watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.6:14762] Modules linked in: irq event stamp: 2431173 hardirqs last enabled at (2431172): [] irqentry_exit+0x3b/0x90 hardirqs last disabled at (2431173): [] sysvec_apic_timer_interrupt+0xf/0x80 softirqs last enabled at (2420196): [] handle_softirqs+0x50c/0x770 softirqs last disabled at (2420203): [] __irq_exit_rcu+0xc4/0x100 CPU: 1 UID: 0 PID: 14762 Comm: syz-executor.6 Not tainted 6.13.0-rc7-next-20250116 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:kasan_addr_to_slab+0x10/0xa0 Code: 5d 41 5c e9 92 c6 ff 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 53 48 89 fb e8 e3 5c 8a ff 41 89 c0 <31> c0 45 84 c0 75 06 5b e9 63 c6 ff 02 bf 00 00 00 80 48 01 fb 72 RSP: 0018:ffff88806cf093a0 EFLAGS: 00000246 RAX: 0000000000000001 RBX: ffff88801552c1a8 RCX: ffffffff8135da10 RDX: ffff888015450000 RSI: ffffffff8135d810 RDI: 0000000000000001 RBP: ffff88806cf09480 R08: 0000000000000001 R09: ffff888015450a48 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81aecea0 R13: 0000000000000000 R14: ffffea0000f8d400 R15: ffff88803e351800 FS: 00007f3b05ad5700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3b05ab4718 CR3: 000000002da50000 CR4: 0000000000350ef0 Call Trace: kasan_record_aux_stack+0xe/0xa0 __call_rcu_common.constprop.0+0x6a/0xb70 kfree+0x2d9/0x480 ieee80211_inform_bss+0x80c/0x10b0 cfg80211_inform_single_bss_data+0x801/0x1c70 cfg80211_inform_bss_data+0x20f/0x3520 cfg80211_inform_bss_frame_data+0x250/0x6a0 ieee80211_bss_info_update+0x2f6/0xa90 ieee80211_scan_rx+0x474/0xac0 ieee80211_rx_list+0x1e38/0x2840 ieee80211_rx_napi+0xdc/0x3b0 ieee80211_handle_queued_frames+0xd9/0x130 tasklet_action_common+0x235/0x3b0 handle_softirqs+0x1b1/0x770 __irq_exit_rcu+0xc4/0x100 irq_exit_rcu+0x9/0x20 sysvec_apic_timer_interrupt+0x70/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:mod_node_page_state+0x51/0x110 Code: ea 03 48 83 ec 08 80 3c 02 00 0f 85 c2 00 00 00 48 8b bd 00 38 00 00 41 89 f0 83 ee 05 4a 8d 54 07 01 83 fe 01 76 48 65 8a 02 <4d> 63 e4 65 44 8a 0f 48 0f be d8 4d 0f be c9 4c 01 e3 48 89 d9 48 RSP: 0018:ffff88803d8bf600 EFLAGS: 00000296 RAX: dffffc0000000000 RBX: fffffffffffff000 RCX: 0000000000000000 RDX: 0000000000041647 RSI: 0000000000000001 RDI: 0000000000041640 RBP: ffff88807ffdc680 R08: 0000000000000006 R09: fffffbfff0fe13e9 R10: ffffffff87f09f4f R11: 0000000000000000 R12: 00000000ffffffff R13: 0000000000000000 R14: ffff88803842fb60 R15: ffff88803842fb60 __free_slab+0xad/0x130 qlist_free_all+0x50/0x160 kasan_quarantine_reduce+0x19f/0x240 __kasan_slab_alloc+0x49/0x70 kmem_cache_alloc_lru_noprof+0x14c/0x3c0 __d_alloc+0x31/0x9e0 d_alloc+0x4a/0x1e0 d_alloc_parallel+0xe6/0x1150 lookup_open.isra.0+0x649/0x1620 path_openat+0xc91/0x2990 do_filp_open+0x1e9/0x450 do_sys_openat2+0x164/0x1d0 __x64_sys_openat+0x143/0x200 do_syscall_64+0xbf/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b0855fb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3b05ad5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f3b08672f60 RCX: 00007f3b0855fb19 RDX: 0000000000101042 RSI: 0000000020000100 RDI: ffffffffffffff9c RBP: 00007f3b085b9f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffeadae316f R14: 00007f3b05ad5300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 14754 Comm: syz-executor.0 Not tainted 6.13.0-rc7-next-20250116 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:clockevents_program_event+0xa/0x360 Code: 5d 41 5c e9 38 df 47 03 e8 03 4f 48 00 eb cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 41 56 41 55 41 54 <49> 89 f4 55 48 89 fd 53 89 d3 e8 e7 3f 0e 00 31 ff 4c 89 e6 e8 fd RSP: 0018:ffff88806ce097b0 EFLAGS: 00000046 RAX: 0000000000010102 RBX: 0000000000000000 RCX: ffffffff8163c4e2 RDX: 0000000000000000 RSI: 00000054e724f135 RDI: ffff88806ce28300 RBP: 00000054e724f135 R08: 0000000000000000 R09: ffffed100d9c5958 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88806ce28300 R13: 0000000000000003 R14: 0000000000000001 R15: ffff88806ce2cac0 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b4fe39a4ec CR3: 000000000c756000 CR4: 0000000000350ef0 Call Trace: tick_program_event+0xa4/0x140 hrtimer_interrupt+0x3ba/0x830 __sysvec_apic_timer_interrupt+0xc2/0x330 sysvec_apic_timer_interrupt+0x34/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:lock_acquire+0x2eb/0x520 Code: 10 e8 e9 55 fe ff 5e 5f 4c 8b 14 24 65 ff 0d d4 77 b3 7e 0f 85 ba fd ff ff 0f 1f 44 00 00 e9 b0 fd ff ff e8 77 08 09 00 84 c0 <0f> 85 d8 fd ff ff 80 3d 4c 40 ed 04 00 0f 85 cb fd ff ff c6 05 3f RSP: 0018:ffff88806ce09980 EFLAGS: 00000202 RAX: 0000000000000001 RBX: 1ffff1100d9c1333 RCX: ffffffff81502cd7 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88806ce36250 RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff0c806fa R10: ffffffff864037d7 R11: 0000000000000000 R12: 0000000000000002 R13: 0000000000000000 R14: ffffffff85c18d00 R15: 0000000000000000 ieee80211_iterate_active_interfaces_atomic+0x44/0x1b0 mac80211_hwsim_addr_match+0x128/0x180 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb21/0x1320 mac80211_hwsim_tx_frame+0x1ee/0x2a0 mac80211_hwsim_beacon_tx+0x546/0x950 __iterate_interfaces+0x2e0/0x650 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x1ab/0xa80 hrtimer_run_softirq+0x14c/0x310 handle_softirqs+0x1b1/0x770 __irq_exit_rcu+0xc4/0x100 irq_exit_rcu+0x9/0x20 sysvec_apic_timer_interrupt+0x70/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:lock_release+0x167/0x6f0 Code: ff 0f 85 b9 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 80 3c 02 00 0f 85 cb 04 00 00 49 81 3c 24 00 3a 7f 87 <0f> 84 90 02 00 00 9c 8f 04 24 fa 48 b8 00 00 00 00 00 fc ff df 48 RSP: 0018:ffff88803aab7588 EFLAGS: 00000283 RAX: dffffc0000000000 RBX: 1ffff11007556eb3 RCX: ffffffff8150243e RDX: 1ffff110065c783f RSI: 0000000000000008 RDI: 0000000000000000 RBP: ffffffff86404574 R08: 0000000000000001 R09: fffffbfff0c806fa R10: ffffffff864037d7 R11: 0000000000000001 R12: ffff888032e3c1f8 R13: ffffffff8199908b R14: ffff88803454b780 R15: ffff88803aab7ad8 _raw_spin_unlock+0x16/0x40 unmap_page_range+0x111b/0x3b10 unmap_single_vma+0x19a/0x2b0 unmap_vmas+0x1f1/0x450 exit_mmap+0x182/0xac0 mmput+0xd1/0x2d0 do_exit+0x9a9/0x2a40 do_group_exit+0xd3/0x2a0 get_signal+0x2240/0x2320 arch_do_signal_or_restart+0x81/0x780 syscall_exit_to_user_mode+0x123/0x1e0 do_syscall_64+0xcc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b428e5b19 Code: Unable to access opcode bytes at 0x7f3b428e5aef. RSP: 002b:00007f3b3fe5b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: 0000000000000005 RBX: 00007f3b429f8f60 RCX: 00007f3b428e5b19 RDX: 0000000000101042 RSI: 0000000020000100 RDI: ffffffffffffff9c RBP: 00007f3b4293ff6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe2ec54f4f R14: 00007f3b3fe5b300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 5d pop %rbp 1: 41 5c pop %r12 3: e9 92 c6 ff 02 jmpq 0x2ffc69a 8: 66 90 xchg %ax,%ax a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 66 0f 1f 00 nopw (%rax) 1e: 53 push %rbx 1f: 48 89 fb mov %rdi,%rbx 22: e8 e3 5c 8a ff callq 0xff8a5d0a 27: 41 89 c0 mov %eax,%r8d * 2a: 31 c0 xor %eax,%eax <-- trapping instruction 2c: 45 84 c0 test %r8b,%r8b 2f: 75 06 jne 0x37 31: 5b pop %rbx 32: e9 63 c6 ff 02 jmpq 0x2ffc69a 37: bf 00 00 00 80 mov $0x80000000,%edi 3c: 48 01 fb add %rdi,%rbx 3f: 72 .byte 0x72