watchdog: BUG: soft lockup - CPU#0 stuck for 121s! [syz.0.1258:5940]
Modules linked in:
CPU: 0 PID: 5940 Comm: syz.0.1258 Not tainted 5.15.151-syzkaller-00134-gd0a6506ecafd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
RIP: 0010:page_ext_invalid mm/page_ext.c:259 [inline]
RIP: 0010:lookup_page_ext mm/page_ext.c:275 [inline]
RIP: 0010:page_ext_get+0xf1/0x140 mm/page_ext.c:148
Code: e8 14 39 b8 ff 31 db 48 83 c3 10 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 28 73 fa ff 4c 8b 33 44 89 f3 83 e3 01 <31> ff 48 89 de e8 25 3d b8 ff 4d 85 f6 74 19 48 85 db 75 14 4c 0f
RSP: 0018:ffffc90000005918 EFLAGS: 00000246
RAX: 1ffff11047ffea9e RBX: 0000000000000000 RCX: ffff888113f6bb40
RDX: 0000000000000504 RSI: 0000000004e09180 RDI: 000000ffffffffc0
RBP: ffffc90000005938 R08: ffffffff81b808db R09: 0000000000000003
R10: fffff52000000adc R11: dffffc0000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff888100b80000 R15: 0000000000138246
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff3a085ffce CR3: 000000011e564000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 __set_page_owner+0x33/0x2e0 mm/page_owner.c:202
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2605
 prep_new_page+0x1b/0x110 mm/page_alloc.c:2611
 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4485
 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5777
 allocate_slab mm/slub.c:1932 [inline]
 new_slab+0x9a/0x4e0 mm/slub.c:1995
 ___slab_alloc+0x39e/0x830 mm/slub.c:3028
 __slab_alloc+0x4a/0x90 mm/slub.c:3115
 slab_alloc_node mm/slub.c:3206 [inline]
 slab_alloc mm/slub.c:3248 [inline]
 kmem_cache_alloc+0x134/0x200 mm/slub.c:3253
 skb_clone+0x1d1/0x360 net/core/skbuff.c:1547
 dev_queue_xmit_nit+0x25b/0xa40 net/core/dev.c:2317
 xmit_one net/core/dev.c:3619 [inline]
 dev_hard_start_xmit+0x149/0x620 net/core/dev.c:3640
 sch_direct_xmit+0x298/0x9b0 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3851 [inline]
 __dev_queue_xmit+0x161e/0x2e70 net/core/dev.c:4220
 dev_queue_xmit+0x17/0x20 net/core/dev.c:4288
 neigh_resolve_output+0x6b8/0x760 net/core/neighbour.c:1504
 neigh_output include/net/neighbour.h:517 [inline]
 ip_finish_output2+0xbe3/0xf60 net/ipv4/ip_output.c:228
 __ip_finish_output+0x162/0x360
 ip_finish_output+0x31/0x210 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip_output+0x1d6/0x420 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:444 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0x1105/0x1c20 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x4c/0x70 net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x1e84/0x3920 net/ipv4/tcp_output.c:1402
 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline]
 tcp_write_xmit+0x144a/0x5e80 net/ipv4/tcp_output.c:2705
 __tcp_push_pending_frames+0x98/0x2f0 net/ipv4/tcp_output.c:2890
 tcp_push_pending_frames include/net/tcp.h:1915 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5495 [inline]
 tcp_rcv_established+0xd4a/0x1ac0 net/ipv4/tcp_input.c:5906
 tcp_v4_do_rcv+0x3d7/0xa00 net/ipv4/tcp_ipv4.c:1722
 tcp_v4_rcv+0x23dd/0x2a70 net/ipv4/tcp_ipv4.c:2125
 ip_protocol_deliver_rcu+0x32f/0x710 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ip_local_deliver+0x2c6/0x590 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:454 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:577 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline]
 ip_sublist_rcv+0x7e2/0x980 net/ipv4/ip_input.c:636
 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:671
 __netif_receive_skb_list_ptype net/core/dev.c:5535 [inline]
 __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5583
 __netif_receive_skb_list net/core/dev.c:5635 [inline]
 netif_receive_skb_list_internal+0x967/0xcc0 net/core/dev.c:5726
 gro_normal_list net/core/dev.c:5880 [inline]
 gro_normal_one net/core/dev.c:5893 [inline]
 napi_skb_finish net/core/dev.c:6230 [inline]
 napi_gro_receive+0x45f/0x920 net/core/dev.c:6260
 receive_buf+0x37ce/0x5720 drivers/net/virtio_net.c:1208
 virtnet_receive drivers/net/virtio_net.c:1472 [inline]
 virtnet_poll+0x628/0x1260 drivers/net/virtio_net.c:1585
 __napi_poll+0xc4/0x5a0 net/core/dev.c:7042
 napi_poll net/core/dev.c:7109 [inline]
 net_rx_action+0x47d/0xc50 net/core/dev.c:7196
 __do_softirq+0x26d/0x5bf kernel/softirq.c:565
 invoke_softirq kernel/softirq.c:425 [inline]
 __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:648
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:660
 sysvec_apic_timer_interrupt+0x9a/0xc0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:preempt_schedule_irq+0xc2/0x140 kernel/sched/core.c:6916
Code: 4c 89 e7 e8 c0 e7 ce fc f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 e4 95 68 fc fb bf 01 00 00 00 <e8> e9 e3 ff ff fa bf 01 00 00 00 e8 6e 97 68 fc 65 48 8b 1d 66 d8
RSP: 0018:ffffc900009e7220 EFLAGS: 00000246
RAX: 1ffff110227ed8be RBX: 1ffff9200013ce48 RCX: ffffffff84e56700
RDX: 1ffff110227ed76d RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc900009e72a8 R08: ffffffff874c5000 R09: ffffffff874c5008
R10: ffffffff874c5018 R11: ffffffff874c5010 R12: ffffc900009e7240
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200013ce44
 irqentry_exit_cond_resched+0x2a/0x30 kernel/entry/common.c:392
 irqentry_exit+0x30/0x40 kernel/entry/common.c:426
 sysvec_apic_timer_interrupt+0x55/0xc0 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__srcu_read_unlock+0x2f/0x70 kernel/rcu/srcutree.c:419
Code: 56 53 41 89 f6 48 89 fb f0 83 44 24 fc 00 48 81 c3 00 01 00 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 <74> 08 48 89 df e8 77 8a 56 00 48 8b 1b 41 83 fe 03 73 0e 49 63 c6
RSP: 0018:ffffc900009e73a0 EFLAGS: 00000246
RAX: 1ffffffff0ea4670 RBX: ffffffff87523380 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff87523280
RBP: ffffc900009e73b0 R08: ffffffff81ccc2a0 R09: ffffed103ee27182
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: 1ffff9200013ce7c R14: 0000000000000000 R15: 0000000000000000
 fsnotify_destroy_marks+0x15e/0x4f0 fs/notify/mark.c:801
 fsnotify_clear_marks_by_inode fs/notify/fsnotify.h:60 [inline]
 __fsnotify_inode_delete+0x1c/0x20 fs/notify/fsnotify.c:22
 fsnotify_inode_delete include/linux/fsnotify.h:193 [inline]
 __destroy_inode+0x181/0x4e0 fs/inode.c:262
 destroy_inode fs/inode.c:284 [inline]
 evict+0x538/0x630 fs/inode.c:602
 iput_final fs/inode.c:1705 [inline]
 iput+0x63b/0x7e0 fs/inode.c:1731
 dentry_unlink_inode+0x34f/0x440 fs/dcache.c:376
 __dentry_kill+0x447/0x660 fs/dcache.c:582
 shrink_dentry_list+0x35e/0x4b0 fs/dcache.c:1177
 shrink_dcache_parent+0xc9/0x340
 do_one_tree+0x27/0xe0 fs/dcache.c:1658
 shrink_dcache_for_umount+0x7d/0x120 fs/dcache.c:1675
 generic_shutdown_super+0x69/0x2e0 fs/super.c:447
 kill_anon_super fs/super.c:1076 [inline]
 kill_litter_super+0x76/0xa0 fs/super.c:1085
 deactivate_locked_super+0xad/0x110 fs/super.c:335
 deactivate_super+0xbe/0xf0 fs/super.c:366
 cleanup_mnt+0x45c/0x510 fs/namespace.c:1143
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1150
 task_work_run+0x129/0x190 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0xc48/0x2ca0 kernel/exit.c:878
 do_group_exit+0x141/0x310 kernel/exit.c:1000
 get_signal+0x7a3/0x1630 kernel/signal.c:2896
 arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x26/0x160 kernel/entry/common.c:301
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fb9c74303b9
Code: Unable to access opcode bytes at RIP 0x7fb9c743038f.
RSP: 002b:00007fb9c60b00f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fb9c75bef88 RCX: 00007fb9c74303b9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fb9c75bef88
RBP: 00007fb9c75bef80 R08: 00007fb9c60b06c0 R09: 00007fb9c60b06c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb9c75bef8c
R13: 000000000000000b R14: 00007ffca24ab3a0 R15: 00007ffca24ab488
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 279 Comm: kworker/u4:3 Not tainted 5.15.151-syzkaller-00134-gd0a6506ecafd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:__sanitizer_cov_trace_pc+0x5d/0x60 kernel/kcov.c:207
Code: 0b 00 00 83 fa 02 75 21 48 8b 91 40 0b 00 00 48 8b 32 48 8d 7e 01 8b 89 3c 0b 00 00 48 39 cf 73 08 48 89 44 f2 08 48 89 3a 5d <c3> 66 90 55 48 89 e5 4c 8b 45 08 65 48 8b 15 a0 2a 92 7e 65 8b 05
RSP: 0018:ffffc90000967878 EFLAGS: 00000293
RAX: ffffffff81659ddb RBX: 1ffff1103ee07af1 RCX: ffff8881193662c0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000967998 R08: ffffffff81659daa R09: ffffed103ee271d3
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff8881f703d788 R14: ffff8881f7138e80 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b88671000 CR3: 0000000006a0f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1135
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1201 [inline]
 text_poke_bp_batch+0x1c4/0x5d0 arch/x86/kernel/alternative.c:1392
 text_poke_flush arch/x86/kernel/alternative.c:1560 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1567
 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
 __jump_label_update+0x36a/0x380 kernel/jump_label.c:459
 jump_label_update+0x3af/0x450 kernel/jump_label.c:830
 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177
 static_key_enable+0x1a/0x30 kernel/jump_label.c:190
 toggle_allocation_gate+0xbf/0x460 mm/kfence/core.c:729
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>