watchdog: BUG: soft lockup - CPU#1 stuck for 143s! [syz.4.72:6225] Modules linked in: irq event stamp: 13433033 hardirqs last enabled at (13433032): [] irqentry_exit+0x5dd/0x660 kernel/entry/common.c:219 hardirqs last disabled at (13433033): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1056 softirqs last enabled at (13383378): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (13383378): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (13383378): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 softirqs last disabled at (13383381): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (13383381): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (13383381): [] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 CPU: 1 UID: 0 PID: 6225 Comm: syz.4.72 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:81 [inline] RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:103 [inline] RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:238 [inline] RIP: 0010:unwind_next_frame+0x513/0x23d0 arch/x86/kernel/unwind_orc.c:510 Code: c1 e8 3f 48 01 c8 48 83 e0 fe 4c 8d 3c 45 00 00 00 00 49 01 ef 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 75 27 49 63 07 4c 01 f8 49 8d 4f 04 4c 39 e0 48 0f 46 e9 49 RSP: 0018:ffffc90000a082f8 EFLAGS: 00000a07 RAX: 0000000000000000 RBX: ffffffff8f9933cc RCX: dffffc0000000000 RDX: ffffffff8f9933bc RSI: ffffffff90143d74 RDI: ffffffff8bc08680 RBP: ffffffff8f9933bc R08: 0000000000000005 R09: ffffffff8df41a20 R10: ffffc90000a07ec8 R11: fffff52000140fdb R12: ffffffff816ac883 R13: ffffffff8f9933bc R14: ffffc90000a08428 R15: ffffffff8f9933c4 FS: 00007f51a5dd46c0(0000) GS:ffff888125f34000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000031716000 CR4: 00000000003526f0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: __unwind_start+0x5b9/0x760 arch/x86/kernel/unwind_orc.c:773 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xe4/0x150 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 unpoison_slab_object mm/kasan/common.c:339 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:365 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x43c/0x720 mm/slub.c:5315 __alloc_skb+0x255/0x430 net/core/skbuff.c:679 __netdev_alloc_skb+0x108/0x960 net/core/skbuff.c:754 netdev_alloc_skb include/linux/skbuff.h:3484 [inline] dev_alloc_skb include/linux/skbuff.h:3497 [inline] hsr_init_skb+0xef/0x6e0 net/hsr/hsr_device.c:267 send_hsr_supervision_frame+0x143/0xcb0 net/hsr/hsr_device.c:316 hsr_announce+0x1d5/0x360 net/hsr/hsr_device.c:421 call_timer_fn+0x16e/0x590 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x61a/0x860 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2404 handle_softirqs+0x27d/0x850 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__schedule+0x0/0x5000 kernel/sched/core.c:6719 Code: cb f6 45 89 f8 89 d9 48 8b 5c 24 08 e9 ee fe ff ff cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 RSP: 0018:ffffc9000b977098 EFLAGS: 00000286 RAX: 8ac2d37b5c1da400 RBX: 0000000000000000 RCX: 8ac2d37b5c1da400 RDX: 0000000000000007 RSI: ffffffff8d792e87 RDI: 0000000000000001 RBP: ffffc9000b977150 R08: ffffffff8f822377 R09: 1ffffffff1f0446e R10: dffffc0000000000 R11: fffffbfff1f0446f R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200172ee14 preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7190 irqentry_exit+0x5d8/0x660 kernel/entry/common.c:216 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:preempt_schedule+0x4/0xc0 kernel/sched/core.c:7064 Code: da 33 f6 c3 cc cc cc cc cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 48 89 e5 41 56 53 48 83 e4 e0 48 83 ec 60 65 48 8b 05 35 8e 21 RSP: 0018:ffffc9000b977260 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000a06 RCX: 0000000000000000 RDX: 0000000000000007 RSI: ffffffff8d792e87 RDI: 00000000ffffffff RBP: ffffc9000b9772b0 R08: ffffffff8f822377 R09: 1ffffffff1f0446e R10: dffffc0000000000 R11: fffffbfff1f0446f R12: dffffc0000000000 R13: dffffc0000000000 R14: ffffffff8df46e00 R15: 1ffff9200172ee58 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xfd/0x110 kernel/locking/spinlock.c:194 __rcu_report_exp_rnp+0x2d1/0x3d0 kernel/rcu/tree_exp.h:208 rcu_report_exp_rnp kernel/rcu/tree_exp.h:232 [inline] rcu_preempt_deferred_qs_irqrestore+0x8bd/0xce0 kernel/rcu/tree_plugin.h:581 rcu_read_unlock_special+0x3d8/0x520 kernel/rcu/tree_plugin.h:769 __rcu_read_unlock+0x84/0xe0 kernel/rcu/tree_plugin.h:438 rcu_read_unlock include/linux/rcupdate.h:899 [inline] class_rcu_destructor include/linux/rcupdate.h:1195 [inline] unwind_next_frame+0x1ab6/0x23d0 arch/x86/kernel/unwind_orc.c:695 __unwind_start+0x5b9/0x760 arch/x86/kernel/unwind_orc.c:773 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xe4/0x150 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 unpoison_slab_object mm/kasan/common.c:339 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:365 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x43c/0x720 mm/slub.c:5315 perf_event_alloc+0x1b9/0x2d50 kernel/events/core.c:12945 __do_sys_perf_event_open kernel/events/core.c:13575 [inline] __se_sys_perf_event_open+0x756/0x1d90 kernel/events/core.c:13456 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f51a4f8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f51a5dd4038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f51a51e5fa0 RCX: 00007f51a4f8f749 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000040 RBP: 00007f51a5013f91 R08: 0000000000000001 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007f51a51e6038 R14: 00007f51a51e5fa0 R15: 00007fff7e08ca68 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 1301 Comm: aoe_tx0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:lookup_object lib/debugobjects.c:421 [inline] RIP: 0010:debug_object_deactivate+0xcf/0x360 lib/debugobjects.c:875 Code: 6d 00 41 ff c4 4d 85 ed 74 38 49 8d 5d 18 48 89 dd 48 c1 ed 03 42 80 7c 35 00 00 74 08 48 89 df e8 86 11 8f fd 4c 39 3b 74 42 <4c> 89 e8 48 c1 e8 03 42 80 3c 30 00 74 c6 4c 89 ef e8 6b 11 8f fd RSP: 0018:ffffc90000007cc0 EFLAGS: 00000083 RAX: 1ffff11004169ee0 RBX: ffff888021e9fd70 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000007ba0 RBP: 1ffff110043d3fae R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000000f74 R12: 0000000000000003 R13: ffff888021e9fd58 R14: dffffc0000000000 R15: ffff8880b8628ba0 FS: 0000000000000000(0000) GS:ffff888125e34000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056388563b9a0 CR3: 000000003410c000 CR4: 00000000003526f0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: debug_hrtimer_deactivate kernel/time/hrtimer.c:443 [inline] debug_deactivate+0x1d/0x1e0 kernel/time/hrtimer.c:483 __run_hrtimer kernel/time/hrtimer.c:1745 [inline] __hrtimer_run_queues+0x2b0/0xc30 kernel/time/hrtimer.c:1841 hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1903 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline] __sysvec_apic_timer_interrupt+0x102/0x3e0 arch/x86/kernel/apic/apic.c:1062 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2037 [inline] RIP: 0010:vprintk_emit+0x4d0/0x5f0 kernel/printk/printk.c:2425 Code: 0f 84 34 ff ff ff e8 cf 62 20 00 fb eb 44 e8 c7 62 20 00 e8 a2 b2 ba 09 4d 85 f6 74 94 e8 b8 62 20 00 fb 48 c7 c7 e0 58 f3 8d <31> f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 45 31 c9 53 e8 28 26 RSP: 0018:ffffc9000488f280 EFLAGS: 00000293 RAX: ffffffff81a14f78 RBX: ffffffff81a14dd1 RCX: ffff888027fdbd00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8df358e0 RBP: ffffc9000488f390 R08: ffffffff8f822377 R09: 1ffffffff1f0446e R10: dffffc0000000000 R11: fffffbfff1f0446f R12: 0000000000000000 R13: 000000000000002d R14: 0000000000000200 R15: 1ffff92000911e54 dev_vprintk_emit+0x337/0x3f0 drivers/base/core.c:4914 dev_printk_emit+0xe0/0x130 drivers/base/core.c:4925 __netdev_printk+0x3e1/0x480 net/core/dev.c:12901 netdev_warn+0x10a/0x160 net/core/dev.c:12954 ieee802154_subif_start_xmit+0x136/0x190 net/mac802154/tx.c:232 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3853 [inline] dev_hard_start_xmit+0x2cd/0x800 net/core/dev.c:3869 sch_direct_xmit+0x241/0x4b0 net/sched/sch_generic.c:347 __dev_xmit_skb net/core/dev.c:4169 [inline] __dev_queue_xmit+0x136f/0x3140 net/core/dev.c:4783 dev_queue_xmit include/linux/netdevice.h:3381 [inline] tx+0x6b/0x190 drivers/block/aoe/aoenet.c:62 kthread+0x1d0/0x3e0 drivers/block/aoe/aoecmd.c:1241 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246