watchdog: BUG: soft lockup - CPU#1 stuck for 143s! [syz.8.1368:11624] Modules linked in: irq event stamp: 6231069 hardirqs last enabled at (6231068): [] irqentry_exit+0x5dd/0x660 kernel/entry/common.c:219 hardirqs last disabled at (6231069): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1056 softirqs last enabled at (63448): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (63448): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (63448): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 softirqs last disabled at (63451): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (63451): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (63451): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 CPU: 1 UID: 0 PID: 11624 Comm: syz.8.1368 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:lock_is_held_type+0x137/0x190 kernel/locking/lockdep.c:5945 Code: 01 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 4c 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 05 a9 ba 2d 07 <48> 3b 44 24 08 75 43 89 d8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f RSP: 0018:ffffc90000a07318 EFLAGS: 00000206 RAX: cabc0bf313062e00 RBX: 0000000000000001 RCX: cabc0bf313062e00 RDX: ffff88802ab30000 RSI: ffffffff8d952191 RDI: ffffffff8bbfc660 RBP: 00000000ffffffff R08: ffffffff81f62031 R09: ffffffff8df41cc0 R10: ffffc90000a07520 R11: fffff52000140eab R12: 0000000000000246 R13: ffff88802ab30000 R14: ffffffff8df41cc0 R15: 0000000000000001 FS: 00007fb2144ee6c0(0000) GS:ffff8881261b0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00002000000054c0 CR3: 000000004b440000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: __perf_output_begin kernel/events/ring_buffer.c:174 [inline] perf_output_begin_forward+0x1b5/0xa80 kernel/events/ring_buffer.c:277 __perf_event_output kernel/events/core.c:8509 [inline] perf_event_output_forward+0x2b2/0x430 kernel/events/core.c:8527 __perf_event_overflow+0x845/0xe70 kernel/events/core.c:10463 perf_swevent_overflow kernel/events/core.c:10538 [inline] perf_swevent_event+0x2f4/0x5e0 kernel/events/core.c:-1 perf_tp_event+0x4f6/0x1380 kernel/events/core.c:11083 perf_trace_run_bpf_submit+0xee/0x170 kernel/events/core.c:11007 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x335/0x410 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2fb/0x340 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:867 [inline] class_rcu_constructor include/linux/rcupdate.h:1195 [inline] unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5652 [inline] __kmalloc_noprof+0x411/0x800 mm/slub.c:5664 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] cfg80211_inform_single_bss_data+0x91e/0x1ad0 net/wireless/scan.c:2345 cfg80211_inform_bss_data+0x203/0x3b40 net/wireless/scan.c:3228 cfg80211_inform_bss_frame_data+0x3c7/0x710 net/wireless/scan.c:3319 ieee80211_bss_info_update+0x749/0x9e0 net/mac80211/scan.c:230 ieee80211_scan_rx+0x593/0xa20 net/mac80211/scan.c:359 __ieee80211_rx_handle_packet net/mac80211/rx.c:5282 [inline] ieee80211_rx_list+0x2485/0x2f90 net/mac80211/rx.c:5539 ieee80211_rx_napi+0x1a8/0x3d0 net/mac80211/rx.c:5562 ieee80211_rx include/net/mac80211.h:5216 [inline] ieee80211_handle_queued_frames+0xe8/0x1e0 net/mac80211/main.c:452 tasklet_action_common+0x358/0x550 kernel/softirq.c:925 handle_softirqs+0x27d/0x850 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:perf_prepare_sample+0x1ca3/0x2250 kernel/events/core.c:8425 Code: 00 48 8b 7c 24 10 74 05 e8 9a 90 35 00 49 01 5e 10 48 8b 44 24 28 42 80 3c 20 00 74 08 4c 89 f7 e8 82 90 35 00 41 80 4e 02 10 <48> c7 44 24 60 0e 36 e0 45 48 8b 44 24 58 4a c7 04 20 00 00 00 00 RSP: 0018:ffffc90004c06aa0 EFLAGS: 00000283 RAX: ffffffff81f1a594 RBX: 0000000000000000 RCX: 0000000000080000 RDX: ffffc900165cd000 RSI: 00000000000097e9 RDI: 00000000000097ea RBP: ffffc90004c06b90 R08: ffffffff81f1b83f R09: ffffffff8df41cc0 R10: dffffc0000000000 R11: ffffffff81f1b7b0 R12: dffffc0000000000 R13: ffff8880213fbed0 R14: ffffc90004c06f40 R15: ffffc90004c06f40 __perf_event_output kernel/events/core.c:8506 [inline] perf_event_output_forward+0x151/0x430 kernel/events/core.c:8527 __perf_event_overflow+0x845/0xe70 kernel/events/core.c:10463 perf_swevent_overflow kernel/events/core.c:10538 [inline] perf_swevent_event+0x2f4/0x5e0 kernel/events/core.c:-1 perf_tp_event+0x4f6/0x1380 kernel/events/core.c:11083 perf_trace_run_bpf_submit+0xee/0x170 kernel/events/core.c:11007 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x335/0x410 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2fb/0x340 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:867 [inline] class_rcu_constructor include/linux/rcupdate.h:1195 [inline] is_module_text_address+0x39/0x1e0 kernel/module/main.c:3856 kernel_text_address+0x94/0xe0 kernel/extable.c:119 __kernel_text_address+0xd/0x40 kernel/extable.c:79 unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:369 arch_stack_walk+0xfc/0x150 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 save_stack+0xf5/0x1f0 mm/page_owner.c:156 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:311 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1394 [inline] __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2901 __slab_free+0x21b/0x2a0 mm/slub.c:5999 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4948 [inline] slab_alloc_node mm/slub.c:5258 [inline] __do_kmalloc_node mm/slub.c:5651 [inline] __kmalloc_node_noprof+0x522/0x810 mm/slub.c:5658 kmalloc_node_noprof include/linux/slab.h:987 [inline] __vmalloc_area_node mm/vmalloc.c:3702 [inline] __vmalloc_node_range_noprof+0x5bb/0x12d0 mm/vmalloc.c:3897 __vmalloc_node_noprof mm/vmalloc.c:3960 [inline] __vmalloc_noprof+0xb1/0xf0 mm/vmalloc.c:3974 bpf_prog_alloc_no_stats+0x4a/0x500 kernel/bpf/core.c:106 bpf_prog_alloc+0x3c/0x1a0 kernel/bpf/core.c:154 bpf_prog_load+0x735/0x1a10 kernel/bpf/syscall.c:2992 __sys_bpf+0x5c3/0x8a0 kernel/bpf/syscall.c:6207 __do_sys_bpf kernel/bpf/syscall.c:6320 [inline] __se_sys_bpf kernel/bpf/syscall.c:6318 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6318 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb21358f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb2144ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fb2137e5fa0 RCX: 00007fb21358f749 RDX: 0000000000000094 RSI: 0000200000000300 RDI: 0000000000000005 RBP: 00007fb213613f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb2137e6038 R14: 00007fb2137e5fa0 R15: 00007ffc4834e028 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6125 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: wg-crypt-wg2 wg_packet_tx_worker RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210 Code: 89 fb e8 23 00 00 00 48 8b 3d b4 7b d7 0b 48 89 de 5b e9 43 dd 5a 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0c 25 08 00 77 92 65 8b 15 b8 b5 RSP: 0018:ffffc90000006938 EFLAGS: 00000282 RAX: 1ffff1100aad7ee6 RBX: ffff88806c5af140 RCX: ffff88802e76bd00 RDX: ffffc90000006a40 RSI: ffff88806c5af140 RDI: ffff888028137440 RBP: dffffc0000000000 R08: ffff88802e76bd00 R09: 0000000000000004 R10: 0000000000000003 R11: ffffffff897cfed0 R12: 0000000000000002 R13: ffff8880556bf728 R14: ffffc90000006a40 R15: ffff888028137440 FS: 0000000000000000(0000) GS:ffff8881260b0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdae673e40 CR3: 000000004b440000 CR4: 00000000003526f0 DR0: 0000200000000240 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: nf_nat_ipv6_out+0x20/0x380 net/netfilter/nf_nat_proto.c:974 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x53e/0x6b0 include/linux/netfilter.h:316 br_nf_post_routing+0xb66/0xfe0 net/bridge/br_netfilter_hooks.c:966 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x215/0x3c0 include/linux/netfilter.h:316 br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66 br_nf_hook_thresh net/bridge/br_netfilter_hooks.c:-1 [inline] br_nf_forward_finish+0xa40/0xe60 net/bridge/br_netfilter_hooks.c:662 NF_HOOK+0x61b/0x6b0 include/linux/netfilter.h:318 br_nf_forward_ip+0x647/0x7e0 net/bridge/br_netfilter_hooks.c:716 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x215/0x3c0 include/linux/netfilter.h:316 __br_forward+0x41e/0x600 net/bridge/br_forward.c:115 br_handle_frame_finish+0x15a3/0x1c90 net/bridge/br_input.c:229 br_nf_hook_thresh+0x3c6/0x4a0 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0x999/0xd60 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x37e/0x6b0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0x96e/0x14f0 net/bridge/br_input.c:442 __netif_receive_skb_core+0x95f/0x2f90 net/core/dev.c:6024 __netif_receive_skb_one_core net/core/dev.c:6135 [inline] __netif_receive_skb+0x72/0x380 net/core/dev.c:6250 process_backlog+0x622/0x1500 net/core/dev.c:6602 __napi_poll+0xae/0x320 net/core/dev.c:7666 napi_poll net/core/dev.c:7729 [inline] net_rx_action+0x672/0xe50 net/core/dev.c:7881 handle_softirqs+0x27d/0x850 kernel/softirq.c:622 do_softirq+0xec/0x180 kernel/softirq.c:523 __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:450 keep_key_fresh drivers/net/wireguard/send.c:138 [inline] wg_packet_create_data_done drivers/net/wireguard/send.c:259 [inline] wg_packet_tx_worker+0x6bf/0x7c0 drivers/net/wireguard/send.c:276 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246