Oops: general protection fault, probably for non-canonical address 0xffff11014a5db000: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0xfff8a80a52ed8000-0xfff8a80a52ed8007]
CPU: 0 UID: 0 PID: 8055 Comm: udevd Not tainted 6.15.0-rc7-syzkaller-00175-g0f8c0258bf04 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:percpu_ref_get_many+0xa3/0x140 include/linux/percpu-refcount.h:205
Code: 08 74 ff 49 bc 00 00 00 00 00 fc ff df 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 b4 89 f7 ff 49 8b 07 a8 03 75 62 <65> 4c 01 30 e8 44 4c 2c 09 85 c0 74 3a e8 4b b7 7c ff 84 c0 75 31
RSP: 0018:ffffc900045cf678 EFLAGS: 00010046
RAX: ffff888024519000 RBX: ffffffff822a6179 RCX: a0d83274a9c1dc00
RDX: 0000000000000000 RSI: ffffffff8bc1f5e0 RDI: ffffffff8bc1f5a0
RBP: ffffc900045cf798 R08: 0000000000000000 R09: 0000000000080000
R10: 0000000000000000 R11: ffffffff822a6179 R12: dffffc0000000000
R13: ffff888075eb4000 R14: 0000000000000001 R15: ffff888075eb4000
FS:  0000000000000000(0000) GS:ffff8881260c2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000002a030 CR3: 00000000329f0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
 obj_cgroup_get include/linux/memcontrol.h:760 [inline]
 replace_stock_objcg mm/memcontrol.c:2772 [inline]
 refill_obj_stock+0x265/0x790 mm/memcontrol.c:2950
 obj_cgroup_uncharge mm/memcontrol.c:3013 [inline]
 __memcg_slab_free_hook+0x1ff/0x330 mm/memcontrol.c:3100
 memcg_slab_free_hook mm/slub.c:2205 [inline]
 slab_free mm/slub.c:4639 [inline]
 kmem_cache_free+0x21b/0x3f0 mm/slub.c:4744
 anon_vma_chain_free mm/rmap.c:147 [inline]
 unlink_anon_vmas+0x2cc/0x670 mm/rmap.c:421
 free_pgtables+0x45d/0x710 mm/memory.c:391
 exit_mmap+0x46c/0xba0 mm/mmap.c:1295
 __mmput+0x118/0x420 kernel/fork.c:1380
 exit_mm+0x1da/0x2c0 kernel/exit.c:589
 do_exit+0x859/0x2550 kernel/exit.c:940
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1102
 __do_sys_exit_group kernel/exit.c:1113 [inline]
 __se_sys_exit_group kernel/exit.c:1111 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1111
 x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f997d2f16c5
Code: Unable to access opcode bytes at 0x7f997d2f169b.
RSP: 002b:00007ffda00512a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000055fca7365f70 RCX: 00007f997d2f16c5
RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000
RBP: 000055fca7351910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffda00512f0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_ref_get_many+0xa3/0x140 include/linux/percpu-refcount.h:205
Code: 08 74 ff 49 bc 00 00 00 00 00 fc ff df 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 b4 89 f7 ff 49 8b 07 a8 03 75 62 <65> 4c 01 30 e8 44 4c 2c 09 85 c0 74 3a e8 4b b7 7c ff 84 c0 75 31
RSP: 0018:ffffc900045cf678 EFLAGS: 00010046
RAX: ffff888024519000 RBX: ffffffff822a6179 RCX: a0d83274a9c1dc00
RDX: 0000000000000000 RSI: ffffffff8bc1f5e0 RDI: ffffffff8bc1f5a0
RBP: ffffc900045cf798 R08: 0000000000000000 R09: 0000000000080000
R10: 0000000000000000 R11: ffffffff822a6179 R12: dffffc0000000000
R13: ffff888075eb4000 R14: 0000000000000001 R15: ffff888075eb4000
FS:  0000000000000000(0000) GS:ffff8881260c2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000002a030 CR3: 00000000329f0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	74 ff                	je     0x1
   2:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
   9:	fc ff df
   c:	4c 89 f8             	mov    %r15,%rax
   f:	48 c1 e8 03          	shr    $0x3,%rax
  13:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  18:	74 08                	je     0x22
  1a:	4c 89 ff             	mov    %r15,%rdi
  1d:	e8 b4 89 f7 ff       	call   0xfff789d6
  22:	49 8b 07             	mov    (%r15),%rax
  25:	a8 03                	test   $0x3,%al
  27:	75 62                	jne    0x8b
* 29:	65 4c 01 30          	add    %r14,%gs:(%rax) <-- trapping instruction
  2d:	e8 44 4c 2c 09       	call   0x92c4c76
  32:	85 c0                	test   %eax,%eax
  34:	74 3a                	je     0x70
  36:	e8 4b b7 7c ff       	call   0xff7cb786
  3b:	84 c0                	test   %al,%al
  3d:	75 31                	jne    0x70