watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz-executor.5:16840] Modules linked in: irq event stamp: 13341913 hardirqs last enabled at (13341912): [] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 hardirqs last disabled at (13341913): [] sysvec_apic_timer_interrupt+0xa/0xb0 arch/x86/kernel/apic/apic.c:1100 softirqs last enabled at (13069072): [] invoke_softirq kernel/softirq.c:221 [inline] softirqs last enabled at (13069072): [] __irq_exit_rcu+0x1d8/0x200 kernel/softirq.c:422 softirqs last disabled at (13069075): [] invoke_softirq kernel/softirq.c:221 [inline] softirqs last disabled at (13069075): [] __irq_exit_rcu+0x1d8/0x200 kernel/softirq.c:422 CPU: 0 PID: 16840 Comm: syz-executor.5 Not tainted 5.12.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:163 [inline] RIP: 0010:unwind_next_frame+0x1de/0x1f90 arch/x86/kernel/unwind_orc.c:443 Code: 80 ae 4c 0a 48 c1 e8 02 ff c8 45 84 ed b9 ff ff ff ff 0f 45 c8 39 e9 0f 86 c0 16 00 00 89 e8 48 8d 1c 85 30 cd e2 8e 48 89 d8 <48> c1 e8 03 42 8a 04 30 84 c0 0f 85 73 18 00 00 44 8b 3b 89 e8 ff RSP: 0018:ffffc900000077b8 EFLAGS: 00000202 RAX: ffffffff8ee5c0f4 RBX: ffffffff8ee5c0f4 RCX: 0000000000088083 RDX: ffffc9000a6efc58 RSI: ffffffff81bcf1f4 RDI: 0000000000000001 RBP: 000000000000bcf1 R08: 0000000000000011 R09: ffffc90000007928 R10: fffff52000000f1b R11: 0000000000000000 R12: ffffffff81bcf1f4 R13: ffffc90000007801 R14: dffffc0000000000 R15: 1ffff92000000f15 FS: 00007f1cec3b7700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9532fb1bb8 CR3: 000000001552f000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0xb2/0xe0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xad/0x150 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x3d/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:357 ____kasan_slab_free+0x100/0x140 mm/kasan/common.c:360 kasan_slab_free include/linux/kasan.h:199 [inline] slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x171/0x270 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kfree+0xcf/0x2d0 mm/slub.c:4213 skb_release_all net/core/skbuff.c:725 [inline] __kfree_skb+0x56/0x1d0 net/core/skbuff.c:739 mac80211_hwsim_beacon_tx+0x4b9/0x870 drivers/net/wireless/mac80211_hwsim.c:1829 __iterate_interfaces+0x23e/0x4b0 net/mac80211/util.c:793 ieee80211_iterate_active_interfaces_atomic+0x9b/0x120 net/mac80211/util.c:829 mac80211_hwsim_beacon+0xa4/0x180 drivers/net/wireless/mac80211_hwsim.c:1852 __run_hrtimer kernel/time/hrtimer.c:1537 [inline] __hrtimer_run_queues+0x4c9/0xa00 kernel/time/hrtimer.c:1601 hrtimer_run_softirq+0x176/0x1e0 kernel/time/hrtimer.c:1618 __do_softirq+0x318/0x714 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu+0x1d8/0x200 kernel/softirq.c:422 irq_exit_rcu+0x5/0x20 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 RIP: 0010:kasan_check_range+0x4/0x2f0 mm/kasan/generic.c:185 Code: c7 e8 90 58 95 07 31 c0 c3 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 <41> 55 41 54 53 b0 01 48 85 f6 0f 84 0d 02 00 00 48 89 fb 48 01 f3 RSP: 0018:ffffc9000a6efc58 EFLAGS: 00000256 RAX: 00000000ffffff01 RBX: ffff88802ba608d8 RCX: ffffffff815e923e RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc9000a6efc9c RBP: 1ffff920014ddf93 R08: dffffc0000000000 R09: ffffed100574c11b R10: ffffed100574c11b R11: 0000000000000000 R12: ffff88802ba608d0 R13: dffffc0000000000 R14: ffffc9000a6efc9c R15: 1ffff1100574c11b instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:706 [inline] queued_spin_lock include/asm-generic/qspinlock.h:82 [inline] do_raw_spin_lock+0xfe/0x810 kernel/locking/spinlock_debug.c:113 spin_lock include/linux/spinlock.h:354 [inline] task_lock include/linux/sched/task.h:168 [inline] chroot_fs_refs+0xbf/0x5c0 fs/fs_struct.c:66 __do_sys_pivot_root fs/namespace.c:3809 [inline] __se_sys_pivot_root+0x1dab/0x1f10 fs/namespace.c:3726 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x466459 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f1cec3b7188 EFLAGS: 00000246 ORIG_RAX: 000000000000009b RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000020000100 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007fff980dd51f R14: 00007f1cec3b7300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 16839 Comm: syz-executor.0 Not tainted 5.12.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:rep_nop arch/x86/include/asm/vdso/processor.h:13 [inline] RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline] RIP: 0010:queued_write_lock_slowpath+0x110/0x290 kernel/locking/qrwlock.c:76 Code: 00 66 0f 1f 84 00 00 00 00 00 42 8a 04 23 84 c0 74 38 89 e9 80 e1 07 80 c1 03 38 c1 7c 2c 48 89 ef e8 44 4b 5e 00 eb 22 66 90 90 42 0f b6 04 23 84 c0 74 15 89 e9 80 e1 07 80 c1 03 38 c1 7c RSP: 0018:ffffc9000a84fb98 EFLAGS: 00000006 RAX: 0000000000000300 RBX: 1ffffffff1881408 RCX: ffffffff815eb309 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8c40a040 RBP: ffffffff8c40a040 R08: dffffc0000000000 R09: fffffbfff1881409 R10: fffffbfff1881409 R11: 0000000000000000 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffffffff8c40a044 R15: 00000000000000ff FS: 0000000002028400(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007efc90df7718 CR3: 000000001921b000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: queued_write_lock include/asm-generic/qrwlock.h:97 [inline] do_raw_write_lock+0x2ff/0x450 kernel/locking/spinlock_debug.c:207 __raw_write_lock_irq include/linux/rwlock_api_smp.h:197 [inline] _raw_write_lock_irq+0x7b/0xa0 kernel/locking/spinlock.c:311 copy_process+0x2fcc/0x5650 kernel/fork.c:2226 kernel_clone+0x1a6/0x6c0 kernel/fork.c:2500 __do_sys_clone kernel/fork.c:2617 [inline] __se_sys_clone kernel/fork.c:2601 [inline] __x64_sys_clone+0x1d5/0x220 kernel/fork.c:2601 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x467881 Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 RSP: 002b:00007ffca5277358 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007efc90df7700 RCX: 0000000000467881 RDX: 00007efc90df79d0 RSI: 00007efc90df72f0 RDI: 00000000003d0f00 RBP: 00007ffca5277590 R08: 00007efc90df7700 R09: 00007efc90df7700 R10: 00007efc90df79d0 R11: 0000000000000206 R12: 00007ffca527740e R13: 00007ffca527740f R14: 00007efc90df7300 R15: 0000000000022000