syzbot

watchdog: BUG: soft lockup - CPU#0 stuck for 144s! [syz.4.6372:23416]
Modules linked in:
irq event stamp: 11546377
hardirqs last  enabled at (11546376): [<ffffffff8badef2e>] irqentry_exit+0x59e/0x620 kernel/entry/common.c:242
hardirqs last disabled at (11546377): [<ffffffff8badd93e>] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1056
softirqs last  enabled at (3996): [<ffffffff8188026f>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last  enabled at (3996): [<ffffffff8188026f>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last  enabled at (3996): [<ffffffff8188026f>] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
softirqs last disabled at (4505): [<ffffffff8188026f>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (4505): [<ffffffff8188026f>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (4505): [<ffffffff8188026f>] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
CPU: 0 UID: 0 PID: 23416 Comm: syz.4.6372 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:unwind_done arch/x86/include/asm/unwind.h:50 [inline]
RIP: 0010:unwind_get_return_address+0x22/0x90 arch/x86/kernel/unwind_orc.c:382
Code: 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 42 0f b6 04 30 <84> c0 75 4c 83 3b 00 74 3a 48 83 c3 48 49 89 df 49 c1 ef 03 43 80
RSP: 0018:ffffc900000076a8 EFLAGS: 00000a02
RAX: 0000000000000000 RBX: ffffc900000076c8 RCX: 0000000000000100
RDX: 0000000000000003 RSI: ffffffff8e165585 RDI: ffffc900000076c8
RBP: ffffc90000007750 R08: ffffc900000073af R09: 0000000000000000
R10: ffffc900000073a0 R11: ffffffffa0202f08 R12: ffff888032308000
R13: 00000000000000f0 R14: dffffc0000000000 R15: ffffc900000076c8
FS:  00007f41bf4de6c0(0000) GS:ffff888125463000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000003ff6 CR3: 0000000021bc2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4542 [inline]
 slab_alloc_node mm/slub.c:4869 [inline]
 kmem_cache_alloc_node_noprof+0x384/0x690 mm/slub.c:4921
 __alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
 alloc_skb include/linux/skbuff.h:1383 [inline]
 new_skb+0x2f/0x2b0 drivers/block/aoe/aoecmd.c:66
 aoecmd_cfg_pkts drivers/block/aoe/aoecmd.c:430 [inline]
 aoecmd_cfg+0x2b1/0x800 drivers/block/aoe/aoecmd.c:1374
 call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2373 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
 run_timer_base kernel/time/timer.c:2394 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:unwind_next_frame+0x1821/0x23c0 arch/x86/kernel/unwind_orc.c:663
Code: 19 02 00 00 80 3d be 9b ab 11 00 0f 85 0c 02 00 00 c6 05 b1 9b ab 11 01 4c 89 f7 e8 b9 0b 00 00 e9 f8 01 00 00 48 8b 54 24 08 <48> 8d 5a 02 48 83 c2 03 48 89 d8 48 c1 e8 03 0f b6 04 28 84 c0 0f
RSP: 0018:ffffc90004446d38 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90004446ea0 RCX: 0000000000000000
RDX: ffffffff90a5ec78 RSI: 0000000000000001 RDI: ffffc90004446ec8
RBP: dffffc0000000000 R08: ffffc90004446ec7 R09: 0000000000000000
R10: ffffc90004446eb8 R11: fffff52000888dd9 R12: ffffc90004446eb8
R13: 1ffff92000888dcf R14: ffffc90004446e68 R15: 1ffffffff214bd8f
 __unwind_start+0x5b8/0x760 arch/x86/kernel/unwind_orc.c:773
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 save_stack+0x122/0x230 mm/page_owner.c:165
 __set_page_owner+0x8d/0x4c0 mm/page_owner.c:341
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2484
 ___kmalloc_large_node+0x4e/0x150 mm/slub.c:5204
 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5235
 __do_kmalloc_node mm/slub.c:5251 [inline]
 __kvmalloc_node_noprof+0x7b/0x8a0 mm/slub.c:6755
 bpf_check+0x102/0x1ce00 kernel/bpf/verifier.c:25935
 bpf_prog_load+0x1484/0x1ae0 kernel/bpf/syscall.c:3089
 __sys_bpf+0x618/0x950 kernel/bpf/syscall.c:6228
 __do_sys_bpf kernel/bpf/syscall.c:6341 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6339 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6339
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f41be59c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f41bf4de028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f41be815fa0 RCX: 00007f41be59c799
RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005
RBP: 00007f41be632c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f41be816038 R14: 00007f41be815fa0 R15: 00007fff8cc481b8
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
------------[ cut here ]------------
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 23420 Comm: syz.0.6374 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:put_dec_trunc8+0xd0/0x340 lib/vsprintf.c:261
Code: 10 27 00 00 89 ee e8 6f 51 1b f6 81 fd 0f 27 00 00 77 10 e8 22 4d 1b f6 4c 89 fb 44 89 f5 e9 f6 00 00 00 4d 69 ee 29 5c 8f 02 <49> c1 ed 20 41 6b c5 9c 41 01 c6 bf 64 00 00 00 4c 89 f6 e8 d8 51
RSP: 0018:ffffc90000a080c8 EFLAGS: 00000002
RAX: ffffffff8baa5081 RBX: ffffc90000a08180 RCX: 0000000000000100
RDX: ffff8880308fdb80 RSI: 000000000001a619 RDI: 0000000000002710
RBP: 000000000001a619 R08: ffffc90000a08197 R09: 0000000000000000
R10: ffffc90000a08180 R11: fffff52000141033 R12: dffffc0000000000
R13: 0000000accccccf8 R14: 0000000000000438 R15: ffffc90000a08182
FS:  00007fa1c2a186c0(0000) GS:ffff888125563000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa1c29f7d58 CR3: 0000000060600000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 number+0x306/0xf80 lib/vsprintf.c:520
 vsnprintf+0x8e5/0xee0 lib/vsprintf.c:2912
 sprintf+0xe7/0x140 lib/vsprintf.c:3111
 print_time kernel/printk/printk.c:1359 [inline]
 info_print_prefix+0x16b/0x360 kernel/printk/printk.c:1385
 record_print_text+0x176/0x450 kernel/printk/printk.c:1434
 printk_get_next_message+0x29c/0x880 kernel/printk/printk.c:3072
 console_emit_next_record kernel/printk/printk.c:3137 [inline]
 console_flush_one_record kernel/printk/printk.c:3269 [inline]
 console_flush_all+0x501/0xb20 kernel/printk/printk.c:3343
 __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
 console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
 vprintk_emit+0x485/0x560 kernel/printk/printk.c:2479
 _printk+0xdd/0x130 kernel/printk/printk.c:2504
 __report_bug+0x317/0x540 lib/bug.c:243
 report_bug+0x16a/0x220 lib/bug.c:281
 handle_bug+0x9c/0x200 arch/x86/kernel/traps.c:435
 exc_invalid_op+0x1a/0x50 arch/x86/kernel/traps.c:489
 asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:616
RIP: 0010:rcu_check_gp_start_stall+0x2e4/0x470 kernel/rcu/tree_stall.h:1049
Code: ff ff 48 c7 c7 c0 65 2b 9a be 04 00 00 00 e8 93 a7 84 00 4c 89 f7 b8 01 00 00 00 87 05 d5 22 80 18 85 c0 0f 85 17 ff ff ff 90 <0f> 0b 90 48 81 ff 00 3f 76 8e 74 47 48 c7 c0 c0 be 11 90 48 c1 e8
RSP: 0018:ffffc90000a08db8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff81ab42dd
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8e763f00
RBP: ffffc90000a08f28 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff3456cb8 R12: 0000000000002904
R13: dffffc0000000000 R14: ffffffff8e763f00 R15: dffffc0000000000
 rcu_core+0x3fe/0x1070 kernel/rcu/tree.c:2864
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x3a/0xb0 kernel/rcu/tree.c:752
Code: e8 eb 4a 03 0a 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 90 d7 1a 8e 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 ec 35 85 00 48 c7 c3 58 09 1d 93 49 03 1e 48 89
RSP: 0018:ffffc900041d7500 EFLAGS: 00000246
RAX: 1ffffffff1c35af3 RBX: 0000000000000001 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8c27b3e0 RDI: ffffffff8c27b3a0
RBP: ffffc900041d7720 R08: ffffffff90118bb7 R09: 1ffffffff2023176
R10: dffffc0000000000 R11: fffffbfff2023177 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffffff8e1ad798 R15: dffffc0000000000
 trace_sched_entry_tp include/trace/events/sched.h:882 [inline]
 __schedule+0xe4/0x52d0 kernel/sched/core.c:6777
 preempt_schedule_notrace+0x57/0x90 kernel/sched/core.c:7185
 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13
 class_preempt_notrace_destructor include/linux/preempt.h:469 [inline]
 perf_trace_lock+0x38b/0x410 include/trace/events/lock.h:50
 __do_trace_lock_release include/trace/events/lock.h:69 [inline]
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x392/0x3d0 kernel/locking/lockdep.c:5879
 rcu_lock_release include/linux/rcupdate.h:322 [inline]
 rcu_read_unlock include/linux/rcupdate.h:881 [inline]
 mntput_no_expire+0x190/0x1c0 fs/namespace.c:1403
 step_into_slowpath+0x2ff/0x7e0 fs/namei.c:2117
 step_into fs/namei.c:2149 [inline]
 walk_component fs/namei.c:2285 [inline]
 link_path_walk+0xd50/0x18d0 fs/namei.c:2647
 path_parentat fs/namei.c:2851 [inline]
 __filename_parentat+0x27f/0x6f0 fs/namei.c:2875
 filename_parentat fs/namei.c:2893 [inline]
 filename_create+0xd9/0x370 fs/namei.c:4903
 filename_mkdirat+0xd2/0x510 fs/namei.c:5259
 __do_sys_mkdir fs/namei.c:5293 [inline]
 __se_sys_mkdir+0x34/0x150 fs/namei.c:5290
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa1c1b9c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa1c2a18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007fa1c1e15fa0 RCX: 00007fa1c1b9c799
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000000
RBP: 00007fa1c1c32c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa1c1e16038 R14: 00007fa1c1e15fa0 R15: 00007ffd0f176da8
 </TASK>