watchdog: BUG: soft lockup - CPU#0 stuck for 24s! [kworker/u9:3:44] Modules linked in: irq event stamp: 2491131 hardirqs last enabled at (2491130): [] kasan_quarantine_put+0x84/0x1e0 hardirqs last disabled at (2491131): [] sysvec_apic_timer_interrupt+0xf/0x80 softirqs last enabled at (2490938): [] handle_softirqs+0x50c/0x770 softirqs last disabled at (2490943): [] __irq_exit_rcu+0xc4/0x100 CPU: 0 UID: 0 PID: 44 Comm: kworker/u9:3 Not tainted 6.16.0-rc7-next-20250722 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:kasan_quarantine_put+0x86/0x1e0 Code: 00 00 00 00 48 03 50 10 48 89 50 10 48 89 d3 48 81 fa 00 00 10 00 77 5c 41 bd 01 00 00 00 4d 85 e4 74 3c e8 bc 9c cc ff fb 5b <44> 89 e8 5d 41 5c 41 5d 41 5e e9 7b d4 0d 03 e8 06 9b cc ff 65 48 RSP: 0018:ffff88806ce08b58 EFLAGS: 00000206 RAX: 00000000002602fa RBX: 0000000000089110 RCX: 0000000000000004 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81af7d34 RBP: ffff8880096f4b40 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff8643c857 R11: 0000000000000001 R12: 0000000000000200 R13: 0000000000000001 R14: 0000000000000000 R15: ffff88803f0a56c0 FS: 0000000000000000(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000001a77c000 CR4: 0000000000350ef0 Call Trace: kmem_cache_free+0x2a1/0x460 skb_release_data+0x88d/0xa40 consume_skb+0xd0/0x160 mac80211_hwsim_tx_frame+0x1f6/0x2a0 mac80211_hwsim_beacon_tx+0x53c/0x940 __iterate_interfaces+0x2e0/0x650 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x1ee/0xac0 hrtimer_run_softirq+0x14c/0x310 handle_softirqs+0x1b1/0x770 __irq_exit_rcu+0xc4/0x100 irq_exit_rcu+0x9/0x20 sysvec_apic_timer_interrupt+0x70/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:_raw_spin_unlock_irqrestore+0x34/0x50 Code: c7 18 53 48 89 f3 48 8b 74 24 10 e8 96 90 94 fc 48 89 ef e8 ce db 94 fc 80 e7 02 74 06 e8 44 e7 be fc fb 65 ff 0d 7c fd c6 02 <74> 07 5b 5d e9 03 1f 00 00 0f 1f 44 00 00 5b 5d e9 f7 1e 00 00 0f RSP: 0018:ffff88800a50faf8 EFLAGS: 00000246 RAX: 000000000026023d RBX: 0000000000000202 RCX: 0000000000000040 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff84bd32ac RBP: ffff88800e0b8de0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff8643c857 R11: 0000000000000001 R12: ffff8880096f48c0 R13: ffffea0000fdd780 R14: 0000000000000000 R15: ffff88803f75ea00 __delete_object+0x2b/0x50 kmem_cache_free+0x2ed/0x460 kfree_skbmem+0x18a/0x1f0 sk_skb_reason_drop+0x10e/0x1b0 ieee80211_iface_work+0x43c/0x1220 cfg80211_wiphy_work+0x245/0x480 process_one_work+0x8e1/0x19c0 worker_thread+0x67e/0xe90 kthread+0x3c8/0x740 ret_from_fork+0x34b/0x430 ret_from_fork_asm+0x1a/0x30 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31819 Comm: syz-executor Not tainted 6.16.0-rc7-next-20250722 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__lookup_object+0x29/0x90 Code: 90 41 54 48 c7 c0 e8 67 36 88 f6 c2 10 75 15 83 e2 20 48 c7 c0 f0 67 36 88 48 c7 c2 e0 67 36 88 48 0f 45 c2 4c 8b 20 4d 85 e4 <74> 14 49 8b 44 24 30 48 39 f8 76 14 4d 8b 64 24 10 4d 85 e4 75 ec RSP: 0018:ffff8880348f7ba8 EFLAGS: 00000082 RAX: ffff888012315a28 RBX: ffffffff886b9a38 RCX: 0000000000004002 RDX: ffff888012315a40 RSI: 0000000000000001 RDI: ffff88806c0271a0 RBP: ffff88806c0271a0 R08: 0000000000000001 R09: ffffed100691ef69 R10: 0000000000000003 R11: 0000000000000001 R12: ffff8880128ff508 R13: ffffffff886b9a38 R14: ffff888044560000 R15: 0000000000000086 FS: 000055556b3eb400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fee597be000 CR3: 000000002ec49000 CR4: 0000000000350ef0 Call Trace: pointer_update_refs.part.0+0x14/0xa0 scan_block+0x7e/0xe0 scan_gray_list+0x25f/0x290 kmemleak_scan+0x574/0xe00 kmemleak_write+0x456/0x530 full_proxy_write+0x133/0x1a0 vfs_write+0x2b7/0x10c0 ksys_write+0x121/0x240 do_syscall_64+0xbf/0x360 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fee596815c3 Code: 16 00 00 00 eb ae 90 b8 6e 00 00 00 eb a6 e8 44 ef 04 00 0f 1f 40 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18 RSP: 002b:00007fff67666c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fff67667268 RCX: 00007fee596815c3 RDX: 0000000000000004 RSI: 00007fee59737ed9 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0004b9b832544bca R09: 00007fee597be000 R10: 00007fee597be010 R11: 0000000000000246 R12: 00007fee59683b10 R13: 00007fff67668ee7 R14: 0000000000000000 R15: 00000000001d4869 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 48 03 50 10 add 0x10(%rax),%rdx 8: 48 89 50 10 mov %rdx,0x10(%rax) c: 48 89 d3 mov %rdx,%rbx f: 48 81 fa 00 00 10 00 cmp $0x100000,%rdx 16: 77 5c ja 0x74 18: 41 bd 01 00 00 00 mov $0x1,%r13d 1e: 4d 85 e4 test %r12,%r12 21: 74 3c je 0x5f 23: e8 bc 9c cc ff callq 0xffcc9ce4 28: fb sti 29: 5b pop %rbx * 2a: 44 89 e8 mov %r13d,%eax <-- trapping instruction 2d: 5d pop %rbp 2e: 41 5c pop %r12 30: 41 5d pop %r13 32: 41 5e pop %r14 34: e9 7b d4 0d 03 jmpq 0x30dd4b4 39: e8 06 9b cc ff callq 0xffcc9b44 3e: 65 gs 3f: 48 rex.W