------------[ cut here ]------------
virt_to_phys used for non-linear address: 00000000ce476148 (lcnbmp_runlist_lock_key+0x0/0x10)
WARNING: CPU: 1 PID: 19 at arch/arm64/mm/physaddr.c:15 __virt_to_phys+0x80/0x98 arch/arm64/mm/physaddr.c:17
Modules linked in:
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 6.0.0-rc4-syzkaller-17255-ga6b443748715 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __virt_to_phys+0x80/0x98 arch/arm64/mm/physaddr.c:17
lr : __virt_to_phys+0x7c/0x98 arch/arm64/mm/physaddr.c:12
sp : ffff80000f28bbd0
x29: ffff80000f28bbd0 x28: 000000000000000a x27: 000000000000000a
x26: 0000000000000000 x25: ffff80000ef63fb8 x24: ffff80000d33c000
x23: ffff80000d463410 x22: 0000000040000000 x21: ffff8000085e810c
x20: 000080000ef63e90 x19: ffff80000ef63e90 x18: 00000000000000c0
x17: 626e636c28203834 x16: ffff80000db78658 x15: ffff0000c02ecf80
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c02ecf80
x11: ff808000081c1fa0 x10: 0000000000000000 x9 : f6797c3e5e914400
x8 : ffff80000cf0e000 x7 : ffff8000081965e0 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000100 x0 : 000000000000005d
Call trace:
 __virt_to_phys+0x80/0x98 arch/arm64/mm/physaddr.c:17
 virt_to_folio include/linux/mm.h:856 [inline]
 virt_to_slab mm/slab.h:175 [inline]
 kmem_cache_free+0x84/0x3a4 mm/slub.c:3551
 __d_free+0x28/0x38 fs/dcache.c:298
 rcu_do_batch+0x19c/0x57c kernel/rcu/tree.c:2245
 rcu_core+0x2b0/0x59c kernel/rcu/tree.c:2505
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2522
 _stext+0x168/0x37c
 run_ksoftirqd+0x4c/0x21c kernel/softirq.c:934
 smpboot_thread_fn+0x248/0x3e4 kernel/smpboot.c:164
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20
irq event stamp: 2148897
hardirqs last  enabled at (2148896): [<ffff8000081c020c>] __up_console_sem+0xb0/0xfc kernel/printk/printk.c:264
hardirqs last disabled at (2148897): [<ffff80000bfc5c8c>] el1_dbg+0x24/0x5c arch/arm64/kernel/entry-common.c:395
softirqs last  enabled at (2148676): [<ffff8000080102e4>] _stext+0x2e4/0x37c
softirqs last disabled at (2148681): [<ffff8000081040b4>] run_ksoftirqd+0x4c/0x21c kernel/softirq.c:934
---[ end trace 0000000000000000 ]---
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000012a2a3000
[0000000000000038] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 19 Comm: ksoftirqd/1 Tainted: G        W          6.0.0-rc4-syzkaller-17255-ga6b443748715 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : slab_objcgs mm/slab.h:435 [inline]
pc : memcg_slab_free_hook+0x24/0x188 mm/slab.h:550
lr : slab_free mm/slub.c:3529 [inline]
lr : kmem_cache_free+0xd8/0x3a4 mm/slub.c:3551
sp : ffff80000f28bb90
x29: ffff80000f28bb90 x28: 000000000000000a x27: 000000000000000a
x26: 0000000000000000 x25: ffff80000ef63fb8 x24: ffff80000d33c000
x23: ffff80000d463410 x22: 0000000000000000 x21: ffff8000085e810c
x20: ffff0000c0197c00 x19: ffff80000ef63e90 x18: 00000000000000c0
x17: 626e636c28203834 x16: ffff80000db78658 x15: ffff0000c02ecf80
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c02ecf80
x11: ff808000081c1fa0 x10: 0000000000000000 x9 : fffffc0000000000
x8 : 0000000000000000 x7 : ffff8000081965e0 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000001
x2 : ffff80000f28bbf0 x1 : 0000000000000000 x0 : ffff0000c0197c00
Call trace:
 arch_static_branch_jump arch/arm64/include/asm/jump_label.h:38 [inline]
 memcg_kmem_enabled include/linux/memcontrol.h:1748 [inline]
 memcg_slab_free_hook+0x24/0x188 mm/slab.h:547
 slab_free mm/slub.c:3529 [inline]
 kmem_cache_free+0xd8/0x3a4 mm/slub.c:3551
 __d_free+0x28/0x38 fs/dcache.c:298
 rcu_do_batch+0x19c/0x57c kernel/rcu/tree.c:2245
 rcu_core+0x2b0/0x59c kernel/rcu/tree.c:2505
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2522
 _stext+0x168/0x37c
 run_ksoftirqd+0x4c/0x21c kernel/softirq.c:934
 smpboot_thread_fn+0x248/0x3e4 kernel/smpboot.c:164
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20
Code: a90457f6 a9054ff4 910003fd d503201f (f9401c28) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	a90457f6 	stp	x22, x21, [sp, #64]
   4:	a9054ff4 	stp	x20, x19, [sp, #80]
   8:	910003fd 	mov	x29, sp
   c:	d503201f 	nop
* 10:	f9401c28 	ldr	x8, [x1, #56] <-- trapping instruction