watchdog: BUG: soft lockup - CPU#0 stuck for 24s! [syz.3.363:6693] Modules linked in: irq event stamp: 3636 hardirqs last enabled at (3635): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (3635): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (3636): [] __el1_irq arch/arm64/kernel/entry-common.c:527 [inline] hardirqs last disabled at (3636): [] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:543 softirqs last enabled at (3624): [] softirq_handle_end kernel/softirq.c:491 [inline] softirqs last enabled at (3624): [] handle_softirqs+0xc28/0xd98 kernel/softirq.c:673 softirqs last disabled at (3619): [] __do_softirq+0x14/0x20 kernel/softirq.c:679 CPU: 0 UID: 0 PID: 6693 Comm: syz.3.363 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : unwind_consume_stack+0x38/0x9c arch/arm64/include/asm/stacktrace/common.h:127 lr : unwind_consume_stack+0x38/0x9c arch/arm64/include/asm/stacktrace/common.h:106 sp : ffff800094086840 x29: ffff800094086860 x28: ffff800088bfa960 x27: ffff0000ff9e8000 x26: ffff800088bbe4e8 x25: ffff8000940868e8 x24: ffff800094087e70 x23: ffff800094087eb0 x22: ffff800094086898 x21: ffff8000940868a8 x20: ffff800094087e70 x19: 0000000000000010 x18: 00000000ffffffff x17: 0000000000000003 x16: ffff800088bf7000 x15: ffff800084c4f38c x14: ffff800084c4f034 x13: 000000000000001b x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000080000 x9 : 0000000000032260 x8 : ffff80009c42a000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000008 x3 : 0000000000000010 x2 : ffff800094087e70 x1 : ffff0000ff9e8000 x0 : 0000000000000001 Call trace: unwind_consume_stack+0x38/0x9c arch/arm64/include/asm/stacktrace/common.h:106 (P) kunwind_next_frame_record arch/arm64/kernel/stacktrace.c:238 [inline] kunwind_next arch/arm64/kernel/stacktrace.c:266 [inline] do_kunwind arch/arm64/kernel/stacktrace.c:295 [inline] kunwind_stack_walk arch/arm64/kernel/stacktrace.c:366 [inline] arch_stack_walk+0x260/0x328 arch/arm64/kernel/stacktrace.c:390 stack_trace_save+0x9c/0xf0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] kmem_cache_alloc_noprof+0x268/0x5d4 mm/slub.c:5010 lsm_inode_alloc security/security.c:254 [inline] security_inode_alloc+0x40/0x304 security/security.c:1215 inode_init_always_gfp+0x704/0xbac fs/inode.c:298 inode_init_always include/linux/fs.h:2965 [inline] alloc_inode+0x9c/0x198 fs/inode.c:345 new_inode+0x20/0x50 fs/inode.c:1171 debugfs_get_inode+0x20/0x7c fs/debugfs/inode.c:72 __debugfs_create_file+0xb8/0x36c fs/debugfs/inode.c:436 debugfs_create_file_short+0x58/0x70 fs/debugfs/inode.c:474 add_sta_files net/mac80211/debugfs_netdev.c:840 [inline] add_files net/mac80211/debugfs_netdev.c:957 [inline] ieee80211_debugfs_add_netdev net/mac80211/debugfs_netdev.c:1010 [inline] ieee80211_debugfs_recreate_netdev+0xad4/0x11e8 net/mac80211/debugfs_netdev.c:1034 ieee80211_setup_sdata+0x754/0x9f0 net/mac80211/iface.c:1977 ieee80211_runtime_change_iftype net/mac80211/iface.c:2061 [inline] ieee80211_if_change_type+0x474/0x630 net/mac80211/iface.c:2083 ieee80211_change_iface+0xd8/0x42c net/mac80211/cfg.c:271 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline] cfg80211_change_iface+0x3f4/0xac8 net/wireless/util.c:1310 nl80211_set_interface+0x458/0x6b4 net/wireless/nl80211.c:5108 genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x43c/0x620 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556 genl_rcv+0x38/0x50 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg+0xc8/0x17c net/socket.c:815 ____sys_sendmsg+0x3d0/0x6c8 net/socket.c:2713 ___sys_sendmsg+0x198/0x224 net/socket.c:2767 __sys_sendmsg+0x158/0x204 net/socket.c:2799 __do_sys_sendmsg net/socket.c:2804 [inline] __se_sys_sendmsg net/socket.c:2802 [inline] __arm64_sys_sendmsg+0x88/0x9c net/socket.c:2802 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 4700 Comm: syz-executor Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline] pc : _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 lr : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] lr : _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 sp : ffff8000947f6e40 x29: ffff8000947f6e40 x28: 0000000000000000 x27: 0000000000000000 x26: ffff0000dd942000 x25: ffff80008eada6f0 x24: 0000000000000001 x23: ffff0000dd941000 x22: 0000000000000000 x21: 0000000000000000 x20: ffff80008eada6f8 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000002 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 x11: ffff80008a6a6e28 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000000c0 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000801561b4 x2 : 0000000000000007 x1 : ffff0000d3198000 x0 : ffff80012517a000 Call trace: __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P) _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P) __debug_check_no_obj_freed lib/debugobjects.c:1180 [inline] debug_check_no_obj_freed+0x2c8/0x3a4 lib/debugobjects.c:1201 __free_pages_prepare mm/page_alloc.c:1425 [inline] free_unref_folios+0x554/0x1430 mm/page_alloc.c:3022 folios_put_refs+0x7e0/0x8dc mm/folio.c:1034 free_pages_and_swap_cache+0x240/0x3e8 mm/swap_state.c:592 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu+0xfc/0x34c mm/mmu_gather.c:424 zap_pte_range mm/memory.c:2104 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x31f4/0x4348 mm/memory.c:2240 unmap_vmas+0x2e0/0x43c mm/memory.c:2309 exit_mmap+0x1e8/0xad4 mm/mmap.c:1315 __mmput+0xe0/0x2e8 kernel/fork.c:1193 mmput+0x70/0xa8 kernel/fork.c:1216 exit_mm+0x1ac/0x264 kernel/exit.c:614 do_exit+0x524/0x1a74 kernel/exit.c:996 do_group_exit+0x198/0x238 kernel/exit.c:1151 __do_sys_exit_group kernel/exit.c:1162 [inline] __se_sys_exit_group kernel/exit.c:1160 [inline] pid_child_should_wake+0x0/0x104 kernel/exit.c:1160 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590