------------[ cut here ]------------
task_rq(p) != rq
WARNING: kernel/sched/fair.c:7656 at hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656, CPU#1: syz.0.40/5995
Modules linked in:
CPU: 1 UID: 0 PID: 5995 Comm: syz.0.40 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:hrtick_start_fair+0x196/0x1f0 kernel/sched/fair.c:7656
Code: 42 80 3c 20 00 74 08 4c 89 ff e8 a5 e8 97 00 4d 39 37 0f 85 0c ff ff ff 48 89 df 5b 41 5c 41 5d 41 5e 41 5f e9 7b 64 fa ff 90 <0f> 0b 90 e9 d1 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 82
RSP: 0018:ffffc90003107060 EFLAGS: 00010006
RAX: ffff8880b863ba40 RBX: ffff8880b873ba40 RCX: ffffffff819778ae
RDX: 0000000000000000 RSI: ffff888038fb5d00 RDI: ffff8880b873ba40
RBP: dffffc0000000000 R08: ffffffff8f8d630f R09: 1ffffffff1f1ac61
R10: dffffc0000000000 R11: fffffbfff1f1ac62 R12: dffffc0000000000
R13: 1ffff110170e78d6 R14: ffff888038fb5d00 R15: ffffffff8d9027d0
FS:  0000000000000000(0000) GS:ffff888125fbb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffea57fef00 CR3: 000000000ddb8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 set_next_task_fair+0xa68/0xce0 kernel/sched/fair.c:15065
 put_prev_set_next_task kernel/sched/sched.h:2770 [inline]
 pick_next_task kernel/sched/core.c:6442 [inline]
 __schedule+0x3e03/0x5550 kernel/sched/core.c:7143
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:220 [inline]
RIP: 0010:unwind_next_frame+0x1db/0x2550 arch/x86/kernel/unwind_orc.c:510
Code: c2 40 b5 49 8b 49 29 dc 0f 84 b2 02 00 00 49 81 fc 00 00 00 81 0f 92 c0 49 81 fc 00 31 38 8b 0f 93 c1 08 c1 0f 85 05 01 00 00 <48> c7 c0 00 00 00 81 4d 89 e7 49 29 c7 49 c1 ef 08 8b 15 ee 43 19
RSP: 0018:ffffc90003107418 EFLAGS: 00000246
RAX: 1ffff92000620e00 RBX: 0000000000000001 RCX: 0000000080000000
RDX: ffffffff8b49b540 RSI: ffffffff8baa4360 RDI: ffffffff8baa4320
RBP: dffffc0000000000 R08: ffffffff8176e806 R09: ffffffff8dfcb2a0
R10: ffffc90003107538 R11: ffffffff81b04c80 R12: ffffffff81872ef1
R13: 1ffff92000620e9d R14: ffffc900031074e8 R15: ffffc90003107530
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2700 [inline]
 slab_free mm/slub.c:6308 [inline]
 kmem_cache_free+0x187/0x6c0 mm/slub.c:6435
 anon_vma_chain_free mm/rmap.c:147 [inline]
 unlink_anon_vmas+0x368/0x730 mm/rmap.c:514
 free_pgtables+0x663/0xb70 mm/memory.c:401
 exit_mmap+0x490/0x9e0 mm/mmap.c:1312
 __mmput+0xcb/0x3e0 kernel/fork.c:1182
 exit_mm+0x18e/0x250 kernel/exit.c:610
 do_exit+0x6a2/0x22c0 kernel/exit.c:992
 __do_sys_exit kernel/exit.c:1114 [inline]
 __se_sys_exit kernel/exit.c:1112 [inline]
 __x64_sys_exit+0x40/0x40 kernel/exit.c:1112
 x64_sys_call+0x2231/0x2240 arch/x86/include/generated/asm/syscalls_64.h:61
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f838786ce59
Code: Unable to access opcode bytes at 0x7f838786ce2f.
RSP: 002b:00007ffea57ff8d8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c
RAX: ffffffffffffffda RBX: 00007f8387ae5fa0 RCX: 00007f838786ce59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000ffff
RBP: 00007f8387902d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8387ae5fac R14: 00007f8387ae5fa0 R15: 00007f8387ae5fa0
 </TASK>
----------------
Code disassembly (best guess):
   0:	c2 40 b5             	ret    $0xb540
   3:	49 8b 49 29          	mov    0x29(%r9),%rcx
   7:	dc 0f                	fmull  (%rdi)
   9:	84 b2 02 00 00 49    	test   %dh,0x49000002(%rdx)
   f:	81 fc 00 00 00 81    	cmp    $0x81000000,%esp
  15:	0f 92 c0             	setb   %al
  18:	49 81 fc 00 31 38 8b 	cmp    $0xffffffff8b383100,%r12
  1f:	0f 93 c1             	setae  %cl
  22:	08 c1                	or     %al,%cl
  24:	0f 85 05 01 00 00    	jne    0x12f
* 2a:	48 c7 c0 00 00 00 81 	mov    $0xffffffff81000000,%rax <-- trapping instruction
  31:	4d 89 e7             	mov    %r12,%r15
  34:	49 29 c7             	sub    %rax,%r15
  37:	49 c1 ef 08          	shr    $0x8,%r15
  3b:	8b                   	.byte 0x8b
  3c:	15                   	.byte 0x15
  3d:	ee                   	out    %al,(%dx)
  3e:	43                   	rex.XB
  3f:	19                   	.byte 0x19