watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.2:4419]
Modules linked in:
irq event stamp: 7168191
hardirqs last  enabled at (7168190): [<ffffffff8460158a>] asm_sysvec_irq_work+0x1a/0x20
hardirqs last disabled at (7168191): [<ffffffff84490faf>] sysvec_apic_timer_interrupt+0xf/0x90
softirqs last  enabled at (7097850): [<ffffffff8118e8cc>] __irq_exit_rcu+0xcc/0x110
softirqs last disabled at (7097853): [<ffffffff8118e8cc>] __irq_exit_rcu+0xcc/0x110
CPU: 1 PID: 4419 Comm: syz-executor.2 Not tainted 6.3.0-rc1-next-20230308 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__unwind_start+0x51e/0x7c0
Code: bd 00 00 00 00 00 fc ff df 49 89 c5 49 89 f4 49 01 ed 49 01 ec eb 2a 4c 89 ff e8 0d d8 ff ff 4c 89 f8 48 c1 e8 03 0f b6 04 28 <84> c0 74 08 3c 03 0f 8e 25 01 00 00 41 8b 07 85 c0 0f 84 8d fd ff
RSP: 0018:ffff88806cf09720 EFLAGS: 00000216
RAX: 0000000000000000 RBX: ffff88806cf09808 RCX: 0000000000000001
RDX: ffff88806cf09778 RSI: ffff88806cf09740 RDI: ffff88806cf09780
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff88806cf097b0
R10: 0000000000038001 R11: 0000000000000001 R12: ffffed100d9e12f0
R13: ffffed100d9e12ef R14: ffff88806cf097b8 R15: ffff88806cf09770
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce6df86718 CR3: 0000000005482000 CR4: 0000000000350ee0
Call Trace:
 <IRQ>
 arch_stack_walk+0x63/0xf0
 stack_trace_save+0x90/0xd0
 set_track_prepare+0x74/0xd0
 __create_object+0x3b2/0xc90
 kmem_cache_alloc_node+0x21f/0x330
 kmalloc_reserve+0x169/0x270
 __alloc_skb+0x129/0x330
 skb_copy+0x13d/0x3f0
 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb08/0x1330
 mac80211_hwsim_tx_frame+0x1ee/0x2a0
 mac80211_hwsim_beacon_tx+0x567/0xb10
 __iterate_interfaces+0x2d3/0x580
 ieee80211_iterate_active_interfaces_atomic+0x73/0x1c0
 mac80211_hwsim_beacon+0x105/0x200
 __hrtimer_run_queues+0x54b/0xcb0
 hrtimer_run_softirq+0x14c/0x310
 __do_softirq+0x258/0x8a2
 __irq_exit_rcu+0xcc/0x110
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x6e/0x90
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70
Code: 81 e1 00 01 00 00 65 48 8b 14 25 80 8a 03 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 0c 14 00 00 85 c0 74 2b 8b 82 e8 13 00 00 <83> f8 02 75 20 48 8b 8a f0 13 00 00 8b 92 ec 13 00 00 48 8b 01 48
RSP: 0018:ffff888045c57570 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffea0000db3f40 RCX: 0000000000000000
RDX: ffff88801a57d040 RSI: ffffffff81655ff3 RDI: 0000000000000007
RBP: ffff88801a43a370 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: dffffc0000000000 R14: 000000000000006c R15: ffffea0000db3f40
 release_pages+0x1f3/0x1040
 tlb_batch_pages_flush+0xa8/0x1b0
 unmap_page_range+0x1af6/0x2db0
 unmap_single_vma+0x19a/0x2b0
 unmap_vmas+0x233/0x390
 exit_mmap+0x15e/0x960
 mmput+0xd5/0x390
 do_exit+0x9c6/0x2800
 do_group_exit+0xd4/0x2a0
 get_signal+0x23c8/0x2450
 arch_do_signal_or_restart+0x79/0x590
 exit_to_user_mode_prepare+0x122/0x190
 syscall_exit_to_user_mode+0x1d/0x50
 do_syscall_64+0x4c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f03f31f8197
Code: Unable to access opcode bytes at 0x7f03f31f816d.
RSP: 002b:00007f03f074a0f8 EFLAGS: 00000286 ORIG_RAX: 0000000000000029
RAX: 0000000000000003 RBX: 00007f03f330a020 RCX: 00007f03f31f8197
RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010
RBP: 00007f03f3250f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 00000000ffffffff
R13: 00007ffea62c814f R14: 00007f03f074b300 R15: 0000000000022000
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at default_idle+0xf/0x20
----------------
Code disassembly (best guess):
   0:	bd 00 00 00 00       	mov    $0x0,%ebp
   5:	00 fc                	add    %bh,%ah
   7:	ff                   	(bad)
   8:	df 49 89             	fisttps -0x77(%rcx)
   b:	c5 49 89             	(bad)
   e:	f4                   	hlt
   f:	49 01 ed             	add    %rbp,%r13
  12:	49 01 ec             	add    %rbp,%r12
  15:	eb 2a                	jmp    0x41
  17:	4c 89 ff             	mov    %r15,%rdi
  1a:	e8 0d d8 ff ff       	callq  0xffffd82c
  1f:	4c 89 f8             	mov    %r15,%rax
  22:	48 c1 e8 03          	shr    $0x3,%rax
  26:	0f b6 04 28          	movzbl (%rax,%rbp,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	74 08                	je     0x36
  2e:	3c 03                	cmp    $0x3,%al
  30:	0f 8e 25 01 00 00    	jle    0x15b
  36:	41 8b 07             	mov    (%r15),%eax
  39:	85 c0                	test   %eax,%eax
  3b:	0f                   	.byte 0xf
  3c:	84                   	.byte 0x84
  3d:	8d                   	(bad)
  3e:	fd                   	std
  3f:	ff                   	.byte 0xff