slab kmalloc-96 start ffff88801e4f0100 pointer offset 0 size 96
list_add corruption. next->prev should be prev (ffffe8ffffc380b0), but was ffffffff84ba4460. (next=ffff88801e4f0100).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:31!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5304 Comm: syz-execprog Not tainted 6.14.0-rc5-syzkaller-00218-g2a520073e74f #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__list_add_valid_or_report+0xf3/0x130 lib/list_debug.c:29
Code: c4 0a fd 42 80 7c 2d 00 00 74 08 48 89 df e8 64 b6 2c fd 49 8b 56 08 48 c7 c7 e0 00 81 8c 4c 89 e6 4c 89 f1 e8 de a1 2a fc 90 <0f> 0b 4c 89 e7 e8 a3 c4 0a fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 34
RSP: 0000:ffffc9000d33ef20 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff88801e4f0108 RCX: cd49858153232300
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 1ffff11003c9e021 R08: ffffffff81a1356c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: ffffe8ffffc380b0
R13: dffffc0000000000 R14: ffff88801e4f0100 R15: ffff88803faa2000
FS:  000000c00007c798(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f27027c9000 CR3: 0000000044e2a000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_add_valid include/linux/list.h:88 [inline]
 __list_add include/linux/list.h:150 [inline]
 list_add include/linux/list.h:169 [inline]
 add_to_unbuddied+0x2e4/0x4d0 mm/z3fold.c:550
 do_compact_page+0x5da/0xd30 mm/z3fold.c:772
 zswap_entry_free+0x2f6/0x440 mm/zswap.c:806
 zswap_load+0x364/0x4a0 mm/zswap.c:1663
 swap_read_folio+0x9b4/0x2690 mm/page_io.c:641
 swap_cluster_readahead+0x3cf/0x710 mm/swap_state.c:689
 swapin_readahead+0x1ba/0xd30 mm/swap_state.c:881
 do_swap_page+0x5c4/0x5c40 mm/memory.c:4422
 handle_pte_fault mm/memory.c:5903 [inline]
 __handle_mm_fault+0x13dd/0x70f0 mm/memory.c:6043
 handle_mm_fault+0x3e5/0x8d0 mm/memory.c:6212
 do_user_addr_fault arch/x86/mm/fault.c:1337 [inline]
 handle_page_fault arch/x86/mm/fault.c:1480 [inline]
 exc_page_fault+0x459/0x8b0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x421aee
Code: c9 75 24 48 89 74 24 50 49 8d 34 10 e8 cb 31 ff ff 48 85 f6 0f 84 98 00 00 00 48 8b 54 24 60 4c 8b 44 24 70 49 89 f1 4d 89 ca <4d> 8b 09 4d 29 c2 4d 85 c9 74 af 4d 89 cb 4d 29 c1 90 4c 39 ca 77
RSP: 002b:000000c00009de88 EFLAGS: 00010202
RAX: 000000c004bac008 RBX: 000000c004bac008 RCX: 0000000000000000
RDX: 0000000000002500 RSI: 000000c004bac008 RDI: 000000000142af80
RBP: 000000c00009df08 R08: 000000c004bab400 R09: 000000c004bac008
R10: 000000c004bac008 R11: 0000000000000bf8 R12: 0000000000000020
R13: 0000000000000010 R14: 000000c000006e00 R15: 000000c0038f4278
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0xf3/0x130 lib/list_debug.c:29
Code: c4 0a fd 42 80 7c 2d 00 00 74 08 48 89 df e8 64 b6 2c fd 49 8b 56 08 48 c7 c7 e0 00 81 8c 4c 89 e6 4c 89 f1 e8 de a1 2a fc 90 <0f> 0b 4c 89 e7 e8 a3 c4 0a fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 34
RSP: 0000:ffffc9000d33ef20 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff88801e4f0108 RCX: cd49858153232300
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 1ffff11003c9e021 R08: ffffffff81a1356c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: ffffe8ffffc380b0
R13: dffffc0000000000 R14: ffff88801e4f0100 R15: ffff88803faa2000
FS:  000000c00007c798(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f27027c9000 CR3: 0000000044e2a000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400