loop0: detected capacity change from 0 to 40 FAT-fs (loop0): bogus number of reserved sectors FAT-fs (loop0): Can't find a valid FAT filesystem watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.7:7413] Modules linked in: irq event stamp: 14348823 hardirqs last enabled at (14348822): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (14348823): [] sysvec_apic_timer_interrupt+0xf/0xc0 softirqs last enabled at (14342472): [] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (14342475): [] __irq_exit_rcu+0x11b/0x180 CPU: 0 PID: 7413 Comm: syz-executor.7 Not tainted 6.1.0-rc5-next-20221114 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:unwind_next_frame+0x348/0x2130 Code: 8e c7 15 00 00 41 c6 46 40 01 49 c7 c0 40 51 4c 85 48 b8 00 00 00 00 00 fc ff df 4d 8d 48 04 4c 89 ca 48 c1 ea 03 0f b6 04 02 <4c> 89 ca 83 e2 07 38 d0 7f 08 84 c0 0f 85 e4 14 00 00 41 0f b6 40 RSP: 0018:ffff88806ce09718 EFLAGS: 00000217 RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffffffff817c9d81 RDX: 1ffffffff0c1e4ac RSI: ffffffff860f2536 RDI: ffffffff85dc51d0 RBP: ffff88806ce097f0 R08: ffffffff860f2560 R09: ffffffff860f2564 R10: ffffed100d9c1300 R11: 0000000000038001 R12: ffff88806ce097d9 R13: ffff88806ce097f8 R14: ffff88806ce09798 R15: ffffffff817c9d81 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fde4dac4000 CR3: 0000000016d28000 CR4: 0000000000350ef0 Call Trace: arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x5c/0x70 kmem_cache_alloc_node+0x1f4/0x420 __alloc_skb+0x21a/0x310 __netdev_alloc_skb+0x76/0x3e0 __ieee80211_beacon_get+0x3de/0x1380 ieee80211_beacon_get_tim+0x99/0x4f0 mac80211_hwsim_beacon_tx+0x1d2/0xab0 __iterate_interfaces+0x2d3/0x560 ieee80211_iterate_active_interfaces_atomic+0x74/0x180 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x541/0xb50 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:_raw_spin_unlock_irqrestore+0x32/0x60 Code: 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 e6 2a ec fc 48 89 ef e8 ae a2 ec fc 80 e7 02 74 06 e8 b4 11 10 fd fb bf 01 00 00 00 09 00 e2 fc 65 8b 05 5a ac c3 7b 85 c0 74 07 5b 5d e9 4b 29 00 RSP: 0018:ffff888042b17990 EFLAGS: 00000202 RAX: 0000000000995625 RBX: 0000000000000282 RCX: 1ffffffff0ba1931 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001 RBP: ffff88806ce3f080 R08: 0000000000000001 R09: 0000000000000001 R10: ffffed100d9c7e10 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000035488 R14: 0000000000000000 R15: ffff88807ffdc500 free_unref_page+0x317/0x3f0 __vunmap+0x786/0xbf0 __vfree+0x3c/0xd0 vfree+0x66/0xa0 kcov_put+0x2a/0x40 kcov_close+0x10/0x20 __fput+0x263/0xa40 task_work_run+0x174/0x280 do_exit+0xa8e/0x2720 do_group_exit+0xd4/0x2a0 get_signal+0x21a5/0x22e0 arch_do_signal_or_restart+0x79/0x5a0 exit_to_user_mode_prepare+0x131/0x1a0 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fc99c423b19 Code: Unable to access opcode bytes at 0x7fc99c423aef. RSP: 002b:00007fc999999188 EFLAGS: 00000246 ORIG_RAX: 000000000000013d RAX: 0000000000000000 RBX: 00007fc99c536f60 RCX: 00007fc99c423b19 RDX: 0000000020000040 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 00007fc99c47df6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff4730ea8f R14: 00007fc999999300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 7406 Comm: syz-executor.1 Not tainted 6.1.0-rc5-next-20221114 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:lock_is_held_type+0xe8/0x130 Code: f6 47 22 03 0f 95 c0 45 31 ed 44 39 f0 41 0f 94 c5 48 c7 c7 60 fd 86 84 e8 b5 0e 00 00 b8 ff ff ff ff 65 0f c1 05 18 c6 c4 7b <83> f8 01 75 26 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 44 89 RSP: 0018:ffff88806cf08f40 EFLAGS: 00000057 RAX: 0000000000000001 RBX: 0000000000000005 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000010104 RDI: 0000000000000000 RBP: ffffffff85608220 R08: 0000000000000000 R09: ffffffff85d0f197 R10: fffffbfff0ba1e32 R11: 0000000000000001 R12: ffff88801a559ac0 R13: 0000000000000000 R14: 00000000ffffffff R15: ffff88801a55a4c0 FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558c38de1f50 CR3: 0000000016d28000 CR4: 0000000000350ee0 Call Trace: rcu_read_lock_sched_held+0x42/0x80 lock_acquire+0x462/0x530 perf_event_output_forward+0xa9/0x280 __perf_event_overflow+0x2d6/0x5b0 perf_swevent_hrtimer+0x361/0x3d0 __hrtimer_run_queues+0x184/0xb50 hrtimer_interrupt+0x319/0x770 __sysvec_apic_timer_interrupt+0x148/0x500 sysvec_apic_timer_interrupt+0x3f/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:__orc_find+0x83/0xf0 Code: 01 d0 48 d1 f8 48 8d 5c 85 00 48 89 d8 48 c1 e8 03 42 0f b6 14 38 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 50 48 63 03 <48> 01 d8 48 39 c1 73 b0 4c 8d 63 fc 49 39 ec 73 b3 4d 29 ee 49 c1 RSP: 0018:ffff88806cf09668 EFLAGS: 00000246 RAX: fffffffffd0a3525 RBX: ffffffff85f18c84 RCX: ffffffff82fbc575 RDX: 0000000000000000 RSI: ffffffff862efd44 RDI: ffffffff85f18c84 RBP: ffffffff85f18c84 R08: ffffffff862efd44 R09: ffffffff862efb7a R10: ffffed100d9e12f3 R11: 0000000000038001 R12: ffffffff85f18c84 R13: ffffffff85f18c84 R14: ffffffff85f18c84 R15: dffffc0000000000 unwind_next_frame+0x2b1/0x2130 arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 __kmalloc_node_track_caller+0x53/0xb0 __alloc_skb+0xe9/0x310 skb_copy+0x13d/0x3d0 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb6d/0x1360 mac80211_hwsim_tx_frame+0x1ee/0x2a0 mac80211_hwsim_beacon_tx+0x566/0xab0 __iterate_interfaces+0x2d3/0x560 ieee80211_iterate_active_interfaces_atomic+0x74/0x180 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x541/0xb50 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:lock_release+0x556/0x750 Code: 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 c8 01 00 00 48 8b 05 8a b1 a2 04 e8 a5 cf 06 00 85 c0 74 17 65 ff 0d 42 7c d7 7e <0f> 85 4e fb ff ff 0f 1f 44 00 00 e9 44 fb ff ff e8 05 b7 11 03 85 RSP: 0018:ffff88804334f590 EFLAGS: 00000282 RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: 1ffff11008669eb4 R08: 0000000000000000 R09: ffffffff85d0f197 R10: fffffbfff0ba1e32 R11: 0000000000000001 R12: ffffffff856082e0 R13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000 page_remove_rmap+0x1ca/0x780 unmap_page_range+0x2002/0x2c30 unmap_single_vma+0x190/0x2a0 unmap_vmas+0x226/0x380 exit_mmap+0x158/0x680 mmput+0xd5/0x390 do_exit+0x99b/0x2720 do_group_exit+0xd4/0x2a0 get_signal+0x21a5/0x22e0 arch_do_signal_or_restart+0x79/0x5a0 exit_to_user_mode_prepare+0x131/0x1a0 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f9b319d1b19 Code: Unable to access opcode bytes at 0x7f9b319d1aef. RSP: 002b:00007f9b2ef47188 EFLAGS: 00000246 ORIG_RAX: 000000000000013d RAX: 0000000000000000 RBX: 00007f9b31ae4f60 RCX: 00007f9b319d1b19 RDX: 0000000020000040 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 00007f9b31a2bf6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd56d8e77f R14: 00007f9b2ef47300 R15: 0000000000022000 ---------------- Code disassembly (best guess), 3 bytes skipped: 0: 00 00 add %al,(%rax) 2: 41 c6 46 40 01 movb $0x1,0x40(%r14) 7: 49 c7 c0 40 51 4c 85 mov $0xffffffff854c5140,%r8 e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 15: fc ff df 18: 4d 8d 48 04 lea 0x4(%r8),%r9 1c: 4c 89 ca mov %r9,%rdx 1f: 48 c1 ea 03 shr $0x3,%rdx 23: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax * 27: 4c 89 ca mov %r9,%rdx <-- trapping instruction 2a: 83 e2 07 and $0x7,%edx 2d: 38 d0 cmp %dl,%al 2f: 7f 08 jg 0x39 31: 84 c0 test %al,%al 33: 0f 85 e4 14 00 00 jne 0x151d 39: 41 rex.B 3a: 0f .byte 0xf 3b: b6 40 mov $0x40,%dh