watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.4:9541] Modules linked in: irq event stamp: 4181287 hardirqs last enabled at (4181286): [<ffffffff87400976>] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (4181287): [<ffffffff874018ae>] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (15562): [<ffffffff8760068b>] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (16785): [<ffffffff81321cf3>] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (16785): [<ffffffff81321cf3>] irq_exit+0x193/0x240 kernel/softirq.c:409 CPU: 0 PID: 9541 Comm: syz-executor.4 Not tainted 4.14.277-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8880b3a4a340 task.stack: ffff88809d4e0000 RIP: 0010:should_failslab+0xb5/0x130 mm/failslab.c:32 RSP: 0018:ffff8880ba407b88 EFLAGS: 00000a07 ORIG_RAX: ffffffffffffff10 RAX: dffffc0000000000 RBX: ffff88813fe74940 RCX: 00000000000001c0 RDX: 0000000000000000 RSI: 0000000001090220 RDI: ffff88813fe749b4 RBP: 0000000001090220 R08: 0000000000000140 R09: 0000000000000001 R10: 0000000000000000 R11: ffff8880b3a4a340 R12: 0000000000000000 R13: 0000000001090220 R14: 00000000000001c0 R15: ffff88809c702680 FS: 00007f804c814700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2fe21000 CR3: 00000000b380d000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3297 [inline] kmem_cache_alloc_node_trace+0x58/0x400 mm/slab.c:3659 __do_kmalloc_node mm/slab.c:3681 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x96/0x510 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] ndisc_alloc_skb+0x134/0x310 net/ipv6/ndisc.c:402 ndisc_send_rs+0x2ec/0x630 net/ipv6/ndisc.c:661 addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3769 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 </IRQ> RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline] RIP: 0010:_raw_spin_unlock_irq+0x50/0x80 kernel/locking/spinlock.c:200 RSP: 0018:ffff88809d4e75d8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e1313 RBX: ffff8880b3a4a340 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880b3a4abc4 RBP: ffff8880ba434380 R08: ffffffff8b9caa48 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ba434380 R13: ffff888078d48600 R14: 0000000000000000 R15: ffff8880ba434cd0 finish_lock_switch kernel/sched/sched.h:1346 [inline] finish_task_switch+0x178/0x610 kernel/sched/core.c:2678 context_switch kernel/sched/core.c:2814 [inline] __schedule+0x893/0x1de0 kernel/sched/core.c:3387 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:3511 ___preempt_schedule+0x16/0x18 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] _raw_spin_unlock_irqrestore+0xaf/0xe0 kernel/locking/spinlock.c:192 __skb_wait_for_more_packets+0x170/0x480 net/core/datagram.c:122 __skb_recv_datagram+0x131/0x1b0 net/core/datagram.c:313 skb_recv_datagram+0x91/0xc0 net/core/datagram.c:324 rawv6_recvmsg+0x1a1/0xb70 net/ipv6/raw.c:485 sock_common_recvmsg+0xe1/0x170 net/core/sock.c:2995 ___sys_recvmsg+0x20b/0x4d0 net/socket.c:2221 __sys_recvmmsg+0x1f3/0x5d0 net/socket.c:2329 SYSC_recvmmsg net/socket.c:2405 [inline] SyS_recvmmsg+0x125/0x140 net/socket.c:2394 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f804de9f0e9 RSP: 002b:00007f804c814168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f804dfb1f60 RCX: 00007f804de9f0e9 RDX: 000000000000045b RSI: 0000000020008880 RDI: 0000000000000005 RBP: 00007f804def908d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe21f1a70f R14: 00007f804c814300 R15: 0000000000022000 Code: c0 74 04 3c 03 7e 76 f6 43 23 02 74 60 e8 84 3b d6 ff 48 8d 7b 74 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 48 48 63 73 74 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4630 Comm: systemd-udevd Not tainted 4.14.277-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88809afbe2c0 task.stack: ffff88809afc0000 RIP: 0010:find_held_lock+0x2/0x210 kernel/locking/lockdep.c:3596 RSP: 0018:ffff88809afc77b0 EFLAGS: 00000002 RAX: 0000000000000001 RBX: 1ffff110135f8efb RCX: ffff88809afc77f8 RDX: 0000000000000001 RSI: ffffffff88f77ec0 RDI: ffff88809afbe2c0 RBP: ffffffff88f77ec0 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: ffff88809afbe2c0 R12: ffffffff815e3961 R13: ffffffff8bed1d40 R14: ffff88809afbe2c0 R15: 0000000000000001 FS: 00007fadf88a08c0(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005585e79203e0 CR3: 000000009a8dd000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __lock_release kernel/locking/lockdep.c:3767 [inline] lock_release+0x237/0x870 kernel/locking/lockdep.c:4017 rcu_lock_release include/linux/rcupdate.h:247 [inline] rcu_read_unlock include/linux/rcupdate.h:685 [inline] is_bpf_text_address+0xb8/0x150 kernel/bpf/core.c:502 kernel_text_address kernel/extable.c:150 [inline] kernel_text_address+0xbd/0xf0 kernel/extable.c:120 __kernel_text_address+0x9/0x30 kernel/extable.c:105 unwind_get_return_address arch/x86/kernel/unwind_orc.c:252 [inline] unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:247 __save_stack_trace+0xa0/0x160 arch/x86/kernel/stacktrace.c:45 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kmem_cache_free+0x7c/0x2b0 mm/slab.c:3758 putname+0xcd/0x110 fs/namei.c:259 filename_lookup+0x37b/0x510 fs/namei.c:2386 user_path_at include/linux/namei.h:57 [inline] vfs_statx+0xd1/0x180 fs/stat.c:185 vfs_lstat include/linux/fs.h:3072 [inline] SYSC_newlstat fs/stat.c:349 [inline] SyS_newlstat+0x83/0xe0 fs/stat.c:343 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fadf7712335 RSP: 002b:00007fff44fa75e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000006 RAX: ffffffffffffffda RBX: 00005585e78ca8b0 RCX: 00007fadf7712335 RDX: 00007fff44fa7620 RSI: 00007fff44fa7620 RDI: 00005585e78c98b0 RBP: 00007fff44fa76e0 R08: 00007fadf79d11b8 R09: 0000000000001010 R10: 0000000000000210 R11: 0000000000000246 R12: 00005585e78c98b0 R13: 00005585e78c98bc R14: 00005585e78d8f55 R15: 00005585e78d8f5c Code: bd 3d 00 e9 46 fd ff ff 48 c7 c7 88 98 f0 88 e8 f5 bc 3d 00 e9 36 ff ff ff e9 c1 2d c1 05 66 66 2e 0f 1f 84 00 00 00 00 00 41 57 <49> 89 f7 41 56 49 89 ce 41 55 44 8d 6a ff 49 63 c5 41 54 48 8d ---------------- Code disassembly (best guess): 0: c0 74 04 3c 03 shlb $0x3,0x3c(%rsp,%rax,1) 5: 7e 76 jle 0x7d 7: f6 43 23 02 testb $0x2,0x23(%rbx) b: 74 60 je 0x6d d: e8 84 3b d6 ff callq 0xffd63b96 12: 48 8d 7b 74 lea 0x74(%rbx),%rdi 16: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 1d: fc ff df 20: 48 89 fa mov %rdi,%rdx 23: 48 c1 ea 03 shr $0x3,%rdx 27: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx * 2b: 48 89 f8 mov %rdi,%rax <-- trapping instruction 2e: 83 e0 07 and $0x7,%eax 31: 83 c0 03 add $0x3,%eax 34: 38 d0 cmp %dl,%al 36: 7c 04 jl 0x3c 38: 84 d2 test %dl,%dl 3a: 75 48 jne 0x84 3c: 48 63 73 74 movslq 0x74(%rbx),%rsi