watchdog: BUG: soft lockup - CPU#0 stuck for 368s! [syz.0.466:4668] Modules linked in: CPU: 0 UID: 0 PID: 4668 Comm: syz.0.466 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] PC is at _raw_spin_unlock_irq+0x28/0x54 kernel/locking/spinlock.c:202 LR is at tmigr_handle_remote_cpu kernel/time/timer_migration.c:980 [inline] LR is at tmigr_handle_remote_up+0x218/0x4b0 kernel/time/timer_migration.c:1074 pc : [<81abba7c>] lr : [<80346da4>] psr: 60000113 sp : df801e08 ip : df801e18 fp : df801e14 r10: 00000001 r9 : 8280c9a4 r8 : 00000001 r7 : ddddb488 r6 : df801ee0 r5 : 830bf3b0 r4 : 830bf380 r3 : 000055f6 r2 : ffffffff r1 : 00000000 r0 : ddddb488 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85d17100 DAC: fffffffd Call trace: frame pointer underflow [<81abba54>] (_raw_spin_unlock_irq) from [<80346da4>] (tmigr_handle_remote_cpu kernel/time/timer_migration.c:980 [inline]) [<81abba54>] (_raw_spin_unlock_irq) from [<80346da4>] (tmigr_handle_remote_up+0x218/0x4b0 kernel/time/timer_migration.c:1074) [<80346b8c>] (tmigr_handle_remote_up) from [<803450a4>] (__walk_groups_from+0x3c/0xe4 kernel/time/timer_migration.c:566) r10:845ea400 r9:8280c820 r8:80346b8c r7:df801ee0 r6:830bf380 r5:00000002 r4:830bf380 [<80345068>] (__walk_groups_from) from [<8034743c>] (__walk_groups kernel/time/timer_migration.c:583 [inline]) [<80345068>] (__walk_groups_from) from [<8034743c>] (tmigr_handle_remote+0xe8/0x108 kernel/time/timer_migration.c:1133) r9:82804d80 r8:00000101 r7:00000001 r6:00000002 r5:00000002 r4:dddc7488 [<80347354>] (tmigr_handle_remote) from [<80327600>] (run_timer_softirq+0x30/0x34 kernel/time/timer.c:2408) r4:82804084 [<803275d0>] (run_timer_softirq) from [<8025b55c>] (handle_softirqs+0x140/0x458 kernel/softirq.c:622) [<8025b41c>] (handle_softirqs) from [<8025b9d0>] (__do_softirq kernel/softirq.c:656 [inline]) [<8025b41c>] (handle_softirqs) from [<8025b9d0>] (invoke_softirq kernel/softirq.c:496 [inline]) [<8025b41c>] (handle_softirqs) from [<8025b9d0>] (__irq_exit_rcu+0x110/0x1d0 kernel/softirq.c:723) r10:decf5ac0 r9:845ea400 r8:00000000 r7:ee09ddc0 r6:82443ff8 r5:8247f12c r4:845ea400 [<8025b8c0>] (__irq_exit_rcu) from [<8025bd48>] (irq_exit+0x10/0x18 kernel/softirq.c:751) r5:8247f12c r4:826c3a9c [<8025bd38>] (irq_exit) from [<81aad6a4>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:295) [<81aad628>] (generic_handle_arch_irq) from [<81a7d654>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) r9:845ea400 r8:ffefdd20 r7:ee09ddf4 r6:ffffffff r5:80000013 r4:8028e010 [<81a7d638>] (call_with_stack) from [<80200bec>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:228) Exception stack(0xee09ddc0 to 0xee09de08) ddc0: 00000001 00000000 00000001 845ea400 ffefd000 845ea400 00000001 00a00000 dde0: ffefdd20 853e5c00 decf5ac0 ee09de24 ee09de28 ee09de10 804cfd38 8028e010 de00: 80000013 ffffffff [<8028df70>] (preempt_count_sub) from [<804cfd38>] (class_preempt_destructor include/linux/preempt.h:468 [inline]) [<8028df70>] (preempt_count_sub) from [<804cfd38>] (__migrate_enable include/linux/sched.h:2378 [inline]) [<8028df70>] (preempt_count_sub) from [<804cfd38>] (migrate_enable include/linux/sched.h:2429 [inline]) [<8028df70>] (preempt_count_sub) from [<804cfd38>] (kunmap_local_indexed+0x1a8/0x2e8 mm/highmem.c:631) [<804cfb90>] (kunmap_local_indexed) from [<804c949c>] (__kunmap_local include/linux/highmem-internal.h:102 [inline]) [<804cfb90>] (kunmap_local_indexed) from [<804c949c>] (follow_page_pte+0x198/0x47c mm/gup.c:889) r7:00a00000 r6:ea930f5f r5:decf5ac0 r4:00210001 [<804c9304>] (follow_page_pte) from [<804c993c>] (follow_pmd_mask mm/gup.c:915 [inline]) [<804c9304>] (follow_page_pte) from [<804c993c>] (follow_pud_mask mm/gup.c:967 [inline]) [<804c9304>] (follow_page_pte) from [<804c993c>] (follow_p4d_mask mm/gup.c:984 [inline]) [<804c9304>] (follow_page_pte) from [<804c993c>] (follow_page_mask mm/gup.c:1023 [inline]) [<804c9304>] (follow_page_pte) from [<804c993c>] (__get_user_pages+0x1bc/0x6e4 mm/gup.c:1426) r10:000009a4 r9:209a4000 r8:845ea400 r7:00000000 r6:85e4f000 r5:853e5c00 r4:00210001 [<804c9780>] (__get_user_pages) from [<804cca80>] (populate_vma_page_range+0xd8/0x220 mm/gup.c:1860) r10:20000000 r9:8461d680 r8:ee09df50 r7:21000000 r6:20000000 r5:853e5c00 r4:00001000 [<804cc9a8>] (populate_vma_page_range) from [<804cd260>] (__mm_populate+0x11c/0x1b8 mm/gup.c:1963) r10:20000000 r9:8461d78c r8:00000001 r7:8461d680 r6:7f000000 r5:21000000 r4:853e5c00 [<804cd144>] (__mm_populate) from [<804e0ee4>] (mm_populate include/linux/mm.h:3701 [inline]) [<804cd144>] (__mm_populate) from [<804e0ee4>] (__do_sys_mlockall mm/mlock.c:769 [inline]) [<804cd144>] (__mm_populate) from [<804e0ee4>] (sys_mlockall+0xe8/0x1b0 mm/mlock.c:745) r10:00000098 r9:845ea400 r8:8020029c r7:8461d78c r6:00000001 r5:8461d680 r4:00000000 [<804e0dfc>] (sys_mlockall) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xee09dfa8 to 0xee09dff0) dfa0: 00000000 00000000 00000001 00000000 00000000 00000000 dfc0: 00000000 00000000 00316308 00000098 00300000 00000000 00006364 76f080bc dfe0: 76f07ec0 76f07eb0 0001929c 00132320 r7:00000098 r6:00316308 r5:00000000 r4:00000000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at arch_spin_lock arch/arm/include/asm/spinlock.h:74 [inline] PC is at do_raw_spin_lock include/linux/spinlock.h:187 [inline] PC is at __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline] PC is at _raw_spin_lock+0x40/0x58 kernel/locking/spinlock.c:154 LR is at __raw_spin_lock include/linux/spinlock_api_smp.h:132 [inline] LR is at _raw_spin_lock+0x18/0x58 kernel/locking/spinlock.c:154 pc : [<81abbc34>] lr : [<81abbc0c>] psr: 80000113 sp : df805d68 ip : df805d68 fp : df805d7c r10: 81c05450 r9 : 84080e40 r8 : 83e9f688 r7 : 84080f68 r6 : 00000001 r5 : 00000001 r4 : 84080f68 r3 : 000067bb r2 : 000067bc r1 : 00000000 r0 : 00000001 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 84bae0c0 DAC: 00000000 Call trace: frame pointer underflow [<81abbbf4>] (_raw_spin_lock) from [<809c77ac>] (class_raw_spinlock_constructor include/linux/spinlock.h:535 [inline]) [<81abbbf4>] (_raw_spin_lock) from [<809c77ac>] (gpio_mmio_set+0x44/0x80 drivers/gpio/gpio-mmio.c:234) r5:00000001 r4:84080e40 [<809c7768>] (gpio_mmio_set) from [<809b7f68>] (gpiochip_set+0x1c/0x44 drivers/gpio/gpiolib.c:2919) r7:00000001 r6:00000000 r5:00000000 r4:840e49c0 [<809b7f4c>] (gpiochip_set) from [<809ba830>] (gpiod_set_raw_value_commit+0x78/0x218 drivers/gpio/gpiolib.c:3662) [<809ba7b8>] (gpiod_set_raw_value_commit) from [<809bc0d0>] (gpiod_set_value_nocheck+0x44/0x58 drivers/gpio/gpiolib.c:3881) r10:81c05450 r9:df805ebc r8:00000102 r7:ffffbf06 r6:00000007 r5:00000001 r4:840e49c0 [<809bc08c>] (gpiod_set_value_nocheck) from [<809bc120>] (gpiod_set_value+0x3c/0x88 drivers/gpio/gpiolib.c:3903) [<809bc0e4>] (gpiod_set_value) from [<809cc8bc>] (gpio_led_set+0x5c/0x60 drivers/leds/leds-gpio.c:57) r5:83f5a044 r4:83f5a044 [<809cc860>] (gpio_led_set) from [<809ca154>] (__led_set_brightness drivers/leds/led-core.c:52 [inline]) [<809cc860>] (gpio_led_set) from [<809ca154>] (led_set_brightness_nopm drivers/leds/led-core.c:335 [inline]) [<809cc860>] (gpio_led_set) from [<809ca154>] (led_set_brightness_nosleep+0x38/0x44 drivers/leds/led-core.c:369) r5:83f5a044 r4:84ffef0c [<809ca11c>] (led_set_brightness_nosleep) from [<809cd1b8>] (led_heartbeat_function+0x84/0x144 drivers/leds/trigger/ledtrig-heartbeat.c:90) [<809cd134>] (led_heartbeat_function) from [<80326f70>] (call_timer_fn+0x30/0x220 kernel/time/timer.c:1748) r7:ffffbf06 r6:809cd134 r5:84ffef0c r4:83216000 [<80326f40>] (call_timer_fn) from [<80327424>] (expire_timers kernel/time/timer.c:1799 [inline]) [<80326f40>] (call_timer_fn) from [<80327424>] (__run_timers+0x2c4/0x3f8 kernel/time/timer.c:2373) r9:df805ebc r8:ffffbf06 r7:00000000 r6:809cd134 r5:dddd9f00 r4:84ffef0c [<80327160>] (__run_timers) from [<803275c0>] (__run_timer_base kernel/time/timer.c:2385 [inline]) [<80327160>] (__run_timers) from [<803275c0>] (__run_timer_base kernel/time/timer.c:2377 [inline]) [<80327160>] (__run_timers) from [<803275c0>] (run_timer_base+0x68/0x78 kernel/time/timer.c:2394) r10:83216000 r9:82804d80 r8:00000102 r7:00000001 r6:00000082 r5:00000002 r4:dddd9f00 [<80327558>] (run_timer_base) from [<803275ec>] (run_timer_softirq+0x1c/0x34 kernel/time/timer.c:2404) r4:82804084 [<803275d0>] (run_timer_softirq) from [<8025b55c>] (handle_softirqs+0x140/0x458 kernel/softirq.c:622) [<8025b41c>] (handle_softirqs) from [<8025b9d0>] (__do_softirq kernel/softirq.c:656 [inline]) [<8025b41c>] (handle_softirqs) from [<8025b9d0>] (invoke_softirq kernel/softirq.c:496 [inline]) [<8025b41c>] (handle_softirqs) from [<8025b9d0>] (__irq_exit_rcu+0x110/0x1d0 kernel/softirq.c:723) r10:00000000 r9:83216000 r8:00000000 r7:df865e08 r6:82443ff8 r5:8247f12c r4:83216000 [<8025b8c0>] (__irq_exit_rcu) from [<8025bd48>] (irq_exit+0x10/0x18 kernel/softirq.c:751) r5:8247f12c r4:826c3a9c [<8025bd38>] (irq_exit) from [<81aad6a4>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:295) [<81aad628>] (generic_handle_arch_irq) from [<81a7d654>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) r9:83216000 r8:83e9f688 r7:df865e3c r6:ffffffff r5:60000013 r4:809c7fac [<81a7d638>] (call_with_stack) from [<80200bec>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:228) Exception stack(0xdf865e08 to 0xdf865e50) 5e00: e01ef008 0000000c 000067bb 00000000 e01ef008 0000000c 5e20: 00000001 84080f68 83e9f688 84080e40 00000000 df865e6c df865e58 df865e58 5e40: 809c7fa8 809c7fac 60000013 ffffffff [<809c7f8c>] (gpio_mmio_write32) from [<809c77cc>] (gpio_mmio_set+0x64/0x80 drivers/gpio/gpio-mmio.c:241) r5:00000008 r4:84080e40 [<809c7768>] (gpio_mmio_set) from [<809b7f68>] (gpiochip_set+0x1c/0x44 drivers/gpio/gpiolib.c:2919) r7:00000001 r6:00000000 r5:00000003 r4:840e49fc [<809b7f4c>] (gpiochip_set) from [<809ba830>] (gpiod_set_raw_value_commit+0x78/0x218 drivers/gpio/gpiolib.c:3662) [<809ba7b8>] (gpiod_set_raw_value_commit) from [<809bc0d0>] (gpiod_set_value_nocheck+0x44/0x58 drivers/gpio/gpiolib.c:3881) r10:00000000 r9:00000000 r8:00000001 r7:ddde24c0 r6:8337e9d8 r5:00000001 r4:840e49fc [<809bc08c>] (gpiod_set_value_nocheck) from [<809bc120>] (gpiod_set_value+0x3c/0x88 drivers/gpio/gpiolib.c:3903) [<809bc0e4>] (gpiod_set_value) from [<809cc8bc>] (gpio_led_set+0x5c/0x60 drivers/leds/leds-gpio.c:57) r5:000000ff r4:83f5a314 [<809cc860>] (gpio_led_set) from [<809ca1e4>] (__led_set_brightness drivers/leds/led-core.c:52 [inline]) [<809cc860>] (gpio_led_set) from [<809ca1e4>] (led_set_brightness_nopm drivers/leds/led-core.c:335 [inline]) [<809cc860>] (gpio_led_set) from [<809ca1e4>] (led_set_brightness_nosleep drivers/leds/led-core.c:369 [inline]) [<809cc860>] (gpio_led_set) from [<809ca1e4>] (led_set_brightness+0x84/0x90 drivers/leds/led-core.c:328) r5:000000ff r4:83f5a314 [<809ca160>] (led_set_brightness) from [<809cbd64>] (led_trigger_event drivers/leds/led-triggers.c:420 [inline]) [<809ca160>] (led_set_brightness) from [<809cbd64>] (led_trigger_event+0x40/0x58 drivers/leds/led-triggers.c:408) r5:000000ff r4:83f5a314 [<809cbd24>] (led_trigger_event) from [<809cd3c0>] (ledtrig_cpu+0xac/0xf4 drivers/leds/trigger/ledtrig-cpu.c:86) r7:ddde24c0 r6:00000002 r5:82b15cd8 r4:000001fd [<809cd314>] (ledtrig_cpu) from [<80227a38>] (arch_cpu_idle_exit+0x14/0x18 arch/arm/kernel/process.c:98) r9:00000000 r8:00000001 r7:8280c710 r6:83216000 r5:8280c6d0 r4:00000001 [<80227a24>] (arch_cpu_idle_exit) from [<802b158c>] (do_idle+0x5c/0x2d8 kernel/sched/idle.c:334) [<802b1530>] (do_idle) from [<802b1b38>] (cpu_startup_entry+0x30/0x34 kernel/sched/idle.c:430) r10:00000000 r9:414fc0f0 r8:80003000 r7:82a7b4a4 r6:83216000 r5:00000001 r4:00000092 [<802b1b08>] (cpu_startup_entry) from [<8022f360>] (secondary_start_kernel+0x128/0x194 arch/arm/kernel/smp.c:478) [<8022f238>] (secondary_start_kernel) from [<80220094>] (__enable_mmu+0x0/0xc arch/arm/kernel/head.S:446) r7:82a7b4a4 r6:30c0387d r5:00000000 r4:830b7bc0