[Android 5.15] BUG: soft lockup in addrconf_rs_timer (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5bfe2b8c1439 Revert "mmc: sdhci: make tuning_err a signed ..
git tree: android13-5.15-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=16fd8ff9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b0ecca01ee1a007b
dashboard link: https://syzkaller.appspot.com/bug?extid=d7be3ae0039ea87306c7
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1477a525580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1277a525580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b305b01c0755/disk-5bfe2b8c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bf129db6d9e/vmlinux-5bfe2b8c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d77fd38c24b6/bzImage-5bfe2b8c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d7be3a...@syzkaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#0 stuck for 226s! [syz.6.18:400]
Modules linked in:
CPU: 0 PID: 400 Comm: syz.6.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:ifname_compare_aligned include/linux/netfilter/x_tables.h:412 [inline]
RIP: 0010:ip6_packet_match net/ipv6/netfilter/ip6_tables.c:67 [inline]
RIP: 0010:ip6t_do_table+0x63b/0x1510 net/ipv6/netfilter/ip6_tables.c:308
Code: b6 d8 31 ff 89 de e8 24 91 31 fd 84 db 0f 94 c0 44 30 f0 0f 84 36 03 00 00 48 8b 4c 24 68 48 89 c8 48 c1 e8 03 42 80 3c 28 00 <74> 0f 48 8b 7c 24 68 e8 69 04 71 fd 48 8b 4c 24 68 49 8d 5c 24 40
RSP: 0018:ffffc90000007780 EFLAGS: 00000246
RAX: 1ffffffff0b34d18 RBX: 0000000000000000 RCX: ffffffff859a68c0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007970 R08: ffff8881125fc840 R09: ffffc900000078d0
R10: dffffc0000000000 R11: fffff52000000f1e R12: ffff8881125fc910
R13: dffffc0000000000 R14: ffff8881125fc900 R15: 0000000000000000
FS: 000055556b398500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000380c4 CR3: 0000000123f3d000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
ip6table_raw_hook+0x25/0x30 net/ipv6/netfilter/ip6table_raw.c:39
nf_hook_entry_hookfn include/linux/netfilter.h:143 [inline]
nf_hook_slow+0xbc/0x200 net/netfilter/core.c:590
nf_hook include/linux/netfilter.h:260 [inline]
NF_HOOK include/linux/netfilter.h:303 [inline]
ndisc_send_skb+0xc93/0xd00 net/ipv6/ndisc.c:513
ndisc_send_rs+0x711/0x960 net/ipv6/ndisc.c:707
addrconf_rs_timer+0x35a/0x600 net/ipv6/addrconf.c:3990
call_timer_fn+0x38/0x290 kernel/time/timer.c:1459
expire_timers kernel/time/timer.c:1504 [inline]
__run_timers+0x637/0x9a0 kernel/time/timer.c:1775
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1788
handle_softirqs+0x250/0x560 kernel/softirq.c:583
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:preempt_schedule_irq+0xa5/0x120 kernel/sched/core.c:6942
Code: 44 24 20 00 02 00 00 43 c6 44 37 04 f8 74 0b 0f 0b 48 f7 03 08 00 00 00 74 4d bf 01 00 00 00 e8 21 8d 94 fc fb bf 01 00 00 00 <e8> 76 e4 ff ff fa bf 01 00 00 00 e8 bb 8e 94 fc 65 48 8b 1d 13 37
RSP: 0018:ffffc90000cd7780 EFLAGS: 00000246
RAX: 1ffff110221e5646 RBX: ffffc90000cd7848 RCX: ffffffff870ccf00
RDX: 1ffffffff0e18a00 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc90000cd77f8 R08: ffffffff870c5008 R09: ffffffff870c5018
R10: ffffffff870c5003 R11: 1ffffffff0e18a00 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200019aef0
irqentry_exit_cond_resched+0x29/0x30 kernel/entry/common.c:398
irqentry_exit+0x37/0x40 kernel/entry/common.c:432
sysvec_irq_work+0x61/0xc0 arch/x86/kernel/irq_work.c:17
asm_sysvec_irq_work+0x1b/0x20 arch/x86/include/asm/idtentry.h:713
RIP: 0010:get_stack_info+0xb8/0xf0 arch/x86/kernel/dumpstack_64.c:213
Code: 48 c7 c7 2a 50 e0 85 e8 66 60 81 03 eb d1 be 01 00 00 00 48 c7 c7 70 9c 6a 86 4c 89 e2 e8 80 93 44 01 31 c0 4d 0f a3 e5 72 9f <41> 8b 0e 48 83 f9 40 73 0d ba 01 00 00 00 48 d3 e2 48 09 13 eb ab
RSP: 0018:ffffc90000cd78f0 EFLAGS: 00000282
RAX: 0000000000000000 RBX: ffffc90000cd79a8 RCX: 0000000010f2a701
RDX: ffffc90000cd7988 RSI: ffffc90000cd8000 RDI: ffffc90000cd7978
RBP: ffffc90000cd7918 R08: ffffc90000cd7901 R09: ffffc90000cd7988
R10: dffffc0000000000 R11: fffff5200019af3d R12: 0000000000000001
R13: 0000000000000000 R14: ffffc90000cd7988 R15: ffff888110f2a780
__unwind_start+0x1e4/0x3a0 arch/x86/kernel/unwind_frame.c:406
unwind_start arch/x86/include/asm/unwind.h:60 [inline]
arch_stack_walk+0xd6/0x140 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack+0x3a/0x60 mm/kasan/common.c:38
__kasan_record_aux_stack+0xd2/0x100 mm/kasan/generic.c:348
kasan_record_aux_stack+0xe/0x10 mm/kasan/generic.c:353
task_work_add+0x27/0x1e0 kernel/task_work.c:38
fput_many+0xe7/0x1a0 fs/file_table.c:367
fput+0x1a/0x20 fs/file_table.c:383
filp_close+0x105/0x150 fs/open.c:1352
__range_close fs/file.c:691 [inline]
__close_range+0x25f/0x430 fs/file.c:746
__do_sys_close_range fs/open.c:1391 [inline]
__se_sys_close_range fs/open.c:1388 [inline]
__x64_sys_close_range+0x7a/0x90 fs/open.c:1388
x64_sys_call+0x48f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:437
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fba56077159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe18498008 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 00007ffe184980f0 RCX: 00007fba56077159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000380c4 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b33220000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fba562fefac R14: 00007fba562fefa8 R15: 00007fba562fefa0
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 45 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_many_cond+0x8ad/0x9e0 kernel/smp.c:969
Code: 0f b6 44 05 00 84 c0 0f 85 9b 00 00 00 41 8b 1f 89 de 83 e6 01 31 ff e8 a1 53 0a 00 83 e3 01 75 07 e8 e7 4f 0a 00 eb 42 f3 90 <48> b8 00 00 00 00 00 fc ff df 41 0f b6 44 05 00 84 c0 75 10 41 f7
RSP: 0018:ffffc900002ef860 EFLAGS: 00000293
RAX: ffffffff815f77df RBX: 0000000000000001 RCX: ffff8881055f3b40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900002ef978 R08: ffff8881f7138e97 R09: 1ffff1103ee271d2
R10: dffffc0000000000 R11: ffffed103ee271d3 R12: ffff8881f7138e80
R13: 1ffff1103ee07af9 R14: 0000000000000000 R15: ffff8881f703d7c8
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4caefcd000 CR3: 000000000660f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
on_each_cpu_cond_mask+0x43/0x80 kernel/smp.c:1134
on_each_cpu include/linux/smp.h:71 [inline]
text_poke_sync arch/x86/kernel/alternative.c:1442 [inline]
text_poke_bp_batch+0x1d4/0x600 arch/x86/kernel/alternative.c:1642
text_poke_flush arch/x86/kernel/alternative.c:1833 [inline]
text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1840
arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
__jump_label_update+0x38f/0x3b0 kernel/jump_label.c:459
jump_label_update+0x39b/0x450 kernel/jump_label.c:830
static_key_enable_cpuslocked+0x126/0x240 kernel/jump_label.c:177
static_key_enable+0x1a/0x30 kernel/jump_label.c:190
toggle_allocation_gate+0xba/0x440 mm/kfence/core.c:783
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup