watchdog: BUG: soft lockup - CPU#0 stuck for 143s! [syz.6.2946:16131] Modules linked in: irq event stamp: 10942809 hardirqs last enabled at (10942808): [] irqentry_exit+0x59e/0x620 kernel/entry/common.c:242 hardirqs last disabled at (10942809): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1056 softirqs last enabled at (142596): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (142596): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (142596): [] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 softirqs last disabled at (142599): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (142599): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (142599): [] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 CPU: 0 UID: 0 PID: 16131 Comm: syz.6.2946 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 RIP: 0010:lock_release+0xb/0x3d0 kernel/locking/lockdep.c:5876 Code: be 2f 00 00 00 e9 0e ff ff ff 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 <41> 54 53 48 83 ec 30 49 89 f5 49 89 fe 65 48 8b 05 70 23 7b 11 48 RSP: 0018:ffffc90000005c88 EFLAGS: 00000246 RAX: ffffffff81d188d8 RBX: 0000000000000001 RCX: ffff888034f2bd00 RDX: 0000000000000100 RSI: ffffffff81d18937 RDI: ffffffff8e75e5e0 RBP: ffffc90000005dd8 R08: ffffffff81d17df2 R09: ffffffff8e75e5e0 R10: dffffc0000000000 R11: fffff91ffff4d005 R12: 0000000000000001 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802bb75ea8 FS: 00007f147a0c16c0(0000) GS:ffff888125452000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147a0a0d58 CR3: 0000000032ebe000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000200000000300 DR3: 0000200000000300 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock+0x93/0xa0 include/linux/rcupdate.h:869 trace_call_bpf+0xa12/0xb70 kernel/trace/bpf_trace.c:124 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11329 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x345/0x440 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2a4/0x2e0 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:300 [inline] rcu_read_lock include/linux/rcupdate.h:838 [inline] class_rcu_constructor include/linux/rcupdate.h:1181 [inline] unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2685 [inline] slab_free mm/slub.c:6165 [inline] kmem_cache_free+0x187/0x630 mm/slub.c:6295 packet_rcv+0x175/0x1730 net/packet/af_packet.c:2223 dev_queue_xmit_nit+0xa39/0xad0 net/core/dev.c:2606 xmit_one net/core/dev.c:3884 [inline] dev_hard_start_xmit+0x1cf/0x870 net/core/dev.c:3904 sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:347 __dev_xmit_skb net/core/dev.c:4203 [inline] __dev_queue_xmit+0x1550/0x3890 net/core/dev.c:4819 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:438 __ip_queue_xmit+0x116a/0x1bb0 net/ipv4/ip_output.c:534 __tcp_transmit_skb+0x2b30/0x43e0 net/ipv4/tcp_output.c:1693 tcp_rcv_established+0x19bd/0x2740 net/ipv4/tcp_input.c:6669 tcp_v4_do_rcv+0xa90/0x1430 net/ipv4/tcp_ipv4.c:1884 tcp_v4_rcv+0x2825/0x31f0 net/ipv4/tcp_ipv4.c:2319 ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 dst_input include/net/dst.h:480 [inline] ip_sublist_rcv_finish+0x1f0/0x240 net/ipv4/ip_input.c:584 ip_list_rcv_finish net/ipv4/ip_input.c:636 [inline] ip_sublist_rcv+0x761/0xa70 net/ipv4/ip_input.c:644 ip_list_rcv+0x3f1/0x450 net/ipv4/ip_input.c:678 __netif_receive_skb_list_ptype net/core/dev.c:6224 [inline] __netif_receive_skb_list_core+0x7e5/0x810 net/core/dev.c:6271 __netif_receive_skb_list net/core/dev.c:6323 [inline] netif_receive_skb_list_internal+0x995/0xcf0 net/core/dev.c:6414 gro_normal_list include/net/gro.h:523 [inline] gro_normal_one include/net/gro.h:543 [inline] gro_skb_finish net/core/gro.c:603 [inline] gro_receive_skb+0x632/0xd40 net/core/gro.c:633 receive_buf+0xb09/0x1900 drivers/net/virtio_net.c:2656 virtnet_receive_packets drivers/net/virtio_net.c:2968 [inline] virtnet_receive drivers/net/virtio_net.c:2992 [inline] virtnet_poll+0x219e/0x2f90 drivers/net/virtio_net.c:3081 __napi_poll+0xae/0x340 net/core/dev.c:7709 napi_poll net/core/dev.c:7772 [inline] net_rx_action+0x627/0xf70 net/core/dev.c:7929 handle_softirqs+0x22a/0x870 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:rcu_rnp_online_cpus kernel/rcu/tree.c:3997 [inline] RIP: 0010:rcu_rdp_cpu_online kernel/rcu/tree.c:4007 [inline] RIP: 0010:rcu_lockdep_current_cpu_online+0xbf/0x120 kernel/rcu/tree.c:4048 Code: 20 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 24 91 86 00 48 8b 1b 48 83 c3 70 48 89 d8 48 c1 e8 03 42 80 3c 30 00 <74> 08 48 89 df e8 07 91 86 00 4c 85 3b 75 1a 48 c7 c7 80 4a 76 8e RSP: 0018:ffffc90003417510 EFLAGS: 00000246 RAX: 1ffffffff1cec83e RBX: ffffffff8e7641f0 RCX: 0000000000000002 RDX: ffff888034f2bd00 RSI: ffffffff8c27d9e0 RDI: ffff8880b863bde8 RBP: ffffc90003417658 R08: ffffc900034175ef R09: 0000000000000000 R10: ffffc900034175e0 R11: fffff52000682ebe R12: ffff88802bb75e80 R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000001 rcu_read_lock_held_common kernel/rcu/update.c:113 [inline] rcu_read_lock_held+0x1e/0x50 kernel/rcu/update.c:349 bpf_prog_run_array include/linux/bpf.h:2458 [inline] trace_call_bpf+0x1fa/0xb70 kernel/trace/bpf_trace.c:145 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11329 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x345/0x440 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2a4/0x2e0 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:300 [inline] rcu_read_lock include/linux/rcupdate.h:838 [inline] class_rcu_constructor include/linux/rcupdate.h:1181 [inline] unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4538 [inline] slab_alloc_node mm/slub.c:4866 [inline] kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4873 alloc_empty_file+0x55/0x1d0 fs/file_table.c:237 alloc_file fs/file_table.c:355 [inline] alloc_file_pseudo+0x155/0x240 fs/file_table.c:384 sock_alloc_file+0xb8/0x2e0 net/socket.c:483 sock_map_fd net/socket.c:513 [inline] __sys_socket+0x13c/0x1b0 net/socket.c:1756 __do_sys_socket net/socket.c:1761 [inline] __se_sys_socket net/socket.c:1759 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1759 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f147919c819 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f147a0c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007f1479415fa0 RCX: 00007f147919c819 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000010 RBP: 00007f1479232c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1479416038 R14: 00007f1479415fa0 R15: 00007fff50b2b298 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 16093 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 RIP: 0010:trace_event_get_offsets_lock_acquire include/trace/events/lock.h:24 [inline] RIP: 0010:do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] RIP: 0010:perf_trace_lock_acquire+0xb9/0x440 include/trace/events/lock.h:24 Code: 00 00 00 00 43 c6 44 37 08 04 c7 84 24 80 00 00 00 00 00 00 00 48 89 74 24 38 48 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 <74> 08 48 89 df e8 ad c6 90 00 48 8b 03 48 85 c0 48 c7 c7 00 e1 cc RSP: 0000:ffffc90000a07f00 EFLAGS: 00000046 RAX: 1ffffffff34a7c15 RBX: ffffffff9a53e0a8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff9a53e090 RDI: ffffffff8e62a540 RBP: ffffc90000a08000 R08: 0000000000000000 R09: 0000000000000001 R10: dffffc0000000000 R11: fffffbfff2023d57 R12: ffffffff8e62a540 R13: ffffffff9a53e090 R14: dffffc0000000000 R15: 1ffff92000140fe8 FS: 00007f0f5adc2880(0000) GS:ffff888125552000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564f1d40b3a0 CR3: 0000000078f44000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2a4/0x2e0 kernel/locking/lockdep.c:5831 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:162 __debug_check_no_obj_freed lib/debugobjects.c:1105 [inline] debug_check_no_obj_freed+0x145/0x550 lib/debugobjects.c:1146 slab_free_hook mm/slub.c:2616 [inline] slab_free mm/slub.c:6165 [inline] kfree+0x13a/0x630 mm/slub.c:6483 ieee80211_inform_bss+0xc75/0x1160 net/mac80211/scan.c:164 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline] cfg80211_inform_single_bss_data+0xd08/0x1b70 net/wireless/scan.c:2372 cfg80211_inform_bss_data+0x266/0x3c40 net/wireless/scan.c:3226 cfg80211_inform_bss_frame_data+0x3c7/0x760 net/wireless/scan.c:3317 ieee80211_bss_info_update+0x794/0xa40 net/mac80211/scan.c:230 ieee80211_scan_rx+0x552/0xa40 net/mac80211/scan.c:364 __ieee80211_rx_handle_packet net/mac80211/rx.c:5305 [inline] ieee80211_rx_list+0x29e5/0x3710 net/mac80211/rx.c:5588 ieee80211_rx_napi+0x1b1/0x3e0 net/mac80211/rx.c:5611 ieee80211_rx include/net/mac80211.h:5267 [inline] ieee80211_handle_queued_frames+0xe8/0x1e0 net/mac80211/main.c:452 tasklet_action_common+0x2da/0x4b0 kernel/softirq.c:925 handle_softirqs+0x22a/0x870 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0xce5/0x12c0 kernel/smp.c:877 Code: 45 8b 2c 24 44 89 ee 83 e6 01 31 ff e8 d4 eb 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 7f e7 0b 00 eb 38 f3 90 <42> 0f b6 04 2b 84 c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 63 e7 RSP: 0000:ffffc900040f7820 EFLAGS: 00000293 RAX: ffffffff81b9cd6d RBX: 1ffff110170c8525 RCX: ffff8880590a0000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc900040f7950 R08: ffffffff9011eab7 R09: 1ffffffff2023d56 R10: dffffc0000000000 R11: fffffbfff2023d57 R12: ffff8880b8642928 R13: dffffc0000000000 R14: ffff8880b873c000 R15: 0000000000000000 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1043 __flush_tlb_multi arch/x86/include/asm/paravirt.h:57 [inline] flush_tlb_multi arch/x86/mm/tlb.c:1382 [inline] flush_tlb_mm_range+0x5c3/0x10c0 arch/x86/mm/tlb.c:1472 flush_tlb_page arch/x86/include/asm/tlbflush.h:323 [inline] ptep_clear_flush+0x120/0x170 mm/pgtable-generic.c:103 wp_page_copy mm/memory.c:3846 [inline] do_wp_page+0x4129/0x5a00 mm/memory.c:4241 handle_pte_fault mm/memory.c:6333 [inline] __handle_mm_fault mm/memory.c:6455 [inline] handle_mm_fault+0x1520/0x3310 mm/memory.c:6624 do_user_addr_fault+0xa73/0x1340 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7f0f5a6b5dda Code: f6 44 01 08 01 74 59 48 83 61 08 fe 48 3d ff 03 00 00 76 69 49 8b 55 70 49 8d 75 60 48 39 72 18 0f 85 ba 00 00 00 66 0f ef c0 <41> 0f 11 44 24 20 49 89 54 24 10 49 89 74 24 18 4c 89 66 10 4c 89 RSP: 002b:00007fff2dcb5e50 EFLAGS: 00010246 RAX: 0000000000006ff0 RBX: 0000000000004470 RCX: 0000564f1d40df00 RDX: 0000564f1d3df630 RSI: 00007f0f5a7f1b20 RDI: 0000564f1d40df00 RBP: 00007f0f5a7f1ac0 R08: 0000000000004470 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000564f1d40b380 R13: 00007f0f5a7f1ac0 R14: 0000000000004470 R15: 00007f0f5a7f1ac0