syzbot

BUG: workqueue leaked atomic, lock or RCU: syz.2.705[7973]
     preempt=0x00000103 lock=3->0 RCU=1->1 workfn=usb_giveback_urb_bh
INFO: lockdep is turned off.
CPU: 1 UID: 0 PID: 7973 Comm: syz.2.705 Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 process_one_work kernel/workqueue.c:3250 [inline]
 process_scheduled_works+0x1157/0x1840 kernel/workqueue.c:3310
 bh_worker+0x2a5/0x620 kernel/workqueue.c:3570
 tasklet_action+0xc/0x70 kernel/softirq.c:836
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:do_raw_spin_trylock+0x0/0x1f0 kernel/locking/spinlock_debug.c:122
Code: ff ff 48 8d 7c 24 60 e8 2e 36 87 00 e9 fd fe ff ff e8 74 ae 44 0a 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48
RSP: 0018:ffffc90003cdf098 EFLAGS: 00000202
RAX: 0000000000000003 RBX: ffff8880b87447c0 RCX: ffffffff9a377903
RDX: 0000000000000000 RSI: ffffffff8c5edcc0 RDI: ffff8880b87447c0
RBP: 0000000000000001 R08: ffff88813fffcad7 R09: 1ffff11027fff95a
R10: dffffc0000000000 R11: ffffed1027fff95b R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000003218 R15: ffff88813fffcb40
 __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline]
 _raw_spin_trylock+0x20/0x80 kernel/locking/spinlock.c:138
 spin_trylock include/linux/spinlock.h:361 [inline]
 rmqueue_pcplist mm/page_alloc.c:3032 [inline]
 rmqueue mm/page_alloc.c:3076 [inline]
 get_page_from_freelist+0x7d7/0x37a0 mm/page_alloc.c:3473
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269
 get_free_pages_noprof+0xc/0x30 mm/page_alloc.c:4800
 tlb_next_batch mm/mmu_gather.c:35 [inline]
 __tlb_remove_folio_pages_size+0x2a5/0x590 mm/mmu_gather.c:196
 zap_present_folio_ptes mm/memory.c:1531 [inline]
 zap_present_ptes mm/memory.c:1585 [inline]
 zap_pte_range mm/memory.c:1627 [inline]
 zap_pmd_range mm/memory.c:1753 [inline]
 zap_pud_range mm/memory.c:1782 [inline]
 zap_p4d_range mm/memory.c:1803 [inline]
 unmap_page_range+0x1c06/0x4040 mm/memory.c:1824
 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1914
 exit_mmap+0x275/0xc20 mm/mmap.c:1668
 __mmput+0x115/0x3b0 kernel/fork.c:1348
 exit_mm+0x220/0x310 kernel/exit.c:570
 do_exit+0x9ad/0x28e0 kernel/exit.c:925
 do_group_exit+0x207/0x2c0 kernel/exit.c:1087
 __do_sys_exit_group kernel/exit.c:1098 [inline]
 __se_sys_exit_group kernel/exit.c:1096 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096
 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f82dc585d29
Code: Unable to access opcode bytes at 0x7f82dc585cff.
RSP: 002b:00007ffc8372abd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f82dc585d29
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffc8372ac2c R08: 00007ffc8372acbf R09: 00000000000255f1
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000032
R13: 00000000000255f1 R14: 00007ffc8372ac80 R15: 00007ffc8372ac80
 </TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	48 8d 7c 24 60       	lea    0x60(%rsp),%rdi
   5:	e8 2e 36 87 00       	call   0x873638
   a:	e9 fd fe ff ff       	jmp    0xffffff0c
   f:	e8 74 ae 44 0a       	call   0xa44ae88
  14:	0f 1f 40 00          	nopl   0x0(%rax)
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	90                   	nop
  26:	90                   	nop
  27:	90                   	nop
* 28:	f3 0f 1e fa          	endbr64 <-- trapping instruction
  2c:	55                   	push   %rbp
  2d:	48 89 e5             	mov    %rsp,%rbp
  30:	41 57                	push   %r15
  32:	41 56                	push   %r14
  34:	41 55                	push   %r13
  36:	41 54                	push   %r12
  38:	53                   	push   %rbx
  39:	48 83 e4 e0          	and    $0xffffffffffffffe0,%rsp
  3d:	48                   	rex.W