------------[ cut here ]------------
WARNING: CPU: 3 PID: 16327 at lib/radix-tree.c:572 delete_node+0x223/0x8d0 lib/radix-tree.c:572
Modules linked in:
CPU: 3 UID: 0 PID: 16327 Comm: kworker/3:2H Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_highpri snd_vmidi_output_work
RIP: 0010:delete_node+0x223/0x8d0 lib/radix-tree.c:572
Code: 9e 49 f6 41 bc 01 00 00 00 e8 99 6d 63 f6 44 89 e0 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f e9 93 dd 07 00 e8 7e 6d 63 f6 90 <0f> 0b 90 e8 75 6d 63 f6 48 c7 c6 00 c3 58 8b 4c 89 e7 e8 c6 9d 49
RSP: 0018:ffffc900005e8c80 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880427a1160 RCX: ffffffff8b58e983
RDX: ffff88800df6c900 RSI: ffffffff8b58ea12 RDI: ffff8880427a11a8
RBP: ffff88804cafeec0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000002b81 R12: ffff88804cafeed8
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000004000004
FS: 0000000000000000(0000) GS:ffff888097b0d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000080035000 CR3: 000000005d1db000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: ffffffffeff7ff15 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__radix_tree_delete+0x193/0x3d0 lib/radix-tree.c:1379
radix_tree_delete_item+0xea/0x230 lib/radix-tree.c:1430
afs_cell_destroy+0x1db/0x310 fs/afs/cell.c:580
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0x79c/0x1530 kernel/rcu/tree.c:2861
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 d1 37 f6 48 89 df e8 8e 25 38 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 b5 2d 28 f6 65 8b 05 7e b5 40 08 85 c0 74 16 5b
RSP: 0018:ffffc90007f3fb40 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffff888044dcc238 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8da2967a RDI: ffffffff8bf07940
RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff908253d7 R11: 0000000000000001 R12: ffff888044dcc238
R13: 0000000000000293 R14: 0000000000000001 R15: ffff88804a124000
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
class_spinlock_irqsave_destructor include/linux/spinlock.h:585 [inline]
snd_rawmidi_transmit+0x117/0x160 sound/core/rawmidi.c:1486
snd_vmidi_output_work+0x111/0x390 sound/core/seq/seq_virmidi.c:151
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
process_scheduled_works kernel/workqueue.c:3346 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 a6 d1 37 f6 call 0xf637d1b9
13: 48 89 df mov %rbx,%rdi
16: e8 8e 25 38 f6 call 0xf63825a9
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 b5 2d 28 f6 call 0xf6282de9
34: 65 8b 05 7e b5 40 08 mov %gs:0x840b57e(%rip),%eax # 0x840b5b9
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx