------------[ cut here ]------------
NETDEV WATCHDOG: lec0 (): transmit queue 0 timed out
WARNING: CPU: 1 PID: 4606 at net/sched/sch_generic.c:481 dev_watchdog+0x85d/0xa40 net/sched/sch_generic.c:480
Modules linked in:
CPU: 1 PID: 4606 Comm: syz.2.114 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:dev_watchdog+0x85d/0xa40 net/sched/sch_generic.c:480
Code: f6 71 05 01 48 8b 5c 24 20 48 89 df e8 9c d6 e3 ff 48 c7 c7 80 53 22 8b 48 89 de 48 8b 1c 24 48 89 c2 44 89 e1 e8 d3 d8 b0 01 <0f> 0b e9 51 fe ff ff e8 97 a3 73 f9 0f 0b e9 33 fe ff ff 89 d9 80
RSP: 0018:ffffc90000dd0af0 EFLAGS: 00010246

RAX: a9aa42eb4937ba00 RBX: ffff88807730a448 RCX: ffff88801839bb80
RDX: 0000000000000100 RSI: 0000000000000101 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffc90000dd0627 R09: 1ffff920001ba0c4
R10: dffffc0000000000 R11: fffff520001ba0c5 R12: 0000000000000000
R13: ffff88807730a540 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3291eff8 CR3: 000000001f456000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
 expire_timers kernel/time/timer.c:1699 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:1970
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983
 handle_softirqs+0x336/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:114 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x173/0x290 mm/kasan/generic.c:189
Code: 00 00 00 41 29 ee 4d 01 f3 49 89 df 4d 29 df 4d 8d 67 07 4d 85 ff 4d 0f 49 e7 49 c1 ec 03 45 85 e4 74 21 45 31 f6 4f 8b 3c 33 <4d> 85 ff 75 40 49 83 c6 08 41 ff cc 75 ee 4c 29 db 4c 29 f3 4d 01
RSP: 0018:ffffc9000124f420 EFLAGS: 00000206
RAX: 0000000000001101 RBX: fffff52000249ece RCX: ffffffff81be240c
RDX: 0000000000000001 RSI: 0000000000000200 RDI: ffffc9000124f470
RBP: 0000000000000006 R08: ffffc9000124f66f R09: 1ffff92000249ecd
R10: dffffc0000000000 R11: fffff52000249e90 R12: 0000000000000005
R13: ffff88806727f420 R14: 0000000000000010 R15: 0000000000000000
 memset+0x1e/0x40 mm/kasan/shadow.c:44
 kasan_save_stack mm/kasan/common.c:35 [inline]
 kasan_set_track+0x3c/0x70 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1710 [inline]
 slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736
 slab_free mm/slub.c:3504 [inline]
 kmem_cache_free+0x8f/0x210 mm/slub.c:3520
 remove_vma mm/mmap.c:188 [inline]
 exit_mmap+0x502/0x640 mm/mmap.c:3227
 __mmput+0x115/0x390 kernel/fork.c:1133
 exit_mm+0x632/0x7b0 kernel/exit.c:557
 do_exit+0x5b8/0x2110 kernel/exit.c:877
 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004
 get_signal+0x7eb/0x12e0 kernel/signal.c:2913
 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:157 [inline]
 exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217
 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fcff5419159
Code: Unable to access opcode bytes at RIP 0x7fcff541912f.
RSP: 002b:00007fcff36710e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007fcff56a0fa8 RCX: 00007fcff5419159
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fcff56a0fac
RBP: 00007fcff56a0fa0 R08: 002abce16ee2ae50 R09: 0000000000000000
R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcff56a1038 R14: 00007ffd54eedf40 R15: 00007ffd54eee028
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 41 29             	add    %al,0x29(%rcx)
   5:	ee                   	out    %al,(%dx)
   6:	4d 01 f3             	add    %r14,%r11
   9:	49 89 df             	mov    %rbx,%r15
   c:	4d 29 df             	sub    %r11,%r15
   f:	4d 8d 67 07          	lea    0x7(%r15),%r12
  13:	4d 85 ff             	test   %r15,%r15
  16:	4d 0f 49 e7          	cmovns %r15,%r12
  1a:	49 c1 ec 03          	shr    $0x3,%r12
  1e:	45 85 e4             	test   %r12d,%r12d
  21:	74 21                	je     0x44
  23:	45 31 f6             	xor    %r14d,%r14d
  26:	4f 8b 3c 33          	mov    (%r11,%r14,1),%r15
* 2a:	4d 85 ff             	test   %r15,%r15 <-- trapping instruction
  2d:	75 40                	jne    0x6f
  2f:	49 83 c6 08          	add    $0x8,%r14
  33:	41 ff cc             	dec    %r12d
  36:	75 ee                	jne    0x26
  38:	4c 29 db             	sub    %r11,%rbx
  3b:	4c 29 f3             	sub    %r14,%rbx
  3e:	4d                   	rex.WRB
  3f:	01                   	.byte 0x1