watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [syz.3.27:5005] Modules linked in: irq event stamp: 36787369 hardirqs last enabled at (36787368): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (36787368): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (36787369): [] __el1_irq arch/arm64/kernel/entry-common.c:527 [inline] hardirqs last disabled at (36787369): [] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:543 softirqs last enabled at (1316): [] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (1316): [] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline] softirqs last enabled at (1316): [] fpsimd_restore_current_state+0x39c/0x9c8 arch/arm64/kernel/fpsimd.c:1797 softirqs last disabled at (1339): [] __do_softirq+0x14/0x20 kernel/softirq.c:679 CPU: 1 UID: 0 PID: 5005 Comm: syz.3.27 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline] pc : _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 lr : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] lr : _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 sp : ffff80008ec47dc0 x29: ffff80008ec47dc0 x28: 1fffe00035ba4052 x27: ffff0001add20280 x26: ffff0001add20290 x25: ffff0000cf54c138 x24: dfff800000000000 x23: 0000000000000001 x22: ffff800084f2e628 x21: ffff0001add1fe40 x20: ffff0001add1fe40 x19: 0000000000000000 x18: 00000000ffffffff x17: ffff8000819f97d4 x16: ffff8000819f9a34 x15: ffff8000819fb03c x14: 00000000803107d8 x13: 0000000000000001 x12: 0000000000000000 x11: ffff80008a6a6e28 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000000c0 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000801561b4 x2 : 0000000000000003 x1 : ffff0000d280bb00 x0 : ffff80012517a000 Call trace: __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P) _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P) __run_hrtimer kernel/time/hrtimer.c:2063 [inline] __hrtimer_run_queues+0x22c/0xbe0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1b4/0x2a8 kernel/time/hrtimer.c:2141 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x1c0/0x458 kernel/softirq.c:767 irq_exit_rcu+0x14/0x84 kernel/softirq.c:784 __el1_irq arch/arm64/kernel/entry-common.c:531 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:543 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) memcg1_commit_charge+0xcc/0x120 mm/memcontrol-v1.c:604 (P) charge_memcg+0x204/0x2a0 mm/memcontrol.c:5216 __mem_cgroup_charge+0x38/0x98 mm/memcontrol.c:5227 mem_cgroup_charge include/linux/memcontrol.h:662 [inline] folio_prealloc+0x78/0x1b0 mm/memory.c:1296 alloc_anon_folio mm/memory.c:5387 [inline] do_anonymous_page mm/memory.c:5482 [inline] do_pte_missing+0x1bd0/0x2a28 mm/memory.c:4698 handle_pte_fault mm/memory.c:6558 [inline] __handle_mm_fault mm/memory.c:6707 [inline] handle_mm_fault+0x1534/0x2bec mm/memory.c:6876 do_page_fault+0x77c/0xb88 arch/arm64/mm/fault.c:713 do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:849 do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:989 el0_da+0x78/0x254 arch/arm64/kernel/entry-common.c:574 el0t_64_sync_handler+0xd8/0x104 arch/arm64/kernel/entry-common.c:780 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 5018 Comm: syz-executor Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __tlb_remove_folio_pages_size+0xd4/0x4d8 mm/mmu_gather.c:-1 lr : __tlb_remove_folio_pages_size+0xa8/0x4d8 mm/mmu_gather.c:187 sp : ffff8000935d70a0 x29: ffff8000935d70b0 x28: fffffdffc3de3700 x27: 00000000000000d8 x26: 1ffff000126baec9 x25: dfff800000000000 x24: fffffdffc3de3700 x23: ffff000102e4d6d0 x22: ffff8000935d7620 x21: ffff000102e4d000 x20: ffff8000935d7648 x19: fffffdffc3de3700 x18: 1fffe00035b9ec28 x17: 0000000000000002 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: ffff7fbff87bc6e7 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff800080c6b0b4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080a86e20 x2 : 0000000000000001 x1 : ffff0000c4f9d880 x0 : 0000000000000000 Call trace: __tlb_remove_folio_pages_size+0xd4/0x4d8 mm/mmu_gather.c:-1 (P) __tlb_remove_folio_pages+0x3c/0x54 mm/mmu_gather.c:210 zap_present_folio_ptes mm/memory.c:1808 [inline] zap_present_ptes mm/memory.c:1861 [inline] do_zap_pte_range mm/memory.c:1963 [inline] zap_pte_range mm/memory.c:2065 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x1a28/0x4348 mm/memory.c:2240 unmap_vmas+0x2e0/0x43c mm/memory.c:2309 exit_mmap+0x1e8/0xad4 mm/mmap.c:1315 __mmput+0xe0/0x2e8 kernel/fork.c:1193 mmput+0x70/0xa8 kernel/fork.c:1216 exit_mm+0x1ac/0x264 kernel/exit.c:614 do_exit+0x524/0x1a74 kernel/exit.c:996 do_group_exit+0x198/0x238 kernel/exit.c:1151 get_signal+0xfb0/0x1094 kernel/signal.c:3039 arch_do_signal_or_restart+0x288/0x444c arch/arm64/kernel/signal.c:1665 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x70/0x17c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline] el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:759 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590