netlink: 384 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 96 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 384 bytes leftover after parsing attributes in process `syz-executor.2'. watchdog: BUG: soft lockup - CPU#1 stuck for 21s! [syz-executor.0:4070] Modules linked in: irq event stamp: 14217351 hardirqs last enabled at (14217350): [] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 hardirqs last disabled at (14217351): [] sysvec_apic_timer_interrupt+0xb/0xa0 arch/x86/kernel/apic/apic.c:1106 softirqs last enabled at (14215924): [] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (14215927): [] asm_call_irq_on_stack+0x12/0x20 CPU: 1 PID: 4070 Comm: syz-executor.0 Not tainted 5.10.236 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:queue_work_on+0x83/0xd0 kernel/workqueue.c:1540 Code: 31 ff 89 ee e8 7e 08 26 00 40 84 ed 74 4a e8 64 0f 26 00 31 ff 48 89 de e8 ca 08 26 00 48 85 db 75 2a e8 50 0f 26 00 41 56 9d <48> 83 c4 08 44 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 07 8f 05 03 RSP: 0018:ffff88806cf098a8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000200 RCX: 1ffffffff0d15faa RDX: ffff88801b018000 RSI: ffffffff811ab0a0 RDI: ffffffff811ab0cf RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8686c797 R10: fffffbfff0d0d8f2 R11: 0000000000000001 R12: ffff8880476f9340 R13: ffff88801b072800 R14: 0000000000000246 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564bdfc3efa0 CR3: 0000000004e26000 CR4: 0000000000350ee0 Call Trace: queue_work include/linux/workqueue.h:509 [inline] ieee80211_queue_work net/mac80211/util.c:931 [inline] ieee80211_queue_work+0x129/0x160 net/mac80211/util.c:924 ieee80211_rx_h_mgmt net/mac80211/rx.c:3722 [inline] ieee80211_rx_handlers+0x5d24/0xa3f0 net/mac80211/rx.c:3888 ieee80211_invoke_rx_handlers net/mac80211/rx.c:3918 [inline] ieee80211_prepare_and_rx_handle+0x17d4/0x5890 net/mac80211/rx.c:4605 __ieee80211_rx_handle_packet net/mac80211/rx.c:4666 [inline] ieee80211_rx_list+0xdd0/0x2370 net/mac80211/rx.c:4846 ieee80211_rx_napi+0xdc/0x3c0 net/mac80211/rx.c:4867 ieee80211_rx include/net/mac80211.h:4502 [inline] ieee80211_tasklet_handler+0xd3/0x130 net/mac80211/main.c:237 tasklet_action_common.constprop.0+0x244/0x2f0 kernel/softirq.c:560 __do_softirq+0x1b8/0x7c9 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x114/0x1b0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:29 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:28 [inline] RIP: 0010:page_ref_count include/linux/page_ref.h:67 [inline] RIP: 0010:put_page_testzero include/linux/mm.h:707 [inline] RIP: 0010:release_pages+0x118/0xc20 mm/swap.c:914 Code: 48 89 de e8 0a bc e9 ff 48 85 db 0f 85 b2 07 00 00 e8 8c c2 e9 ff 4d 8d 67 34 be 04 00 00 00 4c 89 e7 e8 db a0 15 00 4c 89 e0 <48> c1 e8 03 42 0f b6 14 28 4c 89 e0 83 e0 07 83 c0 03 38 d0 7c 08 RSP: 0018:ffff8880174df630 EFLAGS: 00000246 RAX: ffffea0000eda034 RBX: 0000000000000000 RCX: ffffffff8156fd75 RDX: fffff940001db407 RSI: 0000000000000004 RDI: ffffea0000eda034 RBP: 00000000000001df R08: 0000000000000000 R09: ffffea0000eda037 R10: fffff940001db406 R11: 0000000000000001 R12: ffffea0000eda034 R13: dffffc0000000000 R14: ffff88801cd21f10 R15: ffffea0000eda000 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:240 [inline] tlb_flush_mmu+0xe9/0x6e0 mm/mmu_gather.c:247 zap_pte_range mm/memory.c:1355 [inline] zap_pmd_range mm/memory.c:1404 [inline] zap_pud_range mm/memory.c:1433 [inline] zap_p4d_range mm/memory.c:1454 [inline] unmap_page_range+0x17d9/0x1fe0 mm/memory.c:1475 unmap_single_vma+0x198/0x300 mm/memory.c:1520 unmap_vmas+0x16d/0x300 mm/memory.c:1552 exit_mmap+0x27f/0x4f0 mm/mmap.c:3253 __mmput kernel/fork.c:1101 [inline] mmput+0xca/0x340 kernel/fork.c:1122 exit_mm kernel/exit.c:536 [inline] do_exit+0xa96/0x2600 kernel/exit.c:847 do_group_exit+0x125/0x310 kernel/exit.c:982 get_signal+0x4bc/0x2350 kernel/signal.c:2762 arch_do_signal_or_restart+0x2b7/0x1990 arch/x86/kernel/signal.c:805 handle_signal_work kernel/entry/common.c:145 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x10f/0x190 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x38/0x1d0 kernel/entry/common.c:274 entry_SYSCALL_64_after_hwframe+0x67/0xd1 RIP: 0033:0x7f4f2df99b19 Code: Unable to access opcode bytes at RIP 0x7f4f2df99aef. RSP: 002b:00007f4f2b50f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: 0000000000000004 RBX: 00007f4f2e0acf60 RCX: 00007f4f2df99b19 RDX: 00000000000e8b02 RSI: 00000000200035c0 RDI: ffffffffffffff9c RBP: 00007f4f2dff3f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd8436422f R14: 00007f4f2b50f300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline] NMI backtrace for cpu 0 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline] NMI backtrace for cpu 0 skipped: idling at default_idle+0xe/0x20 arch/x86/kernel/process.c:711 Bluetooth: hci1: command 0x0406 tx timeout Bluetooth: hci0: command 0x0406 tx timeout Bluetooth: hci4: command 0x0406 tx timeout Bluetooth: hci3: command 0x0406 tx timeout Bluetooth: hci2: command 0x0406 tx timeout Bluetooth: hci5: command 0x0406 tx timeout Bluetooth: hci6: command 0x0406 tx timeout Bluetooth: hci7: command 0x0406 tx timeout ---------------- Code disassembly (best guess): 0: 31 ff xor %edi,%edi 2: 89 ee mov %ebp,%esi 4: e8 7e 08 26 00 callq 0x260887 9: 40 84 ed test %bpl,%bpl c: 74 4a je 0x58 e: e8 64 0f 26 00 callq 0x260f77 13: 31 ff xor %edi,%edi 15: 48 89 de mov %rbx,%rsi 18: e8 ca 08 26 00 callq 0x2608e7 1d: 48 85 db test %rbx,%rbx 20: 75 2a jne 0x4c 22: e8 50 0f 26 00 callq 0x260f77 27: 41 56 push %r14 29: 9d popfq * 2a: 48 83 c4 08 add $0x8,%rsp <-- trapping instruction 2e: 44 89 f8 mov %r15d,%eax 31: 5b pop %rbx 32: 5d pop %rbp 33: 41 5c pop %r12 35: 41 5d pop %r13 37: 41 5e pop %r14 39: 41 5f pop %r15 3b: e9 07 8f 05 03 jmpq 0x3058f47