------------[ cut here ]------------ debug_locks && !(lock_is_held(&(__rq_lockp(rq))->dep_map) != 0) WARNING: kernel/sched/sched.h:1575 at lockdep_assert_rq_held kernel/sched/sched.h:1575 [inline], CPU#0: syz.3.1838/15880 WARNING: kernel/sched/sched.h:1575 at lockdep_assert_rq_held kernel/sched/sched.h:1573 [inline], CPU#0: syz.3.1838/15880 WARNING: kernel/sched/sched.h:1575 at update_rq_clock+0x34a/0xd30 kernel/sched/core.c:837, CPU#0: syz.3.1838/15880 Modules linked in: CPU: 0 UID: 0 PID: 15880 Comm: syz.3.1838 Tainted: G U L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1575 [inline] RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1573 [inline] RIP: 0010:update_rq_clock+0x34a/0xd30 kernel/sched/core.c:837 Code: ab 48 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 c8 79 a6 09 a8 04 0f 84 9e fd ff ff 90 0f 0b 90 e9 95 fd ff ff 90 <0f> 0b 90 e9 51 fd ff ff 48 8d bb 18 0e 00 00 48 b8 00 00 00 00 00 RSP: 0018:ffffc9000f33f860 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff8880b853ae00 RCX: 0000000000000001 RDX: 0000000000000046 RSI: ffffffff8dc27210 RDI: ffffffff8bfa95a0 RBP: ffffc9000f33fa08 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90b84bd7 R11: 0000000000000000 R12: ffffffff90b87eb4 R13: ffff8880b853bc30 R14: ffff88801e2b3c80 R15: ffff8880b853ae00 FS: 00007f99bf56e6c0(0000) GS:ffff8881245c1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30eb0ff8 CR3: 0000000030f54000 CR4: 00000000003526f0 Call Trace: pick_next_task kernel/sched/core.c:6092 [inline] __schedule+0x1b0f/0x5fa0 kernel/sched/core.c:6809 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7194 irqentry_exit+0x17b/0x670 kernel/entry/common.c:216 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__sanitizer_cov_trace_pc+0x60/0x70 kernel/kcov.c:233 Code: c0 74 f1 8b 82 28 16 00 00 83 f8 02 75 e6 48 8b 8a 30 16 00 00 8b 92 2c 16 00 00 48 8b 01 48 83 c0 01 48 39 d0 73 cd 48 89 01 <48> 89 34 c1 c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 RSP: 0018:ffffc9000f33fb18 EFLAGS: 00000287 RAX: 0000000000008322 RBX: 0000000080000000 RCX: ffffc90011e7a000 RDX: 0000000000080000 RSI: ffffffff81b845a8 RDI: ffff888079984000 RBP: ffff888079984000 R08: 0000000000000005 R09: 0000000000000180 R10: 00000000000000c0 R11: 0000000000000000 R12: 0000000000000000 R13: ffffc9000f33fbc0 R14: 0000000000000000 R15: ffff88809adb77fe __phys_addr+0x18/0x180 arch/x86/mm/physaddr.c:17 kfree+0x6c/0x690 mm/slub.c:6878 skb_kfree_head net/core/skbuff.c:1068 [inline] skb_free_head+0x119/0x220 net/core/skbuff.c:1080 skb_release_data+0x540/0x700 net/core/skbuff.c:1107 skb_release_all net/core/skbuff.c:1182 [inline] __kfree_skb net/core/skbuff.c:1196 [inline] sk_skb_reason_drop+0x102/0x1b0 net/core/skbuff.c:1234 kfree_skb_reason include/linux/skbuff.h:1322 [inline] unix_release_sock+0x759/0x1340 net/unix/af_unix.c:726 unix_release+0x91/0xf0 net/unix/af_unix.c:1184 __sock_release+0xb3/0x260 net/socket.c:662 sock_close+0x1c/0x30 net/socket.c:1455 __fput+0x3ff/0xb40 fs/file_table.c:469 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x100/0x4b0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ea/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f99c1b9bf79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f99bf56e028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f99c1e16360 RCX: 00007f99c1b9bf79 RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000002 RBP: 00007f99c1c327e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f99c1e163f8 R14: 00007f99c1e16360 R15: 00007fffa76ae948 ---------------- Code disassembly (best guess): 0: c0 74 f1 8b 82 shlb $0x82,-0x75(%rcx,%rsi,8) 5: 28 16 sub %dl,(%rsi) 7: 00 00 add %al,(%rax) 9: 83 f8 02 cmp $0x2,%eax c: 75 e6 jne 0xfffffff4 e: 48 8b 8a 30 16 00 00 mov 0x1630(%rdx),%rcx 15: 8b 92 2c 16 00 00 mov 0x162c(%rdx),%edx 1b: 48 8b 01 mov (%rcx),%rax 1e: 48 83 c0 01 add $0x1,%rax 22: 48 39 d0 cmp %rdx,%rax 25: 73 cd jae 0xfffffff4 27: 48 89 01 mov %rax,(%rcx) * 2a: 48 89 34 c1 mov %rsi,(%rcx,%rax,8) <-- trapping instruction 2e: c3 ret 2f: cc int3 30: cc int3 31: cc int3 32: cc int3 33: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop