watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.4:15482] Modules linked in: irq event stamp: 7677 hardirqs last enabled at (7676): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline] hardirqs last enabled at (7676): [] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:94 hardirqs last disabled at (7677): [] __el1_irq arch/arm64/kernel/entry-common.c:470 [inline] hardirqs last disabled at (7677): [] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (2132): [] spin_unlock_bh include/linux/spinlock.h:395 [inline] softirqs last enabled at (2132): [] remove_user_radios drivers/net/wireless/virtual/mac80211_hwsim.c:6192 [inline] softirqs last enabled at (2132): [] mac80211_hwsim_netlink_notify+0x380/0x7c4 drivers/net/wireless/virtual/mac80211_hwsim.c:6210 softirqs last disabled at (2779): [] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 CPU: 1 PID: 15482 Comm: syz-executor.4 Not tainted 6.4.0-rc7-syzkaller-00127-ge40939bbfc68-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : preempt_count arch/arm64/include/asm/preempt.h:13 [inline] pc : check_kcov_mode kernel/kcov.c:173 [inline] pc : write_comp_data kernel/kcov.c:236 [inline] pc : __sanitizer_cov_trace_cmp8+0x34/0x90 kernel/kcov.c:284 lr : ktime_compare include/linux/ktime.h:97 [inline] lr : ktime_after include/linux/ktime.h:113 [inline] lr : find_entry_to_transmit+0x370/0x6d0 net/sched/sch_taprio.c:350 sp : ffff8000800170d0 x29: ffff8000800171a0 x28: 04a500382d7fe39d x27: ffff0000e3946940 x26: ffff0000e3946968 x25: 1fffe0001c728d2d x24: 0000000000000000 x23: 04a50038ad7fe2c1 x22: 04a50038ad7fe300 x21: 04a500392d7fe2c0 x20: dfff800000000000 x19: 04a50038ad7fe300 x18: ffff80009661f080 x17: 0000000000000000 x16: ffff80008050b4cc x15: 0000000000000101 x14: 1ffff00011bde0ac x13: ffffffff80000040 x12: 0000000080000040 x11: 0000000000000302 x10: 0000000000000100 x9 : 0000000000000100 x8 : ffff0000da018000 x7 : 0000000000000000 x6 : ffff8000800172f0 x5 : ffff800080017310 x4 : 04a500382d7fe39d x3 : ffff80008898bf28 x2 : 0000000000000000 x1 : 04a50038ad7fe300 x0 : 04a50038ad7fe2c1 Call trace: check_kcov_mode kernel/kcov.c:173 [inline] write_comp_data kernel/kcov.c:236 [inline] __sanitizer_cov_trace_cmp8+0x34/0x90 kernel/kcov.c:284 get_packet_txtime net/sched/sch_taprio.c:505 [inline] taprio_enqueue_one+0xdb0/0x146c net/sched/sch_taprio.c:574 taprio_enqueue+0x328/0x544 net/sched/sch_taprio.c:655 dev_qdisc_enqueue+0x60/0x35c net/core/dev.c:3773 __dev_xmit_skb net/core/dev.c:3862 [inline] __dev_queue_xmit+0xb24/0x3318 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3088 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0xd2c/0x1a1c net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x538/0x8c8 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ndisc_send_skb+0xc30/0x1790 net/ipv6/ndisc.c:508 ndisc_send_rs+0x47c/0x5d4 net/ipv6/ndisc.c:718 addrconf_rs_timer+0x300/0x58c net/ipv6/addrconf.c:3936 call_timer_fn+0x19c/0x8cc kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x55c/0x734 kernel/time/timer.c:2022 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035 __do_softirq+0x2d0/0xd54 kernel/softirq.c:571 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:882 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:650 irq_exit_rcu+0x14/0x84 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:488 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:493 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:587 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:182 [inline] arch_local_irq_restore arch/arm64/include/asm/irqflags.h:202 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:1033 [inline] debug_check_no_obj_freed+0x50c/0x528 lib/debugobjects.c:1054 free_pages_prepare mm/page_alloc.c:1308 [inline] free_unref_page_prepare+0x2b0/0xadc mm/page_alloc.c:2564 free_unref_page_list+0xec/0x86c mm/page_alloc.c:2705 release_pages+0xf14/0x116c mm/swap.c:1042 free_pages_and_swap_cache+0xa4/0xbc mm/swap_state.c:317 tlb_batch_pages_flush mm/mmu_gather.c:97 [inline] tlb_flush_mmu_free mm/mmu_gather.c:292 [inline] tlb_flush_mmu+0x11c/0x218 mm/mmu_gather.c:299 tlb_finish_mmu+0xc8/0x20c mm/mmu_gather.c:391 exit_mmap+0x314/0xae4 mm/mmap.c:3120 __mmput+0xec/0x394 kernel/fork.c:1351 mmput+0x70/0xac kernel/fork.c:1373 exit_mm+0x14c/0x214 kernel/exit.c:567 do_exit+0x48c/0x1f58 kernel/exit.c:861 do_group_exit+0x194/0x22c kernel/exit.c:1024 __do_sys_exit_group kernel/exit.c:1035 [inline] __se_sys_exit_group kernel/exit.c:1033 [inline] __wake_up_parent+0x0/0x60 kernel/exit.c:1033 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591