INFO: task syz-executor:9239 blocked for more than 143 seconds.
      Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21176 pid:9239  tgid:9239  ppid:1      task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746
 lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
 jfs_umount+0x2ef/0x3c0 fs/jfs/jfs_umount.c:114
 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x135/0x2c0 fs/super.c:642
 kill_block_super+0x44/0x90 fs/super.c:1710
 deactivate_locked_super+0xbc/0x130 fs/super.c:473
 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1435
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work+0x5e/0x80 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x9a/0x120 kernel/entry/common.c:218
 do_syscall_64+0x103/0x210 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fedf698fc97
RSP: 002b:00007ffe49cd7658 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fedf6a1089d RCX: 00007fedf698fc97
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe49cd7710
RBP: 00007ffe49cd7710 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe49cd87a0
R13: 00007fedf6a1089d R14: 0000000000085636 R15: 00007ffe49cd87e0
 </TASK>
INFO: task syz-executor:9351 blocked for more than 144 seconds.
      Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21272 pid:9351  tgid:9351  ppid:1      task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746
 lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
 jfs_umount+0x2ef/0x3c0 fs/jfs/jfs_umount.c:114
 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x135/0x2c0 fs/super.c:642
 kill_block_super+0x44/0x90 fs/super.c:1710
 deactivate_locked_super+0xbc/0x130 fs/super.c:473
 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1435
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work+0x5e/0x80 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x9a/0x120 kernel/entry/common.c:218
 do_syscall_64+0x103/0x210 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc83ed8fc97
RSP: 002b:00007ffe9c5955d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fc83ee1089d RCX: 00007fc83ed8fc97
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe9c595690
RBP: 00007ffe9c595690 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe9c596720
R13: 00007fc83ee1089d R14: 0000000000083f21 R15: 00007ffe9c596760
 </TASK>

Showing all locks held in the system:
2 locks held by ksoftirqd/1/23:
 #0: ffff8880b8839b58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 kernel/sched/core.c:613
 #1: ffff8880b8923b08 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x39e/0x6d0 kernel/sched/psi.c:987
1 lock held by khungtaskd/31:
 #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6764
2 locks held by getty/5579:
 #0: ffff88803349a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900036d42f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
3 locks held by kworker/1:5/5889:
3 locks held by kworker/u8:8/5950:
3 locks held by kworker/1:11/7896:
 #0: ffff88801a078d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88801a078d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
 #1: ffffc9002673fc60 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9002673fc60 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
 #2: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:304 [inline]
 #2: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f4/0x730 kernel/rcu/tree_exp.h:998
1 lock held by syz.7.490/8190:
 #0: ffff8880687ba0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:58 [inline]
 #0: ffff8880687ba0e0 (&type->s_umount_key#70){++++}-{4:4}, at: super_lock+0x2a9/0x3b0 fs/super.c:120
1 lock held by syz.2.536/8347:
 #0: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:336 [inline]
 #0: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b7/0x730 kernel/rcu/tree_exp.h:998
2 locks held by syz-executor/9239:
 #0: ffff88803e3120e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88803e3120e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88803e3120e0 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
 #1: ffffffff8e366b88 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/9351:
 #0: ffff8880687ba0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff8880687ba0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff8880687ba0e0 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
 #1: ffffffff8e366b88 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/9375:
 #0: ffff888087bce0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff888087bce0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff888087bce0e0 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
 #1: ffffffff8e366b88 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/9579:
 #0: ffff88805a10c0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88805a10c0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88805a10c0e0 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
 #1: ffffffff8e366b88 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/9697:
 #0: ffff88804ac0a0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88804ac0a0e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88804ac0a0e0 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
 #1: ffffffff8e366b88 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/9985:
 #0: ffff8880886a20e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff8880886a20e0 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff8880886a20e0 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
 #1: ffffffff8e366b88 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xb4/0x520 fs/jfs/jfs_logmgr.c:1444
3 locks held by syz-executor/11087:
 #0: ffff888032f14d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
 #0: ffff888032f14d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
 #1: ffff888032f14078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
3 locks held by syz-executor/11193:
 #0: ffff888092eecd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
 #0: ffff888092eecd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
 #1: ffff888092eec078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
2 locks held by syz.1.1241/11358:
 #0: ffff88805f05a0e0 (&type->s_umount_key#70){++++}-{4:4}, at: do_remount fs/namespace.c:3365 [inline]
 #0: ffff88805f05a0e0 (&type->s_umount_key#70){++++}-{4:4}, at: path_mount+0xcd2/0xfe0 fs/namespace.c:4203
 #1: ffffffff8e366b88 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogOpen+0xca/0xfb0 fs/jfs/jfs_logmgr.c:1071
3 locks held by syz-executor/11361:
 #0: ffff888044f8cd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
 #0: ffff888044f8cd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
 #1: ffff888044f8c078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
3 locks held by syz-executor/11483:
 #0: ffff88803b1bcd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
 #0: ffff88803b1bcd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
 #1: ffff88803b1bc078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
1 lock held by syz.5.1279/11543:
 #0: ffffffff8f2f37c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline]
 #0: ffffffff8f2f37c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390
4 locks held by syz.4.1283/11556:
 #0: ffff88805d000d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
 #0: ffff88805d000d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
 #1: ffff88805d000078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
 #2: ffffffff8f4599c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
 #3: ffff888080423338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 net/bluetooth/l2cap_core.c:1761

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
 watchdog+0xfee/0x1030 kernel/hung_task.c:437
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5950 Comm: kworker/u8:8 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:__lock_acquire+0xac5/0xd20 kernel/locking/lockdep.c:5243
Code: 00 00 4c 89 fe 8b 54 24 08 4c 89 e9 e8 24 38 00 00 45 31 e4 85 c0 74 3b 41 f6 47 22 10 75 2e 48 8b 1c 24 4c 89 ab e0 0a 00 00 <8b> 83 e8 0a 00 00 ff c0 89 83 e8 0a 00 00 83 f8 30 0f 83 7c 01 00
RSP: 0018:ffffc900000072b8 EFLAGS: 00000046
RAX: 0000000000000001 RBX: ffff8880305e1e00 RCX: 996a718b20ff2800
RDX: 0000000000000000 RSI: ffff8880305e2a08 RDI: ffff8880305e1e00
RBP: ffff8880305e28f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff817199f5 R12: 0000000000000000
R13: bc430a3b14800c04 R14: 0000000059e54395 R15: ffff8880305e2a08
FS:  0000000000000000(0000) GS:ffff8881260cc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3724bff000 CR3: 000000000dd36000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5866
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock include/linux/rcupdate.h:841 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
 unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479
 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:319 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4161 [inline]
 slab_alloc_node mm/slub.c:4210 [inline]
 kmem_cache_alloc_node_noprof+0x1bb/0x3c0 mm/slub.c:4262
 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:658
 skb_copy+0x188/0x800 net/core/skbuff.c:2131
 mac80211_hwsim_tx_frame_no_nl+0xc85/0x1180 drivers/net/wireless/virtual/mac80211_hwsim.c:1866
 mac80211_hwsim_tx_frame+0x1b5/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2217
 mac80211_hwsim_beacon_tx+0x3f6/0x860 drivers/net/wireless/virtual/mac80211_hwsim.c:2317
 __iterate_interfaces+0x2ab/0x590 net/mac80211/util.c:761
 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:797
 mac80211_hwsim_beacon+0xbb/0x1c0 drivers/net/wireless/virtual/mac80211_hwsim.c:2347
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
 handle_softirqs+0x286/0x870 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x3a/0x70 kernel/kcov.c:217
Code: 92 65 8b 15 48 81 b5 10 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 3c 16 00 00 00 74 2c 8b 91 18 16 00 00 83 fa 02 <75> 21 48 8b 91 20 16 00 00 48 8b 32 48 8d 7e 01 8b 89 1c 16 00 00
RSP: 0018:ffffc900048f76f8 EFLAGS: 00000293
RAX: ffffffff81b45620 RBX: ffff8880b883ad40 RCX: ffff8880305e1e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900048f7860 R08: ffffffff8f7ec977 R09: 1ffffffff1efd92e
R10: dffffc0000000000 R11: fffffbfff1efd92f R12: 1ffff11017127e99
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8880b893f4c8
 csd_lock_wait kernel/smp.c:340 [inline]
 smp_call_function_many_cond+0xe80/0x11c0 kernel/smp.c:885
 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1052
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:2455 [inline]
 text_poke_bp_batch+0x84d/0x940 arch/x86/kernel/alternative.c:-1
 text_poke_flush arch/x86/kernel/alternative.c:2856 [inline]
 text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2863
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_disable_cpuslocked+0xc5/0x1b0 kernel/jump_label.c:240
 static_key_disable+0x1a/0x20 kernel/jump_label.c:248
 toggle_allocation_gate+0x1a1/0x240 mm/kfence/core.c:855
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>