watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz-executor.5:4203] Modules linked in: irq event stamp: 4720179 hardirqs last enabled at (4720178): [] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 hardirqs last disabled at (4720179): [] sysvec_apic_timer_interrupt+0xb/0xa0 arch/x86/kernel/apic/apic.c:1094 softirqs last enabled at (4700830): [] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (4700833): [] asm_call_irq_on_stack+0x12/0x20 CPU: 0 PID: 4203 Comm: syz-executor.5 Not tainted 5.10.224 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:19 [inline] RIP: 0010:virt_spin_lock arch/x86/include/asm/qspinlock.h:100 [inline] RIP: 0010:queued_spin_lock_slowpath+0x122/0x8c0 kernel/locking/qspinlock.c:326 Code: 00 00 00 65 48 2b 04 25 28 00 00 00 0f 85 09 07 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 10 a4 f8 02 f3 90 73 ff ff ff 44 8b 74 24 48 41 81 fe 00 01 00 00 0f 84 e1 00 00 RSP: 0018:ffff88806ce09a38 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffffffff87a04180 RCX: ffffffff81279b37 RDX: fffffbfff0f40831 RSI: 0000000000000004 RDI: ffffffff87a04180 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff87a04183 R10: fffffbfff0f40830 R11: 0000000000000001 R12: 0000000000000003 R13: fffffbfff0f40830 R14: 0000000000000001 R15: 1ffff1100d9c1348 FS: 00007f54ee65e700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2d124b70 CR3: 000000000f5ae000 CR4: 0000000000350ef0 Call Trace: queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x1dc/0x260 kernel/locking/spinlock_debug.c:113 spin_lock include/linux/spinlock.h:354 [inline] mac80211_hwsim_tx_frame_no_nl.isra.0+0x695/0x13d0 drivers/net/wireless/mac80211_hwsim.c:1450 mac80211_hwsim_tx_frame+0x152/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1716 mac80211_hwsim_beacon_tx+0x494/0x940 drivers/net/wireless/mac80211_hwsim.c:1770 __iterate_interfaces+0x1f0/0x550 net/mac80211/util.c:792 ieee80211_iterate_active_interfaces_atomic+0x71/0x1c0 net/mac80211/util.c:828 mac80211_hwsim_beacon+0xd1/0x1d0 drivers/net/wireless/mac80211_hwsim.c:1793 __run_hrtimer kernel/time/hrtimer.c:1584 [inline] __hrtimer_run_queues+0x632/0xb40 kernel/time/hrtimer.c:1648 hrtimer_run_softirq+0x148/0x310 kernel/time/hrtimer.c:1665 __do_softirq+0x1b8/0x7c9 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x114/0x1b0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1094 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:qlink_free mm/kasan/quarantine.c:151 [inline] RIP: 0010:qlist_free_all+0x3f/0xe0 mm/kasan/quarantine.c:170 Code: a3 00 00 00 49 89 fc 41 bd 00 00 00 80 49 c7 c6 00 00 00 80 48 bd 00 00 00 00 00 fc ff df eb 2c 48 63 87 c0 00 00 00 4c 8b 3e <48> c7 c2 05 9a 6c 81 48 29 c6 48 89 f0 48 c1 e8 03 c6 04 28 fb e8 RSP: 0018:ffff8880484872d0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00006d36bf RDX: 0000000000000000 RSI: ffff88801af16380 RDI: ffff8880080418c0 RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffffff816c9a00 R10: ffff88801af16180 R11: 0000000000000001 R12: ffff888048487308 R13: 0000000080000000 R14: ffffffff80000000 R15: ffff888017ffbc00 quarantine_reduce+0x184/0x210 mm/kasan/quarantine.c:267 __kasan_kmalloc.constprop.0+0xa2/0xd0 mm/kasan/common.c:442 slab_post_alloc_hook mm/slab.h:532 [inline] slab_alloc_node mm/slub.c:2896 [inline] slab_alloc mm/slub.c:2904 [inline] kmem_cache_alloc+0x13b/0x310 mm/slub.c:2909 insert_revoke_hash+0x28/0x270 fs/jbd2/revoke.c:145 jbd2_journal_revoke+0x2bb/0x570 fs/jbd2/revoke.c:402 __ext4_forget+0x218/0x3e0 fs/ext4/ext4_jbd2.c:297 ext4_free_blocks+0x1b8c/0x2200 fs/ext4/mballoc.c:5746 ext4_free_branches+0x2fc/0x680 fs/ext4/indirect.c:1086 ext4_ind_truncate+0x692/0x900 fs/ext4/indirect.c:1203 ext4_truncate+0xdd4/0x1160 fs/ext4/inode.c:4337 ext4_setattr+0x1684/0x2160 fs/ext4/inode.c:5615 notify_change+0xc28/0x1160 fs/attr.c:410 do_truncate+0x134/0x1f0 fs/open.c:64 handle_truncate fs/namei.c:2970 [inline] do_open fs/namei.c:3311 [inline] path_openat+0x1dcd/0x2770 fs/namei.c:3425 do_filp_open+0x190/0x3e0 fs/namei.c:3452 do_sys_openat2+0x171/0x4d0 fs/open.c:1227 do_sys_open fs/open.c:1243 [inline] __do_sys_creat fs/open.c:1317 [inline] __se_sys_creat fs/open.c:1311 [inline] __x64_sys_creat+0xc9/0x120 fs/open.c:1311 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 RIP: 0033:0x7f54f10e8b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f54ee65e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f54f11fbf60 RCX: 00007f54f10e8b19 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 0000000020000100 RBP: 00007f54f1142f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffe43cdb8f R14: 00007f54ee65e300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4196 Comm: syz-executor.3 Not tainted 5.10.224 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:asm_sysvec_apic_timer_interrupt+0x0/0x20 arch/x86/include/asm/idtentry.h:634 Code: 00 66 0f 1f 84 00 00 00 00 00 0f 01 ca 6a ff e8 16 05 00 00 48 89 e7 e8 fe d6 e5 ff e9 39 06 00 00 66 0f 1f 84 00 00 00 00 00 <0f> 01 ca 6a ff e8 f6 04 00 00 48 89 e7 e8 7e d5 e5 ff e9 19 06 00 RSP: 0018:ffff88806cf09848 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 1ffff1100d9e1332 RDX: dffffc0000000000 RSI: ffffffff816f4582 RDI: ffff88806cf09948 RBP: ffff88806cf0997d R08: 0000000000000005 R09: ffff88806cf09a70 R10: 0000000000032042 R11: 1ffff1100d9e1316 R12: ffff88806cf09990 R13: ffff88806cf09948 R14: 1ffff1100d9e1316 R15: ffffffff816f4582 FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055ce7ca86678 CR3: 0000000017c9a000 CR4: 0000000000350ee0 Call Trace: RIP: 0010:unwind_next_frame+0x194/0x1a90 arch/x86/kernel/unwind_orc.c:448 Code: 0f 85 59 09 00 00 4c 89 e1 41 0f b6 45 35 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 11 00 0f 85 88 12 00 00 4d 8b 7d 48 <3c> 01 48 c7 c1 20 8d eb 84 49 83 df 00 4d 85 ff 0f 84 48 01 00 00 autofs4:pid:4194:autofs_fill_super: called with bogus options ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 65 48 add %ah,0x48(%rbp) 5: 2b 04 25 28 00 00 00 sub 0x28,%eax c: 0f 85 09 07 00 00 jne 0x71b 12: 48 81 c4 88 00 00 00 add $0x88,%rsp 19: 5b pop %rbx 1a: 5d pop %rbp 1b: 41 5c pop %r12 1d: 41 5d pop %r13 1f: 41 5e pop %r14 21: 41 5f pop %r15 23: e9 10 a4 f8 02 jmpq 0x2f8a438 28: f3 90 pause * 2a: e9 73 ff ff ff jmpq 0xffffffa2 <-- trapping instruction 2f: 44 8b 74 24 48 mov 0x48(%rsp),%r14d 34: 41 81 fe 00 01 00 00 cmp $0x100,%r14d 3b: 0f .byte 0xf 3c: 84 e1 test %ah,%cl