=============================
[ BUG: Invalid wait context ]
6.13.0-syzkaller-07048-gae8b53aac327 #0 Not tainted
-----------------------------
syz.0.408/7535 is trying to lock:
ffffffff8e3a62b8 (stack_list_lock){-.-.}-{3:3}, at: add_stack_record_to_list mm/page_owner.c:182 [inline]
ffffffff8e3a62b8 (stack_list_lock){-.-.}-{3:3}, at: inc_stack_record_count mm/page_owner.c:214 [inline]
ffffffff8e3a62b8 (stack_list_lock){-.-.}-{3:3}, at: __set_page_owner+0x5ac/0x790 mm/page_owner.c:329
other info that might help us debug this:
context-{2:2}
no locks held by syz.0.408/7535.
stack backtrace:
CPU: 3 UID: 0 PID: 7535 Comm: syz.0.408 Not tainted 6.13.0-syzkaller-07048-gae8b53aac327 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4828 [inline]
 check_wait_context kernel/locking/lockdep.c:4900 [inline]
 __lock_acquire+0x878/0x3c40 kernel/locking/lockdep.c:5178
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162
 add_stack_record_to_list mm/page_owner.c:182 [inline]
 inc_stack_record_count mm/page_owner.c:214 [inline]
 __set_page_owner+0x5ac/0x790 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x221/0x2470 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x2c8/0x620 mm/mempolicy.c:2269
 stack_depot_save_flags+0x8e0/0x9e0 lib/stackdepot.c:627
 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48
 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:544
 task_work_add+0xc0/0x3b0 kernel/task_work.c:77
 __run_posix_cpu_timers kernel/time/posix-cpu-timers.c:1223 [inline]
 run_posix_cpu_timers+0x69f/0x7d0 kernel/time/posix-cpu-timers.c:1422
 update_process_times+0x1a1/0x2d0 kernel/time/timer.c:2522
 tick_sched_handle kernel/time/tick-sched.c:276 [inline]
 tick_nohz_handler+0x376/0x530 kernel/time/tick-sched.c:297
 __run_hrtimer kernel/time/hrtimer.c:1738 [inline]
 __hrtimer_run_queues+0x5fb/0xae0 kernel/time/hrtimer.c:1802
 hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1864
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0023:0xf706e64f
Code: 00 89 4c 24 04 8d ae 0c 30 02 00 88 5c 24 17 89 7c 24 0c 89 54 24 1c 89 5c 24 18 8b 7c 24 0c 89 c2 81 e2 ff 1f 00 00 8b 34 d7 <8b> 7c d7 04 89 f1 89 fb 33 0c 24 33 5c 24 04 09 d9 74 4e 09 fe 74
RSP: 002b:00000000fff7fd68 EFLAGS: 00000202
RAX: 00000000891db164 RBX: 000000000000000f RCX: 00000000ffffffff
RDX: 0000000000001164 RSI: 00000000891db164 RDI: 00000000f73d2000
RBP: 00000000f73d0000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 89 4c 24 04 8d    	add    %cl,-0x72fbdbb4(%rcx)
   6:	ae                   	scas   %es:(%rdi),%al
   7:	0c 30                	or     $0x30,%al
   9:	02 00                	add    (%rax),%al
   b:	88 5c 24 17          	mov    %bl,0x17(%rsp)
   f:	89 7c 24 0c          	mov    %edi,0xc(%rsp)
  13:	89 54 24 1c          	mov    %edx,0x1c(%rsp)
  17:	89 5c 24 18          	mov    %ebx,0x18(%rsp)
  1b:	8b 7c 24 0c          	mov    0xc(%rsp),%edi
  1f:	89 c2                	mov    %eax,%edx
  21:	81 e2 ff 1f 00 00    	and    $0x1fff,%edx
  27:	8b 34 d7             	mov    (%rdi,%rdx,8),%esi
* 2a:	8b 7c d7 04          	mov    0x4(%rdi,%rdx,8),%edi <-- trapping instruction
  2e:	89 f1                	mov    %esi,%ecx
  30:	89 fb                	mov    %edi,%ebx
  32:	33 0c 24             	xor    (%rsp),%ecx
  35:	33 5c 24 04          	xor    0x4(%rsp),%ebx
  39:	09 d9                	or     %ebx,%ecx
  3b:	74 4e                	je     0x8b
  3d:	09 fe                	or     %edi,%esi
  3f:	74                   	.byte 0x74