wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [syz.4.2354:11318]
Modules linked in:
irq event stamp: 3366331
hardirqs last  enabled at (3366330): [<ffffffffb30f44fb>] irqentry_exit+0x3b/0x90 kernel/entry/common.c:357
hardirqs last disabled at (3366331): [<ffffffffb30f2e8f>] sysvec_apic_timer_interrupt+0xf/0x80 arch/x86/kernel/apic/apic.c:1049
softirqs last  enabled at (3345912): [<ffffffffafba526b>] softirq_handle_end kernel/softirq.c:407 [inline]
softirqs last  enabled at (3345912): [<ffffffffafba526b>] handle_softirqs+0x4eb/0x770 kernel/softirq.c:589
softirqs last disabled at (3345915): [<ffffffffafba6d06>] __do_softirq kernel/softirq.c:595 [inline]
softirqs last disabled at (3345915): [<ffffffffafba6d06>] invoke_softirq kernel/softirq.c:435 [inline]
softirqs last disabled at (3345915): [<ffffffffafba6d06>] __irq_exit_rcu kernel/softirq.c:662 [inline]
softirqs last disabled at (3345915): [<ffffffffafba6d06>] irq_exit_rcu+0xd6/0x110 kernel/softirq.c:678
CPU: 1 UID: 0 PID: 11318 Comm: syz.4.2354 Not tainted 6.14.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:arch_stack_walk+0x79/0xf0 arch/x86/kernel/stacktrace.c:27
Code: 00 00 4c 89 ea 4c 89 f6 48 8d bd 68 ff ff ff e8 4d 84 07 00 8b 95 68 ff ff ff 85 d2 75 24 eb 36 4c 89 e7 e8 09 10 65 03 84 c0 <74> 2a 48 8d bd 68 ff ff ff e8 59 64 07 00 8b 85 68 ff ff ff 85 c0
RSP: 0018:ffff88811ae89a68 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffffffafdf64b0 RCX: 1ffff110235d1301
RDX: 1ffff110235d1384 RSI: ffffffffb04c9db2 RDI: ffff88811ae89b3c
RBP: ffff88811ae89b00 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000022832 R11: ffffed10235d1336 R12: ffff88811ae89b30
R13: 0000000000000000 R14: ffff888115785400 R15: ffff88810633a800
FS:  00007fcc77ac7640(0000) GS:ffff88811ae80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4cdd40d6f4 CR3: 00000001160ba005 CR4: 0000000000770ef0
PKRU: 80000000
Call Trace:
 <IRQ>
 stack_trace_save+0x8f/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3a/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x38/0x50 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kmem_cache_free+0x356/0x580 mm/slub.c:4711
 rcu_do_batch kernel/rcu/tree.c:2546 [inline]
 rcu_core+0x9f5/0x2200 kernel/rcu/tree.c:2802
 handle_softirqs+0x19a/0x770 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu kernel/softirq.c:662 [inline]
 irq_exit_rcu+0xd6/0x110 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x70/0x80 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:227 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:cpumask_test_cpu include/linux/cpumask.h:570 [inline]
RIP: 0010:cpu_online include/linux/cpumask.h:1116 [inline]
RIP: 0010:trace_lock_acquire include/trace/events/lock.h:24 [inline]
RIP: 0010:lock_acquire+0xb7/0x4c0 kernel/locking/lockdep.c:5822
Code: 49 c7 c2 8c a6 03 00 65 41 8b 12 89 d2 be 08 00 00 00 48 89 d0 48 89 14 24 48 c1 e8 06 48 8d 3c c5 d0 15 9d b4 e8 a9 8b 5d 00 <48> 8b 14 24 48 0f a3 15 ad be cc 04 0f 82 1b 02 00 00 48 c7 c0 74
RSP: 0018:ffff88810f9c7308 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 1ffff11021f38e64 RCX: ffffffffafd05717
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffffb49d15d0
RBP: 0000000000000000 R08: ffffffffb328f1a0 R09: fffffbfff693a2bb
R10: fffffbfff693a2ba R11: ffffffffb49d15d7 R12: 0000000000000002
R13: ffffffffb42189c0 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 rcu_read_lock_sched include/linux/rcupdate.h:941 [inline]
 pfn_valid include/linux/mmzone.h:2067 [inline]
 __virt_addr_valid+0x1e2/0x5d0 arch/x86/mm/physaddr.c:65
 kasan_addr_to_slab+0xd/0xa0 mm/kasan/common.c:37
 kasan_record_aux_stack+0xe/0xa0 mm/kasan/generic.c:533
 __call_rcu_common.constprop.0+0x6a/0xce0 kernel/rcu/tree.c:3065
 kmemleak_free_recursive include/linux/kmemleak.h:49 [inline]
 slab_free_hook mm/slub.c:2278 [inline]
 slab_free mm/slub.c:4609 [inline]
 kfree+0x2d9/0x460 mm/slub.c:4757
 free_note_info fs/binfmt_elf.c:1986 [inline]
 elf_core_dump+0x732/0x3900 fs/binfmt_elf.c:2142
 do_coredump+0x33f7/0x4370 fs/coredump.c:759
 get_signal+0x199d/0x2530 kernel/signal.c:3021
 arch_do_signal_or_restart+0x81/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x171/0x1e0 kernel/entry/common.c:218
 do_syscall_64+0xd0/0x1d0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcc794847ed
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcc77ac6fc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fcc796c5fa0 RCX: 00007fcc794847ed
RDX: 0000000000000008 RSI: 0000200000000000 RDI: ffffffffffffffff
RBP: 00007fcc7951db38 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcc796c5fac R14: 00007fcc796c6038 R15: 00007fcc77aa7000
 </TASK>
Sending NMI from CPU 1 to CPUs 0,2-3:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 285 Comm: sshd Not tainted 6.14.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:csd_lock_wait kernel/smp.c:349 [inline]
RIP: 0010:smp_call_function_many_cond+0x521/0x1510 kernel/smp.c:885
Code: 85 e4 74 4f 48 b8 00 00 00 00 00 fc ff df 4d 89 f5 4d 89 f4 49 c1 ed 03 41 83 e4 07 49 01 c5 41 83 c4 03 e8 31 8e 0b 00 f3 90 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 ed 0d 00 00 8b 43 08 31
RSP: 0018:ffff8881088f7740 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88811aec12c0 RCX: ffffffffafe700f5
RDX: 0000000000000001 RSI: ffff8881019db800 RDI: 0000000000000002
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff6c89de7
R10: fffffbfff6c89de6 R11: 0000000000000001 R12: 0000000000000003
R13: ffffed10235d8259 R14: ffff88811aec12c8 R15: 0000000000000001
FS:  00007fc5f934c900(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa56b9266f4 CR3: 000000010163c005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 on_each_cpu_cond_mask+0x57/0xa0 kernel/smp.c:1052
 kvm_flush_tlb_multi+0x1e5/0x300 arch/x86/kernel/kvm.c:678
 __flush_tlb_multi arch/x86/include/asm/paravirt.h:91 [inline]
 flush_tlb_multi arch/x86/mm/tlb.c:966 [inline]
 flush_tlb_mm_range+0x35a/0x580 arch/x86/mm/tlb.c:1054
 tlb_flush arch/x86/include/asm/tlb.h:20 [inline]
 tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:481 [inline]
 tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:471 [inline]
 tlb_flush_mmu+0x454/0x750 mm/mmu_gather.c:395
 tlb_finish_mmu+0x97/0x3f0 mm/mmu_gather.c:488
 vms_clear_ptes.part.0+0x46d/0x6a0 mm/vma.c:1144
 vms_clear_ptes mm/vma.c:1186 [inline]
 vms_complete_munmap_vmas+0x6e5/0xa60 mm/vma.c:1186
 do_vmi_align_munmap+0x3f2/0x560 mm/vma.c:1445
 do_vmi_munmap+0x1f3/0x3e0 mm/vma.c:1493
 __vm_munmap+0x19a/0x380 mm/vma.c:2956
 __do_sys_munmap mm/mmap.c:1084 [inline]
 __se_sys_munmap mm/mmap.c:1081 [inline]
 __x64_sys_munmap+0x59/0x80 mm/mmap.c:1081
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc3/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc5f9835167
Code: 38 eb 85 48 8b 15 29 8d 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb 85 66 2e 0f 1f 84 00 00 00 00 00 90 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f9 8c 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffde4d566b8 EFLAGS: 00000206 ORIG_RAX: 000000000000000b
RAX: ffffffffffffffda RBX: 00005649129425c0 RCX: 00007fc5f9835167
RDX: 000000000000000f RSI: 00000000001e9000 RDI: 00007fc5f8d14000
RBP: 0000564912934730 R08: 00007fc5f8d14000 R09: 000000000007b998
R10: 00005648da3712b8 R11: 0000000000000206 R12: 00005649129425c0
R13: 0000564912958b60 R14: 0000564912943d00 R15: 0000564912943e10
 </TASK>
NMI backtrace for cpu 2
CPU: 2 UID: 0 PID: 10231 Comm: syz-executor Not tainted 6.14.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:write_comp_data+0x2b/0x90 kernel/kcov.c:246
Code: 56 41 55 49 89 fd bf 03 00 00 00 41 54 49 89 f4 55 48 89 d5 53 48 89 cb 65 4c 8b 35 ef 16 11 50 4c 89 f6 e8 c7 fe ff ff 84 c0 <74> 4c 49 8b 86 e0 14 00 00 41 8b be dc 14 00 00 48 81 eb 00 00 80
RSP: 0018:ffff8880121ef718 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffffafe700f5 RCX: ffffffffafe700f5
RDX: 0000000000000001 RSI: ffff8880121e5400 RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff6c89de7
R10: fffffbfff6c89de6 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000005 R14: ffff8880121e5400 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88811af00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f58963926f4 CR3: 000000000aa5a006 CR4: 0000000000770ef0
PKRU: 80000000
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 csd_lock_wait kernel/smp.c:349 [inline]
 smp_call_function_many_cond+0x545/0x1510 kernel/smp.c:885
 on_each_cpu_cond_mask+0x57/0xa0 kernel/smp.c:1052
 kvm_flush_tlb_multi+0x1e5/0x300 arch/x86/kernel/kvm.c:678
 __flush_tlb_multi arch/x86/include/asm/paravirt.h:91 [inline]
 flush_tlb_multi arch/x86/mm/tlb.c:966 [inline]
 flush_tlb_mm_range+0x35a/0x580 arch/x86/mm/tlb.c:1054
 tlb_flush arch/x86/include/asm/tlb.h:20 [inline]
 tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:481 [inline]
 tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:471 [inline]
 tlb_flush_mmu+0x454/0x750 mm/mmu_gather.c:395
 tlb_finish_mmu+0x97/0x3f0 mm/mmu_gather.c:488
 exit_mmap+0x3bd/0xae0 mm/mmap.c:1297
 __mmput kernel/fork.c:1356 [inline]
 mmput+0xd9/0x330 kernel/fork.c:1378
 exit_mm kernel/exit.c:570 [inline]
 do_exit+0x94b/0x2ef0 kernel/exit.c:925
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x2375/0x2530 kernel/signal.c:3036
 arch_do_signal_or_restart+0x81/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x171/0x1e0 kernel/entry/common.c:218
 do_syscall_64+0xd0/0x1d0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0b0936aa2a
Code: Unable to access opcode bytes at 0x7f0b0936aa00.
RSP: 002b:00007ffca9acd9a8 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 00000000000027fb RCX: 00007f0b0936aa2a
RDX: 0000000040000000 RSI: 00007ffca9acd9b4 RDI: 00000000ffffffff
RBP: 00007ffca9acd9b4 R08: 00000000000027fb R09: 0000000080000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008
R13: 0000000000000003 R14: 0000000000000002 R15: 00007ffca9acda3c
 </TASK>
NMI backtrace for cpu 3
CPU: 3 UID: 0 PID: 19 Comm: rcu_exp_gp_kthr Not tainted 6.14.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:csd_lock_wait kernel/smp.c:349 [inline]
RIP: 0010:csd_lock kernel/smp.c:355 [inline]
RIP: 0010:smp_call_function_single+0x1da/0x420 kernel/smp.c:666
Code: 74 52 48 b8 00 00 00 00 00 fc ff df 48 8b 0c 24 49 89 cd 83 e1 07 49 c1 ed 03 48 89 cb 49 01 c5 83 c3 03 e8 f8 6d 0b 00 f3 90 <41> 0f b6 45 00 38 c3 7c 08 84 c0 0f 85 06 02 00 00 41 8b 44 24 08
RSP: 0018:ffff888100a07c20 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffffafe7212f
RDX: 0000000000000001 RSI: ffff8881009eb800 RDI: 0000000000000002
RBP: ffff888100a07cf0 R08: 0000000000000000 R09: fffffbfff693a2bb
R10: fffffbfff693a2ba R11: ffffffffb49d15d7 R12: ffff88811afbc980
R13: ffffed10235f7931 R14: 1ffff11020140f88 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559fd6c2a990 CR3: 000000010aada002 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 __sync_rcu_exp_select_node_cpus+0x5ca/0xd50 kernel/rcu/tree_exp.h:418
 sync_rcu_exp_select_node_cpus kernel/rcu/tree_exp.h:453 [inline]
 sync_rcu_exp_select_cpus+0x432/0xc20 kernel/rcu/tree_exp.h:520
 rcu_exp_sel_wait_wake kernel/rcu/tree_exp.h:716 [inline]
 wait_rcu_exp_gp+0x2d/0x40 kernel/rcu/tree_exp.h:490
 kthread_worker_fn+0x2c7/0xa10 kernel/kthread.c:1010
 kthread+0x422/0x840 kernel/kthread.c:464
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>