watchdog: BUG: soft lockup - CPU#0 stuck for 119s! [syz.4.4067:26008] Modules linked in: irq event stamp: 15644843 hardirqs last enabled at (15644842): [] irqentry_exit+0x59e/0x620 kernel/entry/common.c:242 hardirqs last disabled at (15644843): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1056 softirqs last enabled at (15332974): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (15332974): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (15332974): [] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 softirqs last disabled at (15332977): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (15332977): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (15332977): [] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 CPU: 0 UID: 0 PID: 26008 Comm: syz.4.4067 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x0/0x90 kernel/kcov.c:320 Code: 11 10 48 89 74 11 18 48 89 44 11 20 e9 d9 68 ea 09 cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d 98 ff 55 11 65 8b 15 b9 ff 55 RSP: 0018:ffffc90000007408 EFLAGS: 00000246 RAX: ffffffff81cf79c0 RBX: ffffe8ffffcd9000 RCX: ffff88806cb03c80 RDX: 0000000000000100 RSI: 0000000000000200 RDI: 0000000000000000 RBP: 00000000000000ec R08: ffffc9000000764f R09: 0000000000000000 R10: ffffc90000007640 R11: fffff52000000eca R12: ffffe8ffffcd9000 R13: dffffc0000000000 R14: 0000000000000000 R15: dffffc0000000000 FS: 00007f014906b6c0(0000) GS:ffff888125467000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdfc6f4da08 CR3: 000000007a088000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000200000000300 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: arch_irqs_disabled_flags arch/x86/include/asm/irqflags.h:146 [inline] tracing_gen_ctx_flags include/linux/trace_events.h:199 [inline] tracing_gen_ctx include/linux/trace_events.h:208 [inline] perf_trace_buf_update+0x37/0x190 kernel/trace/trace_event_perf.c:429 perf_tp_event+0x157/0x29b0 kernel/events/core.c:11368 perf_trace_run_bpf_submit+0xee/0x170 kernel/events/core.c:11306 do_perf_trace_lock include/trace/events/lock.h:50 [inline] perf_trace_lock+0x32d/0x410 include/trace/events/lock.h:50 __do_trace_lock_release include/trace/events/lock.h:69 [inline] trace_lock_release include/trace/events/lock.h:69 [inline] lock_release+0x392/0x3d0 kernel/locking/lockdep.c:5879 local_lock_release include/linux/local_lock_internal.h:62 [inline] __pcs_replace_empty_main+0x244/0x620 mm/slub.c:4572 alloc_from_pcs mm/slub.c:4681 [inline] slab_alloc_node mm/slub.c:4815 [inline] kmem_cache_alloc_noprof+0x37d/0x650 mm/slub.c:4837 skb_clone+0x212/0x3a0 net/core/skbuff.c:2120 hsr_forward_do net/hsr/hsr_forward.c:-1 [inline] hsr_forward_skb+0x1028/0x2860 net/hsr/hsr_forward.c:743 send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364 hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421 call_timer_fn+0x192/0x640 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404 handle_softirqs+0x22a/0x870 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:unwind_get_return_address+0x67/0x90 arch/x86/kernel/unwind_orc.c:386 Code: 48 89 df e8 db 32 b9 00 48 8b 3b e8 23 6c 19 00 85 c0 74 14 43 80 3c 37 00 74 08 48 89 df e8 c0 32 b9 00 48 8b 03 eb 02 31 c0 <5b> 41 5e 41 5f c3 cc cc cc cc cc 89 d9 80 e1 07 80 c1 03 38 c1 7c RSP: 0018:ffffc90004316d88 EFLAGS: 00000246 RAX: ffffffff8176944a RBX: ffffc90004316df0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff8e162a24 RDI: ffffffff8176944a RBP: ffffc90004316e30 R08: ffffc90004316917 R09: 0000000000000000 R10: ffffc90004316908 R11: fffff52000862d23 R12: ffff88806cb03c80 R13: ffff888036781e40 R14: dffffc0000000000 R15: 1ffff92000862dbe arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556 __call_rcu_common kernel/rcu/tree.c:3131 [inline] call_rcu+0xee/0x890 kernel/rcu/tree.c:3251 context_switch kernel/sched/core.c:5298 [inline] __schedule+0x158d/0x5340 kernel/sched/core.c:6907 preempt_schedule_notrace+0x57/0x90 kernel/sched/core.c:7184 preempt_schedule_notrace_thunk+0x16/0x30 arch/x86/entry/thunk.S:13 class_preempt_notrace_destructor include/linux/preempt.h:469 [inline] perf_trace_lock+0x38b/0x410 include/trace/events/lock.h:50 __do_trace_lock_release include/trace/events/lock.h:69 [inline] trace_lock_release include/trace/events/lock.h:69 [inline] lock_release+0x392/0x3d0 kernel/locking/lockdep.c:5879 rcu_lock_release include/linux/rcupdate.h:322 [inline] rcu_read_unlock include/linux/rcupdate.h:881 [inline] class_rcu_destructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0x1aaa/0x23c0 arch/x86/kernel/unwind_orc.c:695 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4501 [inline] slab_alloc_node mm/slub.c:4830 [inline] kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4837 taskstats_tgid_alloc kernel/taskstats.c:576 [inline] taskstats_exit+0x14a/0xa30 kernel/taskstats.c:615 do_exit+0x60e/0x2320 kernel/exit.c:941 do_group_exit+0x21b/0x2d0 kernel/exit.c:1112 get_signal+0x1284/0x1330 kernel/signal.c:3034 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f014819c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f014906b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: 000000000000000e RBX: 00007f0148415fa0 RCX: 00007f014819c799 RDX: 000000000000000c RSI: 0000000000000003 RDI: 0000000000000010 RBP: 00007f0148232bd9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0148416038 R14: 00007f0148415fa0 R15: 00007ffced21eef8 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 26010 Comm: syz.0.4068 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:__srcu_check_read_flavor+0xd2/0x250 kernel/rcu/srcutree.c:800 Code: 01 00 00 41 0f b6 0e 85 c9 0f 94 c2 39 cb 0f 94 c1 08 d1 74 7b 85 c0 74 1d 43 0f b6 0c 2f 84 c9 0f 85 0c 01 00 00 41 0f b6 0e <85> c9 74 08 39 c8 0f 85 b2 00 00 00 83 fb 04 75 17 43 0f b6 0c 2f RSP: 0018:ffffc90000a07e30 EFLAGS: 00000046 RAX: 0000000000000004 RBX: 0000000000000004 RCX: 0000000000000004 RDX: 0000000000010100 RSI: 0000000000000004 RDI: ffffffff8e7bee00 RBP: ffffffff931c2140 R08: ffffc90000a07b17 R09: 0000000000000000 R10: ffffc90000a07b08 R11: fffff52000140f63 R12: ffff8880b8729160 R13: dffffc0000000000 R14: ffffffff8e7bee10 R15: 1ffffffff1cf7dc2 FS: 00007fc8a9c0e6c0(0000) GS:ffff888125567000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0a8d316060 CR3: 00000000788f8000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000200000000300 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: srcu_check_read_flavor include/linux/srcutree.h:373 [inline] srcu_read_unlock_fast_notrace include/linux/srcu.h:530 [inline] class_srcu_fast_notrace_destructor include/linux/srcu.h:634 [inline] __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2cc/0x2e0 kernel/locking/lockdep.c:5831 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:162 debug_object_activate+0x83/0x580 lib/debugobjects.c:818 debug_hrtimer_activate kernel/time/hrtimer.c:446 [inline] debug_activate kernel/time/hrtimer.c:485 [inline] enqueue_hrtimer+0x30/0x3c0 kernel/time/hrtimer.c:1089 __run_hrtimer kernel/time/hrtimer.c:1802 [inline] __hrtimer_run_queues+0x650/0xcc0 kernel/time/hrtimer.c:1849 hrtimer_interrupt+0x42b/0x1010 kernel/time/hrtimer.c:1911 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline] __sysvec_apic_timer_interrupt+0x102/0x460 arch/x86/kernel/apic/apic.c:1062 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] RIP: 0010:perf_trace_lock_acquire+0x345/0x440 include/trace/events/lock.h:24 Code: 48 89 47 10 8b 94 24 80 00 00 00 4c 8b 4c 24 60 41 b8 01 00 00 00 8b 74 24 14 48 8b 4c 24 28 6a 00 ff 74 24 10 e8 6b f1 57 00 <48> 83 c4 10 43 c6 44 37 08 f8 43 c6 44 37 04 f8 65 ff 0d f4 cb 7a RSP: 0018:ffffc90000a08330 EFLAGS: 00000282 RAX: c53f214858757500 RBX: ffffe8ffffdd9010 RCX: f8f8f8f8f8f8f8f8 RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc90000a08440 R08: ffffc90000a080d7 R09: 0000000000000000 R10: ffffc90000a080c8 R11: fffff5200014101b R12: ffffe8ffffdd9025 R13: 000000000000000e R14: dffffc0000000000 R15: 1ffff92000141070 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2a4/0x2e0 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2687 [inline] slab_free mm/slub.c:6124 [inline] kmem_cache_free+0x187/0x630 mm/slub.c:6254 kfree_skb_reason include/linux/skbuff.h:1322 [inline] kfree_skb include/linux/skbuff.h:1331 [inline] hsr_forward_skb+0x1a8b/0x2860 net/hsr/hsr_forward.c:753 send_hsr_supervision_frame+0x731/0xcb0 net/hsr/hsr_device.c:364 hsr_announce+0x1db/0x370 net/hsr/hsr_device.c:421 call_timer_fn+0x192/0x640 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404 handle_softirqs+0x22a/0x870 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:194 Code: f7 e8 4d 70 f2 f5 f7 c3 00 02 00 00 74 05 e8 70 bf 1d f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 94 36 e4 f5 65 8b 05 8d df 6b 07 85 c0 74 18 5b 41 5e c3 cc cc RSP: 0018:ffffc900047dfa20 EFLAGS: 00000206 RAX: 0000000000000006 RBX: 0000000000000292 RCX: 0000000080000001 RDX: 0000000000000007 RSI: ffffffff8def2267 RDI: 0000000000000001 RBP: 0000000000000000 R08: ffffffff90117db7 R09: 1ffffffff2022fb6 R10: dffffc0000000000 R11: fffffbfff2022fb7 R12: ffff888083638000 R13: ffff888083630000 R14: ffffffff9a4a6d70 R15: 0000000000000006 __debug_check_no_obj_freed lib/debugobjects.c:1108 [inline] debug_check_no_obj_freed+0x52e/0x550 lib/debugobjects.c:1129 __free_pages_prepare mm/page_alloc.c:1440 [inline] __free_frozen_pages+0x549/0xdb0 mm/page_alloc.c:2978 __slab_free+0x263/0x2b0 mm/slub.c:5532 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4501 [inline] slab_alloc_node mm/slub.c:4830 [inline] kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4849 __d_alloc+0x37/0x6f0 fs/dcache.c:1740 d_alloc_pseudo+0x21/0xc0 fs/dcache.c:1871 alloc_path_pseudo fs/file_table.c:364 [inline] alloc_file_pseudo+0xdd/0x240 fs/file_table.c:380 sock_alloc_file+0xb8/0x2e0 net/socket.c:483 sock_map_fd net/socket.c:513 [inline] __sys_socket+0x13c/0x1b0 net/socket.c:1756 __do_sys_socket net/socket.c:1761 [inline] __se_sys_socket net/socket.c:1759 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1759 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc8a8d9c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc8a9c0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007fc8a9015fa0 RCX: 00007fc8a8d9c799 RDX: 0000000000000004 RSI: 0000100000000002 RDI: 0000000000000010 RBP: 00007fc8a8e32bd9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc8a9016038 R14: 00007fc8a9015fa0 R15: 00007ffd5d3979a8