------------[ cut here ]------------
WARNING: CPU: 1 PID: 14376 at kernel/signal.c:2050 posixtimer_send_sigqueue+0xa08/0xce0 kernel/signal.c:2050
Modules linked in:
CPU: 1 UID: 0 PID: 14376 Comm: syz.7.1440 Not tainted 6.13.0-rc2-syzkaller-00130-g150b567e0d57 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:posixtimer_send_sigqueue+0xa08/0xce0 kernel/signal.c:2050
Code: 00 0f 85 f4 02 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 73 1a 3b 00 4c 8b 64 24 08 e9 28 ff ff ff 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 80 3c 03 00 74 08 4c 89 f7
RSP: 0000:ffffc900100efb00 EFLAGS: 00010086
RAX: dffffc0000000000 RBX: 1ffff1100540be5b RCX: ffff88802f441e00
RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000000000000
RBP: ffffc900100efbf0 R08: ffffffff816450d0 R09: 1ffffffff2853f12
R10: dffffc0000000000 R11: fffffbfff2853f13 R12: ffff88802a05f2c0
R13: 1ffff1100540be68 R14: ffff88802a05f2d8 R15: ffff88802a05f380
FS:  0000000000000000(0000) GS:ffff8880b8700000(0063) knlGS:0000000056cc5440
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f50adda4 CR3: 0000000060874000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 cpu_timer_fire kernel/time/posix-cpu-timers.c:607 [inline]
 handle_posix_cpu_timers kernel/time/posix-cpu-timers.c:1390 [inline]
 posix_cpu_timers_work+0x9ca/0x1470 kernel/time/posix-cpu-timers.c:1137
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
 do_int80_emulation+0x12c/0x200 arch/x86/entry/common.c:256
 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:626
RIP: 0023:0xf7294b80
Code: 4c 24 04 85 c9 0f 84 5f 39 fe ff 8b 54 24 0c 85 d2 0f 84 53 39 fe ff 53 56 8b 74 24 18 89 cb 8b 4c 24 10 b8 b3 01 00 00 cd 80 <85> c0 74 09 5e 5b 0f 8c 34 39 fe ff c3 31 ed 83 e4 f0 83 ec 0c 56
RSP: 002b:00000000f758f8a4 EFLAGS: 00000286 ORIG_RAX: 00000000000001b3
RAX: 000000000000004e RBX: 00000000f758f910 RCX: 0000000000000058
RDX: 00000000f7222490 RSI: 00000000f50adb40 RDI: 00000000ffffffd4
RBP: 000000000000006e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	4c 24 04             	rex.WR and $0x4,%al
   3:	85 c9                	test   %ecx,%ecx
   5:	0f 84 5f 39 fe ff    	je     0xfffe396a
   b:	8b 54 24 0c          	mov    0xc(%rsp),%edx
   f:	85 d2                	test   %edx,%edx
  11:	0f 84 53 39 fe ff    	je     0xfffe396a
  17:	53                   	push   %rbx
  18:	56                   	push   %rsi
  19:	8b 74 24 18          	mov    0x18(%rsp),%esi
  1d:	89 cb                	mov    %ecx,%ebx
  1f:	8b 4c 24 10          	mov    0x10(%rsp),%ecx
  23:	b8 b3 01 00 00       	mov    $0x1b3,%eax
  28:	cd 80                	int    $0x80
* 2a:	85 c0                	test   %eax,%eax <-- trapping instruction
  2c:	74 09                	je     0x37
  2e:	5e                   	pop    %rsi
  2f:	5b                   	pop    %rbx
  30:	0f 8c 34 39 fe ff    	jl     0xfffe396a
  36:	c3                   	ret
  37:	31 ed                	xor    %ebp,%ebp
  39:	83 e4 f0             	and    $0xfffffff0,%esp
  3c:	83 ec 0c             	sub    $0xc,%esp
  3f:	56                   	push   %rsi