------------[ cut here ]------------
NETDEV WATCHDOG: sl0 (): transmit queue 0 timed out 25590 ms
WARNING: CPU: 1 PID: 27158 at net/sched/sch_generic.c:525 dev_watchdog+0x8cd/0x8f0 net/sched/sch_generic.c:525
Modules linked in:
CPU: 1 PID: 27158 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:dev_watchdog+0x8cd/0x8f0 net/sched/sch_generic.c:525
Code: 2c 77 06 01 90 48 8b 5c 24 10 48 89 df e8 8b 31 e6 ff 45 89 e8 89 e9 48 89 de 48 89 c2 48 c7 c7 a0 7b ec 8b e8 c4 84 c1 f8 90 <0f> 0b 90 90 e9 23 fd ff ff e8 85 43 fb f8 90 0f 0b 90 e9 bc fc ff
RSP: 0018:ffffc90000578be0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8880235ce000 RCX: ffffffff814db519
RDX: ffff88801d354800 RSI: ffffffff814db526 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000006 R12: ffff88802737b800
R13: 00000000000063f6 R14: ffff8880235ce548 R15: 00000000ffffd601
FS:  0000000000000000(0000) GS:ffff88802c700000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000003022d000 CR3: 000000000cd77000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x193/0x590 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x764/0xb20 kernel/time/timer.c:2022
 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
 __do_softirq+0x21a/0x8de kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:kasan_check_range+0x1a/0x190 mm/kasan/generic.c:186
Code: 5d 41 5c c3 66 66 2e 0f 1f 84 00 00 00 00 00 90 66 0f 1f 00 48 85 f6 0f 84 48 01 00 00 48 89 f8 41 54 44 0f b6 c2 48 01 f0 55 <53> 0f 82 c6 00 00 00 48 b8 ff ff ff ff ff 7f ff ff 48 39 f8 0f 83
RSP: 0018:ffffc900211df7f8 EFLAGS: 00000282
RAX: ffffea0001768a08 RBX: ffffea0001768a00 RCX: ffffffff81e88ee4
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea0001768a00
RBP: ffffea0001768a00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000003 R12: ffff888041195b40
R13: 0000000000000001 R14: ffffea0001768a08 R15: ffffea0001768a00
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 PageSlab include/linux/page-flags.h:481 [inline]
 page_table_check_clear mm/page_table_check.c:74 [inline]
 page_table_check_clear+0x284/0x9b0 mm/page_table_check.c:61
 __page_table_check_pte_clear+0xef/0x100 mm/page_table_check.c:158
 page_table_check_pte_clear include/linux/page_table_check.h:49 [inline]
 ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1301 [inline]
 zap_pte_range mm/memory.c:1440 [inline]
 zap_pmd_range mm/memory.c:1583 [inline]
 zap_pud_range mm/memory.c:1612 [inline]
 zap_p4d_range mm/memory.c:1633 [inline]
 unmap_page_range+0x1861/0x2b70 mm/memory.c:1654
 unmap_single_vma+0x194/0x2b0 mm/memory.c:1700
 unmap_vmas+0x229/0x470 mm/memory.c:1744
 exit_mmap+0x1ad/0xa70 mm/mmap.c:3308
 __mmput+0x12a/0x4d0 kernel/fork.c:1349
 mmput+0x62/0x70 kernel/fork.c:1371
 exit_mm kernel/exit.c:567 [inline]
 do_exit+0x9a5/0x2ad0 kernel/exit.c:856
 do_group_exit+0xd4/0x2a0 kernel/exit.c:1018
 __do_sys_exit_group kernel/exit.c:1029 [inline]
 __se_sys_exit_group kernel/exit.c:1027 [inline]
 __ia32_sys_exit_group+0x3e/0x50 kernel/exit.c:1027
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x62/0xe0 arch/x86/entry/common.c:321
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:346
 entry_SYSENTER_compat_after_hwframe+0x70/0x7a
RIP: 0023:0xf7f6a579
Code: Unable to access opcode bytes at 0xf7f6a54f.
RSP: 002b:00000000ffd8177c EFLAGS: 00000282 ORIG_RAX: 00000000000000fc
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 00000000ffffff9c RDI: 00000000f7353ff4
RBP: 000000000000001e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	5d                   	pop    %rbp
   1:	41 5c                	pop    %r12
   3:	c3                   	ret
   4:	66 66 2e 0f 1f 84 00 	data16 cs nopw 0x0(%rax,%rax,1)
   b:	00 00 00 00
   f:	90                   	nop
  10:	66 0f 1f 00          	nopw   (%rax)
  14:	48 85 f6             	test   %rsi,%rsi
  17:	0f 84 48 01 00 00    	je     0x165
  1d:	48 89 f8             	mov    %rdi,%rax
  20:	41 54                	push   %r12
  22:	44 0f b6 c2          	movzbl %dl,%r8d
  26:	48 01 f0             	add    %rsi,%rax
  29:	55                   	push   %rbp
* 2a:	53                   	push   %rbx <-- trapping instruction
  2b:	0f 82 c6 00 00 00    	jb     0xf7
  31:	48 b8 ff ff ff ff ff 	movabs $0xffff7fffffffffff,%rax
  38:	7f ff ff
  3b:	48 39 f8             	cmp    %rdi,%rax
  3e:	0f                   	.byte 0xf
  3f:	83                   	.byte 0x83