Oops: general protection fault, probably for non-canonical address 0xffff11015a3f9800: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xfff8a80ad1fcc000-0xfff8a80ad1fcc007]
CPU: 1 UID: 0 PID: 15547 Comm: modprobe Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:percpu_ref_get_many+0xa3/0x140 include/linux/percpu-refcount.h:205
Code: ee 71 ff 49 bc 00 00 00 00 00 fc ff df 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 b4 5c f7 ff 49 8b 07 a8 03 75 62 <65> 4c 01 30 e8 e4 3e 39 09 85 c0 74 3a e8 4b b5 7a ff 84 c0 75 31
RSP: 0018:ffffc90003d8f6f8 EFLAGS: 00010246
RAX: ffff8880346a4800 RBX: ffffffff822c7059 RCX: cfabec91fb0b6400
RDX: 0000000000000000 RSI: ffffffff8be28320 RDI: ffffffff8be282e0
RBP: 0000000000000078 R08: 0000000000000000 R09: ffffffff822c7059
R10: dffffc0000000000 R11: fffffbfff1f4201f R12: dffffc0000000000
R13: ffff8880b873cec0 R14: 0000000000000001 R15: ffffffff99f8d400
FS:  0000000000000000(0000) GS:ffff888125d55000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffe8 CR3: 000000007cb83000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
 obj_cgroup_get include/linux/memcontrol.h:770 [inline]
 refill_obj_stock+0x254/0x850 mm/memcontrol.c:3045
 __memcg_slab_free_hook+0x127/0x3d0 mm/memcontrol.c:3219
 memcg_slab_free_hook mm/slub.c:2206 [inline]
 slab_free mm/slub.c:4640 [inline]
 kmem_cache_free+0x223/0x400 mm/slub.c:4745
 anon_vma_chain_free mm/rmap.c:147 [inline]
 unlink_anon_vmas+0x614/0x670 mm/rmap.c:447
 free_pgtables+0x587/0xaf0 mm/memory.c:381
 exit_mmap+0x444/0xb50 mm/mmap.c:1295
 __mmput+0x118/0x420 kernel/fork.c:1121
 exit_mm+0x1da/0x2c0 kernel/exit.c:581
 do_exit+0x640/0x22e0 kernel/exit.c:943
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1104
 __do_sys_exit_group kernel/exit.c:1115 [inline]
 __se_sys_exit_group kernel/exit.c:1113 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1113
 x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f197cb386c5
Code: Unable to access opcode bytes at 0x7f197cb3869b.
RSP: 002b:00007fff0f1fadf8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f197cc39fe8 RCX: 00007f197cb386c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001
RBP: 0000000000000001 R08: 00007fff0f1fad88 R09: 0000000000000000
R10: 00007fff0f1fac20 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f197cc38680 R15: 00007f197cc3a000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_ref_get_many+0xa3/0x140 include/linux/percpu-refcount.h:205
Code: ee 71 ff 49 bc 00 00 00 00 00 fc ff df 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 b4 5c f7 ff 49 8b 07 a8 03 75 62 <65> 4c 01 30 e8 e4 3e 39 09 85 c0 74 3a e8 4b b5 7a ff 84 c0 75 31
RSP: 0018:ffffc90003d8f6f8 EFLAGS: 00010246
RAX: ffff8880346a4800 RBX: ffffffff822c7059 RCX: cfabec91fb0b6400
RDX: 0000000000000000 RSI: ffffffff8be28320 RDI: ffffffff8be282e0
RBP: 0000000000000078 R08: 0000000000000000 R09: ffffffff822c7059
R10: dffffc0000000000 R11: fffffbfff1f4201f R12: dffffc0000000000
R13: ffff8880b873cec0 R14: 0000000000000001 R15: ffffffff99f8d400
FS:  0000000000000000(0000) GS:ffff888125d55000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffe8 CR3: 000000007cb83000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	ee                   	out    %al,(%dx)
   1:	71 ff                	jno    0x2
   3:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
   a:	fc ff df
   d:	4c 89 f8             	mov    %r15,%rax
  10:	48 c1 e8 03          	shr    $0x3,%rax
  14:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  19:	74 08                	je     0x23
  1b:	4c 89 ff             	mov    %r15,%rdi
  1e:	e8 b4 5c f7 ff       	call   0xfff75cd7
  23:	49 8b 07             	mov    (%r15),%rax
  26:	a8 03                	test   $0x3,%al
  28:	75 62                	jne    0x8c
* 2a:	65 4c 01 30          	add    %r14,%gs:(%rax) <-- trapping instruction
  2e:	e8 e4 3e 39 09       	call   0x9393f17
  33:	85 c0                	test   %eax,%eax
  35:	74 3a                	je     0x71
  37:	e8 4b b5 7a ff       	call   0xff7ab587
  3c:	84 c0                	test   %al,%al
  3e:	75 31                	jne    0x71