watchdog: BUG: soft lockup - CPU#1 stuck for 157s! [kworker/u8:5:1301] Modules linked in: irq event stamp: 22259503 hardirqs last enabled at (22259502): [] kvm_wait arch/x86/kernel/kvm.c:1064 [inline] hardirqs last enabled at (22259502): [] kvm_wait+0x157/0x1f0 arch/x86/kernel/kvm.c:1046 hardirqs last disabled at (22259503): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1050 softirqs last enabled at (22191788): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (22191788): [] cfg80211_put_bss+0x1b4/0x280 net/wireless/scan.c:3355 softirqs last disabled at (22191795): [] __do_softirq kernel/softirq.c:613 [inline] softirqs last disabled at (22191795): [] invoke_softirq kernel/softirq.c:453 [inline] softirqs last disabled at (22191795): [] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680 CPU: 1 UID: 0 PID: 1301 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82 Code: 0d 63 02 e9 9e 4a 7d f5 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 06 17 00 fb f4 77 4a 7d f5 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffc90000a08360 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000002 RDX: ffff8880289dbc00 RSI: ffffffff816a4d21 RDI: ffffffff8c163a80 RBP: ffff88802ab60150 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90abae97 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000003 R14: ffff8880b853b3c0 R15: ffffed100556c02a FS: 0000000000000000(0000) GS:ffff8881247b3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000b00 CR3: 00000000785dd000 CR4: 0000000000350ef0 Call Trace: arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline] kvm_wait arch/x86/kernel/kvm.c:1064 [inline] kvm_wait+0x186/0x1f0 arch/x86/kernel/kvm.c:1046 pv_wait arch/x86/include/asm/paravirt.h:569 [inline] pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:466 [inline] __pv_queued_spin_lock_slowpath+0x4e1/0xcf0 kernel/locking/qspinlock.c:325 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:557 [inline] queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline] queued_spin_lock include/asm-generic/qspinlock.h:114 [inline] do_raw_spin_lock+0x20e/0x2b0 kernel/locking/spinlock_debug.c:116 spin_lock_bh include/linux/spinlock.h:356 [inline] cfg80211_inform_single_bss_data+0x79c/0x1df0 net/wireless/scan.c:2375 cfg80211_inform_bss_data+0x224/0x3bd0 net/wireless/scan.c:3235 cfg80211_inform_bss_frame_data+0x26f/0x750 net/wireless/scan.c:3326 ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:226 ieee80211_scan_rx+0x4cf/0xb30 net/mac80211/scan.c:355 __ieee80211_rx_handle_packet net/mac80211/rx.c:5186 [inline] ieee80211_rx_list+0x1bdb/0x2980 net/mac80211/rx.c:5423 ieee80211_rx_napi+0xdc/0x410 net/mac80211/rx.c:5446 ieee80211_rx include/net/mac80211.h:5210 [inline] ieee80211_handle_queued_frames+0xd5/0x130 net/mac80211/main.c:453 tasklet_action_common+0x284/0x400 kernel/softirq.c:829 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:srso_alias_safe_ret+0x5/0x7 arch/x86/lib/retpoline.S:175 Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8d 64 24 08 cc e8 f4 ff ff ff 0f 0b cc cc cc cc cc cc cc cc cc cc cc cc cc RSP: 0018:ffffc9000454fb00 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff89668847 RDX: ffff8880289dbc00 RSI: ffffffff896688d9 RDI: 0000000000000001 RBP: ffff8880887c1d4c R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000002c10 R12: ffff8880887c1c80 R13: ffff8880877e3c00 R14: ffff8880887c1d50 R15: 0000000000000000 skb_zcopy include/linux/skbuff.h:1745 [inline] skb_release_data+0x159/0x9e0 net/core/skbuff.c:1071 skb_release_all net/core/skbuff.c:1151 [inline] __kfree_skb net/core/skbuff.c:1165 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1203 kfree_skb_reason include/linux/skbuff.h:1275 [inline] kfree_skb include/linux/skbuff.h:1284 [inline] ieee80211_iface_work+0x435/0x1360 net/mac80211/iface.c:1755 cfg80211_wiphy_work+0x2c7/0x580 net/wireless/core.c:435 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x56d/0x730 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 11295 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:taprio_set_budgets+0x1f3/0x310 net/sched/sch_taprio.c:671 Code: 89 ee 48 83 c5 01 83 c6 01 49 83 c5 08 48 83 c3 04 44 89 f7 e8 6e c6 15 f8 41 39 ee 7e 65 89 6c 24 08 e8 e0 cb 15 f8 48 63 f5 <48> 83 fe 0f 0f 87 a6 00 00 00 4c 89 e8 48 c1 e8 03 42 80 3c 38 00 RSP: 0018:ffffc90000007d20 EFLAGS: 00000046 RAX: 0000000000010202 RBX: ffff888026217884 RCX: ffffffff89a5d0e2 RDX: ffff88802ff7da00 RSI: 0000000000000001 RDI: 0000000000000004 RBP: 0000000000000001 R08: 0000000000000004 R09: 0000000000000002 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888026217808 R14: 0000000000000002 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881246b3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2993e864b4 CR3: 000000000e380000 CR4: 0000000000350ef0 Call Trace: advance_sched+0x5f6/0xc80 net/sched/sch_taprio.c:982 __run_hrtimer kernel/time/hrtimer.c:1761 [inline] __hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1825 hrtimer_interrupt+0x397/0x8e0 kernel/time/hrtimer.c:1887 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline] __sysvec_apic_timer_interrupt+0x10b/0x3f0 arch/x86/kernel/apic/apic.c:1056 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5872 Code: f6 3e 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 22 d5 13 0f 0f 82 74 02 00 00 8b 35 ba 06 14 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 79 f6 3e 12 0f 85 c7 02 00 00 48 83 c4 RSP: 0018:ffffc9001dd3ea70 EFLAGS: 00000206 RAX: 0000000000000046 RBX: ffffffff8e5c15a0 RCX: 0000000066f83814 RDX: 0000000000000000 RSI: ffffffff8de2c000 RDI: ffffffff8c163a80 RBP: 0000000000000002 R08: d368243795725151 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:841 [inline] class_rcu_constructor include/linux/rcupdate.h:1155 [inline] unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:330 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:356 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4191 [inline] slab_alloc_node mm/slub.c:4240 [inline] kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4247 kmem_alloc_batch+0x49/0x170 lib/debugobjects.c:371 fill_pool lib/debugobjects.c:403 [inline] debug_objects_fill_pool lib/debugobjects.c:725 [inline] debug_objects_fill_pool+0x23f/0x520 lib/debugobjects.c:697 debug_object_activate+0x10b/0x4c0 lib/debugobjects.c:814 debug_rcu_head_queue kernel/rcu/rcu.h:236 [inline] kvfree_call_rcu+0x30/0x470 mm/slab_common.c:1953 cfg80211_update_known_bss+0x3b9/0x11f0 net/wireless/scan.c:1937 __cfg80211_bss_update+0x1b7/0x23c0 net/wireless/scan.c:1984 cfg80211_inform_single_bss_data+0x7ba/0x1df0 net/wireless/scan.c:2376 cfg80211_inform_bss_data+0x224/0x3bd0 net/wireless/scan.c:3235 cfg80211_inform_bss_frame_data+0x26f/0x750 net/wireless/scan.c:3326 ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:226 ieee80211_rx_bss_info net/mac80211/ibss.c:1094 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1573 [inline] ieee80211_ibss_rx_queued_mgmt+0x1905/0x2fd0 net/mac80211/ibss.c:1600 ieee80211_iface_process_skb net/mac80211/iface.c:1699 [inline] ieee80211_iface_work+0xe2e/0x1360 net/mac80211/iface.c:1753 cfg80211_wiphy_work+0x2c7/0x580 net/wireless/core.c:435 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x56d/0x730 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245