ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 watchdog: BUG: soft lockup - CPU#0 stuck for 246s! [kworker/u8:14:6627] Modules linked in: irq event stamp: 1591532 hardirqs last enabled at (1591531): [] irqentry_exit+0x3b/0x90 kernel/entry/common.c:214 hardirqs last disabled at (1591532): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1052 softirqs last enabled at (1591528): [] softirq_handle_end kernel/softirq.c:468 [inline] softirqs last enabled at (1591528): [] handle_softirqs+0x5be/0x8e0 kernel/softirq.c:650 softirqs last disabled at (1591523): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (1591523): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (1591523): [] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723 CPU: 0 UID: 0 PID: 6627 Comm: kworker/u8:14 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0xe02/0x1600 kernel/smp.c:877 Code: 10 4c 89 74 24 10 49 89 d5 48 89 d5 48 89 54 24 18 49 c1 ed 03 83 e5 07 4d 01 e5 83 c5 03 e8 a5 0d 0c 00 f3 90 41 0f b6 45 00 <40> 38 c5 7c 08 84 c0 0f 85 e0 05 00 00 8b 43 08 31 ff 83 e0 01 41 RSP: 0018:ffffc9001e247878 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff8880b8540460 RCX: ffffffff81b0ec81 RDX: ffff888027eb1e40 RSI: ffffffff81b0ec5b RDI: 0000000000000005 RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000 R13: ffffed10170a808d R14: 0000000000000001 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888124a0c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9bbce65000 CR3: 000000000e182000 CR4: 0000000000350ef0 Call Trace: on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1043 on_each_cpu include/linux/smp.h:71 [inline] smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2713 [inline] smp_text_poke_batch_finish+0x27b/0xdb0 arch/x86/kernel/alternative.c:2923 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 jump_label_update+0x376/0x550 kernel/jump_label.c:919 static_key_enable_cpuslocked+0x1b7/0x270 kernel/jump_label.c:210 static_key_enable+0x1a/0x20 kernel/jump_label.c:223 toggle_allocation_gate mm/kfence/core.c:852 [inline] toggle_allocation_gate+0xfa/0x280 mm/kfence/core.c:844 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 8640 Comm: syz.4.761 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:list_is_last include/linux/list.h:362 [inline] RIP: 0010:should_restart_cycle net/sched/sch_taprio.c:874 [inline] RIP: 0010:advance_sched+0x269/0xc80 net/sched/sch_taprio.c:953 Code: bb 52 f8 48 8b 04 24 4c 8d b5 10 01 00 00 48 8d b8 40 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 2f 09 00 00 48 8b 04 24 48 8d bd 28 01 00 00 48 89 fa 4c 8b RSP: 0018:ffffc90000a08d90 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: ffff8880785dd340 RCX: ffffffff896a3eb4 RDX: 1ffff110069d8528 RSI: ffffffff896a3ec2 RDI: ffff888034ec2940 RBP: ffff88804e4b3400 R08: 0000000000000006 R09: 187f45b95c000000 R10: 0000000000000000 R11: 0000000000000001 R12: 187f45b95c000000 R13: 0000000000000000 R14: ffff88804e4b3510 R15: ffffffff896a3c80 FS: 0000000000000000(0000) GS:ffff888124b0c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c31f06d CR3: 00000000566be000 CR4: 0000000000350ef0 Call Trace: __run_hrtimer kernel/time/hrtimer.c:1777 [inline] __hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841 hrtimer_interrupt+0x397/0x8e0 kernel/time/hrtimer.c:1903 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1041 [inline] __sysvec_apic_timer_interrupt+0x10b/0x3f0 arch/x86/kernel/apic/apic.c:1058 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1052 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194 Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 16 c9 37 f6 48 89 df e8 fe 1c 38 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 45 26 28 f6 65 8b 05 7e 35 40 08 85 c0 74 16 5b RSP: 0018:ffffc9000aff7388 EFLAGS: 00000246 RAX: 0000000000000006 RBX: ffffffff9ad0dad0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffffff8da2897d RDI: ffffffff8bf072c0 RBP: 0000000000000286 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90822cd7 R11: 0000000000000001 R12: dffffc0000000000 R13: 000000000000042e R14: 0000000000000005 R15: ffff88804d400000 __debug_check_no_obj_freed lib/debugobjects.c:1108 [inline] debug_check_no_obj_freed+0x31f/0x600 lib/debugobjects.c:1129 free_pages_prepare mm/page_alloc.c:1401 [inline] free_unref_folios+0x359/0x1610 mm/page_alloc.c:2963 folios_put_refs+0x4be/0x750 mm/swap.c:1002 folio_batch_release include/linux/pagevec.h:101 [inline] truncate_inode_pages_range+0x311/0xe50 mm/truncate.c:383 kill_bdev block/bdev.c:91 [inline] blkdev_flush_mapping+0xfb/0x290 block/bdev.c:712 blkdev_put_whole+0xc4/0xf0 block/bdev.c:719 bdev_release+0x47e/0x6d0 block/bdev.c:1144 blkdev_release+0x15/0x20 block/fops.c:709 __fput+0x402/0xb70 fs/file_table.c:468 task_work_run+0x150/0x240 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x86f/0x2bf0 kernel/exit.c:966 do_group_exit+0xd3/0x2a0 kernel/exit.c:1107 get_signal+0x2671/0x26d0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8f/0x7c0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x85/0x130 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x426/0xfa0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6e2ff8efc9 Code: Unable to access opcode bytes at 0x7f6e2ff8ef9f. RSP: 002b:00007f6e30e69038 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: fffffffffffffe00 RBX: 00007f6e301e5fa0 RCX: 00007f6e2ff8efc9 RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000007 RBP: 00007f6e30011f91 R08: 000000000000fea8 R09: 000000000000000a R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6e301e6038 R14: 00007f6e301e5fa0 R15: 00007ffe0620ea68