watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [syz-executor.6:18878] Modules linked in: irq event stamp: 2271395 hardirqs last enabled at (2271394): [] queue_work_on+0x7e/0xe0 hardirqs last disabled at (2271395): [] sysvec_apic_timer_interrupt+0xf/0x80 softirqs last enabled at (2269498): [] handle_softirqs+0x50c/0x770 softirqs last disabled at (2269501): [] irq_exit_rcu+0x94/0xc0 CPU: 1 UID: 0 PID: 18878 Comm: syz-executor.6 Not tainted 6.12.0-rc3-next-20241016 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80 Code: 7e 60 e8 a3 ff ff ff 31 c0 e9 dc f4 32 03 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 34 24 65 48 8b 15 90 2a b2 7e 65 8b 05 91 2a b2 RSP: 0018:ffff88806cf09848 EFLAGS: 00000202 RAX: 000000000022a8a2 RBX: 0000000000000200 RCX: 1ffffffff0fe3222 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81209c0e RBP: 0000000000000000 R08: 0000000000000001 R09: fffffbfff0fda9e9 R10: ffffffff87ed4f4f R11: 0000000000000005 R12: 0000000000000001 R13: 0000000000000040 R14: ffff888008c71000 R15: ffff88806cf09d78 FS: 00007fbfa6414700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555568041c58 CR3: 000000003fb06000 CR4: 0000000000350ef0 Call Trace: queue_work_on+0x84/0xe0 ieee80211_rx_handlers+0x5e79/0x9100 ieee80211_prepare_and_rx_handle+0x1f7f/0x5d50 ieee80211_rx_for_interface+0x10e/0x200 ieee80211_rx_list+0x1e54/0x2cf0 ieee80211_rx_napi+0xdc/0x3b0 ieee80211_handle_queued_frames+0xd9/0x130 tasklet_action_common+0x235/0x3b0 handle_softirqs+0x1b1/0x770 irq_exit_rcu+0x94/0xc0 sysvec_apic_timer_interrupt+0x70/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:in_gate_area_no_mm+0x0/0x80 Code: d8 83 03 4c 89 e7 e8 2f 9f 8a 00 e9 5a ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 41 54 55 53 48 89 fb e8 40 e3 50 00 8b 2d ba 97 7c 04 RSP: 0018:ffff888040daf468 EFLAGS: 00000203 RAX: dffffc0000000000 RBX: 00007fbfa8ebfb19 RCX: ffffffff86bee0f6 RDX: 1ffff110081b5ea4 RSI: 0000000000000000 RDI: 00007fbfa8ebfb19 RBP: 00007fbfa8ebfb19 R08: ffffffff86bee0fa R09: ffff888040daf508 R10: 000000000003c001 R11: 00000000000c2f81 R12: ffff888040daf590 R13: 0000000000000000 R14: ffff88804107b700 R15: ffff88800bd9e000 core_kernel_text+0x24/0xa0 kernel_text_address+0x11/0xc0 __kernel_text_address+0xd/0x40 unwind_get_return_address+0x59/0xa0 arch_stack_walk+0x9d/0xf0 stack_trace_save+0x8f/0xc0 kasan_save_stack+0x24/0x50 __kasan_record_aux_stack+0x8c/0xa0 __call_rcu_common.constprop.0+0x6a/0xaa0 kfree+0x28e/0x480 skb_release_data+0x7dc/0x990 sk_skb_reason_drop+0x101/0x1b0 skb_queue_purge_reason+0x27b/0x3d0 packet_release+0x8db/0xc30 __sock_release+0xb3/0x270 sock_close+0x1c/0x30 __fput+0x3fa/0xb40 task_work_run+0x173/0x280 get_signal+0x1cf/0x23d0 arch_do_signal_or_restart+0x81/0x780 syscall_exit_to_user_mode+0x123/0x1e0 do_syscall_64+0xcc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbfa8ebfb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbfa6414188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fbfa8fd3020 RCX: 00007fbfa8ebfb19 RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000005 RBP: 00007fbfa8f19f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff9cf37b7f R14: 00007fbfa6414300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at default_idle+0x1e/0x30 loop5: detected capacity change from 0 to 252 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=2576 sclass=netlink_xfrm_socket pid=18914 comm=syz-executor.7 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=2576 sclass=netlink_xfrm_socket pid=18914 comm=syz-executor.7 isofs_fill_super: bread failed, dev=loop5, iso_blknum=63, block=126 loop5: detected capacity change from 0 to 252 isofs_fill_super: bread failed, dev=loop5, iso_blknum=63, block=126 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. loop5: detected capacity change from 0 to 252 isofs_fill_super: bread failed, dev=loop5, iso_blknum=63, block=126 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. loop5: detected capacity change from 0 to 252 isofs_fill_super: bread failed, dev=loop5, iso_blknum=63, block=126 audit: type=1326 audit(1729205615.788:24): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18967 comm="syz-executor.0" exe="/syz-executor.0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9249e52b19 code=0x0 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. loop5: detected capacity change from 0 to 252 isofs_fill_super: bread failed, dev=loop5, iso_blknum=63, block=126 audit: type=1326 audit(1729205616.716:25): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18994 comm="syz-executor.0" exe="/syz-executor.0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9249e52b19 code=0x0 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. tmpfs: Bad value for 'mpol' tmpfs: Bad value for 'mpol' audit: type=1326 audit(1729205619.956:26): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=19059 comm="syz-executor.0" exe="/syz-executor.0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9249e52b19 code=0x0 audit: type=1326 audit(1729205621.233:27): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=19102 comm="syz-executor.0" exe="/syz-executor.0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9249e52b19 code=0x0 ---------------- Code disassembly (best guess): 0: 7e 60 jle 0x62 2: e8 a3 ff ff ff callq 0xffffffaa 7: 31 c0 xor %eax,%eax 9: e9 dc f4 32 03 jmpq 0x332f4ea e: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 15: 00 00 00 00 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: 90 nop 23: 90 nop 24: 90 nop 25: 90 nop 26: 90 nop 27: 90 nop 28: 90 nop 29: 90 nop * 2a: f3 0f 1e fa endbr64 <-- trapping instruction 2e: 48 8b 34 24 mov (%rsp),%rsi 32: 65 48 8b 15 90 2a b2 mov %gs:0x7eb22a90(%rip),%rdx # 0x7eb22aca 39: 7e 3a: 65 gs 3b: 8b .byte 0x8b 3c: 05 .byte 0x5 3d: 91 xchg %eax,%ecx 3e: 2a .byte 0x2a 3f: b2 .byte 0xb2