------------[ cut here ]------------
WARNING: CPU: 0 PID: 12 at mm/slub.c:4550 slab_free_after_rcu_debug+0x18b/0x270 mm/slub.c:4550
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:1 Not tainted 6.11.0-rc2-next-20240805-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events_unbound call_usermodehelper_exec_work
RIP: 0010:slab_free_after_rcu_debug+0x18b/0x270 mm/slub.c:4550
Code: 48 89 04 19 48 8d 4a 08 49 8b 34 24 65 48 0f c7 0e 75 c8 4c 89 f7 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 36 55 ff ff 90 <0f> 0b 90 eb 92 90 0f 0b 90 eb 8c 90 0f 0b 90 eb 86 41 8b 54 24 1c
RSP: 0000:ffffc90000007bc0 EFLAGS: 00010286
RAX: ffff88823be00000 RBX: ffff88801cfb8940 RCX: 000000000002afe0
RDX: ffffea0000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007e30 R08: ffffffff8142d2ec R09: 1ffffffff26e90eb
R10: dffffc0000000000 R11: ffffffff81f105b0 R12: dffffc0000000000
R13: ffffffff817beed6 R14: ffff88823be2afe0 R15: ffffea000073ee00
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823ffff000 CR3: 000000000e734000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rcu_do_batch kernel/rcu/tree.c:2569 [inline]
 rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843
 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:memset_orig+0x46/0xb0 arch/x86/lib/memset_64.S:72
Code: 41 83 e1 07 75 70 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 48 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 <48> 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d8 0f 1f 84 00
RSP: 0000:ffffc900001176c0 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffffc90002f48000 RCX: 0000000000000154
RDX: 0000000000008000 RSI: 0000000000000000 RDI: ffffc90002f4aac0
RBP: dffffc0000000000 R08: ffffc90002f4ffff R09: 0000000000000000
R10: ffffc90002f48000 R11: fffff520005ea000 R12: ffff88801bfdd800
R13: 00000000ffffffff R14: ffff88801bfdd808 R15: 1ffff110037fbb01
 alloc_thread_stack_node kernel/fork.c:297 [inline]
 dup_task_struct+0x1b7/0x8c0 kernel/fork.c:1115
 copy_process+0x5d1/0x3e30 kernel/fork.c:2219
 kernel_clone+0x226/0x8f0 kernel/fork.c:2806
 user_mode_thread+0x132/0x1a0 kernel/fork.c:2884
 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:172
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	41 83 e1 07          	and    $0x7,%r9d
   4:	75 70                	jne    0x76
   6:	48 89 d1             	mov    %rdx,%rcx
   9:	48 c1 e9 06          	shr    $0x6,%rcx
   d:	74 35                	je     0x44
   f:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  14:	48 ff c9             	dec    %rcx
  17:	48 89 07             	mov    %rax,(%rdi)
  1a:	48 89 47 08          	mov    %rax,0x8(%rdi)
  1e:	48 89 47 10          	mov    %rax,0x10(%rdi)
  22:	48 89 47 18          	mov    %rax,0x18(%rdi)
  26:	48 89 47 20          	mov    %rax,0x20(%rdi)
* 2a:	48 89 47 28          	mov    %rax,0x28(%rdi) <-- trapping instruction
  2e:	48 89 47 30          	mov    %rax,0x30(%rdi)
  32:	48 89 47 38          	mov    %rax,0x38(%rdi)
  36:	48 8d 7f 40          	lea    0x40(%rdi),%rdi
  3a:	75 d8                	jne    0x14
  3c:	0f                   	.byte 0xf
  3d:	1f                   	(bad)
  3e:	84 00                	test   %al,(%rax)