------------[ cut here ]------------
ODEBUG: activate active (active state 0) object: ffff888149c542d8 object type: rcu_head hint: 0x0
WARNING: lib/debugobjects.c:615 at debug_print_object lib/debugobjects.c:612 [inline], CPU#0: syz.4.8542/3118
WARNING: lib/debugobjects.c:615 at debug_object_activate+0x333/0x540 lib/debugobjects.c:842, CPU#0: syz.4.8542/3118
Modules linked in:
CPU: 0 UID: 0 PID: 3118 Comm: syz.4.8542 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:debug_print_object lib/debugobjects.c:612 [inline]
RIP: 0010:debug_object_activate+0x38b/0x540 lib/debugobjects.c:842
Code: 30 00 74 08 48 89 ef e8 33 4f 8f fd 4c 8b 4d 00 4c 89 e7 48 c7 c6 c0 89 c0 8b 4c 89 fa 8b 4c 24 04 4c 8b 44 24 10 ff 74 24 08 <67> 48 0f b9 3a 48 83 c4 08 4c 8b 7c 24 18 ff 05 bd 8b ea 0a b8 ea
RSP: 0018:ffffc90000007bd0 EFLAGS: 00010246
RAX: 1ffffffff16d824c RBX: ffff888149c542d8 RCX: 0000000000000000
RDX: ffffffff8bc08f40 RSI: ffffffff8bc089c0 RDI: ffffffff8f8c82c0
RBP: ffffffff8b6c1260 R08: ffff888149c542d8 R09: ffffffff8b6c12c0
R10: dffffc0000000000 R11: 0000000000000000 R12: ffffffff8f8c82c0
R13: 0000000000000003 R14: dffffc0000000000 R15: ffffffff8bc08f40
FS:  00007f4b115e76c0(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4b115c6d58 CR3: 0000000064deb000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 debug_rcu_head_queue kernel/rcu/rcu.h:236 [inline]
 __call_rcu_common kernel/rcu/tree.c:3104 [inline]
 call_rcu+0x43/0x890 kernel/rcu/tree.c:3239
 radix_tree_node_free lib/radix-tree.c:310 [inline]
 delete_node+0x1b6/0xa50 lib/radix-tree.c:573
 radix_tree_delete_item+0x2b6/0x400 lib/radix-tree.c:1430
 afs_cell_destroy+0x16f/0x2c0 fs/afs/cell.c:580
 rcu_do_batch kernel/rcu/tree.c:2605 [inline]
 rcu_core+0xc8e/0x1720 kernel/rcu/tree.c:2857
 handle_softirqs+0x22b/0x7c0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x60/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:iter_file_splice_write+0x1cd/0x10b0 fs/splice.c:680
Code: cd 78 ff 45 85 ed 0f 88 87 0e 00 00 4c 89 b4 24 a0 00 00 00 4c 89 ef 48 c1 e7 04 be c0 0d 00 00 e8 b8 9d d3 ff 48 89 44 24 30 <48> 85 c0 0f 84 c0 0e 00 00 4c 8b 74 24 08 4c 89 f7 e8 3d bc f2 ff
RSP: 0018:ffffc90004947820 EFLAGS: 00000286
RAX: ffff88802874c600 RBX: ffffffff8b7566f0 RCX: 0000000080000001
RDX: 0000000000000100 RSI: ffffffff8bc083c0 RDI: ffffffff8bc08380
RBP: ffffc90004947a30 R08: 0000000000000dc0 R09: 00000000ffffffff
R10: 000000000000000b R11: ffffffff81acf3a0 R12: dffffc0000000000
R13: 0000000000000010 R14: ffff8880a9f90048 R15: ffffc90004947da0
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x101/0x160 fs/splice.c:1161
 splice_direct_to_actor+0x5a8/0xcc0 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0x181/0x270 fs/splice.c:1230
 do_sendfile+0x4da/0x7e0 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64+0x13e/0x190 fs/read_write.c:1417
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4b1078f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4b115e7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f4b109e5fa0 RCX: 00007f4b1078f749
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f4b10813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020fffe82 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4b109e6038 R14: 00007f4b109e5fa0 R15: 00007ffe5f018088
 </TASK>
----------------
Code disassembly (best guess):
   0:	30 00                	xor    %al,(%rax)
   2:	74 08                	je     0xc
   4:	48 89 ef             	mov    %rbp,%rdi
   7:	e8 33 4f 8f fd       	call   0xfd8f4f3f
   c:	4c 8b 4d 00          	mov    0x0(%rbp),%r9
  10:	4c 89 e7             	mov    %r12,%rdi
  13:	48 c7 c6 c0 89 c0 8b 	mov    $0xffffffff8bc089c0,%rsi
  1a:	4c 89 fa             	mov    %r15,%rdx
  1d:	8b 4c 24 04          	mov    0x4(%rsp),%ecx
  21:	4c 8b 44 24 10       	mov    0x10(%rsp),%r8
  26:	ff 74 24 08          	push   0x8(%rsp)
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	48 83 c4 08          	add    $0x8,%rsp
  33:	4c 8b 7c 24 18       	mov    0x18(%rsp),%r15
  38:	ff 05 bd 8b ea 0a    	incl   0xaea8bbd(%rip)        # 0xaea8bfb
  3e:	b8                   	.byte 0xb8
  3f:	ea                   	(bad)