watchdog: BUG: soft lockup - CPU#1 stuck for 24s! [syz-executor.2:4978] Modules linked in: irq event stamp: 11692633 hardirqs last enabled at (11692632): [] asm_sysvec_x86_platform_ipi-0xa/0x20 hardirqs last disabled at (11692633): [] sysvec_apic_timer_interrupt+0xb/0xd0 softirqs last enabled at (11661916): [] __irq_exit_rcu+0x11b/0x190 softirqs last disabled at (11661919): [] __irq_exit_rcu+0x11b/0x190 CPU: 1 PID: 4978 Comm: syz-executor.2 Not tainted 6.1.0-rc1-next-20221019 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:stack_access_ok+0x7e/0x1e0 Code: 00 0f 85 30 01 00 00 48 8d 7b 10 4c 8b 6b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 17 01 00 00 <48> 8b 43 10 49 39 ed 77 1a 48 39 e8 76 15 4a 8d 54 25 00 48 39 d0 RSP: 0018:ffff88806cf09668 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff88806cf09720 RCX: 0000000000000001 RDX: 1ffff1100d9e12e6 RSI: ffff8880446fff58 RDI: ffff88806cf09730 RBP: ffff8880446fff58 R08: ffffffff86063e9a R09: ffffffff86063e9e R10: ffff88806cf09ff8 R11: 0000000000036001 R12: 00000000000000a8 R13: ffff8880446f8000 R14: ffff88806cf09720 R15: ffffffff86063e9f FS: 00007f7eb72d2700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560a22d22648 CR3: 0000000017fe0000 CR4: 0000000000350ee0 Call Trace: unwind_next_frame+0xe59/0x2140 arch_stack_walk+0x83/0x100 stack_trace_save+0x8c/0xd0 kasan_save_stack+0x1e/0x50 kasan_set_track+0x21/0x40 __kasan_slab_alloc+0x58/0x80 kmem_cache_alloc_node+0x1c6/0x410 __alloc_skb+0x210/0x310 skb_copy+0x139/0x3d0 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb6d/0x1370 mac80211_hwsim_tx_frame+0x1ee/0x2b0 mac80211_hwsim_beacon_tx+0x562/0xac0 __iterate_interfaces+0x2d3/0x570 ieee80211_iterate_active_interfaces_atomic+0x70/0x190 mac80211_hwsim_beacon+0x101/0x210 __hrtimer_run_queues+0x541/0xb60 hrtimer_run_softirq+0x172/0x350 __do_softirq+0x1c3/0x8f5 __irq_exit_rcu+0x11b/0x190 irq_exit_rcu+0x5/0x30 sysvec_apic_timer_interrupt+0x8e/0xd0 asm_sysvec_x86_platform_ipi-0xa/0x20 RIP: 0010:qlist_free_all+0x33/0x1b0 Code: 01 00 00 41 57 41 56 41 55 49 89 fd 41 54 49 bc 00 00 00 00 00 fc ff df 55 48 89 f5 53 48 83 ec 08 eb 4d 49 63 86 c0 00 00 00 <49> 8b 18 4c 89 f7 49 29 c0 4c 89 c6 4d 89 c7 e8 f9 f4 ff ff 48 89 RSP: 0018:ffff8880446ff1d0 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff88800fe51300 RCX: ffff888008041780 RDX: ffffea00003f9440 RSI: ffffea0001126400 RDI: 0000000040000000 RBP: 0000000000000000 R08: ffff88800fe51300 R09: dead000080070003 R10: ffffea0001126400 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880446ff210 R14: ffff888008041780 R15: ffff888044993300 kasan_quarantine_reduce+0x192/0x230 __kasan_slab_alloc+0x48/0x80 kmem_cache_alloc+0x1a9/0x3f0 __create_object+0x3d/0xc20 kmem_cache_alloc+0x235/0x3f0 __kernfs_new_node+0xd4/0x8d0 kernfs_new_node+0x93/0x130 __kernfs_create_file+0x51/0x360 sysfs_add_file_mode_ns+0x218/0x440 internal_create_group+0x322/0xb30 internal_create_groups.part.0+0x90/0x150 sysfs_create_groups+0x25/0x60 device_add+0x70d/0x1ed0 netdev_register_kobject+0x17a/0x3c0 register_netdevice+0xd5c/0x1520 register_netdev+0x2d/0x60 sit_init_net+0x354/0xa10 setup_net+0x4ab/0xb50 copy_net_ns+0x318/0x770 create_new_namespaces+0x3f6/0xb40 copy_namespaces+0x3b3/0x4b0 copy_process+0x29f8/0x6ea0 kernel_clone+0xe7/0x8a0 __do_sys_clone3+0x1d5/0x2f0 do_syscall_64+0x3b/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7eb9d7db19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f7eb72d2188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 RAX: ffffffffffffffda RBX: 00007f7eb9e91020 RCX: 00007f7eb9d7db19 RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020004c00 RBP: 00007f7eb9dd7f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9bf0177f R14: 00007f7eb72d2300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4973 Comm: syz-executor.0 Not tainted 6.1.0-rc1-next-20221019 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__lock_acquire+0x414/0x5e80 Code: 6c 6d 00 48 c1 e5 06 48 81 c5 20 5c 20 87 48 8d bd b8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 <84> c0 74 06 0f 8e 98 11 00 00 48 8b 54 24 38 44 0f b6 b5 b8 00 00 RSP: 0018:ffff88806ce095c0 EFLAGS: 00000012 RAX: 0000000000000000 RBX: ffff8880089ebef8 RCX: ffffffff812b1e3a RDX: 1ffffffff0e4110b RSI: 0000000000000008 RDI: ffffffff87208858 RBP: ffffffff872087a0 R08: 0000000000000000 R09: ffffffff87205807 R10: fffffbfff0e40b00 R11: 0000000000000001 R12: ffff8880089eb580 R13: ffff8880089ebfc0 R14: ffffffff852272c8 R15: 0000000000066000 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd3ce19ff8 CR3: 000000000f0a2000 CR4: 0000000000350ef0 Call Trace: lock_acquire+0x1a2/0x540 ktime_get_update_offsets_now+0x97/0x370 hrtimer_interrupt+0x137/0x780 __sysvec_apic_timer_interrupt+0x144/0x510 sysvec_apic_timer_interrupt+0x3b/0xd0 asm_sysvec_x86_platform_ipi-0xa/0x20 RIP: 0010:kasan_check_range+0x14d/0x1d0 Code: 48 89 da 48 29 c2 e9 6a ff ff ff 48 89 d0 49 39 c2 0f 85 f3 fe ff ff 4c 89 c8 49 0f be 12 83 e0 07 48 39 d0 0f 8d e0 fe ff ff <41> bb 01 00 00 00 5b 5d 44 89 d8 41 5c e9 21 75 ba 02 48 85 d2 74 RSP: 0018:ffff88806ce09a08 EFLAGS: 00000246 RAX: fffffbfff0ac8159 RBX: fffffbfff0ac8159 RCX: ffffffff8435fe07 RDX: fffffbfff0ac8159 RSI: 0000000000000004 RDI: ffffffff85640ac0 RBP: fffffbfff0ac8158 R08: 0000000000000000 R09: ffffffff85640ac3 R10: fffffbfff0ac8158 R11: 0000000000000001 R12: 0000000000000003 R13: fffffbfff0ac8158 R14: 0000000000000001 R15: 1ffff1100d9c1346 queued_spin_lock_slowpath+0xa7/0xc90 do_raw_spin_lock+0x1dc/0x270 mac80211_hwsim_tx_frame_no_nl.isra.0+0x6f1/0x1370 mac80211_hwsim_tx_frame+0x1ee/0x2b0 mac80211_hwsim_beacon_tx+0x562/0xac0 __iterate_interfaces+0x2d3/0x570 ieee80211_iterate_active_interfaces_atomic+0x70/0x190 mac80211_hwsim_beacon+0x101/0x210 __hrtimer_run_queues+0x541/0xb60 hrtimer_run_softirq+0x172/0x350 __do_softirq+0x1c3/0x8f5 __irq_exit_rcu+0x11b/0x190 irq_exit_rcu+0x5/0x30 sysvec_apic_timer_interrupt+0x8e/0xd0 asm_sysvec_x86_platform_ipi-0xa/0x20 RIP: 0010:lru_add_drain_cpu+0x2/0x7b0 Code: ff ff ff e8 e0 87 19 00 eb 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 <41> 56 41 55 41 54 55 48 63 ef 53 4c 8d 3c ed a0 68 ef 84 48 c7 c3 RSP: 0018:ffff888043a77580 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffffffff87592700 RCX: 0000000000000000 RDX: 1ffff1100d9c6779 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000033ba0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88806ce33ba0 R13: ffff88806ce33bc8 R14: ffff8880089eb580 R15: 00000000000001f1 lru_add_drain+0x103/0x420 free_pages_and_swap_cache+0x18/0xa0 tlb_batch_pages_flush+0xa8/0x1c0 unmap_page_range+0x1638/0x2a20 unmap_single_vma+0x190/0x2b0 unmap_vmas+0x21e/0x380 exit_mmap+0x154/0x690 mmput+0xd1/0x3a0 do_exit+0xa2e/0x2800 do_group_exit+0xd0/0x2b0 get_signal+0x2195/0x22e0 arch_do_signal_or_restart+0x89/0x1bf0 exit_to_user_mode_prepare+0x131/0x1b0 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x48/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff6e42c3b19 Code: Unable to access opcode bytes at 0x7ff6e42c3aef. RSP: 002b:00007ff6e1839108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 RAX: 0000000000000007 RBX: 00007ff6e43d6f60 RCX: 00007ff6e42c3b19 RDX: 0000000020ffb000 RSI: 00000000200003c0 RDI: 0000000000007668 RBP: 00000000200003c0 R08: 0000000020000480 R09: 0000000020000480 R10: 0000000020000440 R11: 0000000000000202 R12: 0000000020000480 R13: 0000000020ffb000 R14: 0000000020000440 R15: 0000000020ffc000 ---------------- Code disassembly (best guess): 0: 00 0f add %cl,(%rdi) 2: 85 30 test %esi,(%rax) 4: 01 00 add %eax,(%rax) 6: 00 48 8d add %cl,-0x73(%rax) 9: 7b 10 jnp 0x1b b: 4c 8b 6b 08 mov 0x8(%rbx),%r13 f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 48 89 fa mov %rdi,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 17 01 00 00 jne 0x141 * 2a: 48 8b 43 10 mov 0x10(%rbx),%rax <-- trapping instruction 2e: 49 39 ed cmp %rbp,%r13 31: 77 1a ja 0x4d 33: 48 39 e8 cmp %rbp,%rax 36: 76 15 jbe 0x4d 38: 4a 8d 54 25 00 lea 0x0(%rbp,%r12,1),%rdx 3d: 48 39 d0 cmp %rdx,%rax