------------[ cut here ]------------ kernel BUG at mm/swap_cgroup.c:78! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5817 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:swap_cgroup_record+0x19c/0x1c0 mm/swap_cgroup.c:78 Code: 02 e9 6d ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 35 ff ff ff 4c 89 f7 e8 ff 79 f6 ff e9 28 ff ff ff e8 55 a9 8f ff 90 <0f> 0b e8 4d a9 8f ff 4c 89 f7 48 c7 c6 60 f7 98 8b e8 0e b9 f6 fe RSP: 0018:ffffc90003fae080 EFLAGS: 00010093 RAX: ffffffff8231516b RBX: 0000000000007974 RCX: ffff88802f800000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 RBP: 0000000000000004 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520007f5c00 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffc90003fb1000 R15: 0000000000000004 FS: 0000555566e3b500(0000) GS:ffff8881259bb000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f945cd11000 CR3: 000000006af26000 CR4: 00000000003526f0 Call Trace: memcg1_swapout+0x2fa/0x830 mm/memcontrol-v1.c:645 __remove_mapping+0xac5/0xe30 mm/vmscan.c:764 shrink_folio_list+0x28a8/0x5200 mm/vmscan.c:1523 evict_folios+0x473e/0x57f0 mm/vmscan.c:4729 try_to_shrink_lruvec+0x8be/0xb60 mm/vmscan.c:4892 lru_gen_shrink_lruvec mm/vmscan.c:5041 [inline] shrink_lruvec+0x4a3/0x2a40 mm/vmscan.c:5802 shrink_node_memcgs mm/vmscan.c:6038 [inline] shrink_node+0xa38/0x3720 mm/vmscan.c:6079 shrink_zones mm/vmscan.c:6318 [inline] do_try_to_free_pages+0x668/0x18a0 mm/vmscan.c:6380 try_to_free_mem_cgroup_pages+0x2b6/0x730 mm/vmscan.c:6701 try_charge_memcg+0xa2d/0x1280 mm/memcontrol.c:2414 try_charge mm/memcontrol.c:2556 [inline] charge_memcg+0x9f/0x180 mm/memcontrol.c:4732 mem_cgroup_swapin_charge_folio+0x262/0x390 mm/memcontrol.c:4818 __swap_cache_prepare_and_add+0x52a/0x700 mm/swap_state.c:518 swap_cache_alloc_folio+0xf1/0x240 mm/swap_state.c:576 swap_cluster_readahead+0x50b/0x640 mm/swap_state.c:769 swapin_readahead+0x189/0xc50 mm/swap_state.c:925 do_swap_page+0x562/0x57a0 mm/memory.c:4740 handle_pte_fault mm/memory.c:6258 [inline] __handle_mm_fault mm/memory.c:6393 [inline] handle_mm_fault+0x1277/0x32b0 mm/memory.c:6562 do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x71/0xd0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7f386e74e349 Code: 48 8d 45 17 31 db 48 83 f8 1f 76 0c 48 83 e0 f0 48 8d 58 ef 48 c1 eb 04 64 48 8b 14 25 c8 ff ff ff 48 85 d2 0f 84 b7 00 00 00 <48> 3b 1d 38 c9 26 00 0f 82 e2 00 00 00 80 3d fb d1 26 00 00 0f 85 RSP: 002b:00007ffdc43b2d60 EFLAGS: 00010206 RAX: 0000000000008040 RBX: 0000000000000802 RCX: 00007ffdc43b2db0 RDX: 0000555566e3be90 RSI: 0000000000000001 RDI: 0000000000008030 RBP: 0000000000008030 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000001000 R11: 0000000000000206 R12: 00007ffdc43b3fb0 R13: 00007f386e813d7d R14: 000000000005e3fb R15: 00007ffdc43b3ff0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:swap_cgroup_record+0x19c/0x1c0 mm/swap_cgroup.c:78 Code: 02 e9 6d ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 35 ff ff ff 4c 89 f7 e8 ff 79 f6 ff e9 28 ff ff ff e8 55 a9 8f ff 90 <0f> 0b e8 4d a9 8f ff 4c 89 f7 48 c7 c6 60 f7 98 8b e8 0e b9 f6 fe RSP: 0018:ffffc90003fae080 EFLAGS: 00010093 RAX: ffffffff8231516b RBX: 0000000000007974 RCX: ffff88802f800000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 RBP: 0000000000000004 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520007f5c00 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffc90003fb1000 R15: 0000000000000004 FS: 0000555566e3b500(0000) GS:ffff8881259bb000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f945cd11000 CR3: 000000006af26000 CR4: 00000000003526f0