watchdog: BUG: soft lockup - CPU#1 stuck for 122s! [syz.4.228:6612] Modules linked in: irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [] rcu_lock_acquire include/linux/rcupdate.h:337 [inline] hardirqs last disabled at (0): [] rcu_read_lock include/linux/rcupdate.h:849 [inline] hardirqs last disabled at (0): [] copy_process+0x9fa/0x3d50 kernel/fork.c:2260 softirqs last enabled at (0): [] rcu_lock_acquire include/linux/rcupdate.h:337 [inline] softirqs last enabled at (0): [] rcu_read_lock include/linux/rcupdate.h:849 [inline] softirqs last enabled at (0): [] copy_process+0x9fa/0x3d50 kernel/fork.c:2260 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 6612 Comm: syz.4.228 Not tainted 6.13.0-syzkaller-gc03320a6768c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 RIP: 0010:memset_orig+0x36/0xb0 arch/x86/lib/memset_64.S:68 Code: b8 01 01 01 01 01 01 01 01 48 0f af c1 41 89 f9 41 83 e1 07 75 70 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 48 89 07 <48> 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 28 48 89 RSP: 0018:ffffc90000a18758 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888068378600 RCX: 0000000000000000 RDX: 0000000000000050 RSI: 0000000000000000 RDI: ffffed100d06f0c0 RBP: ffff8881416f6a00 R08: 00000000ffffffff R09: 0000000000000000 R10: ffffed100d06f0c0 R11: fffffbfff2036c47 R12: 0000000000000280 R13: 00000000ffffffff R14: 0000000000000280 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055bfe4c45a28 CR3: 000000000e738000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000f3060a Call Trace: kasan_poison mm/kasan/shadow.c:146 [inline] kasan_unpoison+0x46/0x70 mm/kasan/shadow.c:178 unpoison_slab_object mm/kasan/common.c:315 [inline] __kasan_slab_alloc+0x52/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4220 kmalloc_reserve+0xa8/0x2a0 net/core/skbuff.c:587 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 __netdev_alloc_skb+0x103/0xa00 net/core/skbuff.c:742 netdev_alloc_skb include/linux/skbuff.h:3410 [inline] dev_alloc_skb include/linux/skbuff.h:3423 [inline] __ieee80211_beacon_get+0x998/0x15c0 net/mac80211/tx.c:5474 ieee80211_beacon_get_tim+0xb4/0x320 net/mac80211/tx.c:5596 ieee80211_beacon_get include/net/mac80211.h:5641 [inline] mac80211_hwsim_beacon_tx+0x39d/0x850 drivers/net/wireless/virtual/mac80211_hwsim.c:2311 __iterate_interfaces+0x297/0x570 net/mac80211/util.c:760 ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:796 mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2345 __run_hrtimer kernel/time/hrtimer.c:1738 [inline] __hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1802 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1819 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline] RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:102 [inline] RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:227 [inline] RIP: 0010:unwind_next_frame+0x6d5/0x22d0 arch/x86/kernel/unwind_orc.c:494 Code: 89 c1 48 c1 f9 02 48 c1 e8 3f 48 01 c8 48 83 e0 fe 49 8d 1c 46 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 75 27 48 63 03 48 01 d8 48 8d 4b 04 4c 39 f8 4c 0f 46 f1 48 RSP: 0018:ffffc900036e69f0 EFLAGS: 00000a06 RAX: 0000000000000000 RBX: ffffffff909a2158 RCX: dffffc0000000000 RDX: 00000000000b0001 RSI: ffffffff9146ea2c RDI: 0000000000000001 RBP: ffffffff909a215c R08: 0000000000000003 R09: ffffc900036e6bb0 R10: ffffc900036e6b10 R11: ffffffff818b2ae0 R12: ffffffff909a2154 R13: ffffffff909a2154 R14: ffffffff909a2154 R15: ffffffff8bd43393 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 __call_rcu_common kernel/rcu/tree.c:3065 [inline] call_rcu+0x168/0xac0 kernel/rcu/tree.c:3172 context_switch kernel/sched/core.c:5376 [inline] __schedule+0x1874/0x4be0 kernel/sched/core.c:6760 preempt_schedule_common+0x84/0xd0 kernel/sched/core.c:6939 preempt_schedule+0xe1/0xf0 kernel/sched/core.c:6963 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] zap_pte_range mm/memory.c:1705 [inline] zap_pmd_range mm/memory.c:1753 [inline] zap_pud_range mm/memory.c:1782 [inline] zap_p4d_range mm/memory.c:1803 [inline] unmap_page_range+0x36c3/0x4040 mm/memory.c:1824 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1914 exit_mmap+0x292/0xca0 mm/mmap.c:1672 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:570 do_exit+0x9ad/0x28e0 kernel/exit.c:925 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3036 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd91d58cda9 Code: Unable to access opcode bytes at 0x7fd91d58cd7f. RSP: 002b:00007fd91e4ab038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: 000000000000000a RBX: 00007fd91d7a5fa0 RCX: 00007fd91d58cda9 RDX: 0000000000000010 RSI: 0000000000000002 RDI: 0000000000000010 RBP: 00007fd91d60e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd91d7a5fa0 R15: 00007ffe84291838 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6610 Comm: syz.3.227 Not tainted 6.13.0-syzkaller-gc03320a6768c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:36 [inline] RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:149 [inline] RIP: 0010:wrmsr arch/x86/include/asm/msr.h:256 [inline] RIP: 0010:native_apic_msr_write+0x39/0x50 arch/x86/include/asm/apic.h:212 Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 c3 cc cc cc cc f3 0f 1e fa 89 f6 31 d2 e9 03 a7 b5 03 0f 1f RSP: 0018:ffffc900000076c8 EFLAGS: 00000046 RAX: 000000000000007d RBX: 0000000000000020 RCX: 0000000000000838 RDX: 0000000000000000 RSI: 000000000000007d RDI: 0000000000000838 RBP: 000000000000007d R08: ffffffff81900819 R09: 1ffffffff2036c46 R10: dffffc0000000000 R11: ffffffff81491490 R12: 00000000000007d5 R13: dffffc0000000000 R14: 0000000010003c65 R15: ffff8880b8628340 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d599143718 CR3: 0000000065240000 CR4: 00000000003526f0 Call Trace: apic_write arch/x86/include/asm/apic.h:405 [inline] lapic_next_event+0x11/0x20 arch/x86/kernel/apic/apic.c:415 clockevents_program_event+0x1c1/0x350 kernel/time/clockevents.c:334 hrtimer_interrupt+0x5b7/0xa40 kernel/time/hrtimer.c:1877 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline] __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:mac80211_hwsim_tx_frame_no_nl+0xa74/0x18d0 drivers/net/wireless/virtual/mac80211_hwsim.c:1828 Code: 00 4c 39 6c 24 38 0f 84 84 00 00 00 49 8d 9d 10 3e 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 f0 07 00 00 0f b6 1b <31> ff 89 de e8 83 4f 89 fa 85 db 74 63 49 8d 9d 11 3e 00 00 48 89 RSP: 0018:ffffc90000007920 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888074659e00 RDX: 0000000000000100 RSI: 0000000000000005 RDI: 0000000000000003 RBP: ffffc90000007ae8 R08: ffffffff87161f90 R09: ffffffff87161d0f R10: 0000000000000002 R11: ffff888074659e00 R12: 1ffff92000000f4f R13: ffff88807eceb0a0 R14: ffffc90000007a78 R15: dffffc0000000000 mac80211_hwsim_tx_frame+0x1cc/0x220 drivers/net/wireless/virtual/mac80211_hwsim.c:2215 mac80211_hwsim_beacon_tx+0x3bf/0x850 drivers/net/wireless/virtual/mac80211_hwsim.c:2315 __iterate_interfaces+0x297/0x570 net/mac80211/util.c:760 ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:796 mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2345 __run_hrtimer kernel/time/hrtimer.c:1738 [inline] __hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1802 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1819 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:zap_pmd_range mm/memory.c:1753 [inline] RIP: 0010:zap_pud_range mm/memory.c:1782 [inline] RIP: 0010:zap_p4d_range mm/memory.c:1803 [inline] RIP: 0010:unmap_page_range+0x99c/0x4040 mm/memory.c:1824 Code: 5a a5 1a 00 4c 8b ac 24 e8 00 00 00 4c 89 ef 48 8b 74 24 78 48 8b 54 24 28 4c 89 f9 e8 ed fb 06 00 48 85 c0 0f 84 8b 29 00 00 <49> 89 c7 4c 89 ef e8 29 49 07 00 c7 84 24 ac 00 00 00 00 00 00 00 RSP: 0018:ffffc90003d5f2e0 EFLAGS: 00000282 RAX: ffff888076901840 RBX: ffffc90003d5f840 RCX: cba250a0d57e0600 RDX: 0000000000000000 RSI: 0000000076901067 RDI: 0000000076901067 RBP: ffffc90003d5f610 R08: ffffffff81f25118 R09: fffff520007abe2c R10: dffffc0000000000 R11: fffff520007abe2c R12: dffffc0000000000 R13: ffff888034729e00 R14: ffffc90003d5f560 R15: ffffc90003d5f5a0 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1914 exit_mmap+0x292/0xca0 mm/mmap.c:1672 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:570 do_exit+0x9ad/0x28e0 kernel/exit.c:925 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3036 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2b07b8cda9 Code: Unable to access opcode bytes at 0x7f2b07b8cd7f. RSP: 002b:00007f2b08acd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: 0000000000000007 RBX: 00007f2b07da5fa0 RCX: 00007f2b07b8cda9 RDX: 0000000000000002 RSI: 0000000020000080 RDI: 0000000000000006 RBP: 00007f2b07c0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f2b07da5fa0 R15: 00007ffdbdd3d6f8