watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.2:7726]
Modules linked in:
irq event stamp: 2409973
hardirqs last enabled at (2409972): [<ffffffff84a514db>] irqentry_exit+0x3b/0x90
hardirqs last disabled at (2409973): [<ffffffff84a4fe9f>] sysvec_apic_timer_interrupt+0xf/0x80
softirqs last enabled at (2400914): [<ffffffff813a960c>] handle_softirqs+0x50c/0x770
softirqs last disabled at (2400947): [<ffffffff813a99a4>] __irq_exit_rcu+0xc4/0x100
CPU: 0 UID: 0 PID: 7726 Comm: syz-executor.2 Not tainted 6.13.0-rc1-next-20241206 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:tcp_rcv_established+0x1d3/0x2160
Code: c2 40 84 d6 0f 85 2f 1c 00 00 83 e0 07 38 c1 0f 9e c2 84 c9 0f 95 c0 84 c2 0f 85 1a 1c 00 00 49 8d 7d 0c 80 a5 ac 09 00 00 fe <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48
RSP: 0018:ffff88806ce09220 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 1ffff1100d9c124b RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff88803f9e25ee
RBP: ffff888015944b00 R08: 0000000000000001 R09: fffffbfff0fddbf7
R10: 0000000000085282 R11: 0000000000000001 R12: ffff8880189e08c0
R13: ffff88803f9e25e2 R14: 000000000003a70c R15: 00000000000000e8
FS: 00007ffbcad55700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555574394c58 CR3: 000000003fb80000 CR4: 0000000000350ef0
Call Trace:
<IRQ>
tcp_v4_do_rcv+0x5cf/0xa50
tcp_v4_rcv+0x31a0/0x42d0
ip_protocol_deliver_rcu+0xba/0x480
ip_local_deliver_finish+0x2f0/0x500
ip_local_deliver+0x1a3/0x200
ip_sublist_rcv_finish+0x274/0x570
ip_list_rcv_finish.constprop.0+0x3fe/0x580
ip_list_rcv+0x2c5/0x3e0
__netif_receive_skb_list_core+0x695/0x8d0
netif_receive_skb_list_internal+0x6c2/0xc90
napi_gro_complete.constprop.0+0x533/0x820
dev_gro_receive+0x14b1/0x2770
napi_gro_receive+0x48c/0xbd0
e1000_clean_rx_irq+0x7e1/0x11a0
e1000_clean+0x960/0x2540
__napi_poll+0xb9/0x540
net_rx_action+0xa08/0xe00
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:qlist_free_all+0x96/0x160
Code: 0f 82 e0 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 b0 8f d2 03 48 01 ca 48 c1 ea 0c 48 c1 e2 06 48 03 15 8e 8f d2 03 48 8b 72 08 <48> 89 d1 40 f6 c6 01 0f 85 a1 00 00 00 66 90 80 79 33 f5 ba 00 00
RSP: 0018:ffff888040af7840 EFLAGS: 00000282
RAX: ffff88800dedede0 RBX: ffff88800dedede0 RCX: ffff88808dedede0
RDX: ffffea000037b780 RSI: ffff888008c4f780 RDI: ffffffff81a47976
RBP: 0000000000000000 R08: 0000000000000001 R09: fffffbfff0fddbe9
R10: ffffffff87eedf4f R11: 0000000000000000 R12: 0000000000000000
R13: ffff888040af7878 R14: ffff88800a129378 R15: ffff88800a129378
kasan_quarantine_reduce+0x19f/0x240
__kasan_slab_alloc+0x49/0x70
__kmalloc_noprof+0x195/0x4b0
kmalloc_array_noprof+0x42/0x70
iter_file_splice_write+0x1a2/0x1060
direct_splice_actor+0x192/0x7a0
splice_direct_to_actor+0x348/0x9d0
do_splice_direct+0x17a/0x250
do_sendfile+0xa7e/0xdb0
__x64_sys_sendfile64+0x1d5/0x210
do_syscall_64+0xbf/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffbcd7dfb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffbcad55188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007ffbcd8f2f60 RCX: 00007ffbcd7dfb19
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000007
RBP: 00007ffbcd839f6d R08: 0000000000000000 R09: 0000000000000000
R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff8e10e16f R14: 00007ffbcad55300 R15: 0000000000022000
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.13.0-rc1-next-20241206 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:queued_spin_lock_slowpath+0x242/0xb60
Code: 02 48 89 e8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 85 08 00 00 b8 01 00 00 00 66 89 45 00 e9 bf fe ff ff 89 44 24 38 f3 90 <e9> 5b fe ff ff 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03
RSP: 0018:ffff88806cf09b90 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff84a7409f
RDX: ffffed1002b28999 RSI: 0000000000000004 RDI: ffff888015944cc0
RBP: ffff888015944cc0 R08: 0000000000000000 R09: ffffed1002b28998
R10: ffff888015944cc3 R11: 0000000000000001 R12: 1ffff1100d9e1373
R13: 0000000000000003 R14: ffffed1002b28998 R15: ffff88806cf09bc8
FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb529d96588 CR3: 000000000d65c000 CR4: 0000000000350ef0
Call Trace:
<NMI>
</NMI>
<IRQ>
do_raw_spin_lock+0x1de/0x270
tcp_delack_timer+0xb8/0x3b0
call_timer_fn+0x198/0x5d0
__run_timers+0x669/0x930
run_timer_softirq+0x117/0x210
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:default_idle+0x1e/0x30
Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 eb 0c 0f 1f 44 00 00 0f 00 2d 79 67 1d 00 0f 1f 44 00 00 fb f4 <fa> e9 ec 2e 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
RSP: 0018:ffff8880096cfe68 EFLAGS: 00000206
RAX: 000000000010f28b RBX: 0000000000000001 RCX: ffffffff84a51847
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff814b16aa
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffed100d9e6cba
R10: ffff88806cf365d3 R11: 0000000000000000 R12: ffffffff863fb690
R13: 1ffff110012d9fd2 R14: 0000000000000000 R15: 0000000000000000
default_idle_call+0x6d/0xb0
do_idle+0x2fa/0x3b0
cpu_startup_entry+0x4f/0x60
start_secondary+0x1c1/0x220
common_startup_64+0x12c/0x138
</TASK>
loop2: detected capacity change from 0 to 40
netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'.
loop2: detected capacity change from 0 to 40
No source specified
syz-executor.2: attempt to access beyond end of device
loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
Buffer I/O error on dev loop2, logical block 10, lost async page write
vfat: Unknown parameter './file1'
loop2: detected capacity change from 0 to 40
audit: type=1400 audit(1733528653.295:13): avc: denied { block_suspend } for pid=7892 comm="syz-executor.7" capability=36 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1
loop7: detected capacity change from 0 to 10
Bluetooth: hci4: command 0x0406 tx timeout
Bluetooth: hci6: command 0x0406 tx timeout
FAT-fs (loop7): Directory bread(block 10) failed
FAT-fs (loop7): Directory bread(block 11) failed
FAT-fs (loop7): Directory bread(block 12) failed
FAT-fs (loop7): Directory bread(block 13) failed
FAT-fs (loop7): Directory bread(block 14) failed
FAT-fs (loop7): Directory bread(block 15) failed
FAT-fs (loop7): Directory bread(block 16) failed
FAT-fs (loop7): Directory bread(block 17) failed
FAT-fs (loop7): Directory bread(block 18) failed
FAT-fs (loop7): Directory bread(block 19) failed
syz-executor.0 (7906) used greatest stack depth: 22312 bytes left
mmap: syz-executor.4 (7909) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
netlink: 'syz-executor.1': attribute type 11 has an invalid length.
Bluetooth: hci1: command 0x0406 tx timeout
Bluetooth: hci2: command 0x0406 tx timeout
Bluetooth: hci5: command 0x0406 tx timeout
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 40 84 d6 test %dl,%sil
3: 0f 85 2f 1c 00 00 jne 0x1c38
9: 83 e0 07 and $0x7,%eax
c: 38 c1 cmp %al,%cl
e: 0f 9e c2 setle %dl
11: 84 c9 test %cl,%cl
13: 0f 95 c0 setne %al
16: 84 c2 test %al,%dl
18: 0f 85 1a 1c 00 00 jne 0x1c38
1e: 49 8d 7d 0c lea 0xc(%r13),%rdi
22: 80 a5 ac 09 00 00 fe andb $0xfe,0x9ac(%rbp)
* 29: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
30: fc ff df
33: 48 89 fa mov %rdi,%rdx
36: 48 c1 ea 03 shr $0x3,%rdx
3a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
3e: 48 rex.W