------------[ cut here ]------------
cpu_t != t
WARNING: arch/x86/kernel/cpu/mce/core.c:1770 at mce_timer_fn+0x289/0x2e0 arch/x86/kernel/cpu/mce/core.c:1770, CPU#2: syz.0.5/5921
Modules linked in:
CPU: 2 UID: 0 PID: 5921 Comm: syz.0.5 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:mce_timer_fn+0x289/0x2e0 arch/x86/kernel/cpu/mce/core.c:1770
Code: 58 00 4d 01 e4 4d 39 ec 4d 0f 47 e5 31 ff 4c 89 e6 e8 eb e4 58 00 4d 85 e4 0f 84 20 ff ff ff e9 f7 fe ff ff e8 38 ea 58 00 90 <0f> 0b 90 e9 cf fd ff ff 4c 89 f6 48 c7 c7 a0 ee bf 8f e8 f0 17 85
RSP: 0000:ffffc90000548c20 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88802b223440 RCX: 0000000000000100
RDX: ffff888026732580 RSI: ffffffff81b2b878 RDI: ffffffff8e6a9930
RBP: ffff88802b123440 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000000001f R12: 0000000000000002
R13: 8000000000000100 R14: 1ffff920000a918d R15: ffffffff81b2b5f0
FS: 0000000000000000(0000) GS:ffff88809594a000(0063) knlGS:00000000f5436b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7248e50 CR3: 000000002651c000 CR4: 0000000000352ef0
Call Trace:
call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers+0x757/0xb00 kernel/time/timer.c:2374
__run_timer_base kernel/time/timer.c:2386 [inline]
__run_timer_base kernel/time/timer.c:2378 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2395
run_timer_softirq+0x10/0x50 kernel/time/timer.c:2403
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:437
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 4b 72 a0 f5 cc
RSP: 0000:ffffc90004f26d40 EFLAGS: 00000286
RAX: 0000000000000001 RBX: ffffc90004f27ea8 RCX: ffffffff92f15801
RDX: 0000000000000000 RSI: ffffffff8c625a00 RDI: ffffffff8e6a9930
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000011fa4 R12: ffffc90004f26df8
R13: ffffc90004f26db8 R14: ffffc90004f27e90 R15: ffffc90004f26dec
rcu_read_unlock include/linux/rcupdate.h:878 [inline]
class_rcu_destructor include/linux/rcupdate.h:1216 [inline]
unwind_next_frame+0x745/0x2090 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:183
__set_page_owner+0x8c/0x540 mm/page_owner.c:359
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
__alloc_pages_slowpath mm/page_alloc.c:4884 [inline]
__alloc_frozen_pages_noprof+0x936/0x3300 mm/page_alloc.c:5449
__alloc_pages_noprof mm/page_alloc.c:5471 [inline]
alloc_pages_bulk_noprof+0x5e1/0x13c0 mm/page_alloc.c:5295
___alloc_pages_bulk mm/kasan/shadow.c:345 [inline]
__kasan_populate_vmalloc_do mm/kasan/shadow.c:370 [inline]
__kasan_populate_vmalloc+0xf0/0x210 mm/kasan/shadow.c:424
kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
alloc_vmap_area+0x95d/0x2bb0 mm/vmalloc.c:2145
__get_vm_area_node+0x1ed/0x350 mm/vmalloc.c:3248
get_vm_area+0x73/0xa0 mm/vmalloc.c:3290
arena_map_alloc+0x2a0/0x8e0 kernel/bpf/arena.c:296
map_create_alloc kernel/bpf/syscall.c:1534 [inline]
map_create+0x874/0x30d0 kernel/bpf/syscall.c:1644
__sys_bpf+0x12a0/0x4a30 kernel/bpf/syscall.c:6364
__do_sys_bpf kernel/bpf/syscall.c:6506 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6503 [inline]
__ia32_sys_bpf+0xcc/0x170 kernel/bpf/syscall.c:6503
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf741efec
Code: Unable to access opcode bytes at 0xf741efc2.
RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000040
RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: cc int3
1: cc int3
2: cc int3
3: cc int3
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: cc int3
1f: cc int3
20: cc int3
21: cc int3
22: cc int3
23: cc int3
24: cc int3
25: cc int3
26: cc int3
27: cc int3
28: cc int3
29: cc int3
* 2a: c3 ret <-- trapping instruction
2b: cc int3
2c: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
33: 00 00 00 00
37: 0f 1f 00 nopl (%rax)
3a: e9 4b 72 a0 f5 jmp 0xf5a0728a
3f: cc int3