watchdog: BUG: soft lockup - CPU#0 stuck for 143s! [syz.0.495:8425] Modules linked in: irq event stamp: 11188385 hardirqs last enabled at (11188384): [] irqentry_exit+0x63/0x90 kernel/entry/common.c:357 hardirqs last disabled at (11188385): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1049 softirqs last enabled at (47494): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last enabled at (47494): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last enabled at (47494): [] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 softirqs last disabled at (47497): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last disabled at (47497): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (47497): [] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 CPU: 0 UID: 0 PID: 8425 Comm: syz.0.495 Not tainted 6.12.0-rc7-syzkaller-g9f8e716d46c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 RIP: 0010:__nr_to_section include/linux/mmzone.h:1881 [inline] RIP: 0010:__pfn_to_section include/linux/mmzone.h:1989 [inline] RIP: 0010:pfn_valid include/linux/mmzone.h:2042 [inline] RIP: 0010:__virt_addr_valid+0x109/0x530 arch/x86/mm/physaddr.c:65 Code: c1 e8 2e 74 0c e8 27 e8 51 00 31 db e9 66 03 00 00 48 c7 c0 a0 68 43 9a 48 c1 e8 03 48 bd 00 00 00 00 00 fc ff df 80 3c 28 00 <74> 0c 48 c7 c7 a0 68 43 9a e8 59 c4 bb 00 48 8b 05 82 66 00 19 48 RSP: 0018:ffffc90000006d58 EFLAGS: 00000246 RAX: 1ffffffff3486d14 RBX: 000000000000002e RCX: ffff88802d41bc00 RDX: 0000000000000100 RSI: 0000000058819a80 RDI: 00003fffffffffff RBP: dffffc0000000000 R08: ffffffff814301db R09: 1ffffffff285a118 R10: dffffc0000000000 R11: fffffbfff285a119 R12: 0000000058819a80 R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff92000000dc0 FS: 00007f3bdb5cb6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c341fc4 CR3: 000000003018c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: kasan_addr_to_slab+0xd/0x80 mm/kasan/common.c:37 __kasan_record_aux_stack+0x11/0xc0 mm/kasan/generic.c:526 kvfree_call_rcu+0xfc/0x790 kernel/rcu/tree.c:3810 cfg80211_update_known_bss+0xb45/0x1590 net/wireless/scan.c:1891 __cfg80211_bss_update+0x153/0x2030 net/wireless/scan.c:1938 cfg80211_inform_single_bss_data+0xd82/0x2090 net/wireless/scan.c:2329 cfg80211_inform_bss_data+0x3ce/0x5e80 net/wireless/scan.c:3188 cfg80211_inform_bss_frame_data+0x3b8/0x720 net/wireless/scan.c:3283 ieee80211_bss_info_update+0x8a7/0xbc0 net/mac80211/scan.c:226 ieee80211_scan_rx+0x526/0x9c0 net/mac80211/scan.c:340 __ieee80211_rx_handle_packet net/mac80211/rx.c:5225 [inline] ieee80211_rx_list+0x2b02/0x3780 net/mac80211/rx.c:5462 ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5485 ieee80211_rx include/net/mac80211.h:5138 [inline] ieee80211_handle_queued_frames+0xe7/0x1e0 net/mac80211/main.c:441 tasklet_action_common+0x321/0x4d0 kernel/softirq.c:784 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline] RIP: 0010:static_key_false include/linux/jump_label.h:207 [inline] RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:149 [inline] RIP: 0010:wrmsrl arch/x86/include/asm/msr.h:264 [inline] RIP: 0010:native_x2apic_icr_write arch/x86/include/asm/apic.h:233 [inline] RIP: 0010:__x2apic_send_IPI_dest arch/x86/kernel/apic/x2apic_phys.c:113 [inline] RIP: 0010:x2apic_send_IPI+0x7a/0xe0 arch/x86/kernel/apic/x2apic_phys.c:50 Code: d8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 29 8b 13 0f ae f0 0f ae e8 41 83 fe 02 b8 00 04 00 00 41 0f 45 c6 b9 30 08 00 00 0f 30 <66> 90 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 d9 80 e1 07 80 c1 03 38 RSP: 0018:ffffc9001083f558 EFLAGS: 00000206 RAX: 00000000000000fb RBX: ffff8880b8721168 RCX: 0000000000000830 RDX: 0000000000000001 RSI: 00000000000000fb RDI: 0000000000000001 RBP: ffffffff8e320a58 R08: ffffffff8188f4ea R09: 1ffffffff203a145 R10: dffffc0000000000 R11: ffffffff813ee230 R12: dffffc0000000000 R13: ffff8880b863fc80 R14: 00000000000000fb R15: dffffc0000000000 arch_send_call_function_single_ipi arch/x86/include/asm/smp.h:94 [inline] send_call_function_single_ipi kernel/smp.c:118 [inline] smp_call_function_many_cond+0x15c6/0x2ca0 kernel/smp.c:866 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1051 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:2085 [inline] text_poke_bp_batch+0x726/0xb30 arch/x86/kernel/alternative.c:2357 text_poke_flush arch/x86/kernel/alternative.c:2486 [inline] text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2493 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 static_key_enable_cpuslocked+0x136/0x260 kernel/jump_label.c:210 static_key_enable+0x1a/0x20 kernel/jump_label.c:223 tracepoint_add_func+0x953/0x9e0 kernel/tracepoint.c:361 tracepoint_probe_register_prio kernel/tracepoint.c:511 [inline] tracepoint_probe_register+0x105/0x160 kernel/tracepoint.c:531 perf_trace_event_reg kernel/trace/trace_event_perf.c:129 [inline] perf_trace_event_init+0x478/0x930 kernel/trace/trace_event_perf.c:202 perf_trace_init+0x243/0x2e0 kernel/trace/trace_event_perf.c:226 perf_tp_event_init+0x8d/0x110 kernel/events/core.c:10357 perf_try_init_event+0x146/0x810 kernel/events/core.c:11891 perf_init_event kernel/events/core.c:11977 [inline] perf_event_alloc+0x135f/0x2310 kernel/events/core.c:12259 __do_sys_perf_event_open kernel/events/core.c:12766 [inline] __se_sys_perf_event_open+0xb1f/0x3870 kernel/events/core.c:12657 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3bda77e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3bdb5cb038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f3bda935f80 RCX: 00007f3bda77e719 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000040 RBP: 00007f3bda7f175e R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f3bda935f80 R15: 00007ffebbc5eac8 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 66 Comm: kworker/u8:4 Not tainted 6.12.0-rc7-syzkaller-g9f8e716d46c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Workqueue: bat_events batadv_nc_worker RIP: 0010:mark_lock+0x15/0x360 kernel/locking/lockdep.c:4686 Code: 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 53 48 83 ec 10 49 89 f7 48 89 3c 24 <49> bd 00 00 00 00 00 fc ff df 83 fa 08 75 27 49 8d 5f 20 48 89 d8 RSP: 0018:ffffc90000a18cd8 EFLAGS: 00000086 RAX: 00000000000406d8 RBX: ffff88801c790b08 RCX: ffffffff8170cfaa RDX: 0000000000000002 RSI: ffff88801c790b08 RDI: ffff88801c790000 RBP: ffffc90000a18dc8 R08: ffffffff942d08df R09: 1ffffffff285a11b R10: dffffc0000000000 R11: fffffbfff285a11c R12: ffff88801c790b28 R13: 0000000000000001 R14: ffff88801c790ad8 R15: ffff88801c790b08 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9b96f08ff8 CR3: 0000000033bd2000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mark_held_locks kernel/locking/lockdep.c:4321 [inline] __trace_hardirqs_on_caller kernel/locking/lockdep.c:4339 [inline] lockdep_hardirqs_on_prepare+0x282/0x780 kernel/locking/lockdep.c:4406 trace_hardirqs_on+0x28/0x40 kernel/trace/trace_preemptirq.c:61 tasklet_action_common+0x167/0x4d0 kernel/softirq.c:803 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 do_softirq+0x11b/0x1e0 kernel/softirq.c:455 __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_nc_purge_paths+0x312/0x3b0 net/batman-adv/network-coding.c:471 batadv_nc_worker+0x365/0x610 net/batman-adv/network-coding.c:722 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244