------------[ cut here ]------------
WARNING: CPU: 1 PID: 18906 at kernel/workqueue.c:1438 __queue_work+0xe36/0x1200 kernel/workqueue.c:1438
Modules linked in:
CPU: 1 PID: 18906 Comm: rm Not tainted 6.0.0-syzkaller-02770-g79d878f7ad8e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:__queue_work+0xe36/0x1200 kernel/workqueue.c:1438
Code: e0 07 83 c0 03 38 d0 7c 09 84 d2 74 05 e8 22 77 7a 00 8b 5b 2c 31 ff 83 e3 20 89 de e8 73 66 2d 00 85 db 75 42 e8 aa 69 2d 00 <0f> 0b e9 4a f8 ff ff e8 9e 69 2d 00 0f 0b e9 dc f7 ff ff e8 92 69
RSP: 0000:ffffc900001f0cb8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000100 RCX: 0000000000000100
RDX: ffff888020a59d80 RSI: ffffffff814dabc6 RDI: 0000000000000005
RBP: ffffc900001f0d70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000001 R12: ffff888062420b30
R13: 1ffff9200003e1a8 R14: ffffffff814e0720 R15: ffff88804fad4000
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f60ccc45c50 CR3: 000000001be61000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1514 [inline]
 __run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x60 kernel/kcov.c:200
Code: 81 e1 00 01 00 00 65 48 8b 14 25 80 6f 02 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 bc 15 00 00 85 c0 74 2b 8b 82 98 15 00 00 <83> f8 02 75 20 48 8b 8a a0 15 00 00 8b 92 9c 15 00 00 48 8b 01 48
RSP: 0000:ffffc9000337f5a0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f60cced5b6c RCX: 0000000000000000
RDX: ffff888020a59d80 RSI: ffffffff8100746c RDI: 00007f60cced5b6c
RBP: 00007f60cced5b6c R08: ffffffff8efb73ec R09: ffffc9000337f654
R10: fffff5200066fecf R11: 000000000008c07c R12: ffffc9000337f6d8
R13: 0000000000000000 R14: ffff888020a59d80 R15: ffffea00012a1340
 in_gate_area_no_mm+0xc/0x6a arch/x86/entry/vsyscall/vsyscall_64.c:345
 is_kernel_text include/linux/kallsyms.h:31 [inline]
 core_kernel_text+0x20/0x90 kernel/extable.c:68
 kernel_text_address+0xd/0x80 kernel/extable.c:99
 __kernel_text_address+0x9/0x30 kernel/extable.c:79
 unwind_get_return_address arch/x86/kernel/unwind_orc.c:323 [inline]
 unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:318
 arch_stack_walk+0x93/0xe0 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122
 save_stack+0x151/0x1e0 mm/page_owner.c:127
 __set_page_owner+0x2e/0x50 mm/page_owner.c:192
 prep_new_page mm/page_alloc.c:2532 [inline]
 get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5549
 __folio_alloc+0x12/0x40 mm/page_alloc.c:5580
 vma_alloc_folio+0xf9/0x780 mm/mempolicy.c:2231
 alloc_page_vma include/linux/gfp.h:290 [inline]
 wp_page_copy+0x1f1/0x1b10 mm/memory.c:3112
 do_wp_page+0x52c/0x1910 mm/memory.c:3479
 handle_pte_fault mm/memory.c:4935 [inline]
 __handle_mm_fault+0x1813/0x39b0 mm/memory.c:5059
 handle_mm_fault+0x1c8/0x780 mm/memory.c:5157
 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1407
 handle_page_fault arch/x86/mm/fault.c:1498 [inline]
 exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1554
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7f60cced5b6c
Code: e6 48 29 c6 48 83 fe 0a 0f 87 0d fe ff ff 4c 89 f6 48 29 c6 48 89 f0 e9 fb fd ff ff 48 85 ff 74 71 49 8b 47 60 48 85 c0 74 04 <48> 01 78 08 49 8b 47 58 48 85 c0 74 04 48 01 78 08 49 8b 47 68 48
RSP: 002b:00007ffee6a55cc0 EFLAGS: 00010206
RAX: 00007f60ccc45c48 RBX: 000000006ffffdff RCX: 00007f60ccecba40
RDX: 00007f60ccc45d98 RSI: 0000000000000029 RDI: 00007f60ccc2f000
RBP: 00007ffee6a55e10 R08: 000000006fffffff R09: 00000000effffef5
R10: 0000000070000022 R11: 0000000000000032 R12: 000000006ffffeff
R13: 000000006ffffe35 R14: 000000006fffff41 R15: 00007f60ccecba00
 </TASK>
----------------
Code disassembly (best guess):
   0:	81 e1 00 01 00 00    	and    $0x100,%ecx
   6:	65 48 8b 14 25 80 6f 	mov    %gs:0x26f80,%rdx
   d:	02 00
   f:	a9 00 01 ff 00       	test   $0xff0100,%eax
  14:	74 0e                	je     0x24
  16:	85 c9                	test   %ecx,%ecx
  18:	74 35                	je     0x4f
  1a:	8b 82 bc 15 00 00    	mov    0x15bc(%rdx),%eax
  20:	85 c0                	test   %eax,%eax
  22:	74 2b                	je     0x4f
  24:	8b 82 98 15 00 00    	mov    0x1598(%rdx),%eax
* 2a:	83 f8 02             	cmp    $0x2,%eax <-- trapping instruction
  2d:	75 20                	jne    0x4f
  2f:	48 8b 8a a0 15 00 00 	mov    0x15a0(%rdx),%rcx
  36:	8b 92 9c 15 00 00    	mov    0x159c(%rdx),%edx
  3c:	48 8b 01             	mov    (%rcx),%rax
  3f:	48                   	rex.W