watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.1:55622] Modules linked in: irq event stamp: 4540107 hardirqs last enabled at (4540106): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (4540107): [] sysvec_apic_timer_interrupt+0xf/0xc0 softirqs last enabled at (4368308): [] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (4368311): [] __irq_exit_rcu+0x11b/0x180 CPU: 0 PID: 55622 Comm: syz-executor.1 Not tainted 6.1.0-rc6-next-20221124 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:unwind_next_frame+0x44/0x2130 Code: 89 fe 41 55 41 54 55 53 48 83 ec 48 0f b6 04 02 84 c0 74 08 3c 03 0f 8e d2 08 00 00 41 8b 1e 31 c0 85 db 75 13 48 83 c4 48 5b <5d> 41 5c 41 5d 41 5e 41 5f e9 d2 55 2e 03 48 b8 00 00 00 00 00 fc RSP: 0018:ffff88806ce087d8 EFLAGS: 00000292 RAX: 0000000000000001 RBX: ffffffff81380e50 RCX: 0000000000000000 RDX: 0000000000000506 RSI: ffff88802301f4a0 RDI: 0000000000000001 RBP: ffff888023018000 R08: ffffffff860f6bd8 R09: ffffffff860f6bdc R10: ffff88806ce09ff8 R11: ffff88806ce08848 R12: ffff88806ce08849 R13: ffff88806ce08868 R14: ffff88806ce08808 R15: 0000000000000005 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055555697cc58 CR3: 0000000005426000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x5c/0x70 kmem_cache_alloc+0x1e0/0x410 skb_clone+0x172/0x3c0 dev_queue_xmit_nit+0x39c/0xb10 dev_hard_start_xmit+0xa7/0x810 sch_direct_xmit+0x263/0x7b0 __dev_queue_xmit+0x149a/0x37c0 ip_finish_output2+0x137c/0x1fb0 __ip_finish_output.part.0+0x560/0xd10 ip_output+0x2ec/0x8e0 ip_local_out+0x357/0x4c0 __ip_queue_xmit+0x852/0x1a50 __tcp_transmit_skb+0x2a2a/0x3520 __tcp_send_ack.part.0+0x3b1/0x620 tcp_send_ack+0x81/0xa0 __tcp_ack_snd_check+0x156/0x9d0 tcp_rcv_established+0x91e/0x2110 tcp_v4_do_rcv+0x690/0x9c0 tcp_v4_rcv+0x31a6/0x3870 ip_protocol_deliver_rcu+0xbe/0x800 ip_local_deliver_finish+0x2e0/0x4c0 ip_local_deliver+0x1b2/0x200 ip_sublist_rcv_finish+0x274/0x570 ip_sublist_rcv+0x3fd/0x800 ip_list_rcv+0x2a2/0x3a0 __netif_receive_skb_list_core+0x695/0x8d0 netif_receive_skb_list_internal+0x6d0/0xca0 napi_complete_done+0x242/0x850 e1000_clean+0x9b8/0x1c60 __napi_poll+0xb9/0x690 net_rx_action+0x9b4/0xd10 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:lock_release+0x49b/0x750 Code: 85 30 02 00 00 48 8b 1d 93 d4 a2 04 48 85 db 74 30 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 08 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 5c 02 00 00 48 8b 7b 08 48 8b 54 24 08 4c 89 e6 e8 8e 54 fe RSP: 0018:ffff88802301f370 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff88801e0edc90 RCX: ffffffff812c0e92 RDX: 1ffff11003c1db93 RSI: 0000000000000008 RDI: ffff88801e0edc98 RBP: 1ffff11004603e70 R08: 0000000000000000 R09: ffffffff85d11917 R10: fffffbfff0ba2322 R11: 0000000000000001 R12: ffff88806ce3f358 R13: 00000000000411f8 R14: 0000000000000000 R15: ffff88807ffdc500 _raw_spin_unlock+0x16/0x50 free_unref_page+0x291/0x3c0 qlist_free_all+0x6d/0x1a0 kasan_quarantine_reduce+0x196/0x230 __kasan_slab_alloc+0x4c/0x70 kmem_cache_alloc+0x1e0/0x410 jbd2__journal_start+0x194/0x8d0 __ext4_journal_start_sb+0x395/0x470 ext4_dirty_inode+0xa1/0x110 __mark_inode_dirty+0x1aa/0xe70 generic_update_time+0x21b/0x2b0 file_modified_flags+0x2d4/0x330 ext4_buffered_write_iter+0xf9/0x460 ext4_file_write_iter+0x3ff/0x1910 __kernel_write_iter+0x264/0x740 __kernel_write+0xcb/0x110 do_acct_process+0xd8a/0x13d0 acct_process+0x3d4/0x500 do_exit+0x17b0/0x2720 do_group_exit+0xd4/0x2a0 get_signal+0x21a5/0x22e0 arch_do_signal_or_restart+0x79/0x5a0 exit_to_user_mode_prepare+0x131/0x1a0 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f6f0aeb9b19 Code: Unable to access opcode bytes at 0x7f6f0aeb9aef. RSP: 002b:00007f6f0842f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: 0000000000000220 RBX: 00007f6f0afccf60 RCX: 00007f6f0aeb9b19 RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000005 RBP: 00007f6f0af13f6d R08: 0000000000000000 R09: 0000000000000000 R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffeb53bb23f R14: 00007f6f0842f300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 259 Comm: sshd Not tainted 6.1.0-rc6-next-20221124 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:queued_spin_lock_slowpath+0x128/0xc80 Code: 00 00 00 65 48 2b 04 25 28 00 00 00 0f 85 cd 0a 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 ee 1f 00 00 f3 90 71 ff ff ff 44 8b 74 24 48 41 81 fe 00 01 00 00 0f 84 e5 00 00 RSP: 0018:ffff88801e3a7908 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff8440f1db RDX: ffffed100309e194 RSI: 0000000000000004 RDI: ffff8880184f0c98 RBP: ffff8880184f0c98 R08: 0000000000000000 R09: ffff8880184f0c9b R10: ffffed100309e193 R11: 0000000000000001 R12: 0000000000000003 R13: ffffed100309e193 R14: 0000000000000001 R15: 1ffff11003c74f22 FS: 00007fb428390900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faa799c3890 CR3: 000000000d5b2000 CR4: 0000000000350ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: do_raw_spin_lock+0x1e0/0x270 lock_sock_nested+0x5f/0xf0 tcp_recvmsg+0xf8/0x640 inet_recvmsg+0x12b/0x650 sock_recvmsg+0x12f/0x190 sock_read_iter+0x2c1/0x3b0 vfs_read+0x88c/0x9f0 ksys_read+0x1f4/0x260 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fb428872e8e Code: c0 e9 b6 fe ff ff 50 48 8d 3d 6e 18 0a 00 e8 b9 e7 01 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 RSP: 002b:00007ffdf7c06408 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007ffdf7c0a49f RCX: 00007fb428872e8e RDX: 0000000000004000 RSI: 00007ffdf7c06410 RDI: 0000000000000004 RBP: 0000000000000004 R08: 0000000000000368 R09: 00007ffdf7df5080 R10: 00007ffdf7df50f0 R11: 0000000000000246 R12: 000055c344217ec0 R13: 00007ffdf7c06410 R14: 0000000000000004 R15: 000055c343965a80 sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 0, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 1 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 1, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 2, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 3 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 3, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 4, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 5 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 5, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 6, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 7 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 7, async page read ---------------- Code disassembly (best guess): 0: 89 fe mov %edi,%esi 2: 41 55 push %r13 4: 41 54 push %r12 6: 55 push %rbp 7: 53 push %rbx 8: 48 83 ec 48 sub $0x48,%rsp c: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax 10: 84 c0 test %al,%al 12: 74 08 je 0x1c 14: 3c 03 cmp $0x3,%al 16: 0f 8e d2 08 00 00 jle 0x8ee 1c: 41 8b 1e mov (%r14),%ebx 1f: 31 c0 xor %eax,%eax 21: 85 db test %ebx,%ebx 23: 75 13 jne 0x38 25: 48 83 c4 48 add $0x48,%rsp 29: 5b pop %rbx * 2a: 5d pop %rbp <-- trapping instruction 2b: 41 5c pop %r12 2d: 41 5d pop %r13 2f: 41 5e pop %r14 31: 41 5f pop %r15 33: e9 d2 55 2e 03 jmpq 0x32e560a 38: 48 rex.W 39: b8 00 00 00 00 mov $0x0,%eax 3e: 00 fc add %bh,%ah