------------[ cut here ]------------
WARNING: CPU: 1 PID: 9121 at kernel/signal.c:2008 posixtimer_send_sigqueue+0x9da/0xbc0 kernel/signal.c:2008
Modules linked in:
CPU: 1 UID: 0 PID: 9121 Comm: kworker/u8:14 Not tainted 6.12.0-rc6-next-20241108-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Workqueue: writeback wb_workfn (flush-8:0)
RIP: 0010:posixtimer_send_sigqueue+0x9da/0xbc0 kernel/signal.c:2008
Code: df 80 3c 08 00 74 08 48 89 df e8 c1 ad a5 00 4c 89 2b eb 51 e8 a7 32 3b 00 41 be 02 00 00 00 e9 e9 fd ff ff e8 97 32 3b 00 90 <0f> 0b 90 e9 f2 fa ff ff 4c 89 ef e8 86 33 5a 03 84 c0 0f 84 aa 01
RSP: 0018:ffffc90000a18bc0 EFLAGS: 00010006
RAX: ffffffff81644979 RBX: 0000000000000000 RCX: ffff8880261b1e00
RDX: 0000000000010000 RSI: 000000000000001e RDI: 0000000000000009
RBP: ffffc90000a18cc0 R08: ffffffff816450cc R09: 1ffffffff2857112
R10: dffffc0000000000 R11: fffffbfff2857113 R12: ffff888064ade9e4
R13: 1ffff1100c95bd3c R14: ffff888064ade960 R15: ffff888064adea20
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff9f2427ae0 CR3: 000000000e738000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 alarm_handle_timer+0x2f/0x60 kernel/time/alarmtimer.c:537
 alarmtimer_fired+0x173/0x410 kernel/time/alarmtimer.c:205
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1803
 hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1865
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:unwind_next_frame+0x9/0x22d0 arch/x86/kernel/unwind_orc.c:469
Code: c1 03 38 c1 7c 91 4c 89 f7 e8 a3 4d be 00 eb 87 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 <41> 55 41 54 53 48 81 ec 98 00 00 00 49 89 fd 49 bc 00 00 00 00 00
RSP: 0018:ffffc90018aae8c0 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffc90018aae8e0 RCX: ffffffff917b1000
RDX: dffffc0000000000 RSI: ffffffff8109e68a RDI: ffffc90018aae8e0
RBP: ffffc90018aae970 R08: 0000000000000016 R09: ffffc90018aae9d0
R10: ffffc90018aae930 R11: ffffffff818b2c40 R12: ffff8880261b1e00
R13: ffffffff818b2c40 R14: ffffc90018aae9c0 R15: 0000000000000000
 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:319 [inline]
 __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4104 [inline]
 slab_alloc_node mm/slub.c:4153 [inline]
 kmem_cache_alloc_noprof+0x1d9/0x380 mm/slub.c:4160
 mempool_alloc_noprof+0x197/0x5a0 mm/mempool.c:402
 __sg_alloc_table+0xcc/0x3c0 lib/scatterlist.c:322
 sg_alloc_table_chained+0xe6/0x1c0 lib/sg_pool.c:133
 scsi_alloc_sgtables+0x292/0xbd0 drivers/scsi/scsi_lib.c:1132
 sd_setup_read_write_cmnd drivers/scsi/sd.c:1335 [inline]
 sd_init_command+0x505/0x25b0 drivers/scsi/sd.c:1457
 scsi_prepare_cmd drivers/scsi/scsi_lib.c:1691 [inline]
 scsi_queue_rq+0x17f2/0x2e90 drivers/scsi/scsi_lib.c:1825
 blk_mq_dispatch_rq_list+0xad3/0x19d0 block/blk-mq.c:2121
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
 blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
 __blk_mq_sched_dispatch_requests+0xb8a/0x1840 block/blk-mq-sched.c:309
 blk_mq_sched_dispatch_requests+0xd6/0x190 block/blk-mq-sched.c:331
 blk_mq_run_hw_queue+0x414/0x500 block/blk-mq.c:2355
 blk_mq_flush_plug_list+0x1133/0x18b0 block/blk-mq.c:2918
 __blk_flush_plug+0x420/0x500 block/blk-core.c:1213
 blk_finish_plug+0x5e/0x80 block/blk-core.c:1240
 wb_writeback+0xb54/0xbd0 fs/fs-writeback.c:2170
 wb_check_old_data_flush fs/fs-writeback.c:2238 [inline]
 wb_do_writeback fs/fs-writeback.c:2291 [inline]
 wb_workfn+0xba1/0x1090 fs/fs-writeback.c:2319
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	c1 03 38             	roll   $0x38,(%rbx)
   3:	c1 7c 91 4c 89       	sarl   $0x89,0x4c(%rcx,%rdx,4)
   8:	f7 e8                	imul   %eax
   a:	a3 4d be 00 eb 87 90 	movabs %eax,0x90909087eb00be4d
  11:	90 90
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	f3 0f 1e fa          	endbr64
  25:	55                   	push   %rbp
  26:	41 57                	push   %r15
  28:	41 56                	push   %r14
* 2a:	41 55                	push   %r13 <-- trapping instruction
  2c:	41 54                	push   %r12
  2e:	53                   	push   %rbx
  2f:	48 81 ec 98 00 00 00 	sub    $0x98,%rsp
  36:	49 89 fd             	mov    %rdi,%r13
  39:	49                   	rex.WB
  3a:	bc 00 00 00 00       	mov    $0x0,%esp