RBP: 00007ff840397cc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000001000 R11: 0000000000000802 R12: 0000000000008030 R13: 0000000000000076 R14: 00007ff840397d20 R15: 0000000000000000 watchdog: BUG: soft lockup - CPU#1 stuck for 246s! [syz-executor:19011] Modules linked in: irq event stamp: 2620737 hardirqs last enabled at (2620736): [] __local_bh_enable_ip+0xa4/0x120 kernel/softirq.c:412 hardirqs last disabled at (2620737): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1050 softirqs last enabled at (2620670): [] softirq_handle_end kernel/softirq.c:425 [inline] softirqs last enabled at (2620670): [] handle_softirqs+0x5be/0x8e0 kernel/softirq.c:607 softirqs last disabled at (2620673): [] __do_softirq kernel/softirq.c:613 [inline] softirqs last disabled at (2620673): [] invoke_softirq kernel/softirq.c:453 [inline] softirqs last disabled at (2620673): [] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680 CPU: 1 UID: 0 PID: 19011 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0x159/0x1b0 mm/kasan/generic.c:189 Code: 2c 48 89 c2 48 85 c0 75 ad 48 89 da 4c 89 d8 4c 29 da e9 46 ff ff ff 48 85 d2 74 18 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 0a <80> 38 00 74 f2 e9 75 ff ff ff 5b b8 01 00 00 00 5d 41 5c e9 9a 56 RSP: 0000:ffffc90000a084f8 EFLAGS: 00000286 RAX: fffffbfff2157152 RBX: fffffbfff2157153 RCX: ffffffff8ae292a2 RDX: fffffbfff2157153 RSI: 0000000000000008 RDI: ffffffff90ab8a90 RBP: fffffbfff2157152 R08: 0000000000000000 R09: fffffbfff2157152 R10: ffffffff90ab8a97 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888053372868 R14: ffff8880773edf00 R15: ffffc90000a08b28 FS: 0000555590c87500(0000) GS:ffff8881247b9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555590ca25c8 CR3: 0000000048e6f000 CR4: 0000000000350ef0 Call Trace: instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] cpumask_test_cpu include/linux/cpumask.h:646 [inline] cpu_online include/linux/cpumask.h:1205 [inline] trace_cfg80211_return_bss+0x52/0x200 net/wireless/trace.h:3860 cfg80211_inform_single_bss_data+0x9b6/0x1df0 net/wireless/scan.c:2397 cfg80211_inform_bss_data+0x224/0x3bd0 net/wireless/scan.c:3234 cfg80211_inform_bss_frame_data+0x26f/0x750 net/wireless/scan.c:3325 ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:226 ieee80211_scan_rx+0x4cf/0xb30 net/mac80211/scan.c:355 __ieee80211_rx_handle_packet net/mac80211/rx.c:5186 [inline] ieee80211_rx_list+0x1bdb/0x2980 net/mac80211/rx.c:5423 ieee80211_rx_napi+0xdc/0x410 net/mac80211/rx.c:5446 ieee80211_rx include/net/mac80211.h:5210 [inline] ieee80211_handle_queued_frames+0xd5/0x130 net/mac80211/main.c:453 tasklet_action_common+0x284/0x400 kernel/softirq.c:829 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0xdfd/0x1600 kernel/smp.c:877 Code: 57 48 8b 54 24 10 4c 89 74 24 10 49 89 d5 48 89 d5 48 89 54 24 18 49 c1 ed 03 83 e5 07 4d 01 e5 83 c5 03 e8 15 00 0c 00 f3 90 <41> 0f b6 45 00 40 38 c5 7c 08 84 c0 0f 85 e0 05 00 00 8b 43 08 31 RSP: 0000:ffffc9000dc978a8 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff8880b8441ec0 RCX: ffffffff81af8b61 RDX: ffff888054b8bc00 RSI: ffffffff81af8b3b RDI: 0000000000000005 RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000 R13: ffffed10170883d9 R14: 0000000000000001 R15: 0000000000000000 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1044 __flush_tlb_multi arch/x86/include/asm/paravirt.h:91 [inline] flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline] flush_tlb_mm_range+0x4a0/0x17a0 arch/x86/mm/tlb.c:1451 flush_tlb_page arch/x86/include/asm/tlbflush.h:324 [inline] ptep_clear_flush+0x136/0x180 mm/pgtable-generic.c:101 wp_page_copy mm/memory.c:3618 [inline] do_wp_page+0x1683/0x4f00 mm/memory.c:4013 handle_pte_fault mm/memory.c:6068 [inline] __handle_mm_fault+0x1b2d/0x2a50 mm/memory.c:6195 handle_mm_fault+0x589/0xd10 mm/memory.c:6364 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7ff84014d03f Code: 8d 34 19 48 39 d5 48 89 75 60 0f 95 c2 48 29 d8 48 83 c1 10 0f b6 d2 48 83 c8 01 48 c1 e2 02 48 09 da 48 83 ca 01 48 89 51 f8 <48> 89 46 08 eb 80 48 8d 0d 21 e9 0e 00 48 8d 15 25 fb 0e 00 bf 01 RSP: 002b:00007ffde418e1a0 EFLAGS: 00010206 RAX: 0000000000018a41 RBX: 0000000000008040 RCX: 0000555590c9a590 RDX: 0000000000008041 RSI: 0000555590ca25c0 RDI: 0000000000000004 RBP: 00007ff840397cc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000001000 R11: 0000000000000802 R12: 0000000000008030 R13: 0000000000000076 R14: 00007ff840397d20 R15: 0000000000000000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 22400 Comm: syz.4.4112 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:227 [inline] RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline] RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] RIP: 0010:hlock_class+0xb/0x70 kernel/locking/lockdep.c:234 Code: ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f b7 47 20 66 25 ff 1f 0f b7 c0 <48> 0f a3 05 3d e1 45 14 73 15 48 8d 04 80 48 8d 04 80 48 8d 04 c5 RSP: 0018:ffffc90000007be8 EFLAGS: 00000002 RAX: 000000000000006d RBX: ffff888021f9c6f0 RCX: 00000000f8797233 RDX: 0000000000000000 RSI: ffff888021f9c740 RDI: ffff888021f9c718 RBP: 0000000000000000 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000002 R11: 0000000000000000 R12: ffff888021f9c740 R13: ffff888021f9bc00 R14: 0000000000000002 R15: 0000000000000002 FS: 00007f8997dc96c0(0000) GS:ffff8881246b9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8997dc8f98 CR3: 0000000068a45000 CR4: 0000000000350ef0 Call Trace: __lock_acquire+0xa9f/0x1ce0 kernel/locking/lockdep.c:5233 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 debug_object_deactivate+0x135/0x3a0 lib/debugobjects.c:873 debug_hrtimer_deactivate kernel/time/hrtimer.c:450 [inline] debug_deactivate kernel/time/hrtimer.c:490 [inline] __run_hrtimer kernel/time/hrtimer.c:1729 [inline] __hrtimer_run_queues+0x46f/0xad0 kernel/time/hrtimer.c:1825 hrtimer_interrupt+0x397/0x8e0 kernel/time/hrtimer.c:1887 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline] __sysvec_apic_timer_interrupt+0x10b/0x3f0 arch/x86/kernel/apic/apic.c:1056 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194 Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 46 fc 02 f6 48 89 df e8 2e 50 03 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 05 4f f3 f5 65 8b 05 0e ac 41 08 85 c0 74 16 5b RSP: 0018:ffffc9000b6ffca8 EFLAGS: 00000246 RAX: 0000000000000002 RBX: ffff8880b8427c80 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffffffff8de4eeac RDI: ffffffff8c163000 RBP: 0000000000000283 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90ab8a97 R11: 0000000000000000 R12: 0000000000000000 R13: 0000022335f3c2b5 R14: dffffc0000000000 R15: ffff8880b8427c80 clock_was_set+0x599/0x870 kernel/time/hrtimer.c:972 do_settimeofday64+0x35d/0x540 kernel/time/timekeeping.c:1454 do_sys_settimeofday64+0x1dc/0x260 kernel/time/time.c:195 __do_sys_clock_settime kernel/time/posix-timers.c:1132 [inline] __se_sys_clock_settime kernel/time/posix-timers.c:1116 [inline] __x64_sys_clock_settime+0x1c1/0x2a0 kernel/time/posix-timers.c:1116 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8996f8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8997dc9038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3 RAX: ffffffffffffffda RBX: 00007f89971c5fa0 RCX: 00007f8996f8ebe9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000000 RBP: 00007f8997011e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f89971c6038 R14: 00007f89971c5fa0 R15: 00007ffe3b049a18