------------[ cut here ]------------
NETDEV WATCHDOG: sl0 (): transmit queue 0 timed out 22380 ms
WARNING: CPU: 0 PID: 5218 at net/sched/sch_generic.c:525 dev_watchdog+0x8cd/0x8f0 net/sched/sch_generic.c:525
Modules linked in:
CPU: 0 PID: 5218 Comm: syz-executor.1 Not tainted 6.7.0-syzkaller-02723-gde927f6c0b07 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:dev_watchdog+0x8cd/0x8f0 net/sched/sch_generic.c:525
Code: a6 91 06 01 90 48 8b 5c 24 10 48 89 df e8 0b 32 e6 ff 45 89 e8 89 e9 48 89 de 48 89 c2 48 c7 c7 a0 0d ed 8b e8 c4 1d bb f8 90 <0f> 0b 90 90 e9 23 fd ff ff e8 25 2b f5 f8 90 0f 0b 90 e9 bc fc ff
RSP: 0018:ffffc90000007be0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff88801c776000 RCX: ffffffff814cf119
RDX: ffff888028e32400 RSI: ffffffff814cf126 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 572056454454454e R12: ffff8880261b2000
R13: 000000000000576c R14: ffff88801c776548 R15: 0000000100003602
FS:  0000555556c47480(0000) GS:ffff88806b600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1b049ad988 CR3: 0000000061b85000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x193/0x590 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x759/0xaa0 kernel/time/timer.c:2038
 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2051
 __do_softirq+0x21a/0x8de kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:kasan_mem_to_shadow include/linux/kasan.h:61 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x39/0x190 mm/kasan/generic.c:189
Code: f8 41 54 44 0f b6 c2 48 01 f0 55 53 0f 82 c6 00 00 00 48 b8 ff ff ff ff ff 7f ff ff 48 39 f8 0f 83 b3 00 00 00 4c 8d 54 37 ff <48> 89 fd 48 b8 00 00 00 00 00 fc ff df 4d 89 d1 48 c1 ed 03 49 c1
RSP: 0018:ffffc9000366f748 EFLAGS: 00000287
RAX: ffff7fffffffffff RBX: ffff8880327d86a8 RCX: ffffffff8167c28e
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc9000366f790
RBP: 1ffff920006cdeee R08: 0000000000000001 R09: ffffed10064fb0d5
R10: ffffc9000366f793 R11: ffffffff8ace21e0 R12: ffff8880327d86b0
R13: ffff8880327d86b8 R14: 0000000000000000 R15: ffffea0000bab840
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1295 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
 do_raw_spin_lock+0x12e/0x2b0 kernel/locking/spinlock_debug.c:116
 spin_lock include/linux/spinlock.h:351 [inline]
 try_to_free_buffers+0x14e/0x2d0 fs/buffer.c:2928
 jbd2_journal_try_to_free_buffers+0x1fa/0x270 fs/jbd2/transaction.c:2182
 ext4_release_folio+0x19a/0x370 fs/ext4/inode.c:3198
 filemap_release_folio+0x1f1/0x270 mm/filemap.c:4086
 block_invalidate_folio+0x4e5/0x5e0 fs/buffer.c:1633
 folio_invalidate mm/truncate.c:158 [inline]
 truncate_cleanup_folio+0x2a8/0x3d0 mm/truncate.c:178
 truncate_inode_pages_range+0x27b/0xf00 mm/truncate.c:358
 ext4_evict_inode+0x2c7/0x1a40 fs/ext4/inode.c:193
 evict+0x2ed/0x6b0 fs/inode.c:665
 iput_final fs/inode.c:1776 [inline]
 iput.part.0+0x560/0x7b0 fs/inode.c:1802
 iput+0x5c/0x80 fs/inode.c:1792
 do_unlinkat+0x60f/0x740 fs/namei.c:4385
 __do_sys_unlink fs/namei.c:4426 [inline]
 __se_sys_unlink fs/namei.c:4424 [inline]
 __x64_sys_unlink+0xc8/0x110 fs/namei.c:4424
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f68e9c7c4d7
Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe0c062b18 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f68e9c7c4d7
RDX: 00007ffe0c062b40 RSI: 00007ffe0c062bd0 RDI: 00007ffe0c062bd0
RBP: 00007ffe0c062bd0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe0c063c90
R13: 00007f68e9cc83b9 R14: 0000000000070c73 R15: 0000000000000008
 </TASK>
----------------
Code disassembly (best guess):
   0:	f8                   	clc
   1:	41 54                	push   %r12
   3:	44 0f b6 c2          	movzbl %dl,%r8d
   7:	48 01 f0             	add    %rsi,%rax
   a:	55                   	push   %rbp
   b:	53                   	push   %rbx
   c:	0f 82 c6 00 00 00    	jb     0xd8
  12:	48 b8 ff ff ff ff ff 	movabs $0xffff7fffffffffff,%rax
  19:	7f ff ff
  1c:	48 39 f8             	cmp    %rdi,%rax
  1f:	0f 83 b3 00 00 00    	jae    0xd8
  25:	4c 8d 54 37 ff       	lea    -0x1(%rdi,%rsi,1),%r10
* 2a:	48 89 fd             	mov    %rdi,%rbp <-- trapping instruction
  2d:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  34:	fc ff df
  37:	4d 89 d1             	mov    %r10,%r9
  3a:	48 c1 ed 03          	shr    $0x3,%rbp
  3e:	49                   	rex.WB
  3f:	c1                   	.byte 0xc1