------------[ cut here ]------------
task_rq(p) != rq
WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656, CPU#1: syz.1.14/5804
Modules linked in:
CPU: 1 UID: 0 PID: 5804 Comm: syz.1.14 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656
Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 f5 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82
RSP: 0018:ffffc90005aa71c0 EFLAGS: 00010006
RAX: ffff8880b863ba40 RBX: ffff8880b873ba40 RCX: ffffffff8197d8ae
RDX: 0000000000000000 RSI: ffff88803171dd00 RDI: ffff8880b873ba40
RBP: dffffc0000000000 R08: ffffffff8fcf390f R09: 1ffffffff1f9e721
R10: dffffc0000000000 R11: fffffbfff1f9e722 R12: dffffc0000000000
R13: 1ffff110170e78d6 R14: ffff88803171dd00 R15: ffffffff8dc257d0
FS:  00007fc5820e46c0(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001008 CR3: 000000003cb3a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 set_next_task_fair+0xa68/0xce0 kernel/sched/fair.c:15065
 put_prev_set_next_task kernel/sched/sched.h:2770 [inline]
 pick_next_task kernel/sched/core.c:6442 [inline]
 __schedule+0x3e03/0x5550 kernel/sched/core.c:7143
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__preempt_count_add kernel/rcu/tree.c:748 [inline]
RIP: 0010:rcu_is_watching+0x6/0xb0 kernel/rcu/tree.c:751
Code: e8 4f 1a 4d 03 eb cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 <41> 56 53 65 ff 05 80 d4 10 11 e8 5b 96 93 09 89 c3 83 f8 08 73 65
RSP: 0018:ffffc90005aa7570 EFLAGS: 00000202
RAX: ffffffff821b4b2c RBX: ffffffff821b4afc RCX: ffff8880213c9f00
RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f9e71f R12: ffff8880b8734d98
R13: ffff8880b8734cb8 R14: ffffea00013c9a40 R15: 1ffffd4000279348
 rcu_read_lock include/linux/rcupdate.h:841 [inline]
 folio_evictable+0x55/0x250 mm/internal.h:574
 __mlock_new_folio mm/mlock.c:110 [inline]
 mlock_folio_batch+0x140e/0x3fa0 mm/mlock.c:202
 mlock_new_folio+0x4e8/0x910 mm/mlock.c:282
 folio_add_lru_vma+0x1d7/0x210 mm/swap.c:579
 map_anon_folio_pte_nopf+0x2ee/0x5e0 mm/memory.c:5266
 map_anon_folio_pte_pf+0xbe/0x220 mm/memory.c:5276
 do_anonymous_page mm/memory.c:5379 [inline]
 do_pte_missing+0x281e/0x2940 mm/memory.c:4564
 handle_pte_fault mm/memory.c:6379 [inline]
 __handle_mm_fault mm/memory.c:6517 [inline]
 handle_mm_fault+0xdc2/0x14d0 mm/memory.c:6686
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x16d4/0x2620 mm/gup.c:1428
 populate_vma_page_range+0x2be/0x3c0 mm/gup.c:1860
 __mm_populate+0x25f/0x390 mm/gup.c:1963
 do_mlock+0x646/0x750 mm/mlock.c:659
 __do_sys_mlock mm/mlock.c:667 [inline]
 __se_sys_mlock mm/mlock.c:665 [inline]
 __x64_sys_mlock+0x60/0x70 mm/mlock.c:665
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc583ecce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc5820e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095
RAX: ffffffffffffffda RBX: 00007fc584146180 RCX: 00007fc583ecce59
RDX: 0000000000000000 RSI: 0000000000800000 RDI: 0000200000000000
RBP: 00007fc583f62d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc584146218 R14: 00007fc584146180 R15: 00007ffc44f7b5c8
 </TASK>
----------------
Code disassembly (best guess):
   0:	e8 4f 1a 4d 03       	call   0x34d1a54
   5:	eb cc                	jmp    0xffffffd3
   7:	66 66 66 66 2e 0f 1f 	data16 data16 data16 cs nopw 0x0(%rax,%rax,1)
   e:	84 00 00 00 00 00
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	f3 0f 1e fa          	endbr64
  28:	41 57                	push   %r15
* 2a:	41 56                	push   %r14 <-- trapping instruction
  2c:	53                   	push   %rbx
  2d:	65 ff 05 80 d4 10 11 	incl   %gs:0x1110d480(%rip)        # 0x1110d4b4
  34:	e8 5b 96 93 09       	call   0x9939694
  39:	89 c3                	mov    %eax,%ebx
  3b:	83 f8 08             	cmp    $0x8,%eax
  3e:	73 65                	jae    0xa5