loop7: detected capacity change from 0 to 264192 watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [syz-executor.2:15858] Modules linked in: irq event stamp: 4596135 hardirqs last enabled at (4596134): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (4596135): [] sysvec_apic_timer_interrupt+0xf/0xc0 softirqs last enabled at (4586992): [] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (4586995): [] __irq_exit_rcu+0x11b/0x180 CPU: 1 PID: 15858 Comm: syz-executor.2 Not tainted 6.1.0-rc5-next-20221117 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:stack_access_ok+0xd3/0x1d0 Code: 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 e5 00 00 00 48 8b 73 28 48 89 da 48 89 ef e8 8d f5 f5 ff <85> c0 74 13 31 c0 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e e9 2a 84 2d RSP: 0018:ffff88806cf09578 EFLAGS: 00000286 RAX: 0000000000000000 RBX: ffff88806cf09630 RCX: ffff888033040000 RDX: ffff88806cf09630 RSI: 0000000000000001 RDI: ffff88803303f6a0 RBP: ffff88803303f6a0 R08: 0000000000000000 R09: ffffffff864623c4 R10: ffff88806cf09ff8 R11: ffff88806cf09670 R12: 0000000000000008 R13: ffff88806cf02000 R14: ffff88806cf09630 R15: ffffffff864623c5 FS: 00007fb61c8f6700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd4ea2cff64 CR3: 000000003868e000 CR4: 0000000000350ee0 Call Trace: unwind_next_frame+0x94e/0x2130 arch_stack_walk+0x87/0xf0 stack_trace_save+0x90/0xd0 kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x5c/0x70 kmem_cache_alloc+0x1e0/0x410 __create_object+0x3d/0xc00 __kmem_cache_alloc_node+0x257/0x400 __kmalloc_node_track_caller+0x43/0xb0 __alloc_skb+0xe9/0x310 skb_copy+0x13d/0x3d0 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb6d/0x1360 mac80211_hwsim_tx_frame+0x1ee/0x2a0 mac80211_hwsim_beacon_tx+0x566/0xab0 __iterate_interfaces+0x2d3/0x560 ieee80211_iterate_active_interfaces_atomic+0x74/0x180 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x541/0xb50 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:__sanitizer_cov_trace_pc+0x60/0x70 Code: 82 e8 13 00 00 83 f8 02 75 20 48 8b 8a f0 13 00 00 8b 92 ec 13 00 00 48 8b 01 48 83 c0 01 48 39 c2 76 07 48 89 01 48 89 34 c1 df 56 f7 02 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 RSP: 0018:ffff88803303f758 EFLAGS: 00000216 RAX: 0000000000001589 RBX: 0000000000000200 RCX: ffffc90000fc7000 RDX: 0000000000040000 RSI: ffffffff813e5811 RDI: 0000000000000000 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffffff87631847 R10: fffffbfff0ec6308 R11: 0000000000000001 R12: 0000000000000000 R13: ffff88806cf3a080 R14: ffff88806cf3a090 R15: dffffc0000000000 smp_call_function_many_cond+0x221/0xa90 on_each_cpu_cond_mask+0x5a/0xa0 text_poke_bp_batch+0x3fd/0x6b0 text_poke_bp+0x79/0xa0 arch_static_call_transform+0x7f/0xa0 __static_call_update+0x402/0x620 tracepoint_add_func+0xa11/0xe40 tracepoint_probe_register+0xa5/0xf0 trace_event_reg+0x297/0x350 perf_trace_event_init+0x556/0x9e0 perf_trace_init+0x1a4/0x2f0 perf_tp_event_init+0xa6/0x120 perf_try_init_event+0x130/0x570 perf_event_alloc.part.0+0xfb7/0x3a80 __do_sys_perf_event_open+0x4a7/0x2880 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fb61f380b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb61c8f6188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007fb61f493f60 RCX: 00007fb61f380b19 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000080 RBP: 00007fb61f3daf6d R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc68462d7f R14: 00007fb61c8f6300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 15861 Comm: syz-executor.7 Not tainted 6.1.0-rc5-next-20221117 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:mark_lock.part.0+0x4d/0x2f70 Code: 5c 24 38 48 89 3c 24 48 c7 44 24 38 b3 8a b5 41 48 c1 eb 03 48 c7 44 24 40 10 bf 23 85 48 8d 04 13 48 c7 44 24 48 10 6a 2b 81 00 f1 f1 f1 f1 c7 40 04 f1 f1 04 f2 c7 40 08 00 f2 f2 f2 c7 40 RSP: 0018:ffff88806ce09470 EFLAGS: 00000016 RAX: ffffed100d9c1295 RBX: 1ffff1100d9c1295 RCX: ffffffff812b6aff RDX: dffffc0000000000 RSI: ffff888018940a28 RDI: ffff888018940000 RBP: ffff888018940a28 R08: 0000000000000000 R09: ffffffff8763184f R10: fffffbfff0ec6309 R11: 0000000000000001 R12: 0000000000000008 R13: ffff888018940a28 R14: 0000000000000000 R15: 0000000000066000 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056150f886628 CR3: 0000000009976000 CR4: 0000000000350ef0 Call Trace: __lock_acquire+0x896/0x5e70 lock_acquire+0x1a6/0x530 ktime_get_update_offsets_now+0x9b/0x360 hrtimer_interrupt+0x13b/0x770 __sysvec_apic_timer_interrupt+0x148/0x500 sysvec_apic_timer_interrupt+0x3f/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:queued_spin_lock_slowpath+0x128/0xc80 Code: 00 00 00 65 48 2b 04 25 28 00 00 00 0f 85 cd 0a 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 ce 1f 00 00 f3 90 71 ff ff ff 44 8b 74 24 48 41 81 fe 00 01 00 00 0f 84 e5 00 00 RSP: 0018:ffff88806ce09a28 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff84401f3b RDX: fffffbfff0b48a19 RSI: 0000000000000004 RDI: ffffffff85a450c0 RBP: ffffffff85a450c0 R08: 0000000000000000 R09: ffffffff85a450c3 R10: fffffbfff0b48a18 R11: 0000000000000001 R12: 0000000000000003 R13: fffffbfff0b48a18 R14: 0000000000000001 R15: 1ffff1100d9c1346 do_raw_spin_lock+0x1e0/0x270 mac80211_hwsim_tx_frame_no_nl.isra.0+0x6f1/0x1360 mac80211_hwsim_tx_frame+0x1ee/0x2a0 mac80211_hwsim_beacon_tx+0x566/0xab0 __iterate_interfaces+0x2d3/0x560 ieee80211_iterate_active_interfaces_atomic+0x74/0x180 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x541/0xb50 hrtimer_run_softirq+0x176/0x350 __do_softirq+0x1c7/0x8f9 __irq_exit_rcu+0x11b/0x180 irq_exit_rcu+0x9/0x30 sysvec_apic_timer_interrupt+0x92/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:vm_normal_page+0x4/0x2e0 Code: 46 10 00 eb bd 48 c7 c7 10 e0 42 85 e8 05 46 10 00 e9 07 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <41> 57 41 56 41 55 49 89 f5 41 54 49 89 fc 55 53 48 bb 00 00 00 00 RSP: 0018:ffff8880346d76f8 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 8000000000000007 RCX: 0000000000000000 RDX: 800000003bdbe007 RSI: 00007fb34658f000 RDI: ffff8880410971a0 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880371c8c78 R13: 800000003bdbe007 R14: 0000000000000001 R15: ffff8880346d7ad8 unmap_page_range+0x1819/0x2c10 unmap_single_vma+0x190/0x2a0 unmap_vmas+0x226/0x380 exit_mmap+0x158/0x680 mmput+0xd5/0x390 do_exit+0x99b/0x2720 do_group_exit+0xd4/0x2a0 get_signal+0x21a5/0x22e0 arch_do_signal_or_restart+0x79/0x5a0 exit_to_user_mode_prepare+0x131/0x1a0 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fb347c6f8d7 Code: Unable to access opcode bytes at 0x7fb347c6f8ad. RSP: 002b:00007fb3451e4e98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 00007fb347cb9970 RCX: 00007fb347c6f8d7 RDX: 0000000000000006 RSI: 0000000000004c00 RDI: 0000000000000007 RBP: 0000000000000007 R08: 0000000000000000 R09: 00524f5252450040 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 R13: 0000000000000006 R14: 0000000020001f30 R15: 0000000000000002 I/O error, dev loop1, sector 264064 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 ---------------- Code disassembly (best guess): 0: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 7: fc ff df a: 48 89 fa mov %rdi,%rdx d: 48 c1 ea 03 shr $0x3,%rdx 11: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 15: 0f 85 e5 00 00 00 jne 0x100 1b: 48 8b 73 28 mov 0x28(%rbx),%rsi 1f: 48 89 da mov %rbx,%rdx 22: 48 89 ef mov %rbp,%rdi 25: e8 8d f5 f5 ff callq 0xfff5f5b7 * 2a: 85 c0 test %eax,%eax <-- trapping instruction 2c: 74 13 je 0x41 2e: 31 c0 xor %eax,%eax 30: 48 83 c4 08 add $0x8,%rsp 34: 5b pop %rbx 35: 5d pop %rbp 36: 41 5c pop %r12 38: 41 5d pop %r13 3a: 41 5e pop %r14 3c: e9 .byte 0xe9 3d: 2a .byte 0x2a 3e: 84 .byte 0x84 3f: 2d .byte 0x2d