------------[ cut here ]------------
NETDEV WATCHDOG: sl0 (): transmit queue 0 timed out
WARNING: CPU: 0 PID: 7935 at net/sched/sch_generic.c:478 dev_watchdog+0x93c/0xb10 net/sched/sch_generic.c:477
Modules linked in:
CPU: 0 PID: 7935 Comm: syz-executor.0 Not tainted 5.15.158-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:dev_watchdog+0x93c/0xb10 net/sched/sch_generic.c:477
Code: 05 8c 90 7b 05 01 48 8b 5c 24 28 48 89 df e8 3b c6 e2 ff 48 c7 c7 40 c3 7c 8b 48 89 de 48 89 c2 48 8b 4c 24 10 e8 e4 80 f6 f8 <0f> 0b e9 fe fc ff ff e8 88 d8 2a f9 0f 0b e9 83 fc ff ff 44 89 e1
vkms_vblank_simulate: vblank timer overrun
RSP: 0018:ffffc90000007b10 EFLAGS: 00010246
RAX: 056fe42fd7874400 RBX: ffff888076eee000 RCX: ffff88801ddcbb80
RDX: 0000000000000102 RSI: 0000000000000102 RDI: 0000000000000000
RBP: 00000000ffffdf01 R08: ffffffff8166860c R09: fffff52000000ea5
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888076eee448
R13: ffff888076eee440 R14: ffff888076eee540 R15: ffff888076eee460
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f928000 CR3: 0000000072648000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x16d/0x560 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x67c/0x890 kernel/time/timer.c:1767
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 __do_softirq+0x3b3/0x93a kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x155/0x240 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x7c/0x80 kernel/kcov.c:272
Code: 8d 42 28 4c 39 d0 77 22 89 f8 89 f6 48 c7 44 0a 08 01 00 00 00 48 89 44 0a 10 48 89 74 0a 18 4c 89 44 0a 20 49 ff c1 4c 89 09 <c3> 0f 1f 00 4c 8b 04 24 65 48 8b 15 14 10 82 7e 65 8b 05 15 10 82
RSP: 0018:ffffc9000342f700 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81bd5fb5
RDX: ffff88801ddcbb80 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff81bd5fd9 R09: fffff94000329f27
R10: 0000000000000000 R11: dffffc0000000001 R12: 00007f78232c0000
R13: ffffea000194f908 R14: ffffea000194f908 R15: ffffea000194f900
 arch_atomic_add_negative arch/x86/include/asm/atomic.h:152 [inline]
 atomic_add_negative include/linux/atomic/atomic-instrumented.h:557 [inline]
 page_remove_file_rmap mm/rmap.c:1283 [inline]
 page_remove_rmap+0x5c9/0x11e0 mm/rmap.c:1354
 zap_pte_range mm/memory.c:1373 [inline]
 zap_pmd_range mm/memory.c:1494 [inline]
 zap_pud_range mm/memory.c:1523 [inline]
 zap_p4d_range mm/memory.c:1544 [inline]
 unmap_page_range+0xffa/0x2630 mm/memory.c:1565
 unmap_vmas+0x1f8/0x390 mm/memory.c:1642
 exit_mmap+0x3b6/0x670 mm/mmap.c:3186
 __mmput+0x112/0x3b0 kernel/fork.c:1126
 exit_mm+0x688/0x7f0 kernel/exit.c:548
 do_exit+0x626/0x2480 kernel/exit.c:859
 do_group_exit+0x144/0x310 kernel/exit.c:994
 __do_sys_exit_group kernel/exit.c:1005 [inline]
 __se_sys_exit_group kernel/exit.c:1003 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1003
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7823ec2ee9
Code: Unable to access opcode bytes at RIP 0x7f7823ec2ebf.
RSP: 002b:00007ffe6ffabfa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f7823ec2ee9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 00007f7823e46000 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
----------------
Code disassembly (best guess):
   0:	8d 42 28             	lea    0x28(%rdx),%eax
   3:	4c 39 d0             	cmp    %r10,%rax
   6:	77 22                	ja     0x2a
   8:	89 f8                	mov    %edi,%eax
   a:	89 f6                	mov    %esi,%esi
   c:	48 c7 44 0a 08 01 00 	movq   $0x1,0x8(%rdx,%rcx,1)
  13:	00 00
  15:	48 89 44 0a 10       	mov    %rax,0x10(%rdx,%rcx,1)
  1a:	48 89 74 0a 18       	mov    %rsi,0x18(%rdx,%rcx,1)
  1f:	4c 89 44 0a 20       	mov    %r8,0x20(%rdx,%rcx,1)
  24:	49 ff c1             	inc    %r9
  27:	4c 89 09             	mov    %r9,(%rcx)
* 2a:	c3                   	ret <-- trapping instruction
  2b:	0f 1f 00             	nopl   (%rax)
  2e:	4c 8b 04 24          	mov    (%rsp),%r8
  32:	65 48 8b 15 14 10 82 	mov    %gs:0x7e821014(%rip),%rdx        # 0x7e82104e
  39:	7e
  3a:	65                   	gs
  3b:	8b                   	.byte 0x8b
  3c:	05                   	.byte 0x5
  3d:	15                   	.byte 0x15
  3e:	10                   	.byte 0x10
  3f:	82                   	.byte 0x82