------------[ cut here ]------------
ODEBUG: activate active (active state 1) object: ffff88805ba51b98 object type: rcu_head hint: 0x0
WARNING: CPU: 1 PID: 8812 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 8812 Comm: syz.0.699 Not tainted 6.14.0-syzkaller-11270-g08733088b566 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 41 56 48 8b 14 dd c0 48 f4 8b 4c 89 e6 48 c7 c7 40 3d f4 8b e8 df e7 a7 fc 90 <0f> 0b 90 90 58 83 05 56 2a b3 0b 01 48 83 c4 18 5b 5d 41 5c 41 5d
RSP: 0018:ffffc90000a08ad8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff817abc58
RDX: ffff888079682440 RSI: ffffffff817abc65 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8bf44360
R13: ffffffff8b8e9540 R14: 0000000000000000 R15: ffffc90000a08b98
FS: 00007ff3b06d16c0(0000) GS:ffff888124acf000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000bad000 CR3: 0000000036b38000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x2bc/0x4c0 lib/debugobjects.c:842
debug_rcu_head_queue kernel/rcu/rcu.h:224 [inline]
__call_rcu_common.constprop.0+0x2c/0x9f0 kernel/rcu/tree.c:3067
radix_tree_node_free lib/radix-tree.c:310 [inline]
delete_node+0x1fc/0x8d0 lib/radix-tree.c:573
__radix_tree_delete+0x193/0x3d0 lib/radix-tree.c:1379
radix_tree_delete_item+0xea/0x230 lib/radix-tree.c:1430
afs_cell_destroy+0x1db/0x310 fs/afs/cell.c:522
rcu_do_batch kernel/rcu/tree.c:2568 [inline]
rcu_core+0x799/0x14e0 kernel/rcu/tree.c:2824
handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x0/0x20 kernel/kcov.c:299
Code: 0c 24 48 89 f2 48 89 fe bf 06 00 00 00 e9 b8 fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 0c 24 40 0f b6 d6 40 0f b6 f7 bf 01 00 00 00 e9
vkms_vblank_simulate: vblank timer overrun
RSP: 0018:ffffc9000452f7f0 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88802a318d90 RCX: ffffc90005323000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: ffffc9000452f938 R14: 0000000000000300 R15: 0000000000000002
rcu_read_unlock include/linux/rcupdate.h:869 [inline]
mt_find+0x73b/0xa30 lib/maple_tree.c:6908
find_vma+0xbf/0x140 mm/mmap.c:913
lock_mm_and_find_vma+0x62/0x6e0 mm/memory.c:6302
do_user_addr_fault+0x2b0/0x1430 arch/x86/mm/fault.c:1360
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:fault_in_readable+0x160/0x200 mm/gup.c:2241
Code: 42 e8 45 31 f6 e8 70 55 b7 ff 48 39 eb 75 13 eb 2e e8 64 55 b7 ff 48 81 c3 00 10 00 00 48 39 eb 74 1d e8 53 55 b7 ff 45 89 f7 <8a> 03 31 ff 44 89 fe 88 44 24 28 e8 70 50 b7 ff 45 85 ff 74 d2 e8
RSP: 0018:ffffc9000452fb10 EFLAGS: 00050246
RAX: 0000000000080000 RBX: 0000200000bad000 RCX: ffffc90005323000
RDX: 0000000000080000 RSI: ffffffff8203dddd RDI: 0000000000000007
RBP: 0000200000bae000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000100
R13: 0000200000bad000 R14: 0000000000000000 R15: 0000000000000000
fault_in_iov_iter_readable+0x101/0x2c0 lib/iov_iter.c:94
generic_perform_write+0x7b4/0x930 mm/filemap.c:4163
shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3477
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x5ba/0x1180 fs/read_write.c:684
ksys_write+0x12a/0x240 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff3af78d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff3b06d1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff3af9a5fa0 RCX: 00007ff3af78d169
RDX: 00000000fffffd9d RSI: 0000200000000100 RDI: 0000000000000006
RBP: 00007ff3af80e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff3af9a5fa0 R15: 00007ffe6c2217c8
----------------
Code disassembly (best guess):
0: 0c 24 or $0x24,%al
2: 48 89 f2 mov %rsi,%rdx
5: 48 89 fe mov %rdi,%rsi
8: bf 06 00 00 00 mov $0x6,%edi
d: e9 b8 fe ff ff jmp 0xfffffeca
12: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
19: 00
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
* 2a: f3 0f 1e fa endbr64 <-- trapping instruction
2e: 48 8b 0c 24 mov (%rsp),%rcx
32: 40 0f b6 d6 movzbl %sil,%edx
36: 40 0f b6 f7 movzbl %dil,%esi
3a: bf 01 00 00 00 mov $0x1,%edi
3f: e9 .byte 0xe9