Extracting prog: 7m3.0639107s Minimizing prog: 1h0m46.881022667s Simplifying prog options: 9m4.48551188s Extracting C: 2m2.823868626s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program did not crash program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program crashed: BUG: soft lockup in smp_call_function single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)) socket$netlink(0x10, 0x3, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: socket(0x11, 0x800000003, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0) program did not crash testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore simplifying guilty program options testing program (duration=6m40.161817677s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program crashed: BUG: soft lockup in corrupted a never seen crash title: BUG: soft lockup in corrupted, ignore testing program (duration=6m40.161817677s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0xa4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xcb2}]}]}]}}]}, 0xa4}}, 0x0) program did not crash reproducing took 1h18m57.254324208s repro crashed as (corrupted=false): watchdog: BUG: soft lockup - CPU#1 stuck for 21s! [kworker/u8:2:41] Modules linked in: irq event stamp: 1723494 hardirqs last enabled at (1723493): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (1723493): [] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (1723494): [] __el1_irq arch/arm64/kernel/entry-common.c:580 [inline] hardirqs last disabled at (1723494): [] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:598 softirqs last enabled at (1723492): [] softirq_handle_end kernel/softirq.c:425 [inline] softirqs last enabled at (1723492): [] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:607 softirqs last disabled at (1722807): [] __do_softirq+0x14/0x20 kernel/softirq.c:613 CPU: 1 UID: 0 PID: 41 Comm: kworker/u8:2 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: events_unbound toggle_allocation_gate pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : csd_lock_wait kernel/smp.c:340 [inline] pc : smp_call_function_many_cond+0xf08/0x1434 kernel/smp.c:885 lr : csd_lock_wait kernel/smp.c:340 [inline] lr : smp_call_function_many_cond+0xf20/0x1434 kernel/smp.c:885 sp : ffff8000990a7720 x29: ffff8000990a7830 x28: 0000000000000011 x27: dfff800000000000 x26: 0000000000000000 x25: ffff80008f631ff8 x24: ffff00019bf222c0 x23: ffffffffffffffff x22: 1fffe000337e4458 x21: 1fffe000337e4459 x20: ffff00019bf027e8 x19: ffff00019bf222c8 x18: 1fffe000337e1476 x17: ffff80008f62e000 x16: ffff80008aec8e2c x15: 0000000000000001 x14: 1fffe000337e04fd x13: 0000000000000000 x12: 0000000000000000 x11: ffff6000337e04fe x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000011 x7 : ffff80008022fc94 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80008067ca84 x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:231 [inline] (P) __cmpwait arch/arm64/include/asm/cmpxchg.h:257 [inline] (P) csd_lock_wait kernel/smp.c:340 [inline] (P) smp_call_function_many_cond+0xf08/0x1434 kernel/smp.c:885 (P) smp_call_function_many kernel/smp.c:909 [inline] smp_call_function kernel/smp.c:931 [inline] kick_all_cpus_sync+0x40/0xa0 kernel/smp.c:1076 arch_jump_label_transform_apply+0x14/0x20 arch/arm64/kernel/jump_label.c:34 __jump_label_update+0x30c/0x334 kernel/jump_label.c:521 jump_label_update+0x3f0/0x484 kernel/jump_label.c:919 static_key_disable_cpuslocked+0xd0/0x1e0 kernel/jump_label.c:240 static_key_disable+0x24/0x38 kernel/jump_label.c:248 toggle_allocation_gate+0x1a4/0x240 mm/kfence/core.c:855 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3402 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 773 Comm: kworker/u8:13 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: events_power_efficient gc_worker pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:-1 [inline] pc : arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] pc : handle_softirqs+0x1f8/0xc88 kernel/softirq.c:563 lr : handle_softirqs+0x1f4/0xc88 kernel/softirq.c:563 sp : ffff800080007ee0 x29: ffff800080007f80 x28: ffff0000c73fbd00 x27: 0000000000000386 x26: ffff0000c73fbd08 x25: ffff80008f62e768 x24: ffff0000c73fbd10 x23: ffff0000c73fbd00 x22: 1fffe00018e7f7a1 x21: dfff800000000000 x20: ffff80008f58018c x19: ffff00019befa000 x18: 1fffe000337dc876 x17: ffff80010c964000 x16: ffff800080520d04 x15: 0000000000000001 x14: 1ffff00012e737b8 x13: 0000000000000000 x12: 0000000000000000 x11: ffff80009311ec08 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000001cbe74 x7 : ffff8000806244b8 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000010 x2 : 0000000000000002 x1 : ffff80008ec0daa7 x0 : ffff80010c964000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) handle_softirqs+0x1f8/0xc88 kernel/softirq.c:563 (P) __do_softirq+0x14/0x20 kernel/softirq.c:613 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86 invoke_softirq kernel/softirq.c:460 [inline] __irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:680 irq_exit_rcu+0x14/0x84 kernel/softirq.c:696 __el1_irq arch/arm64/kernel/entry-common.c:584 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:598 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:603 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:596 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) lock_acquire+0x178/0x2e0 kernel/locking/lockdep.c:5874 (P) rcu_lock_acquire+0x40/0x4c include/linux/rcupdate.h:331 rcu_read_lock include/linux/rcupdate.h:841 [inline] gc_worker+0x214/0x1184 net/netfilter/nf_conntrack_core.c:1535 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3402 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847 final repro crashed as (corrupted=false): watchdog: BUG: soft lockup - CPU#1 stuck for 21s! [kworker/u8:2:41] Modules linked in: irq event stamp: 1723494 hardirqs last enabled at (1723493): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (1723493): [] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (1723494): [] __el1_irq arch/arm64/kernel/entry-common.c:580 [inline] hardirqs last disabled at (1723494): [] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:598 softirqs last enabled at (1723492): [] softirq_handle_end kernel/softirq.c:425 [inline] softirqs last enabled at (1723492): [] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:607 softirqs last disabled at (1722807): [] __do_softirq+0x14/0x20 kernel/softirq.c:613 CPU: 1 UID: 0 PID: 41 Comm: kworker/u8:2 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: events_unbound toggle_allocation_gate pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : csd_lock_wait kernel/smp.c:340 [inline] pc : smp_call_function_many_cond+0xf08/0x1434 kernel/smp.c:885 lr : csd_lock_wait kernel/smp.c:340 [inline] lr : smp_call_function_many_cond+0xf20/0x1434 kernel/smp.c:885 sp : ffff8000990a7720 x29: ffff8000990a7830 x28: 0000000000000011 x27: dfff800000000000 x26: 0000000000000000 x25: ffff80008f631ff8 x24: ffff00019bf222c0 x23: ffffffffffffffff x22: 1fffe000337e4458 x21: 1fffe000337e4459 x20: ffff00019bf027e8 x19: ffff00019bf222c8 x18: 1fffe000337e1476 x17: ffff80008f62e000 x16: ffff80008aec8e2c x15: 0000000000000001 x14: 1fffe000337e04fd x13: 0000000000000000 x12: 0000000000000000 x11: ffff6000337e04fe x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000011 x7 : ffff80008022fc94 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80008067ca84 x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:231 [inline] (P) __cmpwait arch/arm64/include/asm/cmpxchg.h:257 [inline] (P) csd_lock_wait kernel/smp.c:340 [inline] (P) smp_call_function_many_cond+0xf08/0x1434 kernel/smp.c:885 (P) smp_call_function_many kernel/smp.c:909 [inline] smp_call_function kernel/smp.c:931 [inline] kick_all_cpus_sync+0x40/0xa0 kernel/smp.c:1076 arch_jump_label_transform_apply+0x14/0x20 arch/arm64/kernel/jump_label.c:34 __jump_label_update+0x30c/0x334 kernel/jump_label.c:521 jump_label_update+0x3f0/0x484 kernel/jump_label.c:919 static_key_disable_cpuslocked+0xd0/0x1e0 kernel/jump_label.c:240 static_key_disable+0x24/0x38 kernel/jump_label.c:248 toggle_allocation_gate+0x1a4/0x240 mm/kfence/core.c:855 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3402 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 773 Comm: kworker/u8:13 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: events_power_efficient gc_worker pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:-1 [inline] pc : arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] pc : handle_softirqs+0x1f8/0xc88 kernel/softirq.c:563 lr : handle_softirqs+0x1f4/0xc88 kernel/softirq.c:563 sp : ffff800080007ee0 x29: ffff800080007f80 x28: ffff0000c73fbd00 x27: 0000000000000386 x26: ffff0000c73fbd08 x25: ffff80008f62e768 x24: ffff0000c73fbd10 x23: ffff0000c73fbd00 x22: 1fffe00018e7f7a1 x21: dfff800000000000 x20: ffff80008f58018c x19: ffff00019befa000 x18: 1fffe000337dc876 x17: ffff80010c964000 x16: ffff800080520d04 x15: 0000000000000001 x14: 1ffff00012e737b8 x13: 0000000000000000 x12: 0000000000000000 x11: ffff80009311ec08 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000001cbe74 x7 : ffff8000806244b8 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000010 x2 : 0000000000000002 x1 : ffff80008ec0daa7 x0 : ffff80010c964000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) handle_softirqs+0x1f8/0xc88 kernel/softirq.c:563 (P) __do_softirq+0x14/0x20 kernel/softirq.c:613 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86 invoke_softirq kernel/softirq.c:460 [inline] __irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:680 irq_exit_rcu+0x14/0x84 kernel/softirq.c:696 __el1_irq arch/arm64/kernel/entry-common.c:584 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:598 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:603 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:596 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) lock_acquire+0x178/0x2e0 kernel/locking/lockdep.c:5874 (P) rcu_lock_acquire+0x40/0x4c include/linux/rcupdate.h:331 rcu_read_lock include/linux/rcupdate.h:841 [inline] gc_worker+0x214/0x1184 net/netfilter/nf_conntrack_core.c:1535 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3402 kthread+0x5fc/0x75c kernel/kthread.c:464 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847