BUG: spinlock recursion on CPU#1, udevd/4522
 lock: 0xffff8880b953e140, .magic: dead4ead, .owner: udevd/4522, .owner_cpu: 1
CPU: 1 PID: 4522 Comm: udevd Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
 debug_spin_lock_before kernel/locking/spinlock_debug.c:87 [inline]
 do_raw_spin_lock+0x227/0x370 kernel/locking/spinlock_debug.c:115
 raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
 raw_spin_rq_lock kernel/sched/sched.h:1385 [inline]
 rq_lock kernel/sched/sched.h:1699 [inline]
 ttwu_queue kernel/sched/core.c:4055 [inline]
 try_to_wake_up+0x7d3/0x1470 kernel/sched/core.c:4378
 hrtimer_wakeup+0x62/0x80 kernel/time/hrtimer.c:1946
 __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
 __hrtimer_run_queues+0x595/0xd00 kernel/time/hrtimer.c:1756
 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1818
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x107/0x3a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__bfs kernel/locking/lockdep.c:1775 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1844 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2804 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3138 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3253 [inline]
RIP: 0010:validate_chain+0x1e01/0x58e0 kernel/locking/lockdep.c:3869
Code: 2b 48 89 d8 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 11 03 00 00 80 3b 00 74 04 41 80 e7 fa 41 0f b6 c7 84 c0 0f 84 03 fe ff ff <a8> 0c 41 0f 94 c7 49 8d 5d 2b 48 89 d8 48 c1 e8 03 49 bc 00 00 00
RSP: 0018:ffffc900031a67c0 EFLAGS: 00000202
RAX: 0000000000000008 RBX: ffffc900031a69ab RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffc900031a68e0
RBP: ffffc900031a6ac0 R08: ffffffff92cc7507 R09: 1ffffffff2598ea0
R10: dffffc0000000000 R11: fffffbfff2598ea1 R12: dffffc0000000000
R13: ffffffff93e450d8 R14: ffffffff93e450e8 R15: 0000000000000008
 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
 do_write_seqcount_begin_nested include/linux/seqlock.h:469 [inline]
 do_write_seqcount_begin include/linux/seqlock.h:495 [inline]
 psi_group_change+0x113/0x12d0 kernel/sched/psi.c:787
 psi_task_switch+0x199/0x770 kernel/sched/psi.c:938
 psi_sched_switch kernel/sched/stats.h:185 [inline]
 __schedule+0x24c5/0x4a20 kernel/sched/core.c:6731
 preempt_schedule_common+0x84/0xd0 kernel/sched/core.c:6915
 preempt_schedule+0xe1/0xf0 kernel/sched/core.c:6939
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:12
 unwind_next_frame+0x2124/0x2a00 arch/x86/kernel/unwind_orc.c:672
 arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 save_stack+0xfb/0x1f0 mm/page_owner.c:129
 __reset_page_owner+0x44/0x2d0 mm/page_owner.c:150
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346
 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
 __slab_free+0x349/0x410 mm/slub.c:4211
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x5e/0xc0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3813 [inline]
 slab_alloc_node mm/slub.c:3860 [inline]
 kmalloc_trace+0x16d/0x360 mm/slub.c:4007
 kmalloc include/linux/slab.h:590 [inline]
 kzalloc include/linux/slab.h:711 [inline]
 kernfs_fop_open+0x3e7/0xcd0 fs/kernfs/file.c:621
 do_dentry_open+0x907/0x15a0 fs/open.c:956
 do_open fs/namei.c:3643 [inline]
 path_openat+0x2860/0x3240 fs/namei.c:3800
 do_filp_open+0x235/0x490 fs/namei.c:3827
 do_sys_openat2+0x13e/0x1d0 fs/open.c:1407
 do_sys_open fs/open.c:1422 [inline]
 __do_sys_openat fs/open.c:1438 [inline]
 __se_sys_openat fs/open.c:1433 [inline]
 __x64_sys_openat+0x247/0x2a0 fs/open.c:1433
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f6d95f5e9a4
Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffcf71b13d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f6d95f5e9a4
RDX: 0000000000080000 RSI: 00007ffcf71b1508 RDI: 00000000ffffff9c
RBP: 00007ffcf71b1508 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 0000560bc1d7bb42 R14: 0000000000000001 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	2b 48 89             	sub    -0x77(%rax),%ecx
   3:	d8 48 c1             	fmuls  -0x3f(%rax)
   6:	e8 03 42 0f b6       	call   0xb60f420e
   b:	04 20                	add    $0x20,%al
   d:	84 c0                	test   %al,%al
   f:	0f 85 11 03 00 00    	jne    0x326
  15:	80 3b 00             	cmpb   $0x0,(%rbx)
  18:	74 04                	je     0x1e
  1a:	41 80 e7 fa          	and    $0xfa,%r15b
  1e:	41 0f b6 c7          	movzbl %r15b,%eax
  22:	84 c0                	test   %al,%al
  24:	0f 84 03 fe ff ff    	je     0xfffffe2d
* 2a:	a8 0c                	test   $0xc,%al <-- trapping instruction
  2c:	41 0f 94 c7          	sete   %r15b
  30:	49 8d 5d 2b          	lea    0x2b(%r13),%rbx
  34:	48 89 d8             	mov    %rbx,%rax
  37:	48 c1 e8 03          	shr    $0x3,%rax
  3b:	49                   	rex.WB
  3c:	bc                   	.byte 0xbc
  3d:	00 00                	add    %al,(%rax)