general protection fault, probably for non-canonical address 0xdffffc002000800a: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000100040050-0x0000000100040057]
CPU: 1 PID: 5002 Comm: syz-executor325 Not tainted 6.3.0-next-20230505-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:__rb_insert lib/rbtree.c:115 [inline]
RIP: 0010:rb_insert_color+0x71/0x790 lib/rbtree.c:436
Code: 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 36 05 00 00 48 8b 2b 40 f6 c5 01 0f 85 7e 01 00 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 ef 04 00 00 4c 8b 75 08 49 39 de 0f 84 6a 01
RSP: 0018:ffffc900001e0d90 EFLAGS: 00010006
RAX: 000000002000800a RBX: ffffc90003a9fc50 RCX: 0000000000000000
RDX: 1ffff1101732582e RSI: ffff8880b992b910 RDI: 0000000100040050
RBP: 0000000100040048 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffff8880b993d198 R12: ffff8880b992c170
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffc90003a9fc58
FS:  00007f1f38d8d700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1f30d6c000 CR3: 00000000288ca000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rb_insert_color_cached include/linux/rbtree.h:114 [inline]
 rb_add_cached include/linux/rbtree.h:183 [inline]
 timerqueue_add+0x1bd/0x330 lib/timerqueue.c:40
 enqueue_hrtimer+0x171/0x320 kernel/time/hrtimer.c:1091
 __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
 __hrtimer_run_queues+0x8d9/0xa30 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x320/0x7b0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0x14a/0x430 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x92/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:memmove+0x1ac/0x1b0 arch/x86/lib/memmove_64.S:213
Code: fa 02 72 16 66 44 8b 1e 66 44 8b 54 16 fe 66 44 89 1f 66 44 89 54 17 fe eb 0c 48 83 fa 01 72 06 44 8a 1e 44 88 1f c3 48 89 d1 <f3> a4 c3 90 f3 0f 1e fa eb 1a 49 89 f9 40 88 f0 48 89 d1 f3 aa 4c
RSP: 0018:ffffc90003a7efb0 EFLAGS: 00010286
RAX: ffff888072996fb4 RBX: 0000000000000002 RCX: fffffffffc5c7fec
RDX: ffffffffffffffe0 RSI: ffff8880763cef98 RDI: ffff8880763cefa8
RBP: 0000000000000020 R08: ffff888072996f84 R09: 0000766972705f73
R10: 667265736965722e R11: 0000766972705f73 R12: 0000000000000001
R13: 0000000000000000 R14: ffff888072996fa4 R15: 0000000000000010
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__rb_insert lib/rbtree.c:115 [inline]
RIP: 0010:rb_insert_color+0x71/0x790 lib/rbtree.c:436
Code: 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 36 05 00 00 48 8b 2b 40 f6 c5 01 0f 85 7e 01 00 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 ef 04 00 00 4c 8b 75 08 49 39 de 0f 84 6a 01
RSP: 0018:ffffc900001e0d90 EFLAGS: 00010006
RAX: 000000002000800a RBX: ffffc90003a9fc50 RCX: 0000000000000000
RDX: 1ffff1101732582e RSI: ffff8880b992b910 RDI: 0000000100040050
RBP: 0000000100040048 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffff8880b993d198 R12: ffff8880b992c170
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffc90003a9fc58
FS:  00007f1f38d8d700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1f30d6c000 CR3: 00000000288ca000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	48 89 d8             	mov    %rbx,%rax
   3:	48 c1 e8 03          	shr    $0x3,%rax
   7:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
   c:	0f 85 36 05 00 00    	jne    0x548
  12:	48 8b 2b             	mov    (%rbx),%rbp
  15:	40 f6 c5 01          	test   $0x1,%bpl
  19:	0f 85 7e 01 00 00    	jne    0x19d
  1f:	48 8d 7d 08          	lea    0x8(%rbp),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	0f 85 ef 04 00 00    	jne    0x524
  35:	4c 8b 75 08          	mov    0x8(%rbp),%r14
  39:	49 39 de             	cmp    %rbx,%r14
  3c:	0f                   	.byte 0xf
  3d:	84 6a 01             	test   %ch,0x1(%rdx)