syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...0: (1 GPs behind) idle=58dc/1/0x4000000000000000 softirq=82444/82449 fqs=5247
rcu: 	         hardirqs   softirqs   csw/system
rcu: 	 number:        0          0            0
rcu: 	cputime:        0          0            0   ==> 52510(ms)
rcu: 	(detected by 0, t=10502 jiffies, g=99713, q=2102 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 21360 Comm: syz-executor.4 Not tainted 6.5.0-rc2-syzkaller-00221-gf7e3a1bafdea #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
RIP: 0010:pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:591 [inline]
RIP: 0010:queued_spin_unlock arch/x86/include/asm/qspinlock.h:57 [inline]
RIP: 0010:do_raw_spin_unlock+0x169/0x230 kernel/locking/spinlock_debug.c:141
Code: 06 81 8c c7 43 08 ff ff ff ff 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 b5 00 00 00 48 83 3d af 13 19 0b 00 <74> 4a 48 89 df e8 2d b2 cd 08 90 5b 5d 41 5c c3 48 c7 c6 40 de 6c
RSP: 0018:ffffc900001e0d60 EFLAGS: 00000086
RAX: 1ffffffff19020d9 RBX: ffff88801ef1f2e8 RCX: ffffffff8167f203
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff88801ef1f2e8
RBP: ffff88801ef1f2f0 R08: 0000000000000000 R09: ffffed1003de3e5d
R10: ffff88801ef1f2eb R11: 0000000000000000 R12: ffff88801ef1f2f8
R13: ffff888060c5e400 R14: ffff88801ef1f340 R15: ffff888060c5e000
FS:  000055555681d480(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f607254fd58 CR3: 000000004be77000 CR4: 0000000000350ee0
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 __raw_spin_unlock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_unlock+0x1e/0x40 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 advance_sched+0x60e/0xc60 net/sched/sch_taprio.c:992
 __run_hrtimer kernel/time/hrtimer.c:1688 [inline]
 __hrtimer_run_queues+0x203/0xc10 kernel/time/hrtimer.c:1752
 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1098 [inline]
 __sysvec_apic_timer_interrupt+0x14a/0x430 arch/x86/kernel/apic/apic.c:1115
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1109
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:unwind_next_frame+0xd7d/0x2020 arch/x86/kernel/unwind_orc.c:664
Code: 19 e9 ff ff 49 8d 7d 40 48 89 fa 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 da 0e 00 00 49 89 6d 40 <48> b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 0f b6 04 02 84
RSP: 0018:ffffc90003427888 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90003428000
RDX: 1ffff92000684f31 RSI: ffffc90003427918 RDI: ffffc90003427988
RBP: ffffc900034279d8 R08: ffffc9000342797c R09: ffffffff8f31db04
R10: ffffc90003427948 R11: 0000000000003a07 R12: ffffc90003427998
R13: ffffc90003427948 R14: ffffc90003427948 R15: ffffc90003427940
 __unwind_start+0x457/0x7e0 arch/x86/kernel/unwind_orc.c:760
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0x6d/0xf0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x96/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free mm/kasan/common.c:236 [inline]
 ____kasan_slab_free+0x15e/0x1b0 mm/kasan/common.c:200
 kasan_slab_free include/linux/kasan.h:162 [inline]
 slab_free_hook mm/slub.c:1792 [inline]
 slab_free_freelist_hook+0x10b/0x1e0 mm/slub.c:1818
 slab_free mm/slub.c:3801 [inline]
 __kmem_cache_free+0xb8/0x2f0 mm/slub.c:3814
 free_rb_tree_fname+0x7c/0xe0 fs/ext4/dir.c:426
 ext4_htree_free_dir_info fs/ext4/dir.c:448 [inline]
 ext4_release_dir+0x44/0x60 fs/ext4/dir.c:638
 __fput+0x3fd/0xac0 fs/file_table.c:384
 task_work_run+0x14d/0x240 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
 syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
 do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f1a18e7c3e7
Code: 44 00 00 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb bc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fffbb428638 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000065 RCX: 00007f1a18e7c3e7
RDX: fffffffffffff000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f1a18ec73b9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007fffbb4297b0
R13: 00007f1a18ec73b9 R14: 000000000018de8c R15: 0000000000000014
 </TASK>