watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.2:16095] Modules linked in: irq event stamp: 7916853 hardirqs last enabled at (7916852): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (7916853): [] sysvec_apic_timer_interrupt+0xf/0xc0 softirqs last enabled at (7763756): [] irq_exit_rcu+0x11f/0x190 softirqs last disabled at (7763759): [] irq_exit_rcu+0x11f/0x190 CPU: 1 PID: 16095 Comm: syz-executor.2 Not tainted 6.2.0-rc4-next-20230117 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:unwind_next_frame+0x35f/0x2130 Code: 00 fc ff df 4d 8d 48 04 4c 89 ca 48 c1 ea 03 0f b6 04 02 4c 89 ca 83 e2 07 38 d0 7f 08 84 c0 0f 85 e4 14 00 00 41 0f b6 40 04 0f 0f 85 a2 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 78 05 RSP: 0018:ffff88806cf09680 EFLAGS: 00000246 RAX: 0000000000000015 RBX: 0000000000000002 RCX: ffffffff840f6668 RDX: 0000000000000004 RSI: ffffffff86435f80 RDI: ffffffff85fef700 RBP: ffff88806cf09758 R08: ffffffff86435f80 R09: ffffffff86435f84 R10: ffff88806c6831f0 R11: 0000000000038001 R12: ffff88806cf09741 R13: ffff88806cf09760 R14: ffff88806cf09700 R15: ffffffff840f6668 FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe33db6eb84 CR3: 0000000005482000 CR4: 0000000000350ee0 Call Trace: arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x59/0x70 kmem_cache_alloc+0x172/0x300 __create_object+0x3d/0xc40 kmem_cache_alloc_node+0x215/0x310 __alloc_skb+0x21a/0x310 __netdev_alloc_skb+0x76/0x3e0 __ieee80211_beacon_get+0x3d9/0x13c0 ieee80211_beacon_get_tim+0x99/0x540 mac80211_hwsim_beacon_tx+0x1d2/0xb10 __iterate_interfaces+0x2d3/0x580 ieee80211_iterate_active_interfaces_atomic+0x73/0x1c0 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x54b/0xcb0 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x274/0x8ff irq_exit_rcu+0x11f/0x190 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:unmap_page_range+0xf4d/0x2d90 Code: e8 78 ff db ff 45 85 e4 75 0d e8 3e 03 dc ff 48 89 df e8 96 2c f5 ff e8 31 03 dc ff 48 8b 44 24 50 48 c1 e8 03 42 80 3c 30 00 <0f> 85 86 15 00 00 4c 8b 63 08 31 ff 4d 89 e7 41 83 e7 01 4c 89 fe RSP: 0018:ffff888040d7f700 EFLAGS: 00000246 RAX: 1ffffd40001a4e99 RBX: ffffea0000d274c0 RCX: 0000000000000000 RDX: ffff88804445d040 RSI: ffffffff816d7f3f RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: ffff888040d7fad8 R14: dffffc0000000000 R15: 0000000000000000 unmap_single_vma+0x190/0x2a0 unmap_vmas+0x225/0x370 exit_mmap+0x158/0x6a0 mmput+0xd5/0x390 do_exit+0x99b/0x2780 do_group_exit+0xd4/0x2a0 get_signal+0x2255/0x2390 arch_do_signal_or_restart+0x79/0x5a0 exit_to_user_mode_prepare+0xf5/0x190 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fbe9481eb19 Code: Unable to access opcode bytes at 0x7fbe9481eaef. RSP: 002b:00007fbe91d94188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: 0000000000000005 RBX: 00007fbe94931f60 RCX: 00007fbe9481eb19 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000a RBP: 00007fbe94878f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc177febdf R14: 00007fbe91d94300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at default_idle+0xf/0x20 ---------------- Code disassembly (best guess), 3 bytes skipped: 0: df 4d 8d fisttps -0x73(%rbp) 3: 48 04 4c rex.W add $0x4c,%al 6: 89 ca mov %ecx,%edx 8: 48 c1 ea 03 shr $0x3,%rdx c: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax 10: 4c 89 ca mov %r9,%rdx 13: 83 e2 07 and $0x7,%edx 16: 38 d0 cmp %dl,%al 18: 7f 08 jg 0x22 1a: 84 c0 test %al,%al 1c: 0f 85 e4 14 00 00 jne 0x1506 22: 41 0f b6 40 04 movzbl 0x4(%r8),%eax * 27: a8 0f test $0xf,%al <-- trapping instruction 29: 0f 85 a2 01 00 00 jne 0x1d1 2f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 36: fc ff df 39: 49 8d 78 05 lea 0x5(%r8),%rdi