watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.0:34396]
Modules linked in:
irq event stamp: 2954817
hardirqs last  enabled at (2954816): [<ffffffff84a7d70b>] irqentry_exit+0x3b/0x90
hardirqs last disabled at (2954817): [<ffffffff84a7c0cf>] sysvec_apic_timer_interrupt+0xf/0x80
softirqs last  enabled at (2949352): [<ffffffff813a9aec>] handle_softirqs+0x50c/0x770
softirqs last disabled at (2949365): [<ffffffff813a9e84>] __irq_exit_rcu+0xc4/0x100
CPU: 0 UID: 0 PID: 34396 Comm: syz-executor.0 Not tainted 6.13.0-rc3-next-20241219 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__ieee80211_beacon_get+0x24d/0xfc0
Code: 83 ff 01 0f 85 38 03 00 00 e8 1f 2e f2 fc 48 8d bd 60 f2 ff ff 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 40 0c 00 00 4c 8b b5 60 f2 ff ff e8 01 3b 28 00 31 ff 41 89
RSP: 0018:ffff88806ce09bb0 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff88803007e150 RCX: ffffffff847f94c2
RDX: 1ffff1100600fb0a RSI: ffffffff847f94d1 RDI: ffff88803007d850
RBP: ffff88803007e5f0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88806ce09c68
R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000001
FS:  00007fca6a373700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f00b43bd018 CR3: 000000002d586000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 ieee80211_beacon_get_tim+0xa6/0x280
 mac80211_hwsim_beacon_tx+0x49b/0x950
 __iterate_interfaces+0x2e0/0x650
 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0
 mac80211_hwsim_beacon+0x105/0x200
 __hrtimer_run_queues+0x1ab/0xa80
 hrtimer_run_softirq+0x14c/0x310
 handle_softirqs+0x1b1/0x770
 __irq_exit_rcu+0xc4/0x100
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x70/0x80
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:qlist_free_all+0x96/0x160
Code: 0f 82 e0 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 80 91 d2 03 48 01 ca 48 c1 ea 0c 48 c1 e2 06 48 03 15 5e 91 d2 03 48 8b 72 08 <48> 89 d1 40 f6 c6 01 0f 85 a1 00 00 00 66 90 80 79 33 f5 ba 00 00
RSP: 0018:ffff8880408bf650 EFLAGS: 00000286
RAX: ffff888043008128 RBX: ffff888043008128 RCX: ffff8880c3008128
RDX: ffffea00010c0200 RSI: ffff888008c4f780 RDI: 0000000000080000
RBP: 0000000000000000 R08: ffff88802ef47b90 R09: 00000000000d0007
R10: ffffea0000bbd100 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880408bf688 R14: ffff88802ef47b90 R15: ffff88802ef47b90
 kasan_quarantine_reduce+0x19f/0x240
 __kasan_slab_alloc+0x49/0x70
 kmem_cache_alloc_noprof+0x13d/0x3d0
 __alloc_object+0x2f/0x270
 __create_object+0x1d/0x80
 kmem_cache_alloc_lru_noprof+0x303/0x3c0
 alloc_inode+0x17d/0x240
 path_from_stashed+0x554/0x1040
 ns_get_path+0x60/0x90
 proc_ns_get_link+0x10e/0x240
 step_into+0x1930/0x1fa0
 path_openat+0x549/0x2990
 do_filp_open+0x1e9/0x450
 do_sys_openat2+0x164/0x1d0
 __x64_sys_openat+0x143/0x200
 do_syscall_64+0xbf/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fca6cdb0a04
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44
RSP: 002b:00007fca6a3730b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fca6cf10f60 RCX: 00007fca6cdb0a04
RDX: 0000000000000000 RSI: 00007fca6ce56f82 RDI: 00000000ffffff9c
RBP: 00007fca6ce56f82 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffcae99ef5f R14: 00007fca6a373300 R15: 0000000000022000
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at default_idle+0x1e/0x30
pci 0000:00:02.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem
----------------
Code disassembly (best guess):
   0:	83 ff 01             	cmp    $0x1,%edi
   3:	0f 85 38 03 00 00    	jne    0x341
   9:	e8 1f 2e f2 fc       	callq  0xfcf22e2d
   e:	48 8d bd 60 f2 ff ff 	lea    -0xda0(%rbp),%rdi
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df
  1f:	48 89 fa             	mov    %rdi,%rdx
  22:	48 c1 ea 03          	shr    $0x3,%rdx
  26:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
* 2a:	0f 85 40 0c 00 00    	jne    0xc70 <-- trapping instruction
  30:	4c 8b b5 60 f2 ff ff 	mov    -0xda0(%rbp),%r14
  37:	e8 01 3b 28 00       	callq  0x283b3d
  3c:	31 ff                	xor    %edi,%edi
  3e:	41                   	rex.B
  3f:	89                   	.byte 0x89