rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-....: (1 GPs behind) idle=23d/1/0x4000000000000000 softirq=58072/58073 fqs=4969 
	(t=10502 jiffies g=100589 q=18164)
NMI backtrace for cpu 1
CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted 5.15.0-rc5-next-20211018-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound io_ring_exit_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
 print_cpu_stall kernel/rcu/tree_stall.h:604 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:688 [inline]
 rcu_pending kernel/rcu/tree.c:3889 [inline]
 rcu_sched_clock_irq.cold+0x9d/0x746 kernel/rcu/tree.c:2608
 update_process_times+0x16d/0x200 kernel/time/timer.c:1785
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:163 [inline]
RIP: 0010:unwind_next_frame+0x23e/0x1ca0 arch/x86/kernel/unwind_orc.c:443
Code: 39 c6 0f 83 7b 13 00 00 48 b8 00 00 00 00 00 fc ff df 89 f2 48 8d 3c 95 00 c5 a7 8e 48 89 f9 48 c1 e9 03 0f b6 0c 01 48 89 f8 <83> e0 07 83 c0 03 38 c8 7c 27 84 c9 74 23 48 89 54 24 30 48 89 74
RSP: 0018:ffffc90000cf75d8 EFLAGS: 00000a03
RAX: ffffffff8ea894ec RBX: 1ffff9200019eec3 RCX: 0000000000000000
RDX: 00000000000033fb RSI: 00000000000033fb RDI: ffffffff8ea894ec
RBP: 0000000000000001 R08: ffffffff8b9f99a0 R09: ffffc90000cf7700
R10: fffff5200019eeed R11: 0000000000088089 R12: ffffc90000cf7758
R13: ffffc90000cf7741 R14: ffffc90000cf7700 R15: ffffffff8133fb95
 __unwind_start+0x50b/0x7e0 arch/x86/kernel/unwind_orc.c:712
 unwind_start arch/x86/include/asm/unwind.h:62 [inline]
 arch_stack_walk+0x5c/0xe0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
 kasan_set_track+0x21/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
 ____kasan_slab_free mm/kasan/common.c:366 [inline]
 ____kasan_slab_free mm/kasan/common.c:328 [inline]
 __kasan_slab_free+0xff/0x130 mm/kasan/common.c:374
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:1700 [inline]
 slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1726
 slab_free mm/slub.c:3491 [inline]
 kfree+0xf6/0x560 mm/slub.c:4539
 __io_remove_buffers.part.0+0x115/0x220 fs/io_uring.c:4329
 __io_remove_buffers fs/io_uring.c:9241 [inline]
 io_destroy_buffers fs/io_uring.c:9241 [inline]
 io_ring_ctx_free fs/io_uring.c:9297 [inline]
 io_ring_exit_work+0x74d/0xbe8 fs/io_uring.c:9473
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
----------------
Code disassembly (best guess):
   0:	39 c6                	cmp    %eax,%esi
   2:	0f 83 7b 13 00 00    	jae    0x1383
   8:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   f:	fc ff df
  12:	89 f2                	mov    %esi,%edx
  14:	48 8d 3c 95 00 c5 a7 	lea    -0x71583b00(,%rdx,4),%rdi
  1b:	8e
  1c:	48 89 f9             	mov    %rdi,%rcx
  1f:	48 c1 e9 03          	shr    $0x3,%rcx
  23:	0f b6 0c 01          	movzbl (%rcx,%rax,1),%ecx
  27:	48 89 f8             	mov    %rdi,%rax
* 2a:	83 e0 07             	and    $0x7,%eax <-- trapping instruction
  2d:	83 c0 03             	add    $0x3,%eax
  30:	38 c8                	cmp    %cl,%al
  32:	7c 27                	jl     0x5b
  34:	84 c9                	test   %cl,%cl
  36:	74 23                	je     0x5b
  38:	48 89 54 24 30       	mov    %rdx,0x30(%rsp)
  3d:	48                   	rex.W
  3e:	89                   	.byte 0x89
  3f:	74                   	.byte 0x74