------------[ cut here ]------------
cpu_t != t
WARNING: arch/x86/kernel/cpu/mce/core.c:1770 at mce_timer_fn+0x289/0x2e0 arch/x86/kernel/cpu/mce/core.c:1770, CPU#3: udevd/5967
Modules linked in:
CPU: 3 UID: 0 PID: 5967 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:mce_timer_fn+0x289/0x2e0 arch/x86/kernel/cpu/mce/core.c:1770
Code: 58 00 4d 01 e4 4d 39 ec 4d 0f 47 e5 31 ff 4c 89 e6 e8 8b a4 58 00 4d 85 e4 0f 84 20 ff ff ff e9 f7 fe ff ff e8 d8 a9 58 00 90 <0f> 0b 90 e9 cf fd ff ff 4c 89 f6 48 c7 c7 00 cf 9f 8e e8 a0 e9 85
RSP: 0018:ffffc900006f8c30 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88806a723440 RCX: ffffffff81f5713d
RDX: ffff88802afb0000 RSI: ffffffff81b1c9a8 RDI: ffffffff8e470938
RBP: ffff88806a523440 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003
R13: 1ffff920000df18e R14: ffffffff81b1c720 R15: 0000000000000001
FS:  00007fcab33b2880(0000) GS:ffff8880d60ec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4fdc1eb7c0 CR3: 000000002c5c5000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers+0x757/0xb00 kernel/time/timer.c:2374
 __run_timer_base kernel/time/timer.c:2386 [inline]
 __run_timer_base kernel/time/timer.c:2378 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2395
 run_timer_softirq+0x10/0x50 kernel/time/timer.c:2403
 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:198
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 96 50 28 f6 48 89 df e8 1e a0 28 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 a5 ad 17 f6 65 8b 05 ee 86 a5 08 85 c0 74 16 5b
RSP: 0018:ffffc90003b375c8 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffffffff9b96c840 RCX: 0000000000000080
RDX: 0000000000000000 RSI: ffffffff8e1a9056 RDI: ffffffff8c400380
RBP: 0000000000000282 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000004 R14: 0000000000000004 R15: ffff88805417c900
 __debug_check_no_obj_freed lib/debugobjects.c:1180 [inline]
 debug_check_no_obj_freed+0x31f/0x630 lib/debugobjects.c:1201
 slab_free_hook mm/slub.c:2608 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x3d8/0x6c0 mm/slub.c:6692
 tomoyo_check_open_permission+0x1a2/0x3c0 security/tomoyo/file.c:791
 tomoyo_file_open+0x6b/0x90 security/tomoyo/tomoyo.c:334
 security_file_open+0xb5/0x1e0 security/security.c:2739
 do_dentry_open+0x588/0x14d0 fs/open.c:924
 vfs_open+0x82/0x3f0 fs/open.c:1052
 do_open fs/namei.c:4700 [inline]
 path_openat+0x2873/0x4280 fs/namei.c:4863
 do_file_open+0x20e/0x430 fs/namei.c:4892
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1368
 do_sys_open fs/open.c:1374 [inline]
 __do_sys_openat fs/open.c:1390 [inline]
 __se_sys_openat fs/open.c:1385 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1385
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcab2ca7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffca813f8e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fcab33b2880 RCX: 00007fcab2ca7407
RDX: 0000000000080000 RSI: 00007ffca813fa60 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055f15bc5b7f5
R13: 000055f15bc5b7f5 R14: 0000000000000001 R15: 000055f15bc76140
 </TASK>
----------------
Code disassembly (best guess):
   0:	f5                   	cmc
   1:	53                   	push   %rbx
   2:	48 8b 74 24 10       	mov    0x10(%rsp),%rsi
   7:	48 89 fb             	mov    %rdi,%rbx
   a:	48 83 c7 18          	add    $0x18,%rdi
   e:	e8 96 50 28 f6       	call   0xf62850a9
  13:	48 89 df             	mov    %rbx,%rdi
  16:	e8 1e a0 28 f6       	call   0xf628a039
  1b:	f7 c5 00 02 00 00    	test   $0x200,%ebp
  21:	75 23                	jne    0x46
  23:	9c                   	pushf
  24:	58                   	pop    %rax
  25:	f6 c4 02             	test   $0x2,%ah
  28:	75 37                	jne    0x61
* 2a:	bf 01 00 00 00       	mov    $0x1,%edi <-- trapping instruction
  2f:	e8 a5 ad 17 f6       	call   0xf617add9
  34:	65 8b 05 ee 86 a5 08 	mov    %gs:0x8a586ee(%rip),%eax        # 0x8a58729
  3b:	85 c0                	test   %eax,%eax
  3d:	74 16                	je     0x55
  3f:	5b                   	pop    %rbx