RBP: 00007fed58a32d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fed58c16128 R14: 00007fed58c16090 R15: 00007ffcc97b6998 watchdog: BUG: soft lockup - CPU#1 stuck for 185s! [syz.9.5694:23816] Modules linked in: irq event stamp: 751198 hardirqs last enabled at (751197): [] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:507 [inline] hardirqs last enabled at (751197): [] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:542 [inline] hardirqs last enabled at (751197): [] irqentry_exit+0x24d/0x7e0 kernel/entry/common.c:164 hardirqs last disabled at (751198): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1061 softirqs last enabled at (751196): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (751196): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (751196): [] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 softirqs last disabled at (751101): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (751101): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (751101): [] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 CPU: 1 UID: 0 PID: 23816 Comm: syz.9.5694 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0x58e/0x1700 kernel/smp.c:892 Code: 00 fc ff df 48 8b 54 24 08 49 89 d5 49 89 d4 49 c1 ed 03 41 83 e4 07 49 01 c5 41 83 c4 03 e8 29 84 0c 00 f3 90 41 0f b6 45 00 <41> 38 c4 7c 08 84 c0 0f 85 63 0f 00 00 8b 45 08 31 ff 83 e0 01 41 RSP: 0018:ffffc9000b7bf268 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9001810f000 RDX: 0000000000080000 RSI: ffffffff81fc0c97 RDI: ffff88803769dc40 RBP: ffff8880b8443180 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003 R13: ffffed1017088631 R14: 0000000000000001 R15: ffff8880b853c700 FS: 00007fed598516c0(0000) GS:ffff88812446a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000098030 CR3: 000000005395f000 CR4: 0000000000350ef0 Call Trace: on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1057 __flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline] flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline] flush_tlb_mm_range+0x45f/0x16f0 arch/x86/mm/tlb.c:1451 flush_tlb_page arch/x86/include/asm/tlbflush.h:345 [inline] ptep_clear_flush+0x148/0x170 mm/pgtable-generic.c:104 wp_page_copy mm/memory.c:3941 [inline] do_wp_page+0x12a4/0x4380 mm/memory.c:4336 handle_pte_fault mm/memory.c:6443 [inline] __handle_mm_fault+0x1ab6/0x2a00 mm/memory.c:6565 handle_mm_fault+0x36d/0xa20 mm/memory.c:6734 do_user_addr_fault+0x74c/0x12f0 arch/x86/mm/fault.c:1385 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0010:__put_user_nocheck_4+0x3/0x10 arch/x86/lib/putuser.S:104 Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca e9 b2 ed 86 f5 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca e9 8c ed 86 f5 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc9000b7bf9d8 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000098030 RDX: 0000000000080000 RSI: ffffffff8954e471 RDI: ffff88803769dc40 RBP: ffffc9000b7bfd78 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000 R13: 0000200000098000 R14: ffffc9000b7bfdbc R15: 0000000000000002 ____sys_recvmsg+0x2ec/0x640 net/socket.c:2931 ___sys_recvmsg+0x16a/0x1a0 net/socket.c:2960 do_recvmmsg+0x301/0x760 net/socket.c:3055 __sys_recvmmsg net/socket.c:3129 [inline] __do_sys_recvmmsg net/socket.c:3152 [inline] __se_sys_recvmmsg net/socket.c:3145 [inline] __x64_sys_recvmmsg+0x22a/0x280 net/socket.c:3145 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fed5899ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fed59851028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fed58c16090 RCX: 00007fed5899ce59 RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007fed58a32d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fed58c16128 R14: 00007fed58c16090 R15: 00007ffcc97b6998 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 23832 Comm: syz.8.5697 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline] RIP: 0010:lock_release kernel/locking/lockdep.c:5891 [inline] RIP: 0010:lock_release+0x180/0x310 kernel/locking/lockdep.c:5875 Code: 05 35 d7 f3 0e 85 c0 0f 84 84 01 00 00 90 48 c7 c7 6b cd ef 8d e8 90 94 a5 09 b8 ff ff ff ff 65 0f c1 05 db 32 27 12 83 f8 01 <0f> 85 28 01 00 00 9c 58 f6 c4 02 0f 85 13 01 00 00 41 f7 c6 00 02 RSP: 0000:ffffc90000007d90 EFLAGS: 00000046 RAX: 0000000000000001 RBX: ffffffff8e7e5620 RCX: ffffc90000007d9c RDX: 0000000000000005 RSI: ffffffff8defcd6b RDI: ffffffff8c1c4400 RBP: ffffffff899b334b R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880600a9ec0 R13: 18b26a6112f541f8 R14: 0000000000000002 R15: 0000000000000006 FS: 000055557d2ce500(0000) GS:ffff88812436a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3b0cc2 CR3: 00000000768e4000 CR4: 0000000000350ef0 Call Trace: rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock include/linux/rcupdate.h:869 [inline] advance_sched+0x770/0xd20 net/sched/sch_taprio.c:994 __run_hrtimer kernel/time/hrtimer.c:1930 [inline] __hrtimer_run_queues+0x470/0xa00 kernel/time/hrtimer.c:1994 hrtimer_interrupt+0x3e5/0x940 kernel/time/hrtimer.c:2113 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] __sysvec_apic_timer_interrupt+0x10b/0x460 arch/x86/kernel/apic/apic.c:1067 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline] sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1061 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x8/0x20 kernel/kcov.c:314 Code: bf 03 00 00 00 e9 58 fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <89> f2 89 fe bf 05 00 00 00 e9 2a fe ff ff 66 2e 0f 1f 84 00 00 00 RSP: 0000:ffffc900071679c0 EFLAGS: 00000246 RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff82430355 RDX: 1ffff110048b737b RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90007167b68 R08: 0000000000000001 R09: 000000000000003f R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880245b9b80 R13: ffff888037dc6218 R14: ffffea0001a9ffc0 R15: ffffea0001a9fff4 xa_entry include/linux/xarray.h:1226 [inline] xas_reload+0x105/0x490 include/linux/xarray.h:1624 next_uptodate_folio+0x40d/0xdd0 mm/filemap.c:3720 filemap_map_pages+0x817/0x2140 mm/filemap.c:3940 do_fault_around mm/memory.c:5867 [inline] do_read_fault mm/memory.c:5900 [inline] do_fault+0x985/0x1750 mm/memory.c:6043 do_pte_missing mm/memory.c:4566 [inline] handle_pte_fault mm/memory.c:6427 [inline] __handle_mm_fault+0x187d/0x2a00 mm/memory.c:6565 handle_mm_fault+0x36d/0xa20 mm/memory.c:6734 do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7f3fc0871756 Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 20 fe ff ff e9 d4 fd ff ff 0f 1f 80 RSP: 002b:00007ffffdf047d0 EFLAGS: 00010212 RAX: 000000110c3ac000 RBX: ffffffff84ab2894 RCX: 0000000000000002 RDX: 0000000000000894 RSI: 0000000000002ca2 RDI: 0000000000000004 RBP: 0000000000000000 R08: 00007f3fc0c00000 R09: 00007f3fc0c02000 R10: 0000000084ab2898 R11: 0000000000000000 R12: 00007f3fc0c16038 R13: 0000000000000006 R14: ffffffff84ab273d R15: 00007f3fc1745720