------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:1441 __queue_work+0xe2d/0xfb0 kernel/workqueue.c:1441
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__queue_work+0xe2d/0xfb0 kernel/workqueue.c:1441
Code: e9 9d fc ff ff 48 8b 0c 24 80 e1 07 80 c1 03 38 c1 0f 8c c7 fc ff ff 48 8b 3c 24 e8 2d 03 7f 00 e9 b9 fc ff ff e8 63 17 2e 00 <0f> 0b 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 4d 17 2e 00
RSP: 0018:ffffc90000007ae8 EFLAGS: 00010046
RAX: ffffffff81545c4d RBX: 0000000000010000 RCX: ffffffff8c8bc740
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8e1fcc2f R09: 1ffffffff1c3f985
R10: dffffc0000000000 R11: fffffbfff1c3f986 R12: ffff88807b77e800
R13: ffff88807b77e9c0 R14: 0000000000000008 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f81397d4ff8 CR3: 000000002ddb4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1747 [inline]
 __run_timers+0x569/0x800 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:sched_core_balance+0x149/0xde0 kernel/sched/core.c:6237
Code: 8b 8a e8 fa e5 09 00 4c 89 7c 24 38 4c 89 6c 24 28 e9 1a 0c 00 00 48 8b 7c 24 40 e8 e1 a2 db 08 e8 1c d2 2d 00 fb 41 83 fd 08 <0f> 83 e7 0b 00 00 4e 8d 34 fd 80 f9 64 8c 4c 89 f0 48 c1 e8 03 48
RSP: 0018:ffffffff8c807a00 EFLAGS: 00000293
RAX: cccf9c2bd7870900 RBX: ffff8880b8e3b848 RCX: cccf9c2bd7870900
RDX: dffffc0000000000 RSI: ffffffff8a8c1220 RDI: ffffffff8adf0d20
RBP: ffffffff8c807b68 R08: ffff8880b8e3ab03 R09: 1ffff110171c7560
R10: dffffc0000000000 R11: ffffed10171c7561 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffffff815b0950 R15: 0000000000000000
 do_balance_callbacks kernel/sched/core.c:4893 [inline]
 __balance_callbacks kernel/sched/core.c:4947 [inline]
 finish_lock_switch kernel/sched/core.c:5003 [inline]
 finish_task_switch+0x39d/0x8f0 kernel/sched/core.c:5122
 context_switch kernel/sched/core.c:5248 [inline]
 __schedule+0x11d9/0x40e0 kernel/sched/core.c:6562
 schedule_idle+0x4a/0x90 kernel/sched/core.c:6666
 do_idle+0x554/0x5a0 kernel/sched/idle.c:331
 cpu_startup_entry+0x3f/0x60 kernel/sched/idle.c:401
 rest_init+0x2dc/0x300 init/main.c:745
 arch_call_rest_init+0xa/0xa init/main.c:905
 start_kernel+0x493/0x53c init/main.c:1152
 secondary_startup_64_no_verify+0xcf/0xdb
 </TASK>
----------------
Code disassembly (best guess):
   0:	8b 8a e8 fa e5 09    	mov    0x9e5fae8(%rdx),%ecx
   6:	00 4c 89 7c          	add    %cl,0x7c(%rcx,%rcx,4)
   a:	24 38                	and    $0x38,%al
   c:	4c 89 6c 24 28       	mov    %r13,0x28(%rsp)
  11:	e9 1a 0c 00 00       	jmp    0xc30
  16:	48 8b 7c 24 40       	mov    0x40(%rsp),%rdi
  1b:	e8 e1 a2 db 08       	call   0x8dba301
  20:	e8 1c d2 2d 00       	call   0x2dd241
  25:	fb                   	sti
  26:	41 83 fd 08          	cmp    $0x8,%r13d
* 2a:	0f 83 e7 0b 00 00    	jae    0xc17 <-- trapping instruction
  30:	4e 8d 34 fd 80 f9 64 	lea    -0x739b0680(,%r15,8),%r14
  37:	8c
  38:	4c 89 f0             	mov    %r14,%rax
  3b:	48 c1 e8 03          	shr    $0x3,%rax
  3f:	48                   	rex.W