watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [syz-executor.1:10455] Modules linked in: irq event stamp: 4586393 hardirqs last enabled at (4586392): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (4586393): [] sysvec_apic_timer_interrupt+0xf/0xc0 softirqs last enabled at (4573244): [] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (4573247): [] __irq_exit_rcu+0x11b/0x180 CPU: 1 PID: 10455 Comm: syz-executor.1 Not tainted 6.2.0-rc3-next-20230109 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:rcu_lockdep_current_cpu_online+0xab/0x140 Code: 03 80 3c 02 00 0f 85 85 00 00 00 48 8d 7b 18 48 8b 6b 20 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 70 <48> b8 00 00 00 00 00 fc ff df 48 8b 5b 18 48 8d 7b 70 48 89 fa 48 RSP: 0018:ffff88806cf09758 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff88806cf3a0c0 RCX: 1ffffffff0a55d19 RDX: 1ffff1100d9e741b RSI: 0000000000000103 RDI: ffff88806cf3a0d8 RBP: 0000000000000002 R08: 0000000000000000 R09: ffffffff85d0c5d7 R10: fffffbfff0ba18ba R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fe93f387700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558eeba520d8 CR3: 00000000465f8000 CR4: 0000000000350ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: rcu_read_lock_sched_held+0x2d/0x80 trace_lock_acquire+0x16c/0x1c0 lock_acquire+0x32/0xc0 __is_insn_slot_addr+0x41/0x290 kernel_text_address+0x5b/0xc0 __kernel_text_address+0xd/0x40 unwind_get_return_address+0x59/0xa0 arch_stack_walk+0x9d/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10a/0x190 __kmem_cache_free+0xd1/0x2f0 skb_release_data+0x6d8/0x810 consume_skb+0xcb/0x170 mac80211_hwsim_tx_frame+0x1f6/0x2a0 mac80211_hwsim_beacon_tx+0x566/0xb10 __iterate_interfaces+0x2d3/0x580 ieee80211_iterate_active_interfaces_atomic+0x73/0x1c0 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x54b/0xcb0 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x913 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:_raw_spin_unlock_irqrestore+0x32/0x60 Code: 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 76 c1 e7 fc 48 89 ef e8 be 38 e8 fc 80 e7 02 74 06 e8 74 33 0c fd fb bf 01 00 00 00 29 86 dd fc 65 8b 05 aa 33 bf 7b 85 c0 74 07 5b 5d e9 5b 29 00 RSP: 0018:ffff888045eaf6c0 EFLAGS: 00000202 RAX: 000000000045833b RBX: 0000000000000246 RCX: ffffffff812b799f RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 RBP: ffff88800844e900 R08: 0000000000000001 R09: ffffffff8764e92f R10: fffffbfff0ec9d25 R11: 0000000000000001 R12: ffff88800844e900 R13: 0000000000000246 R14: 0000000000000000 R15: ffffea00003496c0 __unfreeze_partials+0x11c/0x150 qlist_free_all+0x6d/0x1a0 kasan_quarantine_reduce+0x196/0x230 __kasan_slab_alloc+0x49/0x70 kmem_cache_alloc+0x172/0x300 __create_object+0x3d/0xc40 kmem_cache_alloc+0x204/0x300 mas_alloc_nodes+0x402/0x8a0 mas_preallocate+0x1bf/0x370 __split_vma+0x119/0x6a0 do_vmi_align_munmap.constprop.0+0x312/0xb60 do_vmi_munmap+0x1ec/0x2c0 mmap_region+0x1ec/0x1c10 do_mmap+0x82c/0xf50 vm_mmap_pgoff+0x1b3/0x270 ksys_mmap_pgoff+0x3d4/0x500 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fe941e11b62 Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 RSP: 002b:00007fe93f3870f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007fe941e11b62 RDX: 0000000000000003 RSI: 00000000000007c0 RDI: 00000000200b0000 RBP: 00000000200b0000 R08: 0000000000000007 R09: 0000000010000000 R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000280 R13: 00000000200b0000 R14: 0000000020000100 R15: 0000000020fff000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at default_idle+0xf/0x20 ---------------- Code disassembly (best guess): 0: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax 6: 85 85 00 00 00 48 test %eax,0x48000000(%rbp) c: 8d 7b 18 lea 0x18(%rbx),%edi f: 48 8b 6b 20 mov 0x20(%rbx),%rbp 13: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 1a: fc ff df 1d: 48 89 fa mov %rdi,%rdx 20: 48 c1 ea 03 shr $0x3,%rdx 24: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 28: 75 70 jne 0x9a * 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction 31: fc ff df 34: 48 8b 5b 18 mov 0x18(%rbx),%rbx 38: 48 8d 7b 70 lea 0x70(%rbx),%rdi 3c: 48 89 fa mov %rdi,%rdx 3f: 48 rex.W