watchdog: BUG: soft lockup - CPU#0 stuck for 143s! [syz.4.80:6266] Modules linked in: irq event stamp: 11428949 hardirqs last enabled at (11428948): [] irqentry_exit+0x74/0x90 kernel/entry/common.c:200 hardirqs last disabled at (11428949): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1050 softirqs last enabled at (11207024): [] __do_softirq kernel/softirq.c:613 [inline] softirqs last enabled at (11207024): [] invoke_softirq kernel/softirq.c:453 [inline] softirqs last enabled at (11207024): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 softirqs last disabled at (11207027): [] __do_softirq kernel/softirq.c:613 [inline] softirqs last disabled at (11207027): [] invoke_softirq kernel/softirq.c:453 [inline] softirqs last disabled at (11207027): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 CPU: 0 UID: 0 PID: 6266 Comm: syz.4.80 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:lock_acquire+0x28a/0x360 kernel/locking/lockdep.c:-1 Code: 83 3d c9 65 06 0e 00 0f 85 10 fe ff ff e9 fb fe ff ff e8 49 c7 dc 09 f3 0f 1e fa 4c 89 6c 24 18 4c 89 64 24 20 4c 89 7c 24 28 <4c> 89 74 24 10 89 5c 24 08 65 8b 05 6a 40 03 11 83 f8 08 0f 83 a9 RSP: 0018:ffffc90000006c98 EFLAGS: 00000282 RAX: 92d349be500a1e00 RBX: 0000000000000000 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e13a0e0 RBP: ffffffff8172d195 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc90000006e58 R11: ffffffff81ac4b00 R12: 0000000000000002 R13: ffffffff8e13a0e0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f03136616c0(0000) GS:ffff888125c15000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555565ad64a8 CR3: 0000000072cda000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:841 [inline] class_rcu_constructor include/linux/rcupdate.h:1155 [inline] unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4376 [inline] __kmalloc_noprof+0x27a/0x4f0 mm/slub.c:4388 kmalloc_noprof include/linux/slab.h:909 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] cfg80211_inform_single_bss_data+0x905/0x1ac0 net/wireless/scan.c:2352 cfg80211_inform_bss_data+0x1fb/0x3b30 net/wireless/scan.c:3235 cfg80211_inform_bss_frame_data+0x3d7/0x730 net/wireless/scan.c:3326 ieee80211_bss_info_update+0x746/0x9e0 net/mac80211/scan.c:226 ieee80211_scan_rx+0x593/0xa20 net/mac80211/scan.c:355 __ieee80211_rx_handle_packet net/mac80211/rx.c:5186 [inline] ieee80211_rx_list+0x201c/0x2a90 net/mac80211/rx.c:5423 ieee80211_rx_napi+0x1a8/0x3d0 net/mac80211/rx.c:5446 ieee80211_rx include/net/mac80211.h:5210 [inline] ieee80211_handle_queued_frames+0xe8/0x1f0 net/mac80211/main.c:453 tasklet_action_common+0x36c/0x580 kernel/softirq.c:829 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:migrate_disable+0xe9/0x190 kernel/sched/core.c:2402 Code: c0 0f 85 a3 00 00 00 66 c7 03 01 00 bf 01 00 00 00 e8 9b a4 ff ff 65 8b 05 24 47 10 11 85 c0 74 18 5b 41 5c 41 5d 41 5e 41 5f 02 b3 ec 09 cc 90 0f 0b 90 e9 50 ff ff ff e8 e3 5d a3 ff eb e1 RSP: 0018:ffffc9000b9c7038 EFLAGS: 00000206 RAX: 0000000000000003 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffffc9000c8cb000 RSI: ffffffff8be33d60 RDI: 00000000ffffffff RBP: ffffc9000b9c7138 R08: ffffc9000b9c70cf R09: 0000000000000000 R10: ffffc9000b9c70c0 R11: fffff52001738e1a R12: 0000000000000001 R13: ffffc9000b9c70c0 R14: ffff888078646780 R15: ffffffff8e0090e8 bpf_prog_run_array include/linux/bpf.h:2287 [inline] trace_call_bpf+0x229/0x850 kernel/trace/bpf_trace.c:146 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:10918 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x335/0x410 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x311/0x360 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:841 [inline] page_table_check_set+0x1aa/0x730 mm/page_table_check.c:112 page_table_check_ptes_set include/linux/page_table_check.h:76 [inline] set_ptes include/linux/pgtable.h:292 [inline] __copy_present_ptes mm/memory.c:972 [inline] copy_present_ptes mm/memory.c:1051 [inline] copy_pte_range mm/memory.c:1174 [inline] copy_pmd_range+0x4439/0x71d0 mm/memory.c:1261 copy_pud_range mm/memory.c:1298 [inline] copy_p4d_range mm/memory.c:1322 [inline] copy_page_range+0xc14/0x1270 mm/memory.c:1410 dup_mmap+0xf57/0x1ac0 mm/mmap.c:1834 dup_mm kernel/fork.c:1485 [inline] copy_mm+0x13c/0x4b0 kernel/fork.c:1537 copy_process+0x1706/0x3c00 kernel/fork.c:2175 kernel_clone+0x21e/0x840 kernel/fork.c:2605 __do_sys_clone kernel/fork.c:2748 [inline] __se_sys_clone kernel/fork.c:2732 [inline] __x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2732 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f031278eba9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0313660fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007f03129d5fa0 RCX: 00007f031278eba9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000021000000 RBP: 00007f0312811e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f03129d6038 R14: 00007f03129d5fa0 R15: 00007ffe3f7ae908 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 6263 Comm: syz.1.78 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:cpu_max_bits_warn include/linux/cpumask.h:135 [inline] RIP: 0010:cpumask_check include/linux/cpumask.h:142 [inline] RIP: 0010:cpumask_test_cpu include/linux/cpumask.h:646 [inline] RIP: 0010:cpu_online include/linux/cpumask.h:1205 [inline] RIP: 0010:trace_hrtimer_expire_exit include/trace/events/timer.h:306 [inline] RIP: 0010:__run_hrtimer kernel/time/hrtimer.c:1764 [inline] RIP: 0010:__hrtimer_run_queues+0x572/0xc60 kernel/time/hrtimer.c:1825 Code: 18 0f 1f 44 00 00 e8 8d f9 11 00 65 44 8b 2d b9 ea f2 10 bf 07 00 00 00 44 89 ee e8 b8 fd 11 00 41 83 fd 07 0f 87 98 01 00 00 69 f9 11 00 45 89 ef 41 c1 ed 06 4a 8d 3c ed 30 a4 a3 8f be 08 RSP: 0018:ffffc90000a07640 EFLAGS: 00000097 RAX: ffffffff81adc588 RBX: ffff8880b8727b48 RCX: 0000000000010100 RDX: ffff88802742bc00 RSI: 0000000000000001 RDI: 0000000000000007 RBP: ffffc90000a07788 R08: 0000000000000000 R09: ffffffff81ae150e R10: 3e2d735f5f5f5f26 R11: ffffffff8167bab0 R12: ffff888027458168 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f0182a186c0(0000) GS:ffff888125d15000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6209131060 CR3: 0000000028b18000 CR4: 00000000003526f0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1887 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline] __sysvec_apic_timer_interrupt+0x108/0x410 arch/x86/kernel/apic/apic.c:1056 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:strlen+0x2e/0x70 lib/string.c:420 Code: 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 42 0f b6 04 30 <84> c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 75 de eb 19 89 RSP: 0018:ffffc90000a079b8 EFLAGS: 00000a02 RAX: 0000000000000006 RBX: ffffffff8b8bd568 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8e13a0e0 RDI: ffffffff8b8bd560 RBP: ffffc90000a07ad8 R08: 0000000000000002 R09: 0000000000000000 R10: ffffc90000a07cb8 R11: ffffffff81ac4b00 R12: 1ffff92000140f44 R13: ffffffff8e13a0e0 R14: dffffc0000000000 R15: 0000000000000007 __fortify_strlen include/linux/fortify-string.h:268 [inline] trace_event_get_offsets_lock_acquire include/trace/events/lock.h:24 [inline] do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0xcb/0x410 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x311/0x360 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:841 [inline] class_rcu_constructor include/linux/rcupdate.h:1155 [inline] unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548 kvfree_call_rcu+0xbb/0x410 mm/slab_common.c:1962 cfg80211_update_known_bss+0x84b/0x13c0 net/wireless/scan.c:1937 __cfg80211_bss_update+0x147/0x2120 net/wireless/scan.c:1984 cfg80211_inform_single_bss_data+0xba9/0x1ac0 net/wireless/scan.c:2376 cfg80211_inform_bss_data+0x1fb/0x3b30 net/wireless/scan.c:3235 cfg80211_inform_bss_frame_data+0x3d7/0x730 net/wireless/scan.c:3326 ieee80211_bss_info_update+0x746/0x9e0 net/mac80211/scan.c:226 ieee80211_scan_rx+0x593/0xa20 net/mac80211/scan.c:355 __ieee80211_rx_handle_packet net/mac80211/rx.c:5186 [inline] ieee80211_rx_list+0x201c/0x2a90 net/mac80211/rx.c:5423 ieee80211_rx_napi+0x1a8/0x3d0 net/mac80211/rx.c:5446 ieee80211_rx include/net/mac80211.h:5210 [inline] ieee80211_handle_queued_frames+0xe8/0x1f0 net/mac80211/main.c:453 tasklet_action_common+0x36c/0x580 kernel/softirq.c:829 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:get_current arch/x86/include/asm/current.h:25 [inline] RIP: 0010:__cant_migrate+0x8f/0x2e0 kernel/sched/core.c:8998 Code: 89 04 2f 66 43 c7 44 2f 09 f3 f3 43 c6 44 2f 0b f3 48 c7 44 24 60 00 00 00 00 9c 8f 44 24 60 f6 44 24 61 02 0f 84 86 00 00 00 <65> 48 8b 1c 25 08 b0 a0 92 4c 8d a3 40 04 00 00 4d 89 e6 49 c1 ee RSP: 0018:ffffc9000b9e6f00 EFLAGS: 00000202 RAX: f2f2f200f1f1f1f1 RBX: ffffc900038cd000 RCX: dffffc0000000000 RDX: ffffc9000c0c9000 RSI: 00000000000002bf RDI: ffffffff8da0b03e RBP: ffffc9000b9e6fd0 R08: ffffc9000b9e706f R09: 0000000000000000 R10: ffffc9000b9e7060 R11: fffff5200173ce0e R12: 0000000000000001 R13: dffffc0000000000 R14: ffff8880786467a8 R15: 1ffff9200173cde4 __bpf_prog_run include/linux/filter.h:703 [inline] bpf_prog_run include/linux/filter.h:725 [inline] bpf_prog_run_array include/linux/bpf.h:2292 [inline] trace_call_bpf+0x2e6/0x850 kernel/trace/bpf_trace.c:146 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:10918 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x335/0x410 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x311/0x360 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock_sched include/linux/rcupdate.h:932 [inline] pfn_valid+0xd6/0x490 include/linux/mmzone.h:2162 page_table_check_clear+0x21/0x700 mm/page_table_check.c:70 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline] get_and_clear_full_ptes include/linux/pgtable.h:725 [inline] zap_present_folio_ptes mm/memory.c:1499 [inline] zap_present_ptes mm/memory.c:1581 [inline] do_zap_pte_range mm/memory.c:1682 [inline] zap_pte_range mm/memory.c:1726 [inline] zap_pmd_range mm/memory.c:1818 [inline] zap_pud_range mm/memory.c:1847 [inline] zap_p4d_range mm/memory.c:1868 [inline] unmap_page_range+0x3445/0x4370 mm/memory.c:1889 unmap_single_vma mm/memory.c:1932 [inline] unmap_vmas+0x399/0x580 mm/memory.c:1976 exit_mmap+0x248/0xb50 mm/mmap.c:1280 __mmput+0x118/0x430 kernel/fork.c:1129 mmput kernel/fork.c:1152 [inline] dup_mm kernel/fork.c:1502 [inline] copy_mm+0x1f3/0x4b0 kernel/fork.c:1537 copy_process+0x1706/0x3c00 kernel/fork.c:2175 kernel_clone+0x21e/0x840 kernel/fork.c:2605 __do_sys_clone kernel/fork.c:2748 [inline] __se_sys_clone kernel/fork.c:2732 [inline] __x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2732 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0181b8eba9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0182a17fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007f0181dd5fa0 RCX: 00007f0181b8eba9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 RBP: 00007f0181c11e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f0181dd6038 R14: 00007f0181dd5fa0 R15: 00007ffdb295e1e8