watchdog: BUG: soft lockup - CPU#0 stuck for 144s! [syz.5.299:7174] Modules linked in: irq event stamp: 14819449 hardirqs last enabled at (14819448): [] irqentry_exit+0x59c/0x620 kernel/entry/common.c:219 hardirqs last disabled at (14819449): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1056 softirqs last enabled at (5815632): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (5815632): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (5815632): [] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 softirqs last disabled at (5815635): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (5815635): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (5815635): [] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 CPU: 0 UID: 0 PID: 7174 Comm: syz.5.299 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:skb_queue_tail+0x0/0xf0 net/core/skbuff.c:4072 Code: 02 89 d9 80 e1 07 80 c1 03 38 c1 7c d8 48 89 df e8 c5 46 ca f8 eb ce 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 55 41 57 41 56 41 55 41 54 53 50 49 89 f4 48 89 fb 49 RSP: 0018:ffffc900000075d0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000100 RSI: ffff88806161c280 RDI: ffff888056cf5a20 RBP: dffffc0000000000 R08: ffff888033808000 R09: 0000000000000008 R10: 000000000000000b R11: 0000000000000100 R12: ffff88806161c280 R13: ffff88806161c2d5 R14: 00000000ffffffff R15: ffff888056cf4d80 FS: 00007f114b1d46c0(0000) GS:ffff8881256f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcfa3a15f90 CR3: 0000000078834000 CR4: 00000000003526f0 DR0: 0000200000000380 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: __ieee80211_queue_skb_to_iface+0xa1/0x280 net/mac80211/rx.c:238 ieee80211_queue_skb_to_iface net/mac80211/rx.c:261 [inline] ieee80211_rx_h_mgmt+0x493/0x650 net/mac80211/rx.c:4157 ieee80211_rx_handlers+0x8fe1/0xc5b0 net/mac80211/rx.c:4232 ieee80211_invoke_rx_handlers net/mac80211/rx.c:4262 [inline] ieee80211_prepare_and_rx_handle+0x25a1/0x67e0 net/mac80211/rx.c:5132 __ieee80211_rx_handle_packet net/mac80211/rx.c:5405 [inline] ieee80211_rx_list+0x266e/0x3050 net/mac80211/rx.c:5544 ieee80211_rx_napi+0x1b1/0x3e0 net/mac80211/rx.c:5567 ieee80211_rx include/net/mac80211.h:5216 [inline] ieee80211_handle_queued_frames+0xe8/0x1e0 net/mac80211/main.c:452 tasklet_action_common+0x2da/0x4b0 kernel/softirq.c:925 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:kasan_mem_to_shadow include/linux/kasan.h:66 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:140 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:172 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:191 [inline] RIP: 0010:kasan_check_range+0x59/0x2c0 mm/kasan/generic.c:200 Code: ff eb 0d cc cc cc 49 b9 00 00 00 00 00 00 00 ff 4c 39 cf 0f 82 14 02 00 00 49 89 ff 49 c1 ef 03 49 ba 00 00 00 00 00 fc ff df <4f> 8d 1c 17 49 ff c8 4d 89 c1 49 c1 e9 03 48 bb 01 00 00 00 00 fc RSP: 0018:ffffc90005197c50 EFLAGS: 00000a02 RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff8193dc77 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8fef0070 RBP: ffffc90005197ea0 R08: ffffffff8fef0078 R09: ffff800000000000 R10: dffffc0000000000 R11: fffffbfff1fde00f R12: dffffc0000000000 R13: ffff888035221e80 R14: ffff8880b863a910 R15: 1ffffffff1fde00e instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] cpumask_test_cpu include/linux/cpumask.h:649 [inline] cpu_online include/linux/cpumask.h:1231 [inline] trace_sched_exit_tp+0x27/0xf0 include/trace/events/sched.h:886 __schedule+0x1500/0x5050 kernel/sched/core.c:6873 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x164/0x360 kernel/sched/core.c:6960 __exit_to_user_mode_loop kernel/entry/common.c:32 [inline] exit_to_user_mode_loop kernel/entry/common.c:75 [inline] __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline] irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline] irqentry_exit+0x155/0x620 kernel/entry/common.c:196 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0033:0x7f114a39bf79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f114b1d4028 EFLAGS: 00000246 RAX: 0000000000000007 RBX: 00007f114a615fa0 RCX: 00007f114a39bf79 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 00002000000003c0 RBP: 00007f114a4327e0 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007f114a616038 R14: 00007f114a615fa0 R15: 00007ffecb1315f8 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 7182 Comm: kworker/u8:20 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline] RIP: 0010:smp_call_function_many_cond+0xce5/0x1270 kernel/smp.c:877 Code: 45 8b 2c 24 44 89 ee 83 e6 01 31 ff e8 c4 db 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 6f d7 0b 00 eb 38 f3 90 <42> 0f b6 04 2b 84 c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 53 d7 RSP: 0018:ffffc900031876a0 EFLAGS: 00000293 RAX: ffffffff81b89f1d RBX: 1ffff110170c856d RCX: ffff88805e265b80 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc900031877e0 R08: ffffffff8fef0077 R09: 1ffffffff1fde00e R10: dffffc0000000000 R11: fffffbfff1fde00f R12: ffff8880b8642b68 R13: dffffc0000000000 R14: ffff8880b873bb00 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881257f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005623593d4090 CR3: 000000000e346000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1043 on_each_cpu include/linux/smp.h:71 [inline] smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2711 [inline] smp_text_poke_batch_finish+0x5f5/0x1160 arch/x86/kernel/alternative.c:2921 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 static_key_enable_cpuslocked+0x128/0x240 kernel/jump_label.c:210 static_key_enable+0x1a/0x20 kernel/jump_label.c:223 toggle_allocation_gate+0xab/0x250 mm/kfence/core.c:874 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246