: dffffc0000000000 orc_find arch/x86/kernel/unwind_orc.c:173 [inline] unwind_next_frame+0x32a/0x1ce0 arch/x86/kernel/unwind_orc.c:443 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357 ____kasan_slab_free mm/kasan/common.c:360 [inline] ____kasan_slab_free mm/kasan/common.c:325 [inline] __kasan_slab_free+0xda/0x110 mm/kasan/common.c:367 kasan_slab_free include/linux/kasan.h:199 [inline] slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x51/0x130 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kfree+0xdb/0x360 mm/slub.c:4213 l2cap_conn_del+0x40e/0x710 net/bluetooth/l2cap_core.c:1906 hci_disconn_cfm include/net/bluetooth/hci_core.h:1486 [inline] hci_conn_hash_flush+0xfb/0x210 net/bluetooth/hci_conn.c:1598 hci_dev_do_close+0x470/0xed0 net/bluetooth/hci_core.c:1778 hci_unregister_dev+0x21e/0xfb0 net/bluetooth/hci_core.c:3989 vhci_release+0x62/0xd0 drivers/bluetooth/hci_vhci.c:340 __fput+0x209/0x870 fs/file_table.c:280 task_work_run+0xc0/0x160 kernel/task_work.c:140 exit_task_work include/linux/task_work.h:30 [inline] do_exit+0xa26/0x2500 kernel/exit.c:825 do_group_exit+0xe7/0x290 kernel/exit.c:922 get_signal+0x3c1/0x1bf0 kernel/signal.c:2781 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:789 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x465b09 Code: Unable to access opcode bytes at RIP 0x465adf. RSP: 002b:00007f0251c29218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 000000000056bf68 RCX: 0000000000465b09 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000056bf6c RBP: 000000000056bf60 R08: 000000000000000e R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf6c R13: 00007ffe0794cfff R14: 00007f0251c29300 R15: 0000000000022000