watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz.4.318:7613] Modules linked in: irq event stamp: 7527 hardirqs last enabled at (7526): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:86 [inline] hardirqs last enabled at (7526): [] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:96 hardirqs last disabled at (7527): [] __el1_irq arch/arm64/kernel/entry-common.c:650 [inline] hardirqs last disabled at (7527): [] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:668 softirqs last enabled at (2512): [] softirq_handle_end kernel/softirq.c:425 [inline] softirqs last enabled at (2512): [] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:607 softirqs last disabled at (2669): [] __do_softirq+0x14/0x20 kernel/softirq.c:613 CPU: 0 UID: 0 PID: 7613 Comm: syz.4.318 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : preempt_count arch/arm64/include/asm/preempt.h:13 [inline] pc : check_kcov_mode kernel/kcov.c:183 [inline] pc : write_comp_data kernel/kcov.c:246 [inline] pc : __sanitizer_cov_trace_cmp4+0x10/0xa0 kernel/kcov.c:288 lr : taprio_next_tc_txq net/sched/sch_taprio.c:763 [inline] lr : taprio_dequeue_tc_priority+0x1c4/0x620 net/sched/sch_taprio.c:790 sp : ffff800080007230 x29: ffff8000800072a0 x28: ffff0000d0699394 x27: 000000000000000c x26: 0000000000000000 x25: 000000000000000b x24: ffff0000d045c4c0 x23: 0000000000000008 x22: 0000000000000002 x21: 1fffe0001a0d3272 x20: 000000000000000c x19: dfff800000000000 x18: 00000000ffffffff x17: ffff800093363000 x16: ffff80008051fb5c x15: 0000000000000001 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000005f965e2 x10: 0000000000ff0100 x9 : ffff0000d045c042 x8 : ffff0000c7035b80 x7 : ffff80008951b9ec x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff x2 : 0000000000000000 x1 : 000000000000000c x0 : 000000000000000c Call trace: get_current arch/arm64/include/asm/current.h:19 [inline] (P) write_comp_data kernel/kcov.c:245 [inline] (P) __sanitizer_cov_trace_cmp4+0x10/0xa0 kernel/kcov.c:288 (P) taprio_dequeue+0x174/0x4f8 net/sched/sch_taprio.c:-1 dequeue_skb net/sched/sch_generic.c:294 [inline] qdisc_restart net/sched/sch_generic.c:399 [inline] __qdisc_run+0x1c4/0x1300 net/sched/sch_generic.c:417 __dev_xmit_skb net/core/dev.c:4171 [inline] __dev_queue_xmit+0xc7c/0x31f0 net/core/dev.c:4679 dev_queue_xmit include/linux/netdevice.h:3355 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip6_finish_output2+0x1510/0x1c7c net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x418/0x7b4 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:306 [inline] ip6_output+0x274/0x504 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:459 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] ndisc_send_skb+0xb48/0x1524 net/ipv6/ndisc.c:513 ndisc_send_rs+0x378/0x514 net/ipv6/ndisc.c:723 addrconf_rs_timer+0x2f4/0x580 net/ipv6/addrconf.c:4041 call_timer_fn+0x1b4/0x818 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x51c/0x76c kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xcc/0x194 kernel/time/timer.c:2403 handle_softirqs+0x328/0xc88 kernel/softirq.c:579 __do_softirq+0x14/0x20 kernel/softirq.c:613 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86 invoke_softirq kernel/softirq.c:460 [inline] __irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:680 irq_exit_rcu+0x14/0x84 kernel/softirq.c:696 __el1_irq arch/arm64/kernel/entry-common.c:654 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:668 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:673 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:596 __preempt_count_dec_and_test+0xc/0x30 arch/arm64/include/asm/preempt.h:62 (P) lock_is_held include/linux/lockdep.h:249 [inline] rcu_read_lock_held+0x34/0x50 kernel/rcu/update.c:351 lookup_page_ext mm/page_ext.c:254 [inline] page_ext_lookup+0xec/0x164 mm/page_ext.c:520 page_ext_iter_begin include/linux/page_ext.h:132 [inline] page_table_check_clear+0x258/0x570 mm/page_table_check.c:78 __page_table_check_pte_clear+0xa0/0xc0 mm/page_table_check.c:154 page_table_check_pte_clear include/linux/page_table_check.h:51 [inline] __ptep_get_and_clear_anysz arch/arm64/include/asm/pgtable.h:1394 [inline] __ptep_get_and_clear arch/arm64/include/asm/pgtable.h:1414 [inline] __get_and_clear_full_ptes arch/arm64/include/asm/pgtable.h:1435 [inline] get_and_clear_full_ptes arch/arm64/include/asm/pgtable.h:1832 [inline] zap_present_folio_ptes mm/memory.c:1505 [inline] zap_present_ptes mm/memory.c:1590 [inline] do_zap_pte_range mm/memory.c:1691 [inline] zap_pte_range mm/memory.c:1735 [inline] zap_pmd_range mm/memory.c:1827 [inline] zap_pud_range mm/memory.c:1856 [inline] zap_p4d_range mm/memory.c:1877 [inline] unmap_page_range+0x2778/0x3180 mm/memory.c:1898 unmap_single_vma mm/memory.c:1941 [inline] unmap_vmas+0x264/0x3d4 mm/memory.c:1985 exit_mmap+0x1bc/0xabc mm/mmap.c:1284 __mmput+0xec/0x3e4 kernel/fork.c:1121 mmput+0x70/0xac kernel/fork.c:1144 exit_mm+0x13c/0x200 kernel/exit.c:581 do_exit+0x4bc/0x19fc kernel/exit.c:952 do_group_exit+0x194/0x22c kernel/exit.c:1105 __do_sys_exit_group kernel/exit.c:1116 [inline] __se_sys_exit_group kernel/exit.c:1114 [inline] pid_child_should_wake+0x0/0x1dc kernel/exit.c:1114 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:50 lr : default_idle_call+0xd0/0xfc kernel/sched/idle.c:124 sp : ffff800097b07d40 x29: ffff800097b07d40 x28: 0000000000000002 x27: dfff800000000000 x26: 1ffff00012f60fb0 x25: 0000000000000000 x24: 0000000000000000 x23: 1fffe00018342b70 x22: ffff80008f66e768 x21: 1ffff00011ecdced x20: 0000000000000000 x19: ffff8000804c1554 x18: 1fffe000337d8876 x17: ffff80008f66e000 x16: ffff8000804c0eb4 x15: 0000000000000001 x14: 1fffe000337da528 x13: 0000000000000000 x12: 0000000000000000 x11: ffff6000337da529 x10: 0000000000000003 x9 : 0000000000000000 x8 : 000000000004e9a5 x7 : ffff800080652bec x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008aefc46c x2 : 0000000000000000 x1 : ffff80008ec4427a x0 : ffff80010c904000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:48 (P) cpuidle_idle_call kernel/sched/idle.c:185 [inline] do_idle+0x1d8/0x454 kernel/sched/idle.c:325 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:423 secondary_start_kernel+0x1b8/0x1e0 arch/arm64/kernel/smp.c:279 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:401