watchdog: BUG: soft lockup - CPU#0 stuck for 150s! [syz.5.5101:27935] Modules linked in: irq event stamp: 199101 hardirqs last enabled at (199100): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (199100): [] _raw_spin_unlock_irqrestore+0x30/0x80 kernel/locking/spinlock.c:221 hardirqs last disabled at (199101): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062 softirqs last enabled at (193720): [] spin_unlock_bh include/linux/spinlock.h:407 [inline] softirqs last enabled at (193720): [] remove_user_radios drivers/net/wireless/virtual/mac80211_hwsim_main.c:7281 [inline] softirqs last enabled at (193720): [] mac80211_hwsim_netlink_notify+0xd4c/0x1250 drivers/net/wireless/virtual/mac80211_hwsim_main.c:7299 softirqs last disabled at (194241): [] __do_softirq kernel/softirq.c:703 [inline] softirqs last disabled at (194241): [] invoke_softirq kernel/softirq.c:542 [inline] softirqs last disabled at (194241): [] __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786 CPU: 0 UID: 0 PID: 27935 Comm: syz.5.5101 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80 kernel/kcov.c:216 Code: 89 fb e8 23 00 00 00 48 8b 3d 74 ad ce 0c 48 89 de 5b e9 93 25 6b 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d 08 ad 17 13 65 48 8b 15 08 ad RSP: 0018:ffffc90000007598 EFLAGS: 00000202 RAX: ffffffff81d56a2f RBX: 0000000000000001 RCX: 0000000000000100 RDX: ffff888068768000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90000007698 R08: 0000000000000100 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff91ffff98a87 R12: ffffc90000007620 R13: dffffc0000000000 R14: 1ffff92000000ec0 R15: ffffffff90025e08 FS: 0000000000000000(0000) GS:ffff888123413000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000100 CR3: 0000000035d7a000 CR4: 00000000003526f0 DR0: 0000000000000007 DR1: 0000000000000000 DR2: 0000000000008d24 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: trace_call_bpf+0x1bc/0xb80 kernel/trace/bpf_trace.c:147 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11524 do_perf_trace_lock include/trace/events/lock.h:49 [inline] perf_trace_lock+0x32e/0x410 include/trace/events/lock.h:49 __do_trace_lock_release include/trace/events/lock.h:68 [inline] trace_lock_release include/trace/events/lock.h:68 [inline] lock_release+0x396/0x3c0 kernel/locking/lockdep.c:5954 rcu_lock_release include/linux/rcupdate.h:319 [inline] rcu_read_unlock include/linux/rcupdate.h:880 [inline] class_rcu_destructor include/linux/rcupdate.h:1216 [inline] is_module_text_address+0x18b/0x1e0 kernel/module/main.c:3959 kernel_text_address+0x94/0xe0 kernel/extable.c:119 __kernel_text_address+0xd/0x30 kernel/extable.c:79 unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:385 arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2780 [inline] slab_free mm/slub.c:6630 [inline] kmem_cache_free+0x182/0x650 mm/slub.c:6757 mac80211_hwsim_beacon_tx+0x396/0x820 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2516 __iterate_interfaces+0x2af/0x5a0 net/mac80211/util.c:775 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:811 mac80211_hwsim_beacon+0xaf/0x240 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2548 __run_hrtimer kernel/time/hrtimer.c:2075 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2132 hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2149 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 __do_softirq kernel/softirq.c:703 [inline] invoke_softirq kernel/softirq.c:542 [inline] __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__srcu_check_read_flavor+0xda/0x2e0 kernel/rcu/srcutree.c:837 Code: 0f 94 c2 39 cb 0f 94 c1 08 d1 0f 84 ad 00 00 00 85 c0 74 24 43 0f b6 0c 2f 84 c9 0f 85 7f 01 00 00 41 0f b6 16 39 d0 0f 95 c1 <85> d2 75 02 31 c9 84 c9 0f 85 e5 00 00 00 f6 c3 14 74 19 43 0f b6 RSP: 0018:ffffc900053fed10 EFLAGS: 00000246 RAX: 0000000000000004 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000004 RSI: ffffffff94e16500 RDI: ffffffff901bbe80 RBP: ffff888123413000 R08: ffffc900053feb8f R09: 0000000000000000 R10: ffffc900053feb80 R11: ffffffffa0402a14 R12: ffff8880b8229520 R13: dffffc0000000000 R14: ffffffff901bbe90 R15: 1ffffffff20377d2 srcu_check_read_flavor include/linux/srcutree.h:387 [inline] srcu_read_unlock_fast_notrace include/linux/srcu.h:612 [inline] class_srcu_fast_notrace_destructor include/linux/srcu.h:718 [inline] __do_trace_lock_release include/trace/events/lock.h:68 [inline] trace_lock_release include/trace/events/lock.h:68 [inline] lock_release+0x3a7/0x3c0 kernel/locking/lockdep.c:5954 rcu_lock_release include/linux/rcupdate.h:319 [inline] rcu_read_unlock include/linux/rcupdate.h:880 [inline] class_rcu_destructor include/linux/rcupdate.h:1216 [inline] unwind_next_frame+0x1baa/0x2550 arch/x86/kernel/unwind_orc.c:709 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 save_stack+0x122/0x230 mm/page_owner.c:183 __reset_page_owner+0x73/0x2a0 mm/page_owner.c:338 reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1403 [inline] free_unref_folios+0xdc6/0x14e0 mm/page_alloc.c:3014 folios_put_refs+0x9e9/0xb30 mm/folio.c:1039 folio_batch_release include/linux/folio_batch.h:101 [inline] shmem_undo_range+0x547/0x15d0 mm/shmem.c:1371 shmem_truncate_range mm/shmem.c:1496 [inline] shmem_evict_inode+0x240/0xb00 mm/shmem.c:1627 evict+0x624/0xb50 fs/inode.c:822 dentry_kill+0x1b9/0x910 fs/dcache.c:840 finish_dput+0x1a/0x260 fs/dcache.c:1015 __fput+0x65b/0xa40 fs/file_table.c:520 task_work_run+0x1d9/0x260 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x705/0x2360 kernel/exit.c:980 do_group_exit+0x22d/0x2f0 kernel/exit.c:1123 get_signal+0x1216/0x12c0 kernel/signal.c:3112 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop kernel/entry/common.c:101 [inline] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline] irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline] irqentry_exit+0x348/0x9b0 kernel/entry/common.c:152 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7fb20e454cb7 Code: Unable to access opcode bytes at 0x7fb20e454c8d. RSP: 002b:00002000000000e0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fb20e59f559 RDX: 0000200000000100 RSI: 0000200000000230 RDI: 000000000000000b RBP: 00007fb20e636b50 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007fb20e826038 R14: 00007fb20e825fa0 R15: 00007fff7bb2cc48 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 28016 Comm: syz.7.5118 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:check_kcov_mode kernel/kcov.c:190 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x4f/0x80 kernel/kcov.c:223 Code: 01 00 0f 81 fe 00 01 00 00 40 0f 95 c6 81 fa 00 00 00 10 0f 93 c2 40 08 f2 75 35 83 b9 44 17 00 00 00 74 2c 8b 91 18 17 00 00 <83> fa 02 75 21 48 8b 91 20 17 00 00 48 8b 32 48 8d 7e 01 8b 89 1c RSP: 0018:ffffc900056bf358 EFLAGS: 00000246 RAX: ffffffff81bcadde RBX: ffff8880b8244028 RCX: ffff888076cf1f40 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc900056bf4b0 R08: ffff888076cf34df R09: 1ffff1100ed9e69b R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff11017048805 R13: 0000000000000000 R14: ffff8880b8244020 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888123513000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555571ccba78 CR3: 0000000066d1c000 CR4: 00000000003526f0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: csd_lock_wait kernel/smp.c:389 [inline] csd_lock kernel/smp.c:422 [inline] smp_call_function_many_cond+0x63e/0x1500 kernel/smp.c:970 __flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline] flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline] flush_tlb_mm_range+0x910/0x10b0 arch/x86/mm/tlb.c:1435 tlb_flush arch/x86/include/asm/tlb.h:23 [inline] tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:461 [inline] tlb_flush_mmu+0x1af/0xa30 mm/mmu_gather.c:403 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:529 free_ldt_pgtables+0x192/0x360 arch/x86/kernel/ldt.c:411 arch_exit_mmap arch/x86/include/asm/mmu_context.h:229 [inline] exit_mmap+0x1b7/0xa40 mm/mmap.c:1300 __mmput+0x118/0x420 kernel/fork.c:1192 exit_mm+0x18e/0x240 kernel/exit.c:586 do_exit+0x6a8/0x2360 kernel/exit.c:967 do_group_exit+0x22d/0x2f0 kernel/exit.c:1123 get_signal+0x1216/0x12c0 kernel/signal.c:3112 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop kernel/entry/common.c:101 [inline] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline] irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline] irqentry_exit+0x348/0x9b0 kernel/entry/common.c:152 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7fd0ef59f561 Code: Unable to access opcode bytes at 0x7fd0ef59f537. RSP: 002b:00007fd0f03990e8 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007fd0ef825fa8 RCX: 00007fd0ef59f559 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd0ef825fa8 RBP: 00007fd0ef825fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd0ef826038 R14: 00007ffe35e584a0 R15: 00007ffe35e58588