------------[ cut here ]------------ task_rq(p) != rq WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656, CPU#1: syz.0.1721/9719 Modules linked in: CPU: 1 UID: 0 PID: 9719 Comm: syz.0.1721 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656 Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 f5 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82 RSP: 0018:ffffc9000e9def80 EFLAGS: 00010006 RAX: ffff8880b863ba40 RBX: ffff8880b873ba40 RCX: ffffffff8197d8ae RDX: 0000000000000000 RSI: ffff88805e343e00 RDI: ffff8880b873ba40 RBP: dffffc0000000000 R08: ffffffff8fcf390f R09: 1ffffffff1f9e721 R10: dffffc0000000000 R11: fffffbfff1f9e722 R12: dffffc0000000000 R13: 1ffff110170e78d6 R14: ffff88805e343e00 R15: ffffffff8dc257d0 FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f45c945b028 CR3: 0000000056a9a000 CR4: 00000000003526f0 DR0: 0000000000000009 DR1: 00000000000000c9 DR2: 00000000000000f3 DR3: 00000000000000c0 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: set_next_task_fair+0xa68/0xce0 kernel/sched/fair.c:15065 put_prev_set_next_task kernel/sched/sched.h:2770 [inline] pick_next_task kernel/sched/core.c:6442 [inline] __schedule+0x3e03/0x5550 kernel/sched/core.c:7143 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__preempt_count_add kernel/rcu/tree.c:748 [inline] RIP: 0010:rcu_is_watching+0x6/0xb0 kernel/rcu/tree.c:751 Code: e8 4f 1a 4d 03 eb cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 <41> 56 53 65 ff 05 80 d4 10 11 e8 5b 96 93 09 89 c3 83 f8 08 73 65 RSP: 0018:ffffc9000e9df340 EFLAGS: 00000202 RAX: ffffffff8238be95 RBX: 0000000000000001 RCX: ffff88805f063e00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff940002a7fd9 R12: ffffea000153fef0 R13: dffffc0000000000 R14: ffffea000153fec0 R15: ffffffff8238be64 rcu_read_lock include/linux/rcupdate.h:841 [inline] page_table_check_clear+0x15e/0x4f0 mm/page_table_check.c:77 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline] get_and_clear_full_ptes include/linux/pgtable.h:879 [inline] zap_present_folio_ptes mm/memory.c:1648 [inline] zap_present_ptes mm/memory.c:1730 [inline] do_zap_pte_range mm/memory.c:1832 [inline] zap_pte_range mm/memory.c:1934 [inline] zap_pmd_range mm/memory.c:2020 [inline] zap_pud_range mm/memory.c:2048 [inline] zap_p4d_range mm/memory.c:2069 [inline] __zap_vma_range+0x354e/0x4ab0 mm/memory.c:2109 unmap_vmas+0x3ac/0x570 mm/memory.c:2178 exit_mmap+0x280/0x9e0 mm/mmap.c:1300 __mmput+0xcb/0x3e0 kernel/fork.c:1182 exit_mm+0x18e/0x250 kernel/exit.c:610 do_exit+0x6a2/0x22c0 kernel/exit.c:992 do_group_exit+0x21b/0x2d0 kernel/exit.c:1147 get_signal+0x1284/0x1330 kernel/signal.c:3038 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x104/0x710 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1483ccce59 Code: Unable to access opcode bytes at 0x7f1483ccce2f. RSP: 002b:00007f1481f1e028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d RAX: 0000000000000000 RBX: 00007f1483f45fa0 RCX: 00007f1483ccce59 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000003e RBP: 00007f1483d62e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1483f46038 R14: 00007f1483f45fa0 R15: 00007ffdd2beefe8 ---------------- Code disassembly (best guess): 0: e8 4f 1a 4d 03 call 0x34d1a54 5: eb cc jmp 0xffffffd3 7: 66 66 66 66 2e 0f 1f data16 data16 data16 cs nopw 0x0(%rax,%rax,1) e: 84 00 00 00 00 00 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: 90 nop 23: 90 nop 24: f3 0f 1e fa endbr64 28: 41 57 push %r15 * 2a: 41 56 push %r14 <-- trapping instruction 2c: 53 push %rbx 2d: 65 ff 05 80 d4 10 11 incl %gs:0x1110d480(%rip) # 0x1110d4b4 34: e8 5b 96 93 09 call 0x9939694 39: 89 c3 mov %eax,%ebx 3b: 83 f8 08 cmp $0x8,%eax 3e: 73 65 jae 0xa5