watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.0:4487] Modules linked in: irq event stamp: 6620853 hardirqs last enabled at (6620852): [<ffffffff84000d02>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 hardirqs last disabled at (6620853): [<ffffffff83e6374b>] sysvec_apic_timer_interrupt+0xb/0xa0 arch/x86/kernel/apic/apic.c:1106 softirqs last enabled at (6568184): [<ffffffff84001092>] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (6568187): [<ffffffff84001092>] asm_call_irq_on_stack+0x12/0x20 CPU: 1 PID: 4487 Comm: syz-executor.0 Not tainted 5.10.229 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:mac80211_hwsim_tx_frame_no_nl.isra.0+0x734/0x13d0 drivers/net/wireless/mac80211_hwsim.c:1451 Code: 44 24 08 e8 5e 8e 77 fe 0f b6 44 24 08 84 c0 0f 85 ac 06 00 00 e8 3c 95 77 fe e8 37 95 77 fe 48 89 d8 48 c1 e8 03 80 3c 28 00 <0f> 85 c1 09 00 00 48 8b 1b 48 81 fb 60 d4 3d 85 0f 84 f7 04 00 00 RSP: 0018:ffff88806cf09b90 EFLAGS: 00000246 RAX: 1ffff11008fa0638 RBX: ffff888047d031c0 RCX: ffffffff82c92b29 RDX: ffff8880482d8000 RSI: ffffffff82c92949 RDI: 0000000000000004 RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffffff8686a72f R10: 0000000000000002 R11: 0000000000000001 R12: ffff888048cc4140 R13: ffff88804720b3f0 R14: ffff88804720b1c0 R15: 0000000000000004 FS: 00007f81ca93b700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559b6087c3d0 CR3: 0000000017270000 CR4: 0000000000350ee0 Call Trace: <IRQ> mac80211_hwsim_tx_frame+0x152/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1716 mac80211_hwsim_beacon_tx+0x494/0x940 drivers/net/wireless/mac80211_hwsim.c:1770 __iterate_interfaces+0x1f0/0x550 net/mac80211/util.c:792 ieee80211_iterate_active_interfaces_atomic+0x71/0x1c0 net/mac80211/util.c:828 mac80211_hwsim_beacon+0xd1/0x1d0 drivers/net/wireless/mac80211_hwsim.c:1793 __run_hrtimer kernel/time/hrtimer.c:1586 [inline] __hrtimer_run_queues+0x632/0xb40 kernel/time/hrtimer.c:1650 hrtimer_run_softirq+0x148/0x310 kernel/time/hrtimer.c:1667 __do_softirq+0x1b8/0x7c9 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x114/0x1b0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:__preempt_count_sub arch/x86/include/asm/preempt.h:84 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x25/0x40 kernel/locking/spinlock.c:191 Code: 38 00 0f 1f 00 55 48 89 fd 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 7a 66 3f fd 48 89 ef e8 d2 20 40 fd f6 c7 02 75 10 53 9d <65> ff 0d e4 89 1a 7c 5b 5d e9 5d 5a 38 00 e8 88 46 5f fd eb e9 66 RSP: 0018:ffff888048477318 EFLAGS: 00000246 RAX: 000000000062c903 RBX: 0000000000000246 RCX: 1ffffffff0d1326a RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff83e7e568 RBP: ffff88800fb54090 R08: 0000000000000001 R09: ffffffff8686a75f R10: fffffbfff0d0d4eb R11: 0000000000000001 R12: ffff8880099a6810 R13: 0000000000000246 R14: ffff88800fb54090 R15: ffff888008f09310 spin_unlock_irqrestore include/linux/spinlock.h:409 [inline] sidtab_sid2str_put.part.0+0x175/0x730 security/selinux/ss/sidtab.c:594 sidtab_sid2str_put security/selinux/ss/sidtab.c:624 [inline] sidtab_sid2str_get+0x2a8/0x720 security/selinux/ss/sidtab.c:624 sidtab_entry_to_string+0x33/0x110 security/selinux/ss/services.c:1285 security_sid_to_context_core+0x33c/0x5d0 security/selinux/ss/services.c:1378 selinux_inode_init_security+0x4ab/0x690 security/selinux/hooks.c:2928 security_inode_init_security+0x151/0x360 security/security.c:1058 __ext4_new_inode+0x386e/0x5370 fs/ext4/ialloc.c:1327 ext4_create+0x2ce/0x4d0 fs/ext4/namei.c:2731 lookup_open.isra.0+0xea8/0x1270 fs/namei.c:3163 open_last_lookups fs/namei.c:3233 [inline] path_openat+0x972/0x2770 fs/namei.c:3422 do_filp_open+0x190/0x3e0 fs/namei.c:3452 do_sys_openat2+0x171/0x4d0 fs/open.c:1227 do_sys_open fs/open.c:1243 [inline] __do_sys_openat fs/open.c:1259 [inline] __se_sys_openat fs/open.c:1254 [inline] __x64_sys_openat+0x13f/0x1f0 fs/open.c:1254 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 RIP: 0033:0x7f81cd3c5b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f81ca93b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f81cd4d8f60 RCX: 00007f81cd3c5b19 RDX: 00000000000882c2 RSI: 0000000020000000 RDI: ffffffffffffff9c RBP: 00007f81cd41ff6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc741616ef R14: 00007f81ca93b300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4513 Comm: syz-executor.6 Not tainted 5.10.229 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:25 [inline] RIP: 0010:static_key_false include/linux/jump_label.h:200 [inline] RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:162 [inline] RIP: 0010:wrmsrl arch/x86/include/asm/msr.h:281 [inline] RIP: 0010:lapic_next_deadline+0x21/0x50 arch/x86/kernel/apic/apic.c:479 Code: a5 cf ca 02 0f 1f 44 00 00 0f ae f0 0f ae e8 0f 31 48 c1 e2 20 b9 e0 06 00 00 48 09 c2 48 8d 04 fa 48 89 c2 48 c1 ea 20 0f 30 <0f> 1f 44 00 00 31 c0 e9 d3 3d 12 03 48 89 c6 31 d2 bf e0 06 00 00 RSP: 0018:ffff88806ce09840 EFLAGS: 00000016 RAX: 000000f37d54f1a8 RBX: 0000000000000000 RCX: 00000000000006e0 RDX: 00000000000000f3 RSI: ffff88806ce27980 RDI: 000000000000067e RBP: ffff88806ce27980 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000067e R13: 0000000000000000 R14: 7fffffffffffffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f741334c718 CR3: 0000000045c32000 CR4: 0000000000350ef0 Call Trace: <NMI> </NMI> <IRQ> clockevents_program_event+0x244/0x360 kernel/time/clockevents.c:334 tick_program_event+0xa0/0x140 kernel/time/tick-oneshot.c:44 hrtimer_interrupt+0x3e1/0x9b0 kernel/time/hrtimer.c:1725 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline] __sysvec_apic_timer_interrupt+0xfb/0x310 arch/x86/kernel/apic/apic.c:1112 run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:91 [inline] sysvec_apic_timer_interrupt+0x3e/0xa0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:19 [inline] RIP: 0010:virt_spin_lock arch/x86/include/asm/qspinlock.h:100 [inline] RIP: 0010:queued_spin_lock_slowpath+0x122/0x8c0 kernel/locking/qspinlock.c:326 Code: 00 00 00 65 48 2b 04 25 28 00 00 00 0f 85 09 07 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 40 8a f8 02 f3 90 <e9> 73 ff ff ff 44 8b 74 24 48 41 81 fe 00 01 00 00 0f 84 e1 00 00 RSP: 0018:ffff88806ce09a38 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffffffff87a06080 RCX: ffffffff8127b507 RDX: fffffbfff0f40c11 RSI: 0000000000000004 RDI: ffffffff87a06080 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff87a06083 R10: fffffbfff0f40c10 R11: 0000000000000001 R12: 0000000000000003 R13: fffffbfff0f40c10 R14: 0000000000000001 R15: 1ffff1100d9c1348 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x1dc/0x260 kernel/locking/spinlock_debug.c:113 spin_lock include/linux/spinlock.h:354 [inline] mac80211_hwsim_tx_frame_no_nl.isra.0+0x695/0x13d0 drivers/net/wireless/mac80211_hwsim.c:1450 mac80211_hwsim_tx_frame+0x152/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1716 mac80211_hwsim_beacon_tx+0x494/0x940 drivers/net/wireless/mac80211_hwsim.c:1770 __iterate_interfaces+0x1f0/0x550 net/mac80211/util.c:792 ieee80211_iterate_active_interfaces_atomic+0x71/0x1c0 net/mac80211/util.c:828 mac80211_hwsim_beacon+0xd1/0x1d0 drivers/net/wireless/mac80211_hwsim.c:1793 __run_hrtimer kernel/time/hrtimer.c:1586 [inline] __hrtimer_run_queues+0x632/0xb40 kernel/time/hrtimer.c:1650 hrtimer_run_softirq+0x148/0x310 kernel/time/hrtimer.c:1667 __do_softirq+0x1b8/0x7c9 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x114/0x1b0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:PageAnon include/linux/page-flags.h:485 [inline] RIP: 0010:page_remove_rmap+0x7b/0x7c0 mm/rmap.c:1330 Code: 7a dc ff 4d 85 f6 0f 85 49 05 00 00 e8 4e 81 dc ff 48 8d 7b 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 58 06 00 00 48 8b 5b 18 31 ff 83 e3 01 89 de e8 2f 7a dc ff RSP: 0018:ffff888015a5f728 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffea0001151d80 RCX: ffffffff81643d24 RDX: 1ffffd400022a3b3 RSI: ffffffff81643d32 RDI: ffffea0001151d98 RBP: ffffea0001151d80 R08: 0000000000000000 R09: ffffffff8686a6e7 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: ffffea0001151d88 R14: 0000000000000000 R15: dead000000000100 zap_pte_range mm/memory.c:1287 [inline] zap_pmd_range mm/memory.c:1404 [inline] zap_pud_range mm/memory.c:1433 [inline] zap_p4d_range mm/memory.c:1454 [inline] unmap_page_range+0x110f/0x1fe0 mm/memory.c:1475 unmap_single_vma+0x198/0x300 mm/memory.c:1520 unmap_vmas+0x16d/0x300 mm/memory.c:1552 exit_mmap+0x27f/0x4f0 mm/mmap.c:3235 __mmput kernel/fork.c:1101 [inline] mmput+0xca/0x340 kernel/fork.c:1122 exit_mm kernel/exit.c:536 [inline] do_exit+0xa96/0x2600 kernel/exit.c:847 do_group_exit+0x125/0x310 kernel/exit.c:982 get_signal+0x4bc/0x2350 kernel/signal.c:2762 arch_do_signal_or_restart+0x2b7/0x1990 arch/x86/kernel/signal.c:805 handle_signal_work kernel/entry/common.c:145 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x10f/0x190 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x38/0x1d0 kernel/entry/common.c:274 entry_SYSCALL_64_after_hwframe+0x67/0xd1 RIP: 0033:0x7f7415e18b19 Code: Unable to access opcode bytes at RIP 0x7f7415e18aef. RSP: 002b:00007f741336cf48 EFLAGS: 00000246 ORIG_RAX: 000000000000013f RAX: 0000000000000006 RBX: 0000000020000440 RCX: 00007f7415e18b19 RDX: 0000000000004200 RSI: 0000000000000000 RDI: 00007f7415e720fb RBP: 0000000000000005 R08: 0000000000002100 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000246 R12: 0000000008100000 R13: 0000000020000100 R14: 0000000000fffff0 R15: 0000000020000140 ---------------- Code disassembly (best guess): 0: 44 24 08 rex.R and $0x8,%al 3: e8 5e 8e 77 fe callq 0xfe778e66 8: 0f b6 44 24 08 movzbl 0x8(%rsp),%eax d: 84 c0 test %al,%al f: 0f 85 ac 06 00 00 jne 0x6c1 15: e8 3c 95 77 fe callq 0xfe779556 1a: e8 37 95 77 fe callq 0xfe779556 1f: 48 89 d8 mov %rbx,%rax 22: 48 c1 e8 03 shr $0x3,%rax 26: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) * 2a: 0f 85 c1 09 00 00 jne 0x9f1 <-- trapping instruction 30: 48 8b 1b mov (%rbx),%rbx 33: 48 81 fb 60 d4 3d 85 cmp $0xffffffff853dd460,%rbx 3a: 0f 84 f7 04 00 00 je 0x537