watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [syz-executor.0:4641]
Modules linked in:
irq event stamp: 4875699
hardirqs last  enabled at (4875698): [<ffffffff84000d02>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
hardirqs last disabled at (4875699): [<ffffffff83e7819b>] sysvec_apic_timer_interrupt+0xb/0xa0 arch/x86/kernel/apic/apic.c:1106
softirqs last  enabled at (4847182): [<ffffffff84001092>] asm_call_irq_on_stack+0x12/0x20
softirqs last disabled at (4847185): [<ffffffff84001092>] asm_call_irq_on_stack+0x12/0x20
CPU: 1 PID: 4641 Comm: syz-executor.0 Not tainted 5.10.237 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:unwind_next_frame+0xc93/0x1a90 arch/x86/kernel/unwind_orc.c:545
Code: 80 3c 02 00 0f 85 f0 0b 00 00 48 89 ea 49 c7 45 58 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 04 02 48 89 ea <83> e2 07 38 d0 7f 08 84 c0 0f 85 8e 0b 00 00 4c 89 fa 4c 89 c6 41
RSP: 0018:ffff88806cf097b8 EFLAGS: 00000217
RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffffffff85d47342
RDX: ffff88806cf098c5 RSI: 0000000000000001 RDI: ffff88806cf098e8
RBP: ffff88806cf098c5 R08: ffffffff85d47347 R09: ffff88801dd6e920
R10: 0000000000032042 R11: 1ffff1100d9e12ff R12: ffff88801dd6e920
R13: ffff88806cf09890 R14: 1ffff1100d9e12ff R15: ffffffff85d47346
FS:  00007ff85819f700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563a06fc44f8 CR3: 00000000493e6000 CR4: 0000000000350ee0
Call Trace:
 <IRQ>
 arch_stack_walk+0x83/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0x110/0x160 mm/kasan/common.c:422
 slab_free_hook mm/slub.c:1542 [inline]
 slab_free_freelist_hook+0xa9/0x180 mm/slub.c:1576
 slab_free mm/slub.c:3149 [inline]
 kmem_cache_free+0xa7/0x2d0 mm/slub.c:3165
 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:638
 __kfree_skb net/core/skbuff.c:695 [inline]
 consume_skb net/core/skbuff.c:850 [inline]
 consume_skb+0x11d/0x2b0 net/core/skbuff.c:844
 mac80211_hwsim_tx_frame+0x15a/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1717
 mac80211_hwsim_beacon_tx+0x494/0x940 drivers/net/wireless/mac80211_hwsim.c:1770
 __iterate_interfaces+0x1f0/0x550 net/mac80211/util.c:792
 ieee80211_iterate_active_interfaces_atomic+0x71/0x1c0 net/mac80211/util.c:828
 mac80211_hwsim_beacon+0xd1/0x1d0 drivers/net/wireless/mac80211_hwsim.c:1793
 __run_hrtimer kernel/time/hrtimer.c:1588 [inline]
 __hrtimer_run_queues+0x632/0xb40 kernel/time/hrtimer.c:1652
 hrtimer_run_softirq+0x148/0x310 kernel/time/hrtimer.c:1669
 __do_softirq+0x1b8/0x7c9 kernel/softirq.c:298
 asm_call_irq_on_stack+0x12/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x114/0x1b0 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:cfg80211_sinfo_alloc_tid_stats+0xb4/0x110 net/wireless/util.c:2065
Code: e8 21 1f cc fd 48 8d bd c0 00 00 00 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 11 00 75 3b 48 89 85 c0 00 00 00 <48> 83 f8 01 45 19 e4 41 83 e4 f4 e8 8c 6c a0 fd 44 89 e0 48 83 c4
RSP: 0018:ffff88801dd6ea08 EFLAGS: 00000246
RAX: ffff888045bb0000 RBX: 0000000000000000 RCX: 1ffff1100301fa58
RDX: dffffc0000000000 RSI: ffffffff8400011f RDI: ffff8880180fd2c0
RBP: ffff8880180fd200 R08: 00000000dbcdb826 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000dc0
R13: 0000000000000cc0 R14: ffff8880180fd200 R15: ffff888047770000
 sta_set_sinfo+0x2040/0x35c0 net/mac80211/sta_info.c:2441
 __sta_info_destroy_part2+0x2ce/0x4f0 net/mac80211/sta_info.c:1118
 __sta_info_flush+0x3a0/0x520 net/mac80211/sta_info.c:1240
 sta_info_flush net/mac80211/sta_info.h:838 [inline]
 ieee80211_ibss_disconnect+0x115/0x750 net/mac80211/ibss.c:706
 ieee80211_ibss_leave+0x12/0x160 net/mac80211/ibss.c:1875
 rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline]
 __cfg80211_leave_ibss+0x183/0x4f0 net/wireless/ibss.c:212
 __cfg80211_leave+0x14b/0x370 net/wireless/core.c:1177
 cfg80211_leave net/wireless/core.c:1228 [inline]
 cfg80211_netdev_notifier_call+0x385/0x10c0 net/wireless/core.c:1341
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0xb3/0x110 kernel/notifier.c:410
 call_netdevice_notifiers_info+0xba/0x130 net/core/dev.c:2047
 call_netdevice_notifiers_extack net/core/dev.c:2059 [inline]
 call_netdevice_notifiers net/core/dev.c:2073 [inline]
 __dev_close_many+0xf3/0x2f0 net/core/dev.c:1593
 __dev_close net/core/dev.c:1631 [inline]
 __dev_change_flags+0x299/0x6e0 net/core/dev.c:8525
 dev_change_flags+0x8a/0x160 net/core/dev.c:8598
 do_setlink+0x911/0x3ac0 net/core/rtnetlink.c:2732
 __rtnl_newlink+0xc3e/0x1700 net/core/rtnetlink.c:3410
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3530
 rtnetlink_rcv_msg+0x423/0xbb0 net/core/rtnetlink.c:5610
 netlink_rcv_skb+0x14b/0x430 net/netlink/af_netlink.c:2485
 netlink_unicast_kernel net/netlink/af_netlink.c:1307 [inline]
 netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1333
 netlink_sendmsg+0x90f/0xe00 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:651 [inline]
 __sock_sendmsg+0x154/0x190 net/socket.c:663
 ____sys_sendmsg+0x70d/0x870 net/socket.c:2378
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2432
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2461
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x7ff85ac29b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff85819f188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ff85ad3cf60 RCX: 00007ff85ac29b19
RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000004
RBP: 00007ff85ac83f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcb5f2fe0f R14: 00007ff85819f300 R15: 0000000000022000
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
NMI backtrace for cpu 0 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
NMI backtrace for cpu 0 skipped: idling at default_idle+0xe/0x20 arch/x86/kernel/process.c:711
Process accounting resumed
tmpfs: Unknown parameter 'mpol]å£'
tmpfs: Unknown parameter 'mpol]å£'
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.6'.
FAT-fs (loop4): Unrecognized mount option "uid<00000000000000000000" or missing value
loop1: detected capacity change from 0 to 33559552
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.7'.
loop2: detected capacity change from 0 to 2103296
FAT-fs (loop5): Unrecognized mount option "allow_utime=0000000000000000000Fmr+ÁÑæ÷Wz‹" or missing value
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue
ext4 filesystem being mounted at /syzkaller-testdir287761823/syzkaller.kGm7o5/8/file0 supports timestamps until 2038-01-19 (0x7fffffff)
FAT-fs (loop5): Unrecognized mount option "allow_utime=0000000000000000000Fmr+ÁÑæ÷Wz‹" or missing value
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
loop0: detected capacity change from 0 to 33559552
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
----------------
Code disassembly (best guess):
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	0f 85 f0 0b 00 00    	jne    0xbfa
   a:	48 89 ea             	mov    %rbp,%rdx
   d:	49 c7 45 58 00 00 00 	movq   $0x0,0x58(%r13)
  14:	00
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df
  1f:	48 c1 ea 03          	shr    $0x3,%rdx
  23:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax
  27:	48 89 ea             	mov    %rbp,%rdx
* 2a:	83 e2 07             	and    $0x7,%edx <-- trapping instruction
  2d:	38 d0                	cmp    %dl,%al
  2f:	7f 08                	jg     0x39
  31:	84 c0                	test   %al,%al
  33:	0f 85 8e 0b 00 00    	jne    0xbc7
  39:	4c 89 fa             	mov    %r15,%rdx
  3c:	4c 89 c6             	mov    %r8,%rsi
  3f:	41                   	rex.B