8<--- cut here ---
Unable to handle kernel paging request at virtual address 5bd3b000
[5bd3b000] *pgd=80000080005003, *pmd=00000000
Internal error: Oops: 206 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 27985 Comm: kworker/1:2 Not tainted 6.1.0-rc1-syzkaller #0
Hardware name: ARM-Versatile Express
Workqueue: events free_ipc
PC is at percpu_counter_add_batch+0x38/0x108 lib/percpu_counter.c:87
LR is at __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:66
pc : [<80810174>]    lr : [<817563c4>]    psr: 20000013
sp : eaee1e28  ip : eaee1e18  fp : eaee1e4c
r10: 84e21000  r9 : 00000000  r8 : 84e2106c
r7 : 7fffffff  r6 : 00000000  r5 : 852b7de8  r4 : 00000000
r3 : 5bd3b000  r2 : 00000000  r1 : 00000000  r0 : 00000001
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 84309380  DAC: 00000000
Register r0 information: non-paged memory
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: NULL pointer
Register r5 information: slab kmalloc-cg-1k start 852b7c00 pointer offset 488 size 1024
Register r6 information: NULL pointer
Register r7 information: non-paged memory
Register r8 information: slab kmalloc-cg-192 start 84e21000 pointer offset 108 size 192
Register r9 information: NULL pointer
Register r10 information: slab kmalloc-cg-192 start 84e21000 pointer offset 0 size 192
Register r11 information: 2-page vmalloc region starting at 0xeaee0000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671
Register r12 information: 2-page vmalloc region starting at 0xeaee0000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671
Process kworker/1:2 (pid: 27985, stack limit = 0xeaee0000)
Stack: (0xeaee1e28 to 0xeaee2000)
1e20:                   00000000 84e2106c 84e21000 852b7c00 84e2106c 00000000
1e40: eaee1e94 eaee1e50 806637d0 80810148 7fffffff 802a0f18 00000003 00000001
1e60: eaee1e5c ad93715a 852b7cb8 00000001 852b7cb8 00000003 852b7c00 806636c8
1e80: 00000000 84e21000 eaee1ecc eaee1e98 8066ec68 806636d4 eaee1ebc 852b7ca0
1ea0: 808100c8 852b7c00 00000000 ddde5a40 ddde9200 00000090 82a7ae00 ddde9215
1ec0: eaee1ee4 eaee1ed0 80664ca8 8066ec00 852b7c00 00000000 eaee1efc eaee1ee8
1ee0: 8066e794 80664c80 8232cd6c 856a2100 eaee1f44 eaee1f00 802611c0 8066e71c
1f00: 80275518 802a0f18 eaee1f2c eaee1f18 80262ea4 00000000 ddde5a40 856a2100
1f20: ddde5a40 856a2118 ddde5a5c 82204d40 00000008 ddde5a40 eaee1f84 eaee1f48
1f40: 802615cc 80260fc0 eaee1f64 81cffd70 823d7b0e 82a7ae00 eaee1f84 854f3fc0
1f60: 82a7ae00 80261560 856a2100 85485100 ec4d1e8c 00000000 eaee1fac eaee1f88
1f80: 80269b24 8026156c 854f3fc0 80269a38 00000000 00000000 00000000 00000000
1fa0: 00000000 eaee1fb0 80200100 80269a44 00000000 00000000 00000000 00000000
1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
Backtrace: 
[<8081013c>] (percpu_counter_add_batch) from [<806637d0>] (percpu_counter_add_local include/linux/percpu_counter.h:75 [inline])
[<8081013c>] (percpu_counter_add_batch) from [<806637d0>] (percpu_counter_sub_local include/linux/percpu_counter.h:225 [inline])
[<8081013c>] (percpu_counter_add_batch) from [<806637d0>] (freeque+0x108/0x16c ipc/msg.c:292)
 r9:00000000 r8:84e2106c r7:852b7c00 r6:84e21000 r5:84e2106c r4:00000000
[<806636c8>] (freeque) from [<8066ec68>] (free_ipcs+0x74/0x90 ipc/namespace.c:125)
 r10:84e21000 r9:00000000 r8:806636c8 r7:852b7c00 r6:00000003 r5:852b7cb8
 r4:00000001
[<8066ebf4>] (free_ipcs) from [<80664ca8>] (msg_exit_ns+0x34/0x48 ipc/msg.c:1334)
 r10:ddde9215 r9:82a7ae00 r8:00000090 r7:ddde9200 r6:ddde5a40 r5:00000000
 r4:852b7c00
[<80664c74>] (msg_exit_ns) from [<8066e794>] (free_ipc_ns ipc/namespace.c:138 [inline])
[<80664c74>] (msg_exit_ns) from [<8066e794>] (free_ipc+0x84/0xfc ipc/namespace.c:157)
 r5:00000000 r4:852b7c00
[<8066e710>] (free_ipc) from [<802611c0>] (process_one_work+0x20c/0x5ac kernel/workqueue.c:2289)
 r5:856a2100 r4:8232cd6c
[<80260fb4>] (process_one_work) from [<802615cc>] (worker_thread+0x6c/0x4e0 kernel/workqueue.c:2436)
 r10:ddde5a40 r9:00000008 r8:82204d40 r7:ddde5a5c r6:856a2118 r5:ddde5a40
 r4:856a2100
[<80261560>] (worker_thread) from [<80269b24>] (kthread+0xec/0x11c kernel/kthread.c:376)
 r10:00000000 r9:ec4d1e8c r8:85485100 r7:856a2100 r6:80261560 r5:82a7ae00
 r4:854f3fc0
[<80269a38>] (kthread) from [<80200100>] (ret_from_fork+0x14/0x34 arch/arm/kernel/entry-common.S:148)
Exception stack(0xeaee1fb0 to 0xeaee1ff8)
1fa0:                                     00000000 00000000 00000000 00000000
1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80269a38 r4:854f3fc0
Code: e34801ec eb3d188e e5951018 ee1d3f90 (e7918003) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e34801ec 	movt	r0, #33260	; 0x81ec
   4:	eb3d188e 	bl	0xf46244
   8:	e5951018 	ldr	r1, [r5, #24]
   c:	ee1d3f90 	mrc	15, 0, r3, cr13, cr0, {4}
* 10:	e7918003 	ldr	r8, [r1, r3] <-- trapping instruction