------------[ cut here ]------------ task_rq(p) != rq WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656, CPU#0: syz.2.2229/12280 Modules linked in: CPU: 0 UID: 0 PID: 12280 Comm: syz.2.2229 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656 Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 f5 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82 RSP: 0018:ffffc90006956fe0 EFLAGS: 00010087 RAX: ffff8880b873ba40 RBX: ffff8880b863ba40 RCX: ffffffff8197d8ae RDX: 0000000000000000 RSI: ffff88802553dd00 RDI: ffff8880b863ba40 RBP: dffffc0000000000 R08: ffffffff8fcf390f R09: 1ffffffff1f9e721 R10: dffffc0000000000 R11: fffffbfff1f9e722 R12: dffffc0000000000 R13: 1ffff110170c78d6 R14: ffff88802553dd00 R15: ffffffff8dc257d8 FS: 0000000000000000(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e70fff8 CR3: 00000000352de000 CR4: 00000000003526f0 Call Trace: set_next_task_fair+0xa68/0xce0 kernel/sched/fair.c:15065 put_prev_set_next_task kernel/sched/sched.h:2770 [inline] pick_next_task kernel/sched/core.c:6442 [inline] __schedule+0x3e03/0x5550 kernel/sched/core.c:7143 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:native_set_pte arch/x86/include/asm/pgtable_64.h:63 [inline] RIP: 0010:native_pte_clear arch/x86/include/asm/pgtable_64.h:69 [inline] RIP: 0010:native_local_ptep_get_and_clear arch/x86/include/asm/pgtable.h:1186 [inline] RIP: 0010:ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1262 [inline] RIP: 0010:clear_full_ptes include/linux/pgtable.h:939 [inline] RIP: 0010:zap_present_folio_ptes mm/memory.c:1661 [inline] RIP: 0010:zap_present_ptes mm/memory.c:1730 [inline] RIP: 0010:do_zap_pte_range mm/memory.c:1832 [inline] RIP: 0010:zap_pte_range mm/memory.c:1934 [inline] RIP: 0010:zap_pmd_range mm/memory.c:2020 [inline] RIP: 0010:zap_pud_range mm/memory.c:2048 [inline] RIP: 0010:zap_p4d_range mm/memory.c:2069 [inline] RIP: 0010:__zap_vma_range+0x1535/0x4ab0 mm/memory.c:2109 Code: 01 00 00 49 89 df 49 c1 ef 03 43 80 3c 2f 00 74 08 48 89 df e8 5c 95 19 00 4c 8b 33 48 c7 44 24 18 00 00 00 00 4c 8b 6c 24 18 <48> b8 00 00 00 00 00 fc ff df 41 80 3c 07 00 74 08 48 89 df e8 22 RSP: 0018:ffffc900069573a0 EFLAGS: 00000246 RAX: ffffffff82180ad3 RBX: ffff88805b086b40 RCX: ffff88802db9dd00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90006957690 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff94000265eb1 R12: 00007fb5aad68000 R13: 0000000000000000 R14: 840000004cbd6805 R15: 1ffff1100b610d68 unmap_vmas+0x3ac/0x570 mm/memory.c:2178 exit_mmap+0x280/0x9e0 mm/mmap.c:1300 __mmput+0xcb/0x3e0 kernel/fork.c:1182 exit_mm+0x18e/0x250 kernel/exit.c:610 do_exit+0x6a2/0x22c0 kernel/exit.c:992 do_group_exit+0x21b/0x2d0 kernel/exit.c:1147 get_signal+0x1284/0x1330 kernel/signal.c:3038 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x104/0x710 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb5aab7caeb Code: Unable to access opcode bytes at 0x7fb5aab7cac1. RSP: 002b:00007fb5a8dd4450 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 0000200000000000 RCX: 00007fb5aab7caeb RDX: 00007fb5a8dd4bd0 RSI: 000000004020ae46 RDI: 0000000000000004 RBP: 0000000000000004 R08: 0000000000000001 R09: 0000000000000018 R10: 0000000000000004 R11: 0000000000000246 R12: 00000000fec00000 R13: 00007fb5a8dd4bd0 R14: 000020000000d000 R15: 000000000000000d ---------------- Code disassembly (best guess): 0: 01 00 add %eax,(%rax) 2: 00 49 89 add %cl,-0x77(%rcx) 5: df 49 c1 fisttps -0x3f(%rcx) 8: ef out %eax,(%dx) 9: 03 43 80 add -0x80(%rbx),%eax c: 3c 2f cmp $0x2f,%al e: 00 74 08 48 add %dh,0x48(%rax,%rcx,1) 12: 89 df mov %ebx,%edi 14: e8 5c 95 19 00 call 0x199575 19: 4c 8b 33 mov (%rbx),%r14 1c: 48 c7 44 24 18 00 00 movq $0x0,0x18(%rsp) 23: 00 00 25: 4c 8b 6c 24 18 mov 0x18(%rsp),%r13 * 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction 31: fc ff df 34: 41 80 3c 07 00 cmpb $0x0,(%r15,%rax,1) 39: 74 08 je 0x43 3b: 48 89 df mov %rbx,%rdi 3e: e8 .byte 0xe8 3f: 22 .byte 0x22