list_add corruption. prev->next should be next (ffff8881f723cb68), but was ffff8881126ea870. (prev=ffff8881126ea870).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:28!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 5.18.0-rc6-syzkaller-00015-g0ac824f379fb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_add_valid+0xc6/0xd0 lib/list_debug.c:26
Code: 48 c7 c7 c0 1a 68 85 4c 89 e6 4c 89 f1 31 c0 e8 f0 b2 55 02 0f 0b 48 c7 c7 80 1b 68 85 4c 89 f6 4c 89 e1 31 c0 e8 da b2 55 02 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 54 53 49
RSP: 0018:ffffc900000e7898 EFLAGS: 00010046

RAX: 0000000000000075 RBX: ffff8881f723cb70 RCX: 11a3db236f8a2800
RDX: 0000000080000101 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffffc900000e78c0 R08: ffffffff81579578 R09: ffffed103ee465d1
R10: ffffed103ee465d1 R11: 1ffff1103ee465d0 R12: ffff8881126ea870
R13: dffffc0000000000 R14: ffff8881f723cb68 R15: ffff8881126ea870
FS:  0000000000000000(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556885b38 CR3: 000000012533b000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_add include/linux/list.h:69 [inline]
 list_add_tail include/linux/list.h:102 [inline]
 insert_work+0x104/0x320 kernel/workqueue.c:1362
 __queue_work+0x960/0xd20 kernel/workqueue.c:1517
 queue_work_on+0xf2/0x170 kernel/workqueue.c:1545
 queue_work include/linux/workqueue.h:502 [inline]
 css_release+0xae/0xc0 kernel/cgroup/cgroup.c:5214
 percpu_ref_put_many include/linux/percpu-refcount.h:335 [inline]
 percpu_ref_put include/linux/percpu-refcount.h:351 [inline]
 percpu_ref_call_confirm_rcu lib/percpu-refcount.c:163 [inline]
 percpu_ref_switch_to_atomic_rcu+0x60d/0x620 lib/percpu-refcount.c:205
 rcu_do_batch+0x507/0xbc0 kernel/rcu/tree.c:2535
 rcu_core+0x4dc/0xef0 kernel/rcu/tree.c:2786
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2803
 __do_softirq+0x24e/0x586 kernel/softirq.c:558
 run_ksoftirqd+0x23/0x30 kernel/softirq.c:921
 smpboot_thread_fn+0x4db/0x980 kernel/smpboot.c:164
 kthread+0x26b/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid+0xc6/0xd0 lib/list_debug.c:26
Code: 48 c7 c7 c0 1a 68 85 4c 89 e6 4c 89 f1 31 c0 e8 f0 b2 55 02 0f 0b 48 c7 c7 80 1b 68 85 4c 89 f6 4c 89 e1 31 c0 e8 da b2 55 02 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 54 53 49
RSP: 0018:ffffc900000e7898 EFLAGS: 00010046

RAX: 0000000000000075 RBX: ffff8881f723cb70 RCX: 11a3db236f8a2800
RDX: 0000000080000101 RSI: 0000000080000101 RDI: 0000000000000000
RBP: ffffc900000e78c0 R08: ffffffff81579578 R09: ffffed103ee465d1
R10: ffffed103ee465d1 R11: 1ffff1103ee465d0 R12: ffff8881126ea870
R13: dffffc0000000000 R14: ffff8881f723cb68 R15: ffff8881126ea870
FS:  0000000000000000(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556885b38 CR3: 000000012533b000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400