list_del corruption. prev->next should be ffff880193f1eae0, but was ffff880193ba61a0
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:53!
invalid opcode: 0000 [#1] SMP KASAN
CPU: 1 PID: 4671 Comm: syz-executor0 Not tainted 4.19.0-rc1+ #122
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_del_entry_valid.cold.1+0x48/0x58 lib/list_debug.c:51
Code: 19 5d 87 e8 f6 f7 f0 fd 0f 0b 48 89 de 48 c7 c7 a0 1a 5d 87 e8 e5 f7 f0 fd 0f 0b 48 89 de 48 c7 c7 40 1a 5d 87 e8 d4 f7 f0 fd <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57
RSP: 0018:ffff8801db107c68 EFLAGS: 00010086
RAX: 0000000000000054 RBX: ffff880193f1eae0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8163ba61 RDI: 0000000000000001
RBP: ffff8801db107c80 R08: ffff88019e072240 R09: ffffed003b625010
R10: ffffed003b625010 R11: ffff8801db128087 R12: ffff88018d90e320
R13: ffff8801db11d130 R14: ffff880193f1eae0 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8801db100000(0063) knlGS:00000000088cc900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007fdb025bc000 CR3: 000000019e032000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __list_del_entry include/linux/list.h:117 [inline]
 list_del include/linux/list.h:125 [inline]
 __loaded_vmcs_clear+0x14f/0x630 arch/x86/kvm/vmx.c:2199
 flush_smp_call_function_queue+0x1a8/0x5e0 kernel/smp.c:243
 generic_smp_call_function_single_interrupt+0x13/0x2b kernel/smp.c:192
 smp_call_function_single_interrupt+0x11a/0x5d0 arch/x86/kernel/smp.c:296
 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:886
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa1/0xc0 kernel/locking/spinlock.c:184
Code: 28 be 11 88 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 21 48 83 3d 2e 15 3d 01 00 74 0e 48 89 df 57 9d <0f> 1f 44 00 00 eb bb 0f 0b 0f 0b e8 2f 23 e7 fa eb 97 e8 28 23 e7
RSP: 0018:ffff88019e07f9c0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff04
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 0000000000000000
RDX: 1ffffffff10237c5 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff88019e07f9d0 R08: ffff88019e072240 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff89ccc208
R13: 000000000008e380 R14: ffffffff89ccc200 R15: ffff8801bf47e380
 __debug_object_init+0x581/0x12e0 lib/debugobjects.c:419
 debug_object_init_on_stack+0x19/0x20 lib/debugobjects.c:447
 hrtimer_init_on_stack kernel/time/hrtimer.c:435 [inline]
 hrtimer_nanosleep+0x16b/0x620 kernel/time/hrtimer.c:1740
 __do_compat_sys_nanosleep kernel/time/hrtimer.c:1796 [inline]
 __se_compat_sys_nanosleep kernel/time/hrtimer.c:1783 [inline]
 __ia32_compat_sys_nanosleep+0x1f2/0x290 kernel/time/hrtimer.c:1783
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7ffbca9
Code: 55 08 8b 88 64 cd ff ff 8b 98 68 cd ff ff 89 c8 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 1c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:000000000845fd7c EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 000000000845fda8 RCX: 0000000000000000
RDX: 000000000000000f RSI: 00000000000aec94 RDI: 0000000000000000
RBP: 000000000000000f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace 6c94ba9043e93b9d ]---
RIP: 0010:__list_del_entry_valid.cold.1+0x48/0x58 lib/list_debug.c:51
Code: 19 5d 87 e8 f6 f7 f0 fd 0f 0b 48 89 de 48 c7 c7 a0 1a 5d 87 e8 e5 f7 f0 fd 0f 0b 48 89 de 48 c7 c7 40 1a 5d 87 e8 d4 f7 f0 fd <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57
RSP: 0018:ffff8801db107c68 EFLAGS: 00010086
RAX: 0000000000000054 RBX: ffff880193f1eae0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8163ba61 RDI: 0000000000000001
RBP: ffff8801db107c80 R08: ffff88019e072240 R09: ffffed003b625010
R10: ffffed003b625010 R11: ffff8801db128087 R12: ffff88018d90e320
R13: ffff8801db11d130 R14: ffff880193f1eae0 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8801db100000(0063) knlGS:00000000088cc900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007fdb025bc000 CR3: 000000019e032000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400