------------[ cut here ]------------
task_rq(p) != rq
WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656, CPU#0: syz.0.22/5978
Modules linked in:
CPU: 0 UID: 0 PID: 5978 Comm: syz.0.22 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656
Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 e3 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 4b 65 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82
RSP: 0018:ffffc90003e2f140 EFLAGS: 00010087
RAX: ffff8880b873ba40 RBX: ffff8880b863ba40 RCX: ffffffff8197c7de
RDX: 0000000000000000 RSI: ffff888036620000 RDI: ffff8880b863ba40
RBP: dffffc0000000000 R08: ffffffff8fcf0b0f R09: 1ffffffff1f9e161
R10: dffffc0000000000 R11: fffffbfff1f9e162 R12: dffffc0000000000
R13: 1ffff110170c78d6 R14: ffff888036620000 R15: ffffffff8dc217d8
FS:  0000000000000000(0000) GS:ffff888125a76000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f063fff CR3: 00000000448ba000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 set_next_task_fair+0xa68/0xce0 kernel/sched/fair.c:15058
 put_prev_set_next_task kernel/sched/sched.h:2770 [inline]
 pick_next_task kernel/sched/core.c:6443 [inline]
 __schedule+0x3e03/0x5550 kernel/sched/core.c:7144
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7553
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:trace_lock_acquire include/trace/events/lock.h:24 [inline]
RIP: 0010:lock_acquire+0x58/0x350 kernel/locking/lockdep.c:5833
Code: 8b 05 0c 7b 19 11 48 89 44 24 58 0f 1f 44 00 00 65 8b 05 0f 7b 19 11 83 f8 08 0f 83 83 01 00 00 89 c0 48 0f a3 05 b8 e5 2d 0e <73> 0d e8 91 45 09 00 84 c0 0f 84 ca 01 00 00 83 3d f2 f8 2d 0e 00
RSP: 0018:ffffc90003e2f500 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e3cb2a0
RBP: ffffffff81af0d9d R08: 0000000000000000 R09: 0000000000000000
R10: ffffc90003e2f678 R11: ffffffff81b09bb0 R12: 0000000000000002
R13: ffffffff8e3cb2a0 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:840 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
 is_module_text_address+0x39/0x1e0 kernel/module/main.c:3921
 kernel_text_address+0x94/0xe0 kernel/extable.c:119
 __kernel_text_address+0xd/0x30 kernel/extable.c:79
 unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:385
 arch_stack_walk+0xfb/0x150 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
 slab_free_hook mm/slub.c:2661 [inline]
 slab_free mm/slub.c:6308 [inline]
 kmem_cache_free+0x513/0x6c0 mm/slub.c:6435
 tear_down_vmas+0x312/0x520 mm/mmap.c:1262
 exit_mmap+0x4b6/0x9e0 mm/mmap.c:1320
 __mmput+0xcb/0x3e0 kernel/fork.c:1182
 exit_mm+0x18e/0x250 kernel/exit.c:610
 do_exit+0x6a2/0x22c0 kernel/exit.c:992
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1147
 __do_sys_exit_group kernel/exit.c:1158 [inline]
 __se_sys_exit_group kernel/exit.c:1156 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1156
 x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f79e470ce59
Code: Unable to access opcode bytes at 0x7f79e470ce2f.
RSP: 002b:00007ffe361a6638 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f79e470ce59
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffe361a669c R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000005
R13: 00000000000927c0 R14: 000000000001f5f2 R15: 00007ffe361a66f0
 </TASK>
----------------
Code disassembly (best guess):
   0:	8b 05 0c 7b 19 11    	mov    0x11197b0c(%rip),%eax        # 0x11197b12
   6:	48 89 44 24 58       	mov    %rax,0x58(%rsp)
   b:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  10:	65 8b 05 0f 7b 19 11 	mov    %gs:0x11197b0f(%rip),%eax        # 0x11197b26
  17:	83 f8 08             	cmp    $0x8,%eax
  1a:	0f 83 83 01 00 00    	jae    0x1a3
  20:	89 c0                	mov    %eax,%eax
  22:	48 0f a3 05 b8 e5 2d 	bt     %rax,0xe2de5b8(%rip)        # 0xe2de5e2
  29:	0e
* 2a:	73 0d                	jae    0x39 <-- trapping instruction
  2c:	e8 91 45 09 00       	call   0x945c2
  31:	84 c0                	test   %al,%al
  33:	0f 84 ca 01 00 00    	je     0x203
  39:	83 3d f2 f8 2d 0e 00 	cmpl   $0x0,0xe2df8f2(%rip)        # 0xe2df932