watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.7:10591] Modules linked in: irq event stamp: 3853311 hardirqs last enabled at (3853310): [<ffffffff83e00c42>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 hardirqs last disabled at (3853311): [<ffffffff83dcfa7b>] sysvec_apic_timer_interrupt+0xb/0xa0 arch/x86/kernel/apic/apic.c:1095 softirqs last enabled at (3812094): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (3812097): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20 CPU: 0 PID: 10591 Comm: syz-executor.7 Not tainted 5.10.123 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:unwind_next_frame+0x186/0x1a90 arch/x86/kernel/unwind_orc.c:443 Code: 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 55 09 00 00 4c 89 e1 41 0f b6 45 35 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 <80> 3c 11 00 0f 85 84 12 00 00 4d 8b 7d 48 3c 01 48 c7 c1 20 7a cb RSP: 0018:ffff88806ce09668 EFLAGS: 00000212 RAX: 0000000000000001 RBX: 0000000000000001 RCX: 1ffff1100d9c12f1 RDX: dffffc0000000000 RSI: ffffffff812749ae RDI: ffff8880471c7620 RBP: ffff88806ce09775 R08: ffffffff85b2d9ff R09: ffff8880471c7598 R10: 0000000000030041 R11: 1ffff1100d9c12d5 R12: ffff88806ce09788 R13: ffff88806ce09740 R14: 1ffff1100d9c12d5 R15: 00000000000000e0 FS: 00007fe056286700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2d225000 CR3: 0000000044378000 CR4: 0000000000350ef0 Call Trace: <IRQ> arch_stack_walk+0x83/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461 slab_post_alloc_hook mm/slab.h:532 [inline] slab_alloc_node mm/slub.c:2896 [inline] kmem_cache_alloc_node+0x14b/0x370 mm/slub.c:2932 __alloc_skb+0x6d/0x620 net/core/skbuff.c:198 __netdev_alloc_skb+0x6e/0x360 net/core/skbuff.c:446 netdev_alloc_skb include/linux/skbuff.h:2826 [inline] dev_alloc_skb include/linux/skbuff.h:2839 [inline] __ieee80211_beacon_get+0x3af/0x13a0 net/mac80211/tx.c:4874 ieee80211_beacon_get_tim+0x88/0x900 net/mac80211/tx.c:4988 ieee80211_beacon_get include/net/mac80211.h:4912 [inline] mac80211_hwsim_beacon_tx+0x111/0x8f0 drivers/net/wireless/mac80211_hwsim.c:1736 __iterate_interfaces+0x1f0/0x530 net/mac80211/util.c:792 ieee80211_iterate_active_interfaces_atomic+0x72/0x180 net/mac80211/util.c:828 mac80211_hwsim_beacon+0xcd/0x1c0 drivers/net/wireless/mac80211_hwsim.c:1789 __run_hrtimer kernel/time/hrtimer.c:1583 [inline] __hrtimer_run_queues+0x5e8/0xb50 kernel/time/hrtimer.c:1647 hrtimer_run_softirq+0x148/0x310 kernel/time/hrtimer.c:1664 __do_softirq+0x1b8/0x867 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x110/0x1a0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1095 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline] RIP: 0010:do_raw_spin_lock+0x5e/0x260 kernel/locking/spinlock_debug.c:112 Code: 48 c1 ed 03 48 c7 44 24 18 50 49 27 81 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 65 48 8b 0c 25 28 00 00 00 48 89 4c 24 60 31 c9 83 e0 07 RSP: 0018:ffff8880471c7648 EFLAGS: 00000213 RAX: dffffc0000000000 RBX: ffff88800ec86478 RCX: 0000000000007cf4 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88800ec8647c RBP: 1ffff11008e38eca R08: 0000000000000000 R09: ffffffff865526e7 R10: 0000000000000246 R11: 0000000000000001 R12: ffff88800ec864d0 R13: ffff88801abbfb58 R14: ffff88800ec86000 R15: 0000000000000001 spin_lock include/linux/spinlock.h:354 [inline] ext4_mb_free_metadata.isra.0+0x50d/0xb90 fs/ext4/mballoc.c:5183 ext4_free_blocks+0xb97/0x20e0 fs/ext4/mballoc.c:5491 ext4_remove_blocks fs/ext4/extents.c:2534 [inline] ext4_ext_rm_leaf fs/ext4/extents.c:2700 [inline] ext4_ext_remove_space+0x1f7e/0x4000 fs/ext4/extents.c:2948 ext4_ext_truncate+0x1e6/0x240 fs/ext4/extents.c:4409 ext4_truncate+0xd5a/0x12b0 fs/ext4/inode.c:4313 ext4_truncate_failed_write fs/ext4/truncate.h:20 [inline] ext4_handle_inode_extension fs/ext4/file.c:359 [inline] ext4_dio_write_iter fs/ext4/file.c:575 [inline] ext4_file_write_iter+0x1355/0x1890 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:1903 [inline] new_sync_write+0x42c/0x660 fs/read_write.c:518 vfs_write+0x743/0xa20 fs/read_write.c:605 ksys_write+0x12d/0x250 fs/read_write.c:658 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fe058d10b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe056286188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fe058e23f60 RCX: 00007fe058d10b19 RDX: 000000000000fdef RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 00007fe058d6af6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe79db119f R14: 00007fe056286300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 287 Comm: syz-executor.4 Not tainted 5.10.123 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:19 [inline] RIP: 0010:virt_spin_lock arch/x86/include/asm/qspinlock.h:100 [inline] RIP: 0010:queued_spin_lock_slowpath+0x11e/0x8c0 kernel/locking/qspinlock.c:326 Code: 8b 84 24 80 00 00 00 65 48 2b 04 25 28 00 00 00 0f 85 05 07 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 f3 90 <e9> 77 ff ff ff 44 8b 74 24 48 41 81 fe 00 01 00 00 0f 84 e1 00 00 RSP: 0018:ffff888041807a80 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bac040 RCX: ffffffff8126fcf7 RDX: ffffed1001175809 RSI: 0000000000000004 RDI: ffff888008bac040 RBP: 0000000000000001 R08: 0000000000000000 R09: ffff888008bac043 R10: ffffed1001175808 R11: 0000000000000001 R12: 0000000000000003 R13: ffffed1001175808 R14: 0000000000000001 R15: 1ffff11008300f51 FS: 0000555555aec400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc4cdd2cb8 CR3: 00000000417fc000 CR4: 0000000000350ee0 Call Trace: queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x1d8/0x260 kernel/locking/spinlock_debug.c:113 spin_lock include/linux/spinlock.h:354 [inline] ext4_lock_group fs/ext4/ext4.h:3360 [inline] ext4_free_inode+0x7a6/0x1340 fs/ext4/ialloc.c:313 ext4_evict_inode+0xe28/0x1a40 fs/ext4/inode.c:332 evict+0x284/0x6b0 fs/inode.c:578 iput_final fs/inode.c:1656 [inline] iput.part.0+0x4eb/0x780 fs/inode.c:1682 iput+0x58/0x70 fs/inode.c:1672 do_unlinkat+0x3ee/0x650 fs/namei.c:3894 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fb1abe80457 Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc4cdd33f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb1abe80457 RDX: 00007ffc4cdd3430 RSI: 00007ffc4cdd3430 RDI: 00007ffc4cdd34c0 RBP: 00007ffc4cdd34c0 R08: 0000000000000001 R09: 00007ffc4cdd3290 R10: 0000555555aedc7b R11: 0000000000000206 R12: 00007fb1abeda105 R13: 00007ffc4cdd4580 R14: 0000555555aedc20 R15: 00007ffc4cdd45c0 hpet: Lost 8 RTC interrupts hpet: Lost 3 RTC interrupts hpet: Lost 1 RTC interrupts ---------------- Code disassembly (best guess): 0: 04 02 add $0x2,%al 2: 48 89 ea mov %rbp,%rdx 5: 83 e2 07 and $0x7,%edx 8: 38 d0 cmp %dl,%al a: 7f 08 jg 0x14 c: 84 c0 test %al,%al e: 0f 85 55 09 00 00 jne 0x969 14: 4c 89 e1 mov %r12,%rcx 17: 41 0f b6 45 35 movzbl 0x35(%r13),%eax 1c: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 23: fc ff df 26: 48 c1 e9 03 shr $0x3,%rcx * 2a: 80 3c 11 00 cmpb $0x0,(%rcx,%rdx,1) <-- trapping instruction 2e: 0f 85 84 12 00 00 jne 0x12b8 34: 4d 8b 7d 48 mov 0x48(%r13),%r15 38: 3c 01 cmp $0x1,%al 3a: 48 rex.W 3b: c7 .byte 0xc7 3c: c1 20 7a shll $0x7a,(%rax) 3f: cb lret