audit: type=1326 audit(1670493884.991:27): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=9939 comm="syz-executor.1" exe="/syz-executor.1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f35efec0b19 code=0x0 EXT4-fs: failed to create workqueue EXT4-fs (loop1): mount failed syz_tun: refused to change device tx_queue_len watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.3:9890] Modules linked in: irq event stamp: 5194295 hardirqs last enabled at (5194294): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (5194295): [] sysvec_apic_timer_interrupt+0xf/0xc0 softirqs last enabled at (5068582): [] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (5068585): [] __irq_exit_rcu+0x11b/0x180 CPU: 1 PID: 9890 Comm: syz-executor.3 Not tainted 6.1.0-rc8-next-20221207 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:preempt_count_add+0x4e/0x150 Code: c0 03 0f b6 14 11 38 d0 7c 08 84 d2 0f 85 e9 00 00 00 8b 15 f4 9b 79 06 65 01 1d 35 6d e1 7e 85 d2 75 11 65 8b 05 2a 6d e1 7e <0f> b6 c0 3d f4 00 00 00 7f 6c 65 8b 05 19 6d e1 7e 25 ff ff ff 7f RSP: 0018:ffff88806cf09720 EFLAGS: 00000246 RAX: 0000000000000104 RBX: 0000000000000001 RCX: 1ffffffff0f376f8 RDX: 0000000000000000 RSI: ffffffff840f9ef3 RDI: 0000000000000001 RBP: ffff88806cf09810 R08: ffffffff862ecfb4 R09: ffffffff862ecfb8 R10: ffffed100d9e1304 R11: ffff88806cf097f8 R12: ffff88806cf09880 R13: 0000000000000000 R14: ffff88806cf097b8 R15: ffffffff834c1856 FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f35ed416000 CR3: 000000003de32000 CR4: 0000000000350ee0 Call Trace: unwind_next_frame+0xb0/0x2130 arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 __kmalloc_node_track_caller+0x53/0xb0 __alloc_skb+0xe9/0x310 __netdev_alloc_skb+0x76/0x3e0 __ieee80211_beacon_get+0x3d9/0x1310 ieee80211_beacon_get_tim+0x99/0x4f0 mac80211_hwsim_beacon_tx+0x1d2/0xab0 __iterate_interfaces+0x2d3/0x560 ieee80211_iterate_active_interfaces_atomic+0x74/0x180 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x54b/0xba0 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:_raw_spin_unlock_irqrestore+0x32/0x60 Code: 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 76 26 ea fc 48 89 ef e8 3e 9e ea fc 80 e7 02 74 06 e8 94 60 0e fd fb bf 01 00 00 00 09 fb df fc 65 8b 05 7a 82 c1 7b 85 c0 74 07 5b 5d e9 2b 29 00 RSP: 0018:ffff88803f31f6a0 EFLAGS: 00000206 RAX: 000000000029952d RBX: 0000000000000293 RCX: ffffffff812b8edf RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000001 RBP: ffff88800f45d920 R08: 0000000000000001 R09: ffffffff8762e8c7 R10: fffffbfff0ec5d18 R11: 0000000000000001 R12: ffffffffffffffa6 R13: 0000000000000293 R14: 0000000000000001 R15: 0000607f92e21e20 percpu_counter_add_batch+0x13d/0x180 unmap_page_range+0xdff/0x2c10 unmap_single_vma+0x190/0x2a0 unmap_vmas+0x226/0x380 exit_mmap+0x158/0x680 mmput+0xd5/0x390 do_exit+0x99b/0x2720 do_group_exit+0xd4/0x2a0 get_signal+0x21b7/0x22f0 arch_do_signal_or_restart+0x79/0x5a0 exit_to_user_mode_prepare+0x131/0x1a0 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fbbbc121b19 Code: Unable to access opcode bytes at 0x7fbbbc121aef. RSP: 002b:00007fbbb9697188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: 0000000000000006 RBX: 00007fbbbc234f60 RCX: 00007fbbbc121b19 RDX: 0000000000101042 RSI: 0000000020000100 RDI: ffffffffffffff9c RBP: 00007fbbbc17bf6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe898f2bef R14: 00007fbbb9697300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at default_idle+0xf/0x20 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 0f b6 14 11 movzbl (%rcx,%rdx,1),%edx 4: 38 d0 cmp %dl,%al 6: 7c 08 jl 0x10 8: 84 d2 test %dl,%dl a: 0f 85 e9 00 00 00 jne 0xf9 10: 8b 15 f4 9b 79 06 mov 0x6799bf4(%rip),%edx # 0x6799c0a 16: 65 01 1d 35 6d e1 7e add %ebx,%gs:0x7ee16d35(%rip) # 0x7ee16d52 1d: 85 d2 test %edx,%edx 1f: 75 11 jne 0x32 21: 65 8b 05 2a 6d e1 7e mov %gs:0x7ee16d2a(%rip),%eax # 0x7ee16d52 * 28: 0f b6 c0 movzbl %al,%eax <-- trapping instruction 2b: 3d f4 00 00 00 cmp $0xf4,%eax 30: 7f 6c jg 0x9e 32: 65 8b 05 19 6d e1 7e mov %gs:0x7ee16d19(%rip),%eax # 0x7ee16d52 39: 25 ff ff ff 7f and $0x7fffffff,%eax