------------[ cut here ]------------
WARNING: CPU: 0 PID: 5080 at kernel/softirq.c:307 __local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307
Modules linked in:
CPU: 0 PID: 5080 Comm: syz-executor512 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:__local_bh_disable_ip+0x1f6/0x220 kernel/softirq.c:307
Code: 2c 0b 00 65 48 8b 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 75 33 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 e9 99 fe ff ff e8 4d 74 16 0a 41 f7 c6 00 02 00 00 0f 85
RSP: 0018:ffffc90000007a40 EFLAGS: 00010006
RAX: 0000000080010002 RBX: ffffffff895fa5b7 RCX: ffff88807f7d5a00
RDX: ffff88807f7d5a00 RSI: 0000000000000201 RDI: ffffffff895fa5b7
RBP: ffffc90000007b08 R08: ffffffff895fa57d R09: 1ffffffff2598ea0
R10: dffffc0000000000 R11: ffffffffa0001a20 R12: dffffc0000000000
R13: 1ffff92000000f4c R14: ffffc90000007aa0 R15: 0000000000000201
FS:  000055556be3a380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f25de02c110 CR3: 000000002069a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:125 [inline]
 _raw_spin_lock_bh+0x1c/0x50 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:356 [inline]
 __sock_map_delete net/core/sock_map.c:414 [inline]
 sock_map_delete_elem+0x97/0x140 net/core/sock_map.c:446
 bpf_prog_2c29ac5cdc6b1842+0x42/0x46
 bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
 __bpf_prog_run include/linux/filter.h:657 [inline]
 bpf_prog_run include/linux/filter.h:664 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
 bpf_trace_run2+0x204/0x420 kernel/trace/bpf_trace.c:2420
 trace_contention_end+0xf6/0x120 include/trace/events/lock.h:122
 __pv_queued_spin_lock_slowpath+0x939/0xc60 kernel/locking/qspinlock.c:560
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
 queued_spin_lock_slowpath+0x42/0x50 arch/x86/include/asm/qspinlock.h:51
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x272/0x370 kernel/locking/spinlock_debug.c:116
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
 _raw_spin_lock_irqsave+0xe1/0x120 kernel/locking/spinlock.c:162
 rcu_report_exp_cpu_mult+0x27/0x2f0 kernel/rcu/tree_exp.h:238
 csd_do_func kernel/smp.c:133 [inline]
 __flush_smp_call_function_queue+0xb2e/0x15b0 kernel/smp.c:542
 __sysvec_call_function_single+0xa8/0x3e0 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:lock_is_held_type+0x13b/0x190
Code: 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 4c 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 08 75 42 89 d8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffffc90004337a70 EFLAGS: 00000206
RAX: c9aa31e483ded600 RBX: 0000000000000001 RCX: ffff88807f7d5a00
RDX: 0000000000000000 RSI: ffffffff8baad3a0 RDI: ffffffff8bfec660
RBP: 0000000000000000 R08: ffffffff8b64b326 R09: ffffffff8b64b239
R10: 0000000000000004 R11: ffff88807f7d5a00 R12: 0000000000000246
R13: ffff88807f7d5a00 R14: 00000000ffffffff R15: ffff88807cd85720
 lock_is_held include/linux/lockdep.h:231 [inline]
 mt_locked lib/maple_tree.c:781 [inline]
 mt_slot lib/maple_tree.c:788 [inline]
 mas_next_slot+0xb5d/0xf90 lib/maple_tree.c:4691
 mas_find+0x950/0xbb0 lib/maple_tree.c:6070
 vma_next include/linux/mm.h:961 [inline]
 acct_collect+0x23e/0x830 kernel/acct.c:565
 do_exit+0x92a/0x27e0 kernel/exit.c:857
 do_group_exit+0x207/0x2c0 kernel/exit.c:1027
 __do_sys_exit_group kernel/exit.c:1038 [inline]
 __se_sys_exit_group kernel/exit.c:1036 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f25ddfb0009
Code: 90 49 c7 c0 b8 ff ff ff be e7 00 00 00 ba 3c 00 00 00 eb 12 0f 1f 44 00 00 89 d0 0f 05 48 3d 00 f0 ff ff 77 1c f4 89 f0 0f 05 <48> 3d 00 f0 ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00
RSP: 002b:00007ffe50499d48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f25ddfb0009
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f25de02b2b0 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f25de02b2b0
R13: 0000000000000000 R14: 00007f25de02bd00 R15: 00007f25ddf81240
 </TASK>
----------------
Code disassembly (best guess):
   0:	75 44                	jne    0x46
   2:	48 c7 04 24 00 00 00 	movq   $0x0,(%rsp)
   9:	00
   a:	9c                   	pushf
   b:	8f 04 24             	pop    (%rsp)
   e:	f7 04 24 00 02 00 00 	testl  $0x200,(%rsp)
  15:	75 4c                	jne    0x63
  17:	41 f7 c4 00 02 00 00 	test   $0x200,%r12d
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	65 48 8b 04 25 28 00 	mov    %gs:0x28,%rax
  28:	00 00
* 2a:	48 3b 44 24 08       	cmp    0x8(%rsp),%rax <-- trapping instruction
  2f:	75 42                	jne    0x73
  31:	89 d8                	mov    %ebx,%eax
  33:	48 83 c4 10          	add    $0x10,%rsp
  37:	5b                   	pop    %rbx
  38:	41 5c                	pop    %r12
  3a:	41 5d                	pop    %r13
  3c:	41 5e                	pop    %r14
  3e:	41 5f                	pop    %r15