watchdog: BUG: soft lockup - CPU#1 stuck for 143s! [syz.8.4432:18999] Modules linked in: irq event stamp: 11398805 hardirqs last enabled at (11398804): [] irqentry_exit+0x63/0x90 kernel/entry/common.c:357 hardirqs last disabled at (11398805): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1049 softirqs last enabled at (11331988): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last enabled at (11331988): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last enabled at (11331988): [] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655 softirqs last disabled at (11331991): [] __do_softirq kernel/softirq.c:588 [inline] softirqs last disabled at (11331991): [] invoke_softirq kernel/softirq.c:428 [inline] softirqs last disabled at (11331991): [] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655 CPU: 1 UID: 0 PID: 18999 Comm: syz.8.4432 Not tainted 6.12.0-syzkaller-05676-gfc39fb56917b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 RIP: 0010:should_failslab+0x0/0x100 mm/failslab.c:20 Code: ff 4c 89 ff e8 e1 74 ff ff e9 1e fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 55 41 57 41 56 41 54 53 89 f3 49 89 fe 48 c7 c0 28 cb RSP: 0018:ffffc90000a18768 EFLAGS: 00000246 RAX: 000000000040054c RBX: 0000000000000820 RCX: dffffc0000000000 RDX: 00000000ffffffff RSI: 0000000000000820 RDI: ffff8881416d4000 RBP: ffffc90000a18890 R08: ffffffff898601d7 R09: ffffffff87000aef R10: 0000000000000002 R11: ffff88803033da00 R12: ffffffff89860233 R13: ffff8881416d4000 R14: 00000000ffffffff R15: 00000000000000f0 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f167a8656c0 CR3: 000000000e738000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000020000300 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: slab_pre_alloc_hook mm/slub.c:4038 [inline] slab_alloc_node mm/slub.c:4114 [inline] kmem_cache_alloc_node_noprof+0x71/0x320 mm/slub.c:4186 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:668 skb_copy+0x19d/0x9c0 net/core/skbuff.c:2159 mac80211_hwsim_tx_frame_no_nl+0x106b/0x18d0 drivers/net/wireless/virtual/mac80211_hwsim.c:1866 mac80211_hwsim_tx_frame+0x1cc/0x220 drivers/net/wireless/virtual/mac80211_hwsim.c:2215 mac80211_hwsim_beacon_tx+0x3bf/0x850 drivers/net/wireless/virtual/mac80211_hwsim.c:2315 __iterate_interfaces+0x297/0x570 net/mac80211/util.c:775 ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:811 mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2345 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655 irq_exit_rcu+0x9/0x30 kernel/softirq.c:671 instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline] sysvec_irq_work+0xa3/0xc0 arch/x86/kernel/irq_work.c:17 asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:738 RIP: 0010:lock_is_held_type+0x13b/0x190 Code: 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 4c 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 08 75 42 89 d8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f RSP: 0018:ffffc9000b856c58 EFLAGS: 00000206 RAX: 8be733bb7821b900 RBX: 0000000000000000 RCX: ffff88803033da00 RDX: 0000000000000000 RSI: ffffffff8c0ae4e0 RDI: ffffffff8c606aa0 RBP: 0000000000000001 R08: ffffc9000b856e3f R09: 0000000000000000 R10: ffffc9000b856e30 R11: fffff5200170adc8 R12: 0000000000000246 R13: ffff88803033da00 R14: 00000000ffffffff R15: ffffffff8e93c8c0 lock_is_held include/linux/lockdep.h:249 [inline] schedule_debug kernel/sched/core.c:5959 [inline] __schedule+0x20c/0x4c30 kernel/sched/core.c:6655 preempt_schedule_common+0x84/0xd0 kernel/sched/core.c:6935 preempt_schedule+0xe1/0xf0 kernel/sched/core.c:6959 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x130/0x140 kernel/locking/spinlock.c:194 rcu_preempt_deferred_qs_irqrestore+0x87b/0xc70 rcu_read_unlock_special+0x497/0x570 kernel/rcu/tree_plugin.h:692 __rcu_read_unlock+0xa1/0x110 kernel/rcu/tree_plugin.h:437 rcu_read_unlock include/linux/rcupdate.h:882 [inline] pte_unmap include/linux/pgtable.h:115 [inline] zap_pte_range mm/memory.c:1691 [inline] zap_pmd_range mm/memory.c:1739 [inline] zap_pud_range mm/memory.c:1768 [inline] zap_p4d_range mm/memory.c:1789 [inline] unmap_page_range+0x3753/0x40e0 mm/memory.c:1810 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1900 exit_mmap+0x275/0xc40 mm/mmap.c:1923 __mmput+0x115/0x390 kernel/fork.c:1348 exit_mm+0x220/0x310 kernel/exit.c:570 do_exit+0x9b2/0x28e0 kernel/exit.c:925 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3016 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffb1b77e819 Code: Unable to access opcode bytes at 0x7ffb1b77e7ef. RSP: 002b:00007ffb1c4ad038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: 000000000000000c RBX: 00007ffb1b935fa0 RCX: 00007ffb1b77e819 RDX: 0000000000000090 RSI: 00000000200001c0 RDI: 0000000000000005 RBP: 00007ffb1b7f175e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffb1b935fa0 R15: 00007fff5ad6dae8 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 19002 Comm: syz.3.4433 Not tainted 6.12.0-syzkaller-05676-gfc39fb56917b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 RIP: 0010:check_wait_context kernel/locking/lockdep.c:4850 [inline] RIP: 0010:__lock_acquire+0x57d/0x2100 kernel/locking/lockdep.c:5176 Code: 8c e8 37 64 e5 ff 48 ba 00 00 00 00 00 fc ff df 90 0f 0b 90 90 90 31 db 48 81 c3 c4 00 00 00 48 89 d8 48 c1 e8 03 0f b6 04 10 <84> c0 0f 85 f8 12 00 00 0f b6 2b 41 0f b6 04 16 84 c0 0f 85 0c 13 RSP: 0018:ffffc90000006f90 EFLAGS: 00000807 RAX: 0000000000000000 RBX: ffffffff93c57804 RCX: ffffffff817096cc RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffffff942df880 RBP: 00000000000c6000 R08: ffffffff942df887 R09: 1ffffffff285bf10 R10: dffffc0000000000 R11: fffffbfff285bf11 R12: ffff88803584a8c4 R13: 0000000000000019 R14: 1ffff11006b09539 R15: ffff88803584a9c8 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056469d1acd88 CR3: 000000002fbea000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 debug_object_deactivate+0x158/0x390 lib/debugobjects.c:873 debug_hrtimer_deactivate kernel/time/hrtimer.c:433 [inline] debug_deactivate+0x1b/0x220 kernel/time/hrtimer.c:475 __run_hrtimer kernel/time/hrtimer.c:1707 [inline] __hrtimer_run_queues+0x305/0xd50 kernel/time/hrtimer.c:1803 hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1865 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline] __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:430 [inline] RIP: 0010:__pv_queued_spin_lock_slowpath+0x781/0xdb0 kernel/locking/qspinlock.c:508 Code: ff 42 0f b6 04 2b 84 c0 75 6c 66 c7 84 24 b0 00 00 00 00 01 48 8b 44 24 40 42 0f b6 04 28 84 c0 75 77 41 80 3e 00 74 0c f3 90 <41> ff c4 75 d2 e9 a0 00 00 00 4c 89 f7 be 02 00 00 00 e8 38 4b 31 RSP: 0018:ffffc90000007700 EFLAGS: 00000206 RAX: 0000000000000000 RBX: 1ffff92000000ef6 RCX: ffffc90000007701 RDX: 0000000000000100 RSI: ffffffff8c0ad300 RDI: ffffffff8c606aa0 RBP: ffffc90000007838 R08: ffffffff942df8f7 R09: 1ffffffff285bf1e R10: dffffc0000000000 R11: fffffbfff285bf1f R12: 00000000fffff0d6 R13: dffffc0000000000 R14: ffffffff8f533180 R15: ffffc900000077c0 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline] queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116 spin_lock include/linux/spinlock.h:351 [inline] mac80211_hwsim_tx_frame_no_nl+0x982/0x18d0 drivers/net/wireless/virtual/mac80211_hwsim.c:1817 mac80211_hwsim_tx_frame+0x1cc/0x220 drivers/net/wireless/virtual/mac80211_hwsim.c:2215 mac80211_hwsim_beacon_tx+0x3bf/0x850 drivers/net/wireless/virtual/mac80211_hwsim.c:2315 __iterate_interfaces+0x297/0x570 net/mac80211/util.c:775 ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:811 mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2345 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655 irq_exit_rcu+0x9/0x30 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:raw_spin_rq_unlock_irq+0x19/0x90 kernel/sched/sched.h:1527 Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 53 48 89 fb 66 90 48 89 df e8 9e a8 68 0a e8 99 31 37 00 fb 5b <41> 5e 41 5f c3 cc cc cc cc f3 0f 1e fa 49 bf 00 00 00 00 00 fc ff RSP: 0018:ffffc90004026ee8 EFLAGS: 00000282 RAX: 823ac7d13ee6ca00 RBX: ffff8880b863e8c0 RCX: ffffffff8171048a RDX: dffffc0000000000 RSI: ffffffff8c0ad300 RDI: ffffffff8c606aa0 RBP: ffffc90004027110 R08: ffffffff942df8b7 R09: 1ffffffff285bf16 R10: dffffc0000000000 R11: fffffbfff285bf17 R12: ffffc90004027090 R13: 1ffff110170c7ed9 R14: ffff888035849e00 R15: ffff88803584a570 __schedule+0x1a09/0x4c30 kernel/sched/core.c:6760 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7078 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:preempt_schedule+0x0/0xf0 kernel/sched/core.c:6952 Code: 00 00 e8 63 c2 96 f5 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 55 48 89 e5 41 57 41 56 41 54 53 48 83 e4 e0 48 83 ec RSP: 0018:ffffc90004027290 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff8880651361e0 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffffc900040272e0 R08: ffff8880651361e3 R09: 1ffff1100ca26c3c R10: dffffc0000000000 R11: ffffed100ca26c3d R12: dffffc0000000000 R13: 00007fb7b5c26000 R14: ffffc90004027501 R15: ffffc900040275a0 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] zap_pte_range mm/memory.c:1691 [inline] zap_pmd_range mm/memory.c:1739 [inline] zap_pud_range mm/memory.c:1768 [inline] zap_p4d_range mm/memory.c:1789 [inline] unmap_page_range+0x36b1/0x40e0 mm/memory.c:1810 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1900 exit_mmap+0x275/0xc40 mm/mmap.c:1923 __mmput+0x115/0x390 kernel/fork.c:1348 exit_mm+0x220/0x310 kernel/exit.c:570 do_exit+0x9b2/0x28e0 kernel/exit.c:925 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3016 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb7b737e819 Code: Unable to access opcode bytes at 0x7fb7b737e7ef. RSP: 002b:00007fb7b8105038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: 0000000000000009 RBX: 00007fb7b7535fa0 RCX: 00007fb7b737e819 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 000000000000000a RBP: 00007fb7b73f175e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fb7b7535fa0 R15: 00007fff2b757fc8