------------[ cut here ]------------
WARNING: CPU: 1 PID: 16578 at kernel/workqueue.c:2257 __queue_work+0xcd3/0xf50 kernel/workqueue.c:2256
Modules linked in:
CPU: 1 UID: 0 PID: 16578 Comm: syz-executor Not tainted 6.14.0-rc3-syzkaller-g319fc77f8f45 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:__queue_work+0xcd3/0xf50 kernel/workqueue.c:2256
Code: ff e8 e1 af 38 00 90 0f 0b 90 e9 b2 fe ff ff e8 d3 af 38 00 eb 13 e8 cc af 38 00 eb 0c e8 c5 af 38 00 eb 05 e8 be af 38 00 90 <0f> 0b 90 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc
RSP: 0000:ffffc90000a18b08 EFLAGS: 00010046
RAX: ffffffff81890abd RBX: 0000000000000100 RCX: ffff88801cb41e00
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: 0000000000010000 R08: ffffffff8188fee8 R09: 1ffffffff2079d2e
R10: dffffc0000000000 R11: ffffffff818912f0 R12: ffff88801bef4800
R13: ffff88801bef49c0 R14: dffffc0000000000 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f02b0b78340 CR3: 000000003245e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x187/0x650 kernel/time/timer.c:1789
 expire_timers kernel/time/timer.c:1835 [inline]
 __run_timers kernel/time/timer.c:2414 [inline]
 __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2426
 run_timer_base kernel/time/timer.c:2435 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__list_del_entry_valid_or_report+0xc0/0x190 lib/list_debug.c:71
Code: 0f 85 92 00 00 00 4d 8d 66 08 4c 89 e3 48 c1 eb 03 42 80 3c 2b 00 74 08 4c 89 e7 e8 6a da 2c fd 4d 39 3c 24 0f 85 9e 00 00 00 <b0> 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c7 a0 f1 80
RSP: 0000:ffffc9000cad70d8 EFLAGS: 00000246
RAX: 1ffffd40002caf11 RBX: 1ffffd40002caf1a RCX: ffff8880b8744a38
RDX: 0000000000000001 RSI: 0000000000000190 RDI: ffffea0001657890
RBP: 0000000000000080 R08: ffff8880b8744a10 R09: ffff8880b8744a08
R10: dffffc0000000000 R11: fffffbfff28a8f09 R12: ffffea00016578d0
R13: dffffc0000000000 R14: ffffea00016578c8 R15: ffffea0001657888
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 __rmqueue_pcplist+0x2292/0x2a90 mm/page_alloc.c:3014
 rmqueue_pcplist mm/page_alloc.c:3046 [inline]
 rmqueue mm/page_alloc.c:3077 [inline]
 get_page_from_freelist+0x886/0x37a0 mm/page_alloc.c:3474
 __alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
 alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
 folio_alloc_mpol_noprof mm/mempolicy.c:2289 [inline]
 vma_alloc_folio_noprof+0x12b/0x260 mm/mempolicy.c:2324
 folio_prealloc+0x2e/0x170
 wp_page_copy mm/memory.c:3446 [inline]
 do_wp_page+0x1253/0x49b0 mm/memory.c:3838
 handle_pte_fault mm/memory.c:5916 [inline]
 __handle_mm_fault+0x24d5/0x70f0 mm/memory.c:6043
 handle_mm_fault+0x3e5/0x8d0 mm/memory.c:6212
 do_user_addr_fault arch/x86/mm/fault.c:1337 [inline]
 handle_page_fault arch/x86/mm/fault.c:1480 [inline]
 exc_page_fault+0x459/0x8b0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f02b09a52c4
Code: 66 0f 1f 44 00 00 48 8b 38 8b 50 08 4c 01 ff 48 83 fa 26 74 0a 48 83 fa 08 0f 85 1b 0a 00 00 48 8b 50 10 48 83 c0 18 4c 01 fa <48> 89 17 48 39 d8 72 d4 4c 8b b1 e8 01 00 00 49 01 f0 4d 85 f6 0f
RSP: 002b:00007fff82de06b0 EFLAGS: 00010202
RAX: 00007f02b0844d30 RBX: 00007f02b0847088 RCX: 00007f02b0b7d700
RDX: 00007f02b0a1e2ec RSI: 00007f02b08003c0 RDI: 00007f02b0b78340
RBP: 00007f02b0b7d700 R08: 00000000000470b8 R09: 00007f02b0847478
R10: 0000000070000025 R11: 00007f02b08003a0 R12: 00007fff82de06f0
R13: 00007fff82de0878 R14: 00007fff82de0810 R15: 00007f02b0800000
 </TASK>
----------------
Code disassembly (best guess):
   0:	0f 85 92 00 00 00    	jne    0x98
   6:	4d 8d 66 08          	lea    0x8(%r14),%r12
   a:	4c 89 e3             	mov    %r12,%rbx
   d:	48 c1 eb 03          	shr    $0x3,%rbx
  11:	42 80 3c 2b 00       	cmpb   $0x0,(%rbx,%r13,1)
  16:	74 08                	je     0x20
  18:	4c 89 e7             	mov    %r12,%rdi
  1b:	e8 6a da 2c fd       	call   0xfd2cda8a
  20:	4d 39 3c 24          	cmp    %r15,(%r12)
  24:	0f 85 9e 00 00 00    	jne    0xc8
* 2a:	b0 01                	mov    $0x1,%al <-- trapping instruction
  2c:	5b                   	pop    %rbx
  2d:	41 5c                	pop    %r12
  2f:	41 5d                	pop    %r13
  31:	41 5e                	pop    %r14
  33:	41 5f                	pop    %r15
  35:	c3                   	ret
  36:	cc                   	int3
  37:	cc                   	int3
  38:	cc                   	int3
  39:	cc                   	int3
  3a:	48                   	rex.W
  3b:	c7                   	.byte 0xc7
  3c:	c7                   	(bad)
  3d:	a0                   	.byte 0xa0
  3e:	f1                   	int1
  3f:	80                   	.byte 0x80