Extracting prog: 7m51.419125577s
Minimizing prog: 8m46.944756314s
Simplifying prog options: 20m31.827963286s
Extracting C: 37.612739181s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
single: successfully extracted reproducer
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=8m36.567694545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=8m36.567694545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
program did not crash
simplifying guilty program options
testing program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: INFO: rcu detected stall in corrupted
extracting C reproducer
testing compiled C program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
program did not crash
testing program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

program did not crash
testing program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

program crashed: INFO: rcu detected stall in worker_thread
validation run: crashed=true
testing program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

program crashed: lost connection to test machine
ignore low priority crash: lost connection to test machine
validation run: crashed=false
testing program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=8m36.567694545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)

program crashed: INFO: rcu detected stall in worker_thread
validation run: crashed=true
reproducing took 1h13m36.92744818s
repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P6125/2:b..l P29/3:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=22953, q=831 ncpus=2)
task:ktimers/1       state:D stack:24496 pid:29    tgid:29    ppid:2      task_flags:0x4208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16df/0x5510 kernel/sched/core.c:7239
 __schedule_loop kernel/sched/core.c:7316 [inline]
 schedule_rtlock+0x30/0x70 kernel/sched/core.c:7395
 rtlock_slowlock_locked+0x35c9/0x3c20 kernel/locking/rtmutex.c:1895
 rtlock_slowlock kernel/locking/rtmutex.c:1922 [inline]
 rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
 __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
 rt_spin_lock+0x165/0x400 kernel/locking/spinlock_rt.c:57
 spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
 cfg80211_inform_single_bss_data+0xc22/0x1bf0 net/wireless/scan.c:2377
 cfg80211_inform_bss_data+0x25b/0x3d50 net/wireless/scan.c:3241
 cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3333
 ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
 ieee80211_scan_rx+0x552/0xa40 net/mac80211/scan.c:364
 __ieee80211_rx_handle_packet net/mac80211/rx.c:5427 [inline]
 ieee80211_rx_list+0x2d23/0x3b40 net/mac80211/rx.c:5720
 ieee80211_rx_napi+0x1ad/0x3d0 net/mac80211/rx.c:5743
 ieee80211_rx include/net/mac80211.h:5437 [inline]
 ieee80211_handle_queued_frames+0xe4/0x1d0 net/mac80211/main.c:452
 tasklet_action_common+0x31c/0x600 kernel/softirq.c:970
 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:kworker/u8:15   state:R  running task     stack:23232 pid:6125  tgid:6125  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16df/0x5510 kernel/sched/core.c:7239
 preempt_schedule_irq+0x4b/0x90 kernel/sched/core.c:7561
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x910 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:_ieee802_11_parse_elems_full+0xc19/0x4950 net/mac80211/parse.c:355
Code: 00 e8 9b 65 fe f6 e9 8d 00 00 00 e8 91 65 fe f6 e9 83 00 00 00 e8 87 65 fe f6 eb 7c e8 80 65 fe f6 eb 75 e8 79 65 fe f6 eb 6e <e8> 72 65 fe f6 eb 67 e8 6b 65 fe f6 eb 60 e8 64 65 fe f6 eb 59 e8
RSP: 0018:ffffc900043f6780 EFLAGS: 00000246
RAX: 0000000000000028 RBX: 0000000000000008 RCX: 0000000000000001
RDX: ffffffff8ac77b67 RSI: ffffffff8f868b10 RDI: 0000000000000000
RBP: ffffc900043f6bd0 R08: ffff8880388a9f00 R09: 0000000000000028
R10: 0000000000000100 R11: 00000000000000f4 R12: ffff88803e62659d
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88803e6265c5
 ieee802_11_parse_elems_full+0xfce/0x2db0 net/mac80211/parse.c:1145
 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2551 [inline]
 ieee80211_inform_bss+0x163/0x10d0 net/mac80211/scan.c:79
 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
 cfg80211_inform_single_bss_data+0xd98/0x1bf0 net/wireless/scan.c:2382
 cfg80211_inform_bss_data+0x25b/0x3d50 net/wireless/scan.c:3241
 cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3333
 ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
 ieee80211_rx_bss_info net/mac80211/ibss.c:1063 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1544 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 net/mac80211/ibss.c:1571
 ieee80211_iface_process_skb net/mac80211/iface.c:1769 [inline]
 ieee80211_iface_work+0x78a/0x1010 net/mac80211/iface.c:1823
 cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa88/0x14c0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10491 jiffies! g22953 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=12913
rcu: rcu_preempt kthread starved for 10492 jiffies! g22953 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:23776 pid:18    tgid:18    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16df/0x5510 kernel/sched/core.c:7239
 __schedule_loop kernel/sched/core.c:7316 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7331
 schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 3c 6c 02 e9 53 d3 03 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 73 2b 21 00 fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffc900001d7e40 EFLAGS: 00000246
RAX: 000000000014640f RBX: ffffffff819a05cc RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8d891be1 RDI: ffffffff8bca8f80
RBP: ffffc900001d7f10 R08: ffff8880b8733d5b R09: 1ffff110170e67ab
R10: dffffc0000000000 R11: ffffed10170e67ac R12: 0000000000000000
R13: 1ffff110039d0000 R14: 1ffff9200003afd0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888125d22000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc0aecf52 CR3: 000000004c4b0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/kernel/process.c:767 [inline]
 default_idle+0x9/0x20 arch/x86/kernel/process.c:768
 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x1cc/0x540 kernel/sched/idle.c:355
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x157
 </TASK>

final repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P6125/2:b..l P29/3:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=22953, q=831 ncpus=2)
task:ktimers/1       state:D stack:24496 pid:29    tgid:29    ppid:2      task_flags:0x4208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16df/0x5510 kernel/sched/core.c:7239
 __schedule_loop kernel/sched/core.c:7316 [inline]
 schedule_rtlock+0x30/0x70 kernel/sched/core.c:7395
 rtlock_slowlock_locked+0x35c9/0x3c20 kernel/locking/rtmutex.c:1895
 rtlock_slowlock kernel/locking/rtmutex.c:1922 [inline]
 rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
 __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
 rt_spin_lock+0x165/0x400 kernel/locking/spinlock_rt.c:57
 spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
 cfg80211_inform_single_bss_data+0xc22/0x1bf0 net/wireless/scan.c:2377
 cfg80211_inform_bss_data+0x25b/0x3d50 net/wireless/scan.c:3241
 cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3333
 ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
 ieee80211_scan_rx+0x552/0xa40 net/mac80211/scan.c:364
 __ieee80211_rx_handle_packet net/mac80211/rx.c:5427 [inline]
 ieee80211_rx_list+0x2d23/0x3b40 net/mac80211/rx.c:5720
 ieee80211_rx_napi+0x1ad/0x3d0 net/mac80211/rx.c:5743
 ieee80211_rx include/net/mac80211.h:5437 [inline]
 ieee80211_handle_queued_frames+0xe4/0x1d0 net/mac80211/main.c:452
 tasklet_action_common+0x31c/0x600 kernel/softirq.c:970
 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:kworker/u8:15   state:R  running task     stack:23232 pid:6125  tgid:6125  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16df/0x5510 kernel/sched/core.c:7239
 preempt_schedule_irq+0x4b/0x90 kernel/sched/core.c:7561
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x910 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:_ieee802_11_parse_elems_full+0xc19/0x4950 net/mac80211/parse.c:355
Code: 00 e8 9b 65 fe f6 e9 8d 00 00 00 e8 91 65 fe f6 e9 83 00 00 00 e8 87 65 fe f6 eb 7c e8 80 65 fe f6 eb 75 e8 79 65 fe f6 eb 6e <e8> 72 65 fe f6 eb 67 e8 6b 65 fe f6 eb 60 e8 64 65 fe f6 eb 59 e8
RSP: 0018:ffffc900043f6780 EFLAGS: 00000246
RAX: 0000000000000028 RBX: 0000000000000008 RCX: 0000000000000001
RDX: ffffffff8ac77b67 RSI: ffffffff8f868b10 RDI: 0000000000000000
RBP: ffffc900043f6bd0 R08: ffff8880388a9f00 R09: 0000000000000028
R10: 0000000000000100 R11: 00000000000000f4 R12: ffff88803e62659d
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88803e6265c5
 ieee802_11_parse_elems_full+0xfce/0x2db0 net/mac80211/parse.c:1145
 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2551 [inline]
 ieee80211_inform_bss+0x163/0x10d0 net/mac80211/scan.c:79
 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
 cfg80211_inform_single_bss_data+0xd98/0x1bf0 net/wireless/scan.c:2382
 cfg80211_inform_bss_data+0x25b/0x3d50 net/wireless/scan.c:3241
 cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3333
 ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
 ieee80211_rx_bss_info net/mac80211/ibss.c:1063 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1544 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 net/mac80211/ibss.c:1571
 ieee80211_iface_process_skb net/mac80211/iface.c:1769 [inline]
 ieee80211_iface_work+0x78a/0x1010 net/mac80211/iface.c:1823
 cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa88/0x14c0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10491 jiffies! g22953 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=12913
rcu: rcu_preempt kthread starved for 10492 jiffies! g22953 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:23776 pid:18    tgid:18    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16df/0x5510 kernel/sched/core.c:7239
 __schedule_loop kernel/sched/core.c:7316 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7331
 schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2123
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 3c 6c 02 e9 53 d3 03 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 73 2b 21 00 fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffc900001d7e40 EFLAGS: 00000246
RAX: 000000000014640f RBX: ffffffff819a05cc RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8d891be1 RDI: ffffffff8bca8f80
RBP: ffffc900001d7f10 R08: ffff8880b8733d5b R09: 1ffff110170e67ab
R10: dffffc0000000000 R11: ffffed10170e67ac R12: 0000000000000000
R13: 1ffff110039d0000 R14: 1ffff9200003afd0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888125d22000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc0aecf52 CR3: 000000004c4b0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/kernel/process.c:767 [inline]
 default_idle+0x9/0x20 arch/x86/kernel/process.c:768
 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x1cc/0x540 kernel/sched/idle.c:355
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x157
 </TASK>