watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [syz-executor.6:60036]
Modules linked in:
irq event stamp: 7085145
hardirqs last  enabled at (7085144): [<ffffffff8460144a>] asm_sysvec_apic_timer_interrupt+0x1a/0x20
hardirqs last disabled at (7085145): [<ffffffff84458faf>] sysvec_apic_timer_interrupt+0xf/0x90
softirqs last  enabled at (6926764): [<ffffffff8118cfdc>] __irq_exit_rcu+0xcc/0x110
softirqs last disabled at (6926767): [<ffffffff8118cfdc>] __irq_exit_rcu+0xcc/0x110
CPU: 1 PID: 60036 Comm: syz-executor.6 Not tainted 6.2.0-rc6-next-20230202 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__orc_find+0x6f/0xf0
Code: 72 4d 4c 89 e0 48 29 e8 48 89 c2 48 c1 e8 3f 48 c1 fa 02 48 01 d0 48 d1 f8 48 8d 5c 85 00 48 89 d8 48 c1 e8 03 42 0f b6 14 38 <48> 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 50 48 63 03 48 01
RSP: 0018:ffff88806cf09658 EFLAGS: 00000212
RAX: 1ffffffff0baa004 RBX: ffffffff85d50020 RCX: ffffffff81080f68
RDX: 0000000000000000 RSI: ffffffff86048a72 RDI: ffffffff85d5001c
RBP: ffffffff85d5001c R08: ffffffff86048a8a R09: ffff88806cf09758
R10: 0000000000038001 R11: 0000000000000000 R12: ffffffff85d50028
R13: ffffffff85d5001c R14: ffffffff85d5001c R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055829e0370e0 CR3: 0000000005482000 CR4: 0000000000350ee0
Call Trace:
 <IRQ>
 unwind_next_frame+0x290/0x2360
 arch_stack_walk+0x87/0xf0
 stack_trace_save+0x90/0xd0
 kasan_save_stack+0x22/0x50
 kasan_set_track+0x25/0x30
 __kasan_slab_alloc+0x59/0x70
 kmem_cache_alloc_node+0x187/0x330
 __alloc_skb+0x21a/0x310
 skb_copy+0x13d/0x3f0
 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb08/0x1330
 mac80211_hwsim_tx_frame+0x1ee/0x2a0
 mac80211_hwsim_beacon_tx+0x567/0xb10
 __iterate_interfaces+0x2d3/0x580
 ieee80211_iterate_active_interfaces_atomic+0x73/0x1c0
 mac80211_hwsim_beacon+0x105/0x200
 __hrtimer_run_queues+0x54b/0xcb0
 hrtimer_run_softirq+0x14c/0x310
 __do_softirq+0x258/0x8a2
 __irq_exit_rcu+0xcc/0x110
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x6e/0x90
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:strlen+0x58/0xa0
Code: 75 50 80 7d 00 00 74 3d 48 bb 00 00 00 00 00 fc ff df 48 89 e8 48 83 c0 01 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a <38> ca 7f 04 84 d2 75 27 80 38 00 75 de 48 83 c4 08 48 29 e8 5b 5d
RSP: 0018:ffff888046217510 EFLAGS: 00000202
RAX: ffffffff84853f6f RBX: dffffc0000000000 RCX: 0000000000000007
RDX: 0000000000000000 RSI: ffff88800dfff7f8 RDI: ffffffff84853f60
RBP: ffffffff84853f60 R08: 0000000000000000 R09: ffffffff85d10397
R10: fffffbfff0ba2072 R11: 0000000000000001 R12: 1ffff11008c42eac
R13: ffff8880462175e0 R14: ffffffff8550d5e0 R15: 0000000000000000
 perf_trace_lock+0xc1/0x480
 lock_release+0x4a9/0x710
 _raw_spin_unlock+0x16/0x40
 unmap_page_range+0x1206/0x2da0
 unmap_single_vma+0x194/0x2a0
 unmap_vmas+0x233/0x390
 exit_mmap+0x15b/0x6a0
 mmput+0xd5/0x390
 do_exit+0x9c6/0x2800
 do_group_exit+0xd4/0x2a0
 get_signal+0x23c8/0x2450
 arch_do_signal_or_restart+0x79/0x590
 exit_to_user_mode_prepare+0xeb/0x180
 syscall_exit_to_user_mode+0x1d/0x50
 do_syscall_64+0x4c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f79b2b4ab19
Code: Unable to access opcode bytes at 0x7f79b2b4aaef.
RSP: 002b:00007f79b00c0218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f79b2c5df68 RCX: 00007f79b2b4ab19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f79b2c5df68
RBP: 00007f79b2c5df60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f79b2c5df6c
R13: 00007ffea8703bef R14: 00007f79b00c0300 R15: 0000000000022000
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at default_idle+0xf/0x20
----------------
Code disassembly (best guess):
   0:	72 4d                	jb     0x4f
   2:	4c 89 e0             	mov    %r12,%rax
   5:	48 29 e8             	sub    %rbp,%rax
   8:	48 89 c2             	mov    %rax,%rdx
   b:	48 c1 e8 3f          	shr    $0x3f,%rax
   f:	48 c1 fa 02          	sar    $0x2,%rdx
  13:	48 01 d0             	add    %rdx,%rax
  16:	48 d1 f8             	sar    %rax
  19:	48 8d 5c 85 00       	lea    0x0(%rbp,%rax,4),%rbx
  1e:	48 89 d8             	mov    %rbx,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	42 0f b6 14 38       	movzbl (%rax,%r15,1),%edx
* 2a:	48 89 d8             	mov    %rbx,%rax <-- trapping instruction
  2d:	83 e0 07             	and    $0x7,%eax
  30:	83 c0 03             	add    $0x3,%eax
  33:	38 d0                	cmp    %dl,%al
  35:	7c 04                	jl     0x3b
  37:	84 d2                	test   %dl,%dl
  39:	75 50                	jne    0x8b
  3b:	48 63 03             	movslq (%rbx),%rax
  3e:	48                   	rex.W
  3f:	01                   	.byte 0x1