watchdog: BUG: soft lockup - CPU#1 stuck for 143s! [syz-executor.0:6981] Modules linked in: irq event stamp: 14675433 hardirqs last enabled at (14675432): [] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 hardirqs last disabled at (14675433): [] sysvec_apic_timer_interrupt+0xb/0xc0 arch/x86/kernel/apic/apic.c:1097 softirqs last enabled at (14668810): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last enabled at (14668810): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 softirqs last disabled at (14668815): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last disabled at (14668815): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 CPU: 1 PID: 6981 Comm: syz-executor.0 Not tainted 5.15.0-next-20211106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:56 [inline] RIP: 0010:stack_access_ok arch/x86/kernel/unwind_orc.c:342 [inline] RIP: 0010:deref_stack_reg+0x5c/0x150 arch/x86/kernel/unwind_orc.c:352 Code: 00 00 41 8b 04 24 85 c0 74 62 49 8d 7c 24 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c3 00 00 00 <49> 8d 7c 24 10 4d 8b 6c 24 08 48 b8 00 00 00 00 00 fc ff df 48 89 RSP: 0018:ffffc90000dc0718 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffc90000dc0860 RCX: 0000000000000000 RDX: 1ffff920001b8105 RSI: ffffc90005d97688 RDI: ffffc90000dc0828 RBP: ffffc90005d97688 R08: ffffffff8e17f430 R09: 0000000000000001 R10: fffff520001b810f R11: 000000000008808a R12: ffffc90000dc0820 R13: ffffc90000dc0855 R14: ffffc90000dc0820 R15: ffffc90000dc0854 FS: 00007fb4e08da700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555560a4708 CR3: 000000002a88f000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: unwind_next_frame+0x13f9/0x1ce0 arch/x86/kernel/unwind_orc.c:600 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0xff/0x130 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1749 slab_free mm/slub.c:3513 [inline] kfree+0xf6/0x560 mm/slub.c:4561 skb_free_head net/core/skbuff.c:655 [inline] skb_release_data+0x65a/0x790 net/core/skbuff.c:677 skb_release_all net/core/skbuff.c:742 [inline] __kfree_skb net/core/skbuff.c:756 [inline] consume_skb net/core/skbuff.c:912 [inline] consume_skb+0xc2/0x160 net/core/skbuff.c:906 mac80211_hwsim_tx_frame+0x1f6/0x2a0 drivers/net/wireless/mac80211_hwsim.c:1785 mac80211_hwsim_beacon_tx+0x49b/0x930 drivers/net/wireless/mac80211_hwsim.c:1838 __iterate_interfaces+0x1e5/0x520 net/mac80211/util.c:793 ieee80211_iterate_active_interfaces_atomic+0x70/0x180 net/mac80211/util.c:829 mac80211_hwsim_beacon+0xcd/0x1c0 drivers/net/wireless/mac80211_hwsim.c:1861 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:_compound_head include/linux/page-flags.h:201 [inline] RIP: 0010:virt_to_head_page include/linux/mm.h:863 [inline] RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:120 [inline] RIP: 0010:qlist_free_all+0x89/0xc0 mm/kasan/quarantine.c:162 Code: 4c 89 fe 48 85 ed 48 89 ef 75 cb 48 89 f7 48 89 34 24 e8 ca 77 76 ff 48 8b 34 24 48 c1 e8 0c 48 c1 e0 06 4c 01 f0 48 8b 50 08 <48> 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 78 18 eb 9b 49 c7 45 08 00 RSP: 0018:ffffc90005d97630 EFLAGS: 00000282 RAX: ffffea00022eb180 RBX: ffff8880afed39e0 RCX: ffffc9000a8d2000 RDX: ffffea0000701cc8 RSI: ffff88808bac6a00 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000002e R10: ffffffff81350e0a R11: 000000000000003f R12: dffffc0000000000 R13: ffffc90005d97668 R14: ffffea0000000000 R15: ffff88808bac6a00 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc_trace+0x1e9/0x2c0 mm/slub.c:3259 kmalloc include/linux/slab.h:590 [inline] kzalloc include/linux/slab.h:724 [inline] snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2414 [inline] snd_pcm_oss_open.part.0+0x564/0x1330 sound/core/oss/pcm_oss.c:2516 snd_pcm_oss_open+0x3c/0x50 sound/core/oss/pcm_oss.c:2480 soundcore_open+0x451/0x620 sound/sound_core.c:593 chrdev_open+0x266/0x770 fs/char_dev.c:414 do_dentry_open+0x4c8/0x1250 fs/open.c:822 do_open fs/namei.c:3426 [inline] path_openat+0x1cad/0x2750 fs/namei.c:3559 do_filp_open+0x1aa/0x400 fs/namei.c:3586 do_sys_openat2+0x16d/0x4d0 fs/open.c:1212 do_sys_open fs/open.c:1228 [inline] __do_sys_openat fs/open.c:1244 [inline] __se_sys_openat fs/open.c:1239 [inline] __x64_sys_openat+0x13f/0x1f0 fs/open.c:1239 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fb4e3364ae9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb4e08da188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fb4e3477f60 RCX: 00007fb4e3364ae9 RDX: 0000000000000000 RSI: 0000000020000280 RDI: ffffffffffffff9c RBP: 00007fb4e33bef25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc70cd8f2f R14: 00007fb4e08da300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.0-next-20211106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline] RIP: 0010:smp_call_function_many_cond+0x447/0xc90 kernel/smp.c:969 Code: 0b 00 85 ed 74 4d 48 b8 00 00 00 00 00 fc ff df 4d 89 f4 4c 89 f5 49 c1 ec 03 83 e5 07 49 01 c4 83 c5 03 e8 2b 75 0b 00 f3 90 <41> 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 95 06 00 00 8b 43 08 31 RSP: 0018:ffffc90000cd79f8 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff8880b9d3fca0 RCX: 0000000000000000 RDX: ffff8880119357c0 RSI: ffffffff816c5625 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff816c564b R11: 0000000000000000 R12: ffffed10173a7f95 R13: 0000000000000001 R14: ffff8880b9d3fca8 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00c27dfc8 CR3: 000000000b88e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: on_each_cpu_cond_mask+0x56/0xa0 kernel/smp.c:1135 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:1112 [inline] text_poke_bp_batch+0x1b3/0x560 arch/x86/kernel/alternative.c:1297 text_poke_flush arch/x86/kernel/alternative.c:1451 [inline] text_poke_flush arch/x86/kernel/alternative.c:1448 [inline] text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1458 arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146 jump_label_update+0x1d5/0x430 kernel/jump_label.c:830 static_key_enable_cpuslocked+0x1b1/0x260 kernel/jump_label.c:177 static_key_enable+0x16/0x20 kernel/jump_label.c:190 toggle_allocation_gate mm/kfence/core.c:732 [inline] toggle_allocation_gate+0x100/0x390 mm/kfence/core.c:724 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 41 8b 04 24 mov (%r12),%eax 6: 85 c0 test %eax,%eax 8: 74 62 je 0x6c a: 49 8d 7c 24 08 lea 0x8(%r12),%rdi f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 48 89 fa mov %rdi,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 c3 00 00 00 jne 0xed * 2a: 49 8d 7c 24 10 lea 0x10(%r12),%rdi <-- trapping instruction 2f: 4d 8b 6c 24 08 mov 0x8(%r12),%r13 34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 3b: fc ff df 3e: 48 rex.W 3f: 89 .byte 0x89