------------[ cut here ]------------
task_rq(p) != rq
WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656, CPU#1: syz.0.68/5892
Modules linked in:
CPU: 1 UID: 0 PID: 5892 Comm: syz.0.68 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656
Code: 42 80 3c 20 00 74 08 4c 89 ff e8 85 e3 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 4b 65 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82
RSP: 0018:ffffc90003eff8c0 EFLAGS: 00010006
RAX: ffff8880b863ba40 RBX: ffff8880b873ba40 RCX: ffffffff8197c7de
RDX: 0000000000000000 RSI: ffff888012029f00 RDI: ffff8880b873ba40
RBP: dffffc0000000000 R08: ffffffff8fcf0b0f R09: 1ffffffff1f9e161
R10: dffffc0000000000 R11: fffffbfff1f9e162 R12: dffffc0000000000
R13: 1ffff110170e78d6 R14: ffff888012029f00 R15: ffffffff8dc217d0
FS:  0000000000000000(0000) GS:ffff888125b76000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b34363fff CR3: 0000000011720000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 set_next_task_fair+0xa68/0xce0 kernel/sched/fair.c:15058
 put_prev_set_next_task kernel/sched/sched.h:2770 [inline]
 pick_next_task kernel/sched/core.c:6443 [inline]
 __schedule+0x3e03/0x5550 kernel/sched/core.c:7144
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7553
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:kasan_get_free_meta mm/kasan/generic.c:479 [inline]
RIP: 0010:kasan_save_free_info+0xb/0x50 mm/kasan/generic.c:577
Code: 41 5e e9 38 cf ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 63 bf b8 00 00 00 <48> 81 ff ff ff ff 7f 0f 94 c0 48 01 f7 0f 94 c1 08 c1 75 2b 53 48
RSP: 0018:ffffc90003effc78 EFLAGS: 00000246
RAX: ffffed10067cc6c0 RBX: ffff888033e63600 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888033e63600 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: 0000000000000000
R10: ffffed10067cc6c0 R11: fffffbfff1f9e15f R12: ffff888033e63600
R13: 0000000000000000 R14: ffff88813fe48b40 R15: ffffffff81879eae
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2700 [inline]
 slab_free mm/slub.c:6308 [inline]
 kmem_cache_free+0x187/0x6c0 mm/slub.c:6435
 exit_mm+0x18e/0x250 kernel/exit.c:610
 do_exit+0x6a2/0x22c0 kernel/exit.c:992
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1147
 __do_sys_exit_group kernel/exit.c:1158 [inline]
 __se_sys_exit_group kernel/exit.c:1156 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1156
 x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff8f874ce59
Code: Unable to access opcode bytes at 0x7ff8f874ce2f.
RSP: 002b:00007fffedad78c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff8f874ce59
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fffedad792c R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000033
R13: 00000000000927c0 R14: 000000000001845a R15: 00007fffedad7980
 </TASK>
----------------
Code disassembly (best guess):
   0:	41 5e                	pop    %r14
   2:	e9 38 cf ff ff       	jmp    0xffffcf3f
   7:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
   e:	00
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  23:	48 63 bf b8 00 00 00 	movslq 0xb8(%rdi),%rdi
* 2a:	48 81 ff ff ff ff 7f 	cmp    $0x7fffffff,%rdi <-- trapping instruction
  31:	0f 94 c0             	sete   %al
  34:	48 01 f7             	add    %rsi,%rdi
  37:	0f 94 c1             	sete   %cl
  3a:	08 c1                	or     %al,%cl
  3c:	75 2b                	jne    0x69
  3e:	53                   	push   %rbx
  3f:	48                   	rex.W