watchdog: BUG: soft lockup - CPU#1 stuck for 143s! [syz.5.6228:25165] Modules linked in: irq event stamp: 5677 hardirqs last enabled at (5676): [] seqcount_lockdep_reader_access+0xa9/0x100 include/linux/seqlock.h:75 hardirqs last disabled at (5677): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062 softirqs last enabled at (1446): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last enabled at (1446): [] fpregs_lock arch/x86/include/asm/fpu/api.h:69 [inline] softirqs last enabled at (1446): [] fpu_clone+0x340/0xaf0 arch/x86/kernel/fpu/core.c:728 softirqs last disabled at (1483): [] __do_softirq kernel/softirq.c:703 [inline] softirqs last disabled at (1483): [] invoke_softirq kernel/softirq.c:542 [inline] softirqs last disabled at (1483): [] __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786 CPU: 1 UID: 0 PID: 25165 Comm: syz.5.6228 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:seqcount_lockdep_reader_access+0xec/0x100 include/linux/seqlock.h:76 Code: 00 75 11 e8 66 63 13 00 4d 85 ff 75 16 e8 5c 63 13 00 eb 15 e8 55 63 13 00 e8 30 93 44 0a 4d 85 ff 74 ea e8 46 63 13 00 fb 5b <41> 5e 41 5f c3 cc cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 RSP: 0018:ffffc90000a08a60 EFLAGS: 00000246 RAX: ffffffff81b592ea RBX: ffffffff9baa7798 RCX: ffff888022b8be80 RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000100 R09: 1ffffffff22f8ef7 R10: dffffc0000000000 R11: fffffbfff22f8ef8 R12: dffffc0000000000 R13: ffff88803549b998 R14: ffffffff81b599a3 R15: 0000000000000200 FS: 00007f2e21c126c0(0000) GS:ffff888123b51000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561f6a49ca38 CR3: 000000005f136000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: ktime_get_with_offset+0x93/0x2d0 kernel/time/timekeeping.c:1048 ktime_get_boottime include/linux/timekeeping.h:105 [inline] mac80211_hwsim_get_sim_tsf drivers/net/wireless/virtual/mac80211_hwsim_main.c:1272 [inline] mac80211_hwsim_tx_frame_no_nl+0x13d/0x1820 drivers/net/wireless/virtual/mac80211_hwsim_main.c:1917 mac80211_hwsim_tx_frame+0x199/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2440 mac80211_hwsim_beacon_tx+0x396/0x820 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2516 __iterate_interfaces+0x2af/0x5a0 net/mac80211/util.c:775 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:811 mac80211_hwsim_beacon+0xaf/0x240 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2548 __run_hrtimer kernel/time/hrtimer.c:2075 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2132 hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2149 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 __do_softirq kernel/softirq.c:703 [inline] invoke_softirq kernel/softirq.c:542 [inline] __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__sanitizer_cov_trace_pc+0x5e/0x80 kernel/kcov.c:218 Code: 00 00 00 10 0f 93 c2 40 08 f2 75 35 83 b9 44 17 00 00 00 74 2c 8b 91 18 17 00 00 83 fa 02 75 21 48 8b 91 20 17 00 00 48 8b 32 <48> 8d 7e 01 8b 89 1c 17 00 00 48 39 cf 73 08 48 89 3a 48 89 44 f2 RSP: 0018:ffffc90003bfed28 EFLAGS: 00000246 RAX: ffffffff8207d551 RBX: 0000000000000000 RCX: ffff888022b8be80 RDX: ffffc900069d1000 RSI: 000000000007ffff RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000002 R09: 0000000000000000 R10: 6f6c5f646165725f R11: 64656863735f6b63 R12: 1ffff11004571a6d R13: dffffc0000000000 R14: ffff888022b8d368 R15: dffffc0000000000 get_recursion_context kernel/events/internal.h:218 [inline] perf_swevent_get_recursion_context+0xa1/0x100 kernel/events/core.c:11198 perf_trace_buf_alloc+0x43/0x280 kernel/trace/trace_event_perf.c:410 do_perf_trace_lock_acquire include/trace/events/lock.h:23 [inline] perf_trace_lock_acquire+0x1a6/0x440 include/trace/events/lock.h:23 __do_trace_lock_acquire include/trace/events/lock.h:23 [inline] trace_lock_acquire include/trace/events/lock.h:23 [inline] lock_acquire+0x303/0x350 kernel/locking/lockdep.c:5905 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] trace_call_bpf+0xd5/0xb80 kernel/trace/bpf_trace.c:-1 perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11512 do_perf_trace_lock_acquire include/trace/events/lock.h:23 [inline] perf_trace_lock_acquire+0x346/0x440 include/trace/events/lock.h:23 __do_trace_lock_acquire include/trace/events/lock.h:23 [inline] trace_lock_acquire include/trace/events/lock.h:23 [inline] lock_acquire+0x303/0x350 kernel/locking/lockdep.c:5905 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock_sched include/linux/rcupdate.h:947 [inline] pfn_valid+0xd6/0x490 include/linux/mmzone.h:2307 page_table_check_clear+0x21/0x590 mm/page_table_check.c:70 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline] get_and_clear_full_ptes include/linux/pgtable.h:879 [inline] zap_present_folio_ptes mm/memory.c:1742 [inline] zap_present_ptes mm/memory.c:1824 [inline] do_zap_pte_range mm/memory.c:1926 [inline] zap_pte_range mm/memory.c:2028 [inline] zap_pmd_range mm/memory.c:2114 [inline] zap_pud_range mm/memory.c:2142 [inline] zap_p4d_range mm/memory.c:2163 [inline] __zap_vma_range+0x3a12/0x4f70 mm/memory.c:2203 unmap_vmas+0x38b/0x550 mm/memory.c:2272 exit_mmap+0x293/0x9f0 mm/mmap.c:1315 __mmput+0x118/0x420 kernel/fork.c:1191 copy_process+0x2fbb/0x44b0 kernel/fork.c:2617 kernel_clone+0x2d7/0x940 kernel/fork.c:2783 __do_sys_clone kernel/fork.c:2925 [inline] __se_sys_clone kernel/fork.c:2909 [inline] __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2909 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2e20d9f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2e21c11fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007f2e21025fa0 RCX: 00007f2e20d9f559 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000008000000 RBP: 00007f2e20e36b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f2e21026038 R14: 00007f2e21025fa0 R15: 00007ffc06f106c8 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 25167 Comm: syz.5.6228 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:csd_lock_wait kernel/smp.c:389 [inline] RIP: 0010:csd_lock kernel/smp.c:422 [inline] RIP: 0010:smp_call_function_many_cond+0x61e/0x1500 kernel/smp.c:970 Code: b6 04 04 84 c0 0f 85 d5 03 00 00 44 8b 3b 44 89 fe 83 e6 01 31 ff e8 71 71 0c 00 41 83 e7 01 75 07 e8 66 6c 0c 00 eb 3f f3 90 <48> b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 75 0f f7 03 01 RSP: 0018:ffffc90003b571a0 EFLAGS: 00000293 RAX: ffffffff81bc89ee RBX: ffff8880b8541b08 RCX: ffff888021b83e80 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90003b572f0 R08: ffff888021b8541f R09: 1ffff11004370a83 R10: dffffc0000000000 R11: ffffffff817a5570 R12: 1ffff110170a8361 R13: 0000000000000001 R14: ffff8880b8541b00 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888123a51000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2e21bf1990 CR3: 000000005f136000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: __flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline] flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline] flush_tlb_mm_range+0x910/0x10b0 arch/x86/mm/tlb.c:1435 flush_tlb_page arch/x86/include/asm/tlbflush.h:352 [inline] ptep_clear_flush+0x120/0x170 mm/pgtable-generic.c:116 wp_page_copy mm/memory.c:4039 [inline] do_wp_page+0x3c52/0x4b70 mm/memory.c:4438 handle_pte_fault mm/memory.c:6554 [inline] __handle_mm_fault mm/memory.c:6679 [inline] handle_mm_fault+0x15d7/0x3750 mm/memory.c:6846 do_user_addr_fault+0x7f6/0x1480 arch/x86/mm/fault.c:1394 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:__put_user_4+0xd/0x30 arch/x86/lib/putuser.S:74 Code: 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca e9 07 aa 03 00 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90003b57a90 EFLAGS: 00050206 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2e21bf1990 RDX: 0000000000000000 RSI: ffffffff8e7180ce RDI: ffffffff8c6e7280 RBP: dffffc0000000000 R08: ffffffff8226145f R09: 0000000000000000 R10: ffffc90003b577e0 R11: ffffffffa0400914 R12: dffffc0000000000 R13: 1ffff110043708b2 R14: ffff888021b83e80 R15: ffff888021b84590 mm_release kernel/fork.c:1494 [inline] mm_exit_exec_release+0xe1/0x290 kernel/fork.c:1512 exit_mm+0x50/0x240 kernel/exit.c:556 do_exit+0x6a8/0x2360 kernel/exit.c:967 do_group_exit+0x22d/0x2f0 kernel/exit.c:1123 get_signal+0x1216/0x12c0 kernel/signal.c:3112 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2e20d9f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2e21bf10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f2e21026098 RCX: 00007f2e20d9f559 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2e21026098 RBP: 00007f2e21026090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2e21026128 R14: 00007ffc06f105e0 R15: 00007ffc06f106c8