syzbot

watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz-executor:11584]
Modules linked in:
CPU: 1 PID: 11584 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:native_restore_fl arch/x86/include/asm/irqflags.h:41 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:84 [inline]
RIP: 0010:kvm_wait+0xce/0x130 arch/x86/kernel/kvm.c:926
Code: 38 f0 75 26 41 f7 c4 00 02 00 00 75 0f 0f 1f 44 00 00 0f 00 2d 03 20 b8 03 f4 eb 0e 0f 1f 44 00 00 0f 00 2d f4 1f b8 03 fb f4 <4c> 89 64 24 18 ff 74 24 18 9d 48 c7 44 24 20 0e 36 e0 45 4b c7 04
RSP: 0018:ffffc90001596f80 EFLAGS: 00000246
RAX: 0000000000000003 RBX: ffffffff86eb2520 RCX: 0000000086eb2500
RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffffff86eb2520
RBP: ffffc90001597030 R08: 0000000000000000 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0dd64a4 R12: 0000000000000246
R13: ddda9f2c6d7a7460 R14: dffffc0000000000 R15: 1ffff920002b2df4
FS:  000055557694f500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055557696a918 CR3: 00000001174e5000 CR4: 00000000003506a0
DR0: 0000200000000300 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 pv_wait arch/x86/include/asm/paravirt.h:564 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:470 [inline]
 __pv_queued_spin_lock_slowpath+0x72d/0xb80 kernel/locking/qspinlock.c:508
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:554 [inline]
 queued_spin_lock_slowpath+0x47/0x50 arch/x86/include/asm/qspinlock.h:51
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:184 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0xe4/0xf0 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:355 [inline]
 alloc_vmap_area+0x218/0x19d0 mm/vmalloc.c:1216
 __get_vm_area_node+0x147/0x450 mm/vmalloc.c:2099
 __vmalloc_node_range+0xe7/0x7a0 mm/vmalloc.c:2598
 __vmalloc_node mm/vmalloc.c:2689 [inline]
 vzalloc+0x78/0x90 mm/vmalloc.c:2742
 alloc_counters+0x65/0x540 net/ipv4/netfilter/arp_tables.c:671
 copy_entries_to_user net/ipv4/netfilter/arp_tables.c:692 [inline]
 get_entries net/ipv4/netfilter/arp_tables.c:876 [inline]
 do_arpt_get_ctl+0x9ec/0xff0 net/ipv4/netfilter/arp_tables.c:1469
 nf_getsockopt+0x26d/0x290 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0x134c/0x17a0 net/ipv4/ip_sockglue.c:1797
 tcp_getsockopt+0x1e2/0x1ff0 net/ipv4/tcp.c:4049
 sock_common_getsockopt+0x98/0xb0 net/core/sock.c:3299
 __sys_getsockopt+0x201/0x370 net/socket.c:2188
 __do_sys_getsockopt net/socket.c:2203 [inline]
 __se_sys_getsockopt net/socket.c:2200 [inline]
 __x64_sys_getsockopt+0xbf/0xd0 net/socket.c:2200
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f1b341a262a
Code: 48 83 ec 10 89 d2 48 63 ff 45 31 c9 6a 2a 45 31 c0 31 c9 e8 d8 99 fb ff 48 83 c4 18 c3 0f 1f 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7
RSP: 002b:00007ffc3ba918f8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1b341a262a
RDX: 0000000000000061 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffc3ba91960 R08: 00007ffc3ba9190c R09: 0000000000000000
R10: 00007ffc3ba91960 R11: 0000000000000212 R12: 00007ffc3ba9190c
R13: 00007f1b342378bd R14: 0000000000060136 R15: 00007ffc3ba92050
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 15847 Comm: syz.1.4370 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:perf_callchain_store include/linux/perf_event.h:1303 [inline]
RIP: 0010:perf_callchain_kernel+0x358/0x6c0 arch/x86/events/core.c:2567
Code: 44 8b 20 44 89 ef 44 89 e6 e8 84 df 63 00 45 39 e5 0f 83 49 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 30 0f b6 04 01 <84> c0 0f 85 f7 00 00 00 48 8b 44 24 18 80 38 01 4c 8b 64 24 10 0f
RSP: 0018:ffffc90000006f60 EFLAGS: 00000097
RAX: 0000000000000000 RBX: ffffc90000006fc0 RCX: 1ffff92000000e1e
RDX: ffff88811f6d62c0 RSI: 000000000000007f RDI: 000000000000001b
RBP: ffffc90000007090 R08: ffffc90000007001 R09: ffffc90000006fc0
R10: dffffc0000000000 R11: fffff52000000e04 R12: 000000000000007f
R13: 000000000000001b R14: ffffffff8199619c R15: 1ffff92000000e1d
FS:  00007f978cc256c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c29a75e CR3: 0000000120a05000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 get_perf_callchain+0x356/0x460 kernel/events/callchain.c:200
 perf_callchain kernel/events/core.c:7225 [inline]
 perf_prepare_sample+0x349/0x1950 kernel/events/core.c:7252
 __perf_event_output kernel/events/core.c:7410 [inline]
 perf_event_output_forward+0xd1/0x1a0 kernel/events/core.c:7430
 __perf_event_overflow+0x19d/0x350 kernel/events/core.c:9086
 perf_swevent_hrtimer+0x3cb/0x570 kernel/events/core.c:10489
 __run_hrtimer kernel/time/hrtimer.c:1587 [inline]
 __hrtimer_run_queues+0x33a/0x7d0 kernel/time/hrtimer.c:1651
 hrtimer_interrupt+0x313/0xc80 kernel/time/hrtimer.c:1713
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0xfa/0x3f0 arch/x86/kernel/apic/apic.c:1112
 run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:91 [inline]
 sysvec_apic_timer_interrupt+0xba/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:190
Code: 00 00 00 0f 0b 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb e8 13 00 00 00 48 8b 3d 6c cb 5e 05 48 89 de e8 c4 d6 39 00 5b 5d c3 00 <55> 48 89 e5 48 8b 45 08 65 48 8b 0d 10 ca 9d 7e 65 8b 15 15 ca 9d
RSP: 0018:ffffc900000078d8 EFLAGS: 00000246
RAX: ffffffff83984aa3 RBX: ffff888147b9d140 RCX: 0000000000000102
RDX: ffff88811f6d62c0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007910 R08: ffff88811f6d62c0 R09: 0000000000000003
R10: 0000000000000002 R11: 0000000000000102 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000080 R15: ffff88810d4abc00
 deliver_clone net/bridge/br_forward.c:119 [inline]
 br_flood+0x384/0x420 net/bridge/br_forward.c:233
 br_handle_frame_finish+0xcd0/0x10f0 net/bridge/br_input.c:173
 nf_hook_bridge_pre net/bridge/br_input.c:259 [inline]
 br_handle_frame+0x406/0x8e0 net/bridge/br_input.c:363
 __netif_receive_skb_core+0xed5/0x30b0 net/core/dev.c:5307
 __netif_receive_skb_one_core net/core/dev.c:5411 [inline]
 __netif_receive_skb+0x72/0x280 net/core/dev.c:5527
 process_backlog+0x351/0x600 net/core/dev.c:6434
 napi_poll net/core/dev.c:6885 [inline]
 net_rx_action+0x48d/0xed0 net/core/dev.c:6955
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:find_stack lib/stackdepot.c:208 [inline]
RIP: 0010:__stack_depot_save+0x1bb/0x4c0 lib/stackdepot.c:305
Code: 0e 44 29 c6 31 f3 c1 c6 18 29 f3 4c 8b 3d 05 4f 96 04 41 89 de 41 81 e6 ff 0f 00 00 4f 8b 24 f7 4d 85 e4 74 5e 44 89 ee eb 09 <4d> 8b 24 24 4d 85 e4 74 50 41 39 5c 24 08 75 f0 45 39 6c 24 0c 75
RSP: 0018:ffffc9000141f068 EFLAGS: 00000207
RAX: 0000000000000000 RBX: 00000000ebd3f92d RCX: 0000000000000001
RDX: 0000000000002800 RSI: 0000000000000010 RDI: ffffc9000141f120
RBP: ffffc9000141f0c0 R08: 0000000042ea500e R09: 000000006d049ea7
R10: 0000000000000002 R11: 000000009183071d R12: ffff888110b18f60
R13: 0000000000000010 R14: 000000000000092d R15: ffff88823ff00000
 stack_depot_save+0xe/0x10 lib/stackdepot.c:384
 save_stack+0x171/0x230 mm/page_owner.c:159
 __reset_page_owner+0x36/0x140 mm/page_owner.c:174
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 free_pcp_prepare mm/page_alloc.c:1421 [inline]
 free_unref_page_prepare+0x2b7/0x2d0 mm/page_alloc.c:3336
 free_unref_page mm/page_alloc.c:3391 [inline]
 free_the_page mm/page_alloc.c:5443 [inline]
 __free_pages+0x146/0x390 mm/page_alloc.c:5454
 free_pages+0x82/0x90 mm/page_alloc.c:5465
 kasan_depopulate_vmalloc_pte+0x6b/0x90 mm/kasan/shadow.c:354
 apply_to_pte_range mm/memory.c:2504 [inline]
 apply_to_pmd_range mm/memory.c:2540 [inline]
 apply_to_pud_range mm/memory.c:2568 [inline]
 apply_to_p4d_range mm/memory.c:2596 [inline]
 __apply_to_page_range+0x790/0xa20 mm/memory.c:2623
 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2874
 kasan_release_vmalloc+0x97/0xb0 mm/kasan/shadow.c:464
 __purge_vmap_area_lazy+0x1326/0x1440 mm/vmalloc.c:1382
 _vm_unmap_aliases+0x2ec/0x370 mm/vmalloc.c:1779
 vm_unmap_aliases+0x19/0x20 mm/vmalloc.c:1802
 change_page_attr_set_clr+0x317/0xc10 arch/x86/mm/pat/set_memory.c:1732
 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1789 [inline]
 set_memory_ro+0x89/0xd0 arch/x86/mm/pat/set_memory.c:1935
 bpf_jit_binary_lock_ro include/linux/filter.h:846 [inline]
 bpf_int_jit_compile+0x8473/0x8930 arch/x86/net/bpf_jit_comp.c:2134
 bpf_prog_select_runtime+0x722/0x9c0 kernel/bpf/core.c:1876
 bpf_prog_load+0x1031/0x14e0 kernel/bpf/syscall.c:2238
 __do_sys_bpf kernel/bpf/syscall.c:4435 [inline]
 __se_sys_bpf+0x49a/0x740 kernel/bpf/syscall.c:4391
 __x64_sys_bpf+0x7b/0x90 kernel/bpf/syscall.c:4391
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f978e1ece59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f978cc25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f978e475090 RCX: 00007f978e1ece59
RDX: 0000000000000048 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007f978e282e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f978e475128 R14: 00007f978e475090 R15: 00007ffe760b25c8