[syzbot] [kernel?] WARNING in __run_timer_base (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f4d0ec0aa20d Merge tag 'erofs-for-7.0-rc2-fixes' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13674d5a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=70fe0401f305d8d4
dashboard link: https://syzkaller.appspot.com/bug?extid=b65655bc21a8355d65c8
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/85c0270b9693/disk-f4d0ec0a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/01f6d53163fe/vmlinux-f4d0ec0a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d351d713d10e/bzImage-f4d0ec0a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b65655...@syzkaller.appspotmail.com

------------[ cut here ]------------
!fn
WARNING: kernel/time/timer.c:1786 at expire_timers kernel/time/timer.c:1786 [inline], CPU#0: ktimers/0/16
WARNING: kernel/time/timer.c:1786 at __run_timers kernel/time/timer.c:2373 [inline], CPU#0: ktimers/0/16
WARNING: kernel/time/timer.c:1786 at __run_timer_base+0x7d2/0x9f0 kernel/time/timer.c:2385, CPU#0: ktimers/0/16
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:expire_timers kernel/time/timer.c:1786 [inline]
RIP: 0010:__run_timers kernel/time/timer.c:2373 [inline]
RIP: 0010:__run_timer_base+0x7d2/0x9f0 kernel/time/timer.c:2385
Code: 27 4d 85 e4 74 7d e8 4d ee 13 00 e9 48 fe ff ff e8 43 ee 13 00 48 8b 5c 24 30 43 80 7c 35 00 00 75 d4 eb da e8 2f ee 13 00 90 <0f> 0b 90 48 8b 44 24 48 42 80 3c 30 00 48 8b 5c 24 30 74 a9 48 89
RSP: 0018:ffffc90000157b40 EFLAGS: 00010046
RAX: ffffffff81b064e1 RBX: 0000000000000000 RCX: ffff88801caa8000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100
RBP: ffffc90000157cb8 R08: 0000000000000000 R09: 0000000000000100
R10: dffffc0000000000 R11: fffffbfff1ed4517 R12: ffff88803c019f38
R13: 1ffff9200002af81 R14: dffffc0000000000 R15: ffffc90000157c08
FS: 0000000000000000(0000) GS:ffff888126343000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f718355de06 CR3: 0000000059208000 CR4: 00000000003526f0
Call Trace:
<TASK>
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x1de/0x6f0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1138
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup