BUG: soft lockup in neigh_timer_handler

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a6ca7c65b137 Linux 4.14.260
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=171fdec3b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=6eeb01284ed5abab
dashboard link: https://syzkaller.appspot.com/bug?extid=56835622161ff07db188
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+568356...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.2:9630]
Modules linked in:
irq event stamp: 4200841
hardirqs last enabled at (4200840): [<ffffffff87400976>] restore_regs_and_return_to_kernel+0x0/0x2a
hardirqs last disabled at (4200841): [<ffffffff874018ae>] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793
softirqs last enabled at (18406): [<ffffffff8760068b>] __do_softirq+0x68b/0x9ff kernel/softirq.c:314
softirqs last disabled at (20661): [<ffffffff81321d13>] invoke_softirq kernel/softirq.c:368 [inline]
softirqs last disabled at (20661): [<ffffffff81321d13>] irq_exit+0x193/0x240 kernel/softirq.c:409
CPU: 0 PID: 9630 Comm: syz-executor.2 Not tainted 4.14.260-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88804822e080 task.stack: ffff888048230000
RIP: 0010:__read_once_size_nocheck.constprop.0+0x3/0x10 include/linux/compiler.h:203
RSP: 0018:ffff8880ba4071a8 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff10
RAX: ffffffff81749257 RBX: 1ffff11017480e37 RCX: ffffffff8a715f0c
RDX: ffff8880ba407330 RSI: ffff8880ba4071d8 RDI: ffff888048237910
RBP: ffff888048237910 R08: ffffffff8a715f10 R09: ffffffff8a715f11
R10: 000000000001c1d0 R11: 0000000000000001 R12: ffff8880ba4072e8
R13: ffff8880ba407330 R14: ffff888048230000 R15: ffff8880ba4072e8
FS: 00007f8ced677700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fb225a18e0 CR3: 00000000b2fec000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
deref_stack_reg arch/x86/kernel/unwind_orc.c:289 [inline]
deref_stack_reg+0x124/0x1a0 arch/x86/kernel/unwind_orc.c:283
unwind_next_frame+0xc98/0x17d0 arch/x86/kernel/unwind_orc.c:425
__save_stack_trace+0x90/0x160 arch/x86/kernel/stacktrace.c:44
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
slab_post_alloc_hook mm/slab.h:442 [inline]
slab_alloc_node mm/slab.c:3333 [inline]
kmem_cache_alloc_node+0x133/0x410 mm/slab.c:3640
__alloc_skb+0x5c/0x510 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:980 [inline]
alloc_skb_with_frags+0x85/0x500 net/core/skbuff.c:5258
sock_alloc_send_pskb+0x577/0x6d0 net/core/sock.c:2101
__ip6_append_data.isra.0+0x161f/0x2860 net/ipv6/ip6_output.c:1457
ip6_append_data+0x1b8/0x2f0 net/ipv6/ip6_output.c:1620
icmp6_send+0x1564/0x1f60 net/ipv6/icmp.c:579
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
ip6_link_failure+0x2b/0x420 net/ipv6/route.c:1440
dst_link_failure include/net/dst.h:453 [inline]
ndisc_error_report+0xa7/0x180 net/ipv6/ndisc.c:687
neigh_invalidate+0x21c/0x520 net/core/neighbour.c:897
neigh_timer_handler+0x820/0xa50 net/core/neighbour.c:983
call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
__run_timers kernel/time/timer.c:1637 [inline]
run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
</IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x23/0x50 kernel/kcov.c:68
RSP: 0018:ffff888048237730 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
RAX: ffff88804822e080 RBX: 800000009fee7007 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 00007f8ceec15000 RDI: 800000009fee7007
RBP: 1ffff11009046ee9 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffff88804822e080 R12: 800000009fee7007
R13: ffff88809f32f568 R14: 00007f8ceec15000 R15: ffff888048237768
pte_pfn arch/x86/include/asm/pgtable.h:196 [inline]
_vm_normal_page+0xd8/0x3b0 mm/memory.c:855
zap_pte_range mm/memory.c:1337 [inline]
zap_pmd_range mm/memory.c:1466 [inline]
zap_pud_range mm/memory.c:1495 [inline]
zap_p4d_range mm/memory.c:1516 [inline]
unmap_page_range+0xcf0/0x1ce0 mm/memory.c:1537
unmap_single_vma+0x147/0x2b0 mm/memory.c:1582
unmap_vmas+0x9d/0x160 mm/memory.c:1612
exit_mmap+0x270/0x4d0 mm/mmap.c:3058
__mmput kernel/fork.c:931 [inline]
mmput kernel/fork.c:952 [inline]
mmput+0xfa/0x420 kernel/fork.c:947
exit_mm kernel/exit.c:548 [inline]
do_exit+0x984/0x2850 kernel/exit.c:855
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f8ceed01e99
RSP: 002b:00007f8ced677218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f8ceee14f68 RCX: 00007f8ceed01e99
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8ceee14f68
RBP: 00007f8ceee14f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8ceee14f6c
R13: 00007ffc1f4dcb0f R14: 00007f8ced677300 R15: 0000000000022000
Code: 02 00 75 18 48 8b 43 48 5b 5d c3 e8 38 7c 5b 00 eb a8 48 89 ef e8 9e 7c 5b 00 eb c4 48 89 ef e8 94 7c 5b 00 eb de 66 90 48 8b 07 <48> 89 06 c3 66 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 9641 Comm: syz-executor.3 Not tainted 4.14.260-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff888094ee8340 task.stack: ffff888048828000
RIP: 0010:native_apic_mem_write+0x8/0x10 arch/x86/include/asm/apic.h:100
RSP: 0018:ffff8880ba507348 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: ffffffff88cc7000 RCX: 0000000000000000
RDX: 1ffffffff1198e1e RSI: 0000000000000000 RDI: 00000000000000b0
RBP: ffff88804882f568 R08: ffff88823fff7058 R09: ffff88823fff704f
R10: ffff88823fff7057 R11: 000000518d0a1e33 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fb22591160 CR3: 00000000af97e000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
apic_eoi arch/x86/include/asm/apic.h:390 [inline]
ack_APIC_irq arch/x86/include/asm/apic.h:434 [inline]
entering_ack_irq arch/x86/include/asm/apic.h:626 [inline]
smp_apic_timer_interrupt+0x88/0x5e0 arch/x86/kernel/apic/apic.c:1102
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:unwind_next_frame+0xd67/0x17d0 arch/x86/kernel/unwind_orc.c:467
RSP: 0018:ffff8880ba507438 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: 1ffff110174a0e8e RCX: ffffffff8a6935b0
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff88804882feb8
RBP: 0000000000000001 R08: ffffffff8a6935b4 R09: 0000000000000005
R10: ffff88804882fec0 R11: 0000000000000001 R12: ffff8880ba50752d
R13: ffff8880ba507530 R14: ffff8880ba507548 R15: ffff8880ba5074f8
__save_stack_trace+0x90/0x160 arch/x86/kernel/stacktrace.c:44
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
__do_kmalloc mm/slab.c:3720 [inline]
__kmalloc+0x15a/0x400 mm/slab.c:3729
kmalloc include/linux/slab.h:493 [inline]
kzalloc include/linux/slab.h:661 [inline]
neigh_alloc net/core/neighbour.c:324 [inline]
__neigh_create+0x1db/0x19b0 net/core/neighbour.c:499
ip6_finish_output2+0x802/0x1f10 net/ipv6/ip6_output.c:117
ip6_finish_output+0x5c6/0xd50 net/ipv6/ip6_output.c:192
NF_HOOK_COND include/linux/netfilter.h:239 [inline]
ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:209
dst_output include/net/dst.h:470 [inline]
NF_HOOK include/linux/netfilter.h:250 [inline]
ndisc_send_skb+0x82a/0x1390 net/ipv6/ndisc.c:483
ndisc_send_rs+0x125/0x630 net/ipv6/ndisc.c:677
addrconf_rs_timer+0x2bb/0x5a0 net/ipv6/addrconf.c:3769
call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
__run_timers kernel/time/timer.c:1637 [inline]
run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650
__do_softirq+0x24d/0x9ff kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x193/0x240 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:192
RSP: 0018:ffff88804882f618 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: 1ffffffff11e1279 RBX: 0000000000000286 RCX: 1ffff110129dd17d
RDX: dffffc0000000000 RSI: ffff888094ee8bc8 RDI: 0000000000000286
RBP: ffffffff8c041a08 R08: ffffffff8b9b3f78 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a6249000
R13: 0000000000000000 R14: ffffffff8c041a08 R15: 0000000000000000
__debug_check_no_obj_freed lib/debugobjects.c:760 [inline]
debug_check_no_obj_freed+0x2c0/0x680 lib/debugobjects.c:776
free_pages_prepare mm/page_alloc.c:1064 [inline]
free_pcp_prepare mm/page_alloc.c:1078 [inline]
free_hot_cold_page+0x224/0xc80 mm/page_alloc.c:2615
pte_free arch/x86/include/asm/pgalloc.h:65 [inline]
zap_deposited_table mm/huge_memory.c:1672 [inline]
zap_huge_pmd+0x736/0xa10 mm/huge_memory.c:1726
zap_pmd_range mm/memory.c:1453 [inline]
zap_pud_range mm/memory.c:1495 [inline]
zap_p4d_range mm/memory.c:1516 [inline]
unmap_page_range+0xc07/0x1ce0 mm/memory.c:1537
unmap_single_vma+0x147/0x2b0 mm/memory.c:1582
unmap_vmas+0x9d/0x160 mm/memory.c:1612
exit_mmap+0x270/0x4d0 mm/mmap.c:3058
__mmput kernel/fork.c:931 [inline]
mmput kernel/fork.c:952 [inline]
mmput+0xfa/0x420 kernel/fork.c:947
exit_mm kernel/exit.c:548 [inline]
do_exit+0x984/0x2850 kernel/exit.c:855
do_group_exit+0x100/0x2e0 kernel/exit.c:965
get_signal+0x38d/0x1ca0 kernel/signal.c:2412
do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f26f5d6de99
RSP: 002b:00007f26f46e3218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f26f5e80f68 RCX: 00007f26f5d6de99
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f26f5e80f68
RBP: 00007f26f5e80f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f26f5e80f6c
R13: 00007ffc7b6830ef R14: 00007f26f46e3300 R15: 0000000000022000
Code: 83 3d fc 9e 0b 0a 01 7f 02 5d c3 89 ef 5d e9 fd db de 05 48 c7 c7 c0 23 2e 8b e8 14 65 5c 00 eb df 66 90 89 ff 89 b7 00 c0 5f ff <c3> 0f 1f 80 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 53 89 fb
----------------
Code disassembly (best guess):
0: 02 00 add (%rax),%al
2: 75 18 jne 0x1c
4: 48 8b 43 48 mov 0x48(%rbx),%rax
8: 5b pop %rbx
9: 5d pop %rbp
a: c3 retq
b: e8 38 7c 5b 00 callq 0x5b7c48
10: eb a8 jmp 0xffffffba
12: 48 89 ef mov %rbp,%rdi
15: e8 9e 7c 5b 00 callq 0x5b7cb8
1a: eb c4 jmp 0xffffffe0
1c: 48 89 ef mov %rbp,%rdi
1f: e8 94 7c 5b 00 callq 0x5b7cb8
24: eb de jmp 0x4
26: 66 90 xchg %ax,%ax
28: 48 8b 07 mov (%rdi),%rax
* 2b: 48 89 06 mov %rax,(%rsi) <-- trapping instruction
2e: c3 retq
2f: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
36: 00 00
38: 48 rex.W
39: b8 00 00 00 00 mov $0x0,%eax
3e: 00 fc add %bh,%ah


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.