================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
dhcpcd-run-hook/5683 is leaving the kernel with locks still held!
1 lock held by dhcpcd-run-hook/5683:
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: do_fault_around mm/memory.c:5850 [inline]
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: do_read_fault mm/memory.c:5884 [inline]
 #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: do_fault+0x8b4/0x1750 mm/memory.c:6027
------------[ cut here ]------------
Voluntary context switch within RCU read-side critical section!
WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332, CPU#1: dhcpcd-run-hook/5683
Modules linked in:
CPU: 1 UID: 0 PID: 5683 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:rcu_note_context_switch+0x859/0x19c0 kernel/rcu/tree_plugin.h:332
Code: c1 ea 03 80 3c 02 00 0f 85 9b 0b 00 00 48 8b 53 28 b9 01 00 00 00 4c 89 ef e8 a3 cf fe ff e9 1d f9 ff ff 48 8d 3d 37 ac ed 0e <67> 48 0f b9 3a e9 99 f8 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0000:ffffc90003b37cf0 EFLAGS: 00010002
RAX: 0000000000000001 RBX: ffff88802b33c3c0 RCX: ffffffff81ed2401
RDX: 0000000000000000 RSI: ffffffff8c1c2080 RDI: ffffffff90db4460
RBP: ffff88802214ca00 R08: 0000000000000000 R09: fffffbfff21af62a
R10: ffffffff90d7b157 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88802214cec4 R14: ffff88802b33b380 R15: ffffffff90d7e4c4
FS:  00007f95b83edc80(0000) GS:ffff888097280000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f95b8709feb CR3: 000000004d7ad000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __schedule+0x276/0x6820 kernel/sched/core.c:7043
 __schedule_loop kernel/sched/core.c:7267 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7282
 __exit_to_user_mode_loop kernel/entry/common.c:54 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:252 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:323 [inline]
 irqentry_exit+0x359/0x790 kernel/entry/common.c:162
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0033:0x7f95b8709feb
Code: 08 48 8b 78 08 48 89 13 e8 5e f9 ff ff 97 e8 bb ff ff ff 48 09 e8 40 0f 95 c5 40 0f b6 ed eb 04 48 83 2b 08 48 95 5a 5b 5d c3 <55> 53 89 fb 48 83 ec 18 48 8b 3e 48 89 74 24 08 e8 a9 e7 f9 ff 80
RSP: 002b:00007fff193633f8 EFLAGS: 00010287
RAX: 00007f95b8754190 RBX: 0000564cf772e910 RCX: 0000000000000002
RDX: 0000564cf772e910 RSI: 0000564cf7737120 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000040 R11: 0000000000000000 R12: 0000564cf7736e50
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	c1 ea 03             	shr    $0x3,%edx
   3:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   7:	0f 85 9b 0b 00 00    	jne    0xba8
   d:	48 8b 53 28          	mov    0x28(%rbx),%rdx
  11:	b9 01 00 00 00       	mov    $0x1,%ecx
  16:	4c 89 ef             	mov    %r13,%rdi
  19:	e8 a3 cf fe ff       	call   0xfffecfc1
  1e:	e9 1d f9 ff ff       	jmp    0xfffff940
  23:	48 8d 3d 37 ac ed 0e 	lea    0xeedac37(%rip),%rdi        # 0xeedac61
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 99 f8 ff ff       	jmp    0xfffff8cd
  34:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  3b:	fc ff df
  3e:	48                   	rex.W
  3f:	8d                   	.byte 0x8d