================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
cmp/5700 is leaving the kernel with locks still held!
1 lock held by cmp/5700:
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290
------------[ cut here ]------------
Voluntary context switch within RCU read-side critical section!
WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332, CPU#3: cmp/5700
Modules linked in:
CPU: 3 UID: 0 PID: 5700 Comm: cmp Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332
Code: c1 ea 03 80 3c 02 00 0f 85 9b 0b 00 00 48 8b 53 28 b9 01 00 00 00 4c 89 ef e8 a3 cf fe ff e9 1d f9 ff ff 48 8d 3d 37 ac ed 0e <67> 48 0f b9 3a e9 99 f8 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0000:ffffc90003b7fcf0 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff88802b53c3c0 RCX: ffffffff81ed2401
RDX: 0000000000000000 RSI: ffffffff8c1c2080 RDI: ffffffff90db4460
RBP: ffff88802a368000 R08: 0000000000000000 R09: fffffbfff21af62a
R10: ffffffff90d7b157 R11: 0000000000000003 R12: 0000000000000000
R13: ffff88802a3684c4 R14: ffff88802b53b380 R15: ffffffff90d7e4c4
FS:  00007f15be3a5c80(0000) GS:ffff888097480000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f15be70c0f0 CR3: 000000004fb3c000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __schedule+0x276/0x6820 kernel/sched/core.c:7043
 __schedule_loop kernel/sched/core.c:7267 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7282
 __exit_to_user_mode_loop kernel/entry/common.c:54 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:252 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:323 [inline]
 irqentry_exit+0x359/0x790 kernel/entry/common.c:162
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0033:0x7f15be7278ec
Code: 1f 80 00 00 00 00 48 8b 31 8b 51 08 4c 01 fe 48 83 fa 26 74 0a 48 83 fa 08 0f 85 ef 3c ff ff 48 8b 51 10 48 83 c1 18 4c 01 fa <48> 89 16 48 39 d9 72 d4 4d 8b 9a 08 02 00 00 4d 85 db 0f 84 ec 0b
RSP: 002b:00007ffc356f6830 EFLAGS: 00010206
RAX: 00007f15be64fcd0 RBX: 00007f15be659280 RCX: 00007f15be655d40
RDX: 00007f15be65fa00 RSI: 00007f15be70c0f0 RDI: 00007f15be65d4c8
RBP: 00007ffc356f6950 R08: 00007f15be65af90 R09: 00007f15be65d4c8
R10: 00007f15be7100c0 R11: 0000000000000000 R12: 00007ffc356f68e0
R13: 00007ffc356f68e0 R14: 00007f15be7100c0 R15: 00007f15be64e000
 </TASK>
----------------
Code disassembly (best guess):
   0:	c1 ea 03             	shr    $0x3,%edx
   3:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   7:	0f 85 9b 0b 00 00    	jne    0xba8
   d:	48 8b 53 28          	mov    0x28(%rbx),%rdx
  11:	b9 01 00 00 00       	mov    $0x1,%ecx
  16:	4c 89 ef             	mov    %r13,%rdi
  19:	e8 a3 cf fe ff       	call   0xfffecfc1
  1e:	e9 1d f9 ff ff       	jmp    0xfffff940
  23:	48 8d 3d 37 ac ed 0e 	lea    0xeedac37(%rip),%rdi        # 0xeedac61
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 99 f8 ff ff       	jmp    0xfffff8cd
  34:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  3b:	fc ff df
  3e:	48                   	rex.W
  3f:	8d                   	.byte 0x8d