8<--- cut here ---
Unable to handle kernel paging request at virtual address 5bd2a000
[5bd2a000] *pgd=80000080005003, *pmd=00000000
Internal error: Oops: 206 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 27162 Comm: kworker/0:1 Not tainted 6.1.0-rc2-syzkaller #0
Hardware name: ARM-Versatile Express
Workqueue: events free_ipc
PC is at percpu_counter_add_batch+0x38/0x108 lib/percpu_counter.c:87
LR is at __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:66
pc : [<808101f4>]    lr : [<81756544>]    psr: 20000113
sp : ed80de28  ip : ed80de18  fp : ed80de4c
r10: 850bf180  r9 : 00000006  r8 : 850bf1ec
r7 : 7fffffff  r6 : 00000000  r5 : 8405b5e8  r4 : 00000000
r3 : 5bd2a000  r2 : 00000000  r1 : 00000000  r0 : 00000000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 8501f780  DAC: fffffffd
Register r0 information: NULL pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: NULL pointer
Register r5 information: slab kmalloc-cg-1k start 8405b400 pointer offset 488 size 1024
Register r6 information: NULL pointer
Register r7 information: non-paged memory
Register r8 information: slab kmalloc-cg-192 start 850bf180 pointer offset 108 size 192
Register r9 information: non-paged memory
Register r10 information: slab kmalloc-cg-192 start 850bf180 pointer offset 0 size 192
Register r11 information: 2-page vmalloc region starting at 0xed80c000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671
Register r12 information: 2-page vmalloc region starting at 0xed80c000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671
Process kworker/0:1 (pid: 27162, stack limit = 0xed80c000)
Stack: (0xed80de28 to 0xed80e000)
de20:                   00000000 850bf1ec 850bf180 8405b400 850bf1ec 00000006
de40: ed80de94 ed80de50 80663850 808101c8 7fffffff 802a0f18 0000000a 00000001
de60: ed80de5c 596fc4c0 8405b4b8 00000001 8405b4b8 0000000a 8405b400 80663748
de80: 00000006 850bf180 ed80decc ed80de98 8066ece8 80663754 ed80debc 8405b4a0
dea0: 80810148 8405b400 00000000 dddd4a40 dddd8200 00000010 84ad5c00 dddd8215
dec0: ed80dee4 ed80ded0 80664d28 8066ec80 8405b400 00000000 ed80defc ed80dee8
dee0: 8066e814 80664d00 8232cd6c 853afb80 ed80df44 ed80df00 802611c0 8066e79c
df00: 80275518 802a0f18 ed80df2c ed80df18 80262ea4 00000000 dddd4a40 853afb80
df20: dddd4a40 853afb98 dddd4a5c 82204d40 00000008 dddd4a40 ed80df84 ed80df48
df40: 802615cc 80260fc0 ed80df64 81cffdc0 823d7b0e 84ad5c00 ed80df84 8505b280
df60: 84ad5c00 80261560 853afb80 8505b700 e04e9e8c 00000000 ed80dfac ed80df88
df80: 80269b24 8026156c 8505b280 80269a38 00000000 00000000 00000000 00000000
dfa0: 00000000 ed80dfb0 80200100 80269a44 00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
Backtrace: 
[<808101bc>] (percpu_counter_add_batch) from [<80663850>] (percpu_counter_add_local include/linux/percpu_counter.h:75 [inline])
[<808101bc>] (percpu_counter_add_batch) from [<80663850>] (percpu_counter_sub_local include/linux/percpu_counter.h:225 [inline])
[<808101bc>] (percpu_counter_add_batch) from [<80663850>] (freeque+0x108/0x16c ipc/msg.c:292)
 r9:00000006 r8:850bf1ec r7:8405b400 r6:850bf180 r5:850bf1ec r4:00000000
[<80663748>] (freeque) from [<8066ece8>] (free_ipcs+0x74/0x90 ipc/namespace.c:125)
 r10:850bf180 r9:00000006 r8:80663748 r7:8405b400 r6:0000000a r5:8405b4b8
 r4:00000001
[<8066ec74>] (free_ipcs) from [<80664d28>] (msg_exit_ns+0x34/0x48 ipc/msg.c:1334)
 r10:dddd8215 r9:84ad5c00 r8:00000010 r7:dddd8200 r6:dddd4a40 r5:00000000
 r4:8405b400
[<80664cf4>] (msg_exit_ns) from [<8066e814>] (free_ipc_ns ipc/namespace.c:138 [inline])
[<80664cf4>] (msg_exit_ns) from [<8066e814>] (free_ipc+0x84/0xfc ipc/namespace.c:157)
 r5:00000000 r4:8405b400
[<8066e790>] (free_ipc) from [<802611c0>] (process_one_work+0x20c/0x5ac kernel/workqueue.c:2289)
 r5:853afb80 r4:8232cd6c
[<80260fb4>] (process_one_work) from [<802615cc>] (worker_thread+0x6c/0x4e0 kernel/workqueue.c:2436)
 r10:dddd4a40 r9:00000008 r8:82204d40 r7:dddd4a5c r6:853afb98 r5:dddd4a40
 r4:853afb80
[<80261560>] (worker_thread) from [<80269b24>] (kthread+0xec/0x11c kernel/kthread.c:376)
 r10:00000000 r9:e04e9e8c r8:8505b700 r7:853afb80 r6:80261560 r5:84ad5c00
 r4:8505b280
[<80269a38>] (kthread) from [<80200100>] (ret_from_fork+0x14/0x34 arch/arm/kernel/entry-common.S:148)
Exception stack(0xed80dfb0 to 0xed80dff8)
dfa0:                                     00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80269a38 r4:8505b280
Code: e34801ec eb3d18ce e5951018 ee1d3f90 (e7918003) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e34801ec 	movt	r0, #33260	; 0x81ec
   4:	eb3d18ce 	bl	0xf46344
   8:	e5951018 	ldr	r1, [r5, #24]
   c:	ee1d3f90 	mrc	15, 0, r3, cr13, cr0, {4}
* 10:	e7918003 	ldr	r8, [r1, r3] <-- trapping instruction