watchdog: BUG: soft lockup - CPU#0 stuck for 144s! [syz.8.723:9056] Modules linked in: irq event stamp: 14390377 hardirqs last enabled at (14390376): [] irqentry_exit+0x74/0x90 kernel/entry/common.c:214 hardirqs last disabled at (14390377): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1052 softirqs last enabled at (10369674): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (10369674): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (10369674): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 softirqs last disabled at (10369679): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (10369679): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (10369679): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 CPU: 0 UID: 0 PID: 9056 Comm: syz.8.723 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline] RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:102 [inline] RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:227 [inline] RIP: 0010:unwind_next_frame+0x130e/0x2390 arch/x86/kernel/unwind_orc.c:494 Code: c1 e8 3f 48 01 c8 48 83 e0 fe 4c 8d 3c 45 00 00 00 00 49 01 ef 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 75 27 49 63 07 4c 01 f8 49 8d 4f 04 4c 39 e0 48 0f 46 e9 49 RSP: 0018:ffffc90000006db8 EFLAGS: 00000a02 RAX: 0000000000000000 RBX: ffffffff8fa64ebc RCX: dffffc0000000000 RDX: ffffffff8fa64e98 RSI: ffffffff903be50c RDI: ffffffff8b9eea00 RBP: ffffffff8fa64e98 R08: 000000000000000a R09: ffffffff81725d45 R10: ffffc900000069c8 R11: ffffffff81aaf950 R12: ffffffff862ec85f R13: ffffffff8fa64e98 R14: ffffc90000006e88 R15: ffffffff8fa64ea8 FS: 00007f1f3d1a06c0(0000) GS:ffff88812638a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002000 CR3: 0000000050d4a000 CR4: 00000000003526f0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2514 [inline] slab_free mm/slub.c:6566 [inline] kmem_cache_free+0x19b/0x690 mm/slub.c:6676 skb_release_data+0x62d/0x7c0 net/core/skbuff.c:1087 skb_release_all net/core/skbuff.c:1152 [inline] __kfree_skb net/core/skbuff.c:1166 [inline] consume_skb+0x9e/0xf0 net/core/skbuff.c:1398 dummy_xmit+0x140/0x1d0 drivers/net/dummy.c:65 __netdev_start_xmit include/linux/netdevice.h:5248 [inline] netdev_start_xmit include/linux/netdevice.h:5257 [inline] xmit_one net/core/dev.c:3845 [inline] dev_hard_start_xmit+0x2d4/0x830 net/core/dev.c:3861 __dev_queue_xmit+0x1b8d/0x3b50 net/core/dev.c:4763 neigh_output include/net/neighbour.h:547 [inline] ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK include/linux/netfilter.h:318 [inline] ndisc_send_skb+0xbce/0x1510 net/ipv6/ndisc.c:512 addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4037 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x283/0x870 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:preempt_schedule_irq+0xb0/0x150 kernel/sched/core.c:7256 Code: 24 20 f6 44 24 21 02 74 0c 90 0f 0b 48 f7 03 10 00 00 00 74 64 bf 01 00 00 00 e8 2b c7 58 f6 e8 06 3f 90 f6 fb bf 01 00 00 00 5b ab ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24 RSP: 0018:ffffc9000502e800 EFLAGS: 00000286 RAX: 02943ef7f710ea00 RBX: ffff88802da59e40 RCX: 02943ef7f710ea00 RDX: 0000000000000006 RSI: ffffffff8d512c0f RDI: 0000000000000001 RBP: ffffc9000502e8b0 R08: ffffffff8f5bed37 R09: 1ffffffff1eb7da6 R10: dffffc0000000000 R11: fffffbfff1eb7da7 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000a05d00 irqentry_exit+0x6f/0x90 kernel/entry/common.c:211 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:unwind_next_frame+0x374/0x2390 arch/x86/kernel/unwind_orc.c:505 Code: ea 48 01 d2 48 01 f2 48 bd 00 00 00 00 00 fc ff df 0f 84 37 01 00 00 4c 8d 62 04 4c 8d 6a 05 4c 89 e0 48 c1 e8 03 0f b6 04 28 <84> c0 0f 85 6d 19 00 00 4c 89 e8 48 c1 e8 03 0f b6 04 28 84 c0 0f RSP: 0018:ffffc9000502e978 EFLAGS: 00000a07 RAX: 0000000000000000 RBX: ffffffff8fc7330c RCX: ffffffff8fc73314 RDX: ffffffff906d3bba RSI: ffffffff906d3bba RDI: ffffffff8b9eea00 RBP: dffffc0000000000 R08: 0000000000000005 R09: ffffffff81725d45 R10: ffffc9000502e588 R11: ffffffff81aaf950 R12: ffffffff906d3bbe R13: ffffffff906d3bbf R14: ffffc9000502ea48 R15: ffffffff8fc73310 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5603 [inline] __kvmalloc_node_noprof+0x5cd/0x910 mm/slub.c:7036 allocate_hook_entries_size net/netfilter/core.c:58 [inline] nf_hook_entries_grow+0x281/0x720 net/netfilter/core.c:137 __nf_register_net_hook+0x2c9/0x930 net/netfilter/core.c:432 nf_register_net_hook+0xb2/0x190 net/netfilter/core.c:575 nf_register_net_hooks+0x44/0x1b0 net/netfilter/core.c:591 nf_defrag_ipv4_enable+0x87/0x120 net/ipv4/netfilter/nf_defrag_ipv4.c:160 nf_ct_netns_do_get+0x18c/0x5a0 net/netfilter/nf_conntrack_proto.c:448 nf_ct_netns_inet_get+0x1f/0x150 net/netfilter/nf_conntrack_proto.c:563 nft_ct_get_init+0x5a4/0x8c0 net/netfilter/nft_ct.c:507 nf_tables_newexpr net/netfilter/nf_tables_api.c:3527 [inline] nf_tables_newrule+0x1794/0x28a0 net/netfilter/nf_tables_api.c:4358 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:526 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:649 [inline] nfnetlink_rcv+0x11d6/0x2590 net/netfilter/nfnetlink.c:667 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x830 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1f3c38eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f1f3d1a0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1f3c5e5fa0 RCX: 00007f1f3c38eec9 RDX: 0000000004000000 RSI: 0000200000000380 RDI: 0000000000000007 RBP: 00007f1f3c411f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1f3c5e6038 R14: 00007f1f3c5e5fa0 R15: 00007ffff4e0fdd8 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5859 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: hci1 hci_cmd_timeout RIP: 0010:hlock_class kernel/locking/lockdep.c:246 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline] RIP: 0010:__lock_acquire+0x50e/0xd20 kernel/locking/lockdep.c:5187 Code: c7 28 41 89 c4 48 39 cb 0f 8d d6 00 00 00 48 83 fb 31 0f 83 92 00 00 00 41 8b 07 25 ff 1f 00 00 48 0f a3 05 e4 ea b4 11 73 10 <48> 69 c0 c8 00 00 00 48 8d 88 30 13 f2 92 eb 40 83 3d 4b 7a b8 17 RSP: 0018:ffffc90004087170 EFLAGS: 00000007 RAX: 0000000000000750 RBX: 0000000000000000 RCX: 00000000ffffffff RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff888031639e40 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff850f1b6e R10: dffffc0000000000 R11: ffffffff850e0e50 R12: ffffffffffffff05 R13: 0000000000000003 R14: ffff88803163aa60 R15: ffff88803163a990 FS: 0000000000000000(0000) GS:ffff88812648a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f63f8a00218 CR3: 0000000077f7a000 CR4: 00000000003526f0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 uart_port_lock_irqsave include/linux/serial_core.h:717 [inline] serial8250_console_write+0x17e/0x1ba0 drivers/tty/serial/8250/8250_port.c:3355 console_emit_next_record kernel/printk/printk.c:3111 [inline] console_flush_all+0x6f0/0xb10 kernel/printk/printk.c:3199 __console_flush_and_unlock kernel/printk/printk.c:3258 [inline] console_unlock+0xbb/0x190 kernel/printk/printk.c:3298 vprintk_emit+0x4c5/0x590 kernel/printk/printk.c:2423 _printk+0xcf/0x120 kernel/printk/printk.c:2448 bt_err+0x10b/0x160 net/bluetooth/lib.c:296 hci_cmd_timeout+0xd8/0x1e0 net/bluetooth/hci_core.c:1469 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x436/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245