------------[ cut here ]------------ WARNING: CPU: 1 PID: 11 at mm/slub.c:4550 slab_free_after_rcu_debug+0x18b/0x270 mm/slub.c:4550 Modules linked in: CPU: 1 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.11.0-rc2-next-20240805-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Workqueue: eval_map_wq eval_map_work_func RIP: 0010:slab_free_after_rcu_debug+0x18b/0x270 mm/slub.c:4550 Code: 48 89 04 19 48 8d 4a 08 49 8b 34 24 65 48 0f c7 0e 75 c8 4c 89 f7 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 36 55 ff ff 90 <0f> 0b 90 eb 92 90 0f 0b 90 eb 8c 90 0f 0b 90 eb 86 41 8b 54 24 1c RSP: 0000:ffffc90000a18bc0 EFLAGS: 00010286 RAX: ffff88823be00000 RBX: ffff888018b71280 RCX: 0000000000022fe0 RDX: ffffea0000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000a18e30 R08: ffffffff8142d2ec R09: 1ffffffff26e90eb R10: dffffc0000000000 R11: ffffffff81f105b0 R12: dffffc0000000000 R13: ffffffff817beed6 R14: ffff88823be22fe0 R15: ffffea000062dc00 FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000000e734000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__sanitizer_cov_trace_switch+0x109/0x120 kernel/kcov.c:351 Code: e3 48 c1 e3 05 48 8d 43 28 4c 39 f8 77 a3 49 ff c4 4c 89 21 4c 89 44 0b 08 4c 89 74 0b 10 48 89 7c 0b 18 4c 89 4c 0b 20 eb 87 <5b> 41 5c 41 5e 41 5f c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 RSP: 0000:ffffc90000107aa8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 000000000000004f RCX: ffff888017ad3c00 RDX: 0000000000000002 RSI: ffffffff8e993990 RDI: 000000000000004f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff819ca021 R10: 0000000000000002 R11: ffff888017ad3c00 R12: ffffffff919685b8 R13: 0000000000000001 R14: 000000000000005c R15: ffffffff8ebf7672 update_event_printk kernel/trace/trace_events.c:2766 [inline] trace_event_eval_update+0x311/0xf90 kernel/trace/trace_events.c:2938 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 ---------------- Code disassembly (best guess): 0: e3 48 jrcxz 0x4a 2: c1 e3 05 shl $0x5,%ebx 5: 48 8d 43 28 lea 0x28(%rbx),%rax 9: 4c 39 f8 cmp %r15,%rax c: 77 a3 ja 0xffffffb1 e: 49 ff c4 inc %r12 11: 4c 89 21 mov %r12,(%rcx) 14: 4c 89 44 0b 08 mov %r8,0x8(%rbx,%rcx,1) 19: 4c 89 74 0b 10 mov %r14,0x10(%rbx,%rcx,1) 1e: 48 89 7c 0b 18 mov %rdi,0x18(%rbx,%rcx,1) 23: 4c 89 4c 0b 20 mov %r9,0x20(%rbx,%rcx,1) 28: eb 87 jmp 0xffffffb1 * 2a: 5b pop %rbx <-- trapping instruction 2b: 41 5c pop %r12 2d: 41 5e pop %r14 2f: 41 5f pop %r15 31: c3 ret 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 3d: 00 00 00