------------[ cut here ]------------
percpu ref (css_release) <= 0 (-1) after switching to atomic
WARNING: lib/percpu-refcount.c:197 at percpu_ref_switch_to_atomic_rcu+0x3cc/0x480, CPU#1: systemd/1
Modules linked in:
CPU: 1 UID: 0 PID: 1 Comm: systemd Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:percpu_ref_switch_to_atomic_rcu+0x3cc/0x480
Code: 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 9e 00 00 00 49 8b 75 e8 48 c7 c7 c0 99 e2 84 e8 25 ac e9 fe 90 <0f> 0b 90 90 e9 2b ff ff ff e8 56 de 5f ff e9 9e fe ff ff e8 dc de
RSP: 0000:ffff88806cf08e20 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8139de70
RDX: ffff8880094f8000 RSI: ffffffff8139de7e RDI: 0000000000000001
RBP: 7fffffffffffffff R08: 0000000000000001 R09: ffffed100d9e4801
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800cca9900
R13: ffff88800cca9920 R14: 0000000000000002 R15: 0000000000000003
FS:  00007fc8fc4de900(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe999049fc CR3: 000000000be9a000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 rcu_core+0x7c8/0x1800
 handle_softirqs+0x1b1/0x770
 __irq_exit_rcu+0xc4/0x100
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x70/0x80
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x8/0x20
Code: bf 03 00 00 00 e9 48 fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <89> f2 89 fe bf 05 00 00 00 e9 1a fe ff ff 66 2e 0f 1f 84 00 00 00
RSP: 0000:ffff888009547d68 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff888009547e10 RCX: ffffffff84b3b148
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888009826a1e
R13: ffffed10012a8fc9 R14: 0000000000000001 R15: ffff888009547e4d
 mas_walk+0x228/0x8c0
 lock_vma_under_rcu+0x102/0x530
 do_user_addr_fault+0x4aa/0xeb0
 exc_page_fault+0xb0/0x180
 asm_exc_page_fault+0x26/0x30
RIP: 0033:0x7fc8fcd1ffa4
Code: 77 19 c5 fe 7f 07 c5 fe 7f 47 20 c5 fe 7f 44 17 e0 c5 fe 7f 44 17 c0 c5 f8 77 c3 48 8d 8f 80 00 00 00 c5 fe 7f 07 48 83 e1 80 <c5> fe 7f 44 17 e0 c5 fe 7f 47 20 c5 fe 7f 44 17 c0 c5 fe 7f 47 40
RSP: 002b:00007ffe999026c8 EFLAGS: 00010202
RAX: 00007ffe99902700 RBX: 0000000000000073 RCX: 00007ffe99902780
RDX: 000000000000231c RSI: 0000000000000000 RDI: 00007ffe99902700
RBP: 0000000000000084 R08: 00007ffe99906da4 R09: 00007ffe99906c60
R10: 00007fc8fcdcea57 R11: 0000000000000000 R12: 0000000000000027
R13: 00007ffe99902700 R14: 00007ffe99908e80 R15: 000000000000046a
 </TASK>
irq event stamp: 6015780
hardirqs last  enabled at (6015790): [<ffffffff81541b18>] __up_console_sem+0x78/0x80
hardirqs last disabled at (6015799): [<ffffffff81541afd>] __up_console_sem+0x5d/0x80
softirqs last  enabled at (6014618): [<ffffffff813bafcc>] handle_softirqs+0x50c/0x770
softirqs last disabled at (6014917): [<ffffffff813bb364>] __irq_exit_rcu+0xc4/0x100
---[ end trace 0000000000000000 ]---
percpu_ref_switch_to_atomic_rcu: percpu_ref_switch_to_atomic_rcu(): percpu_ref underflow slab kmalloc-64 start ffff88800cca9900 pointer offset 0 size 64
percpu_ref_switch_to_atomic_rcu: percpu_ref_switch_to_atomic_rcu(): percpu_ref underflow slab kmalloc-64 start ffff88803b3efc80 pointer offset 0 size 64
----------------
Code disassembly (best guess):
   0:	bf 03 00 00 00       	mov    $0x3,%edi
   5:	e9 48 fe ff ff       	jmpq   0xfffffe52
   a:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
  11:	00
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	f3 0f 1e fa          	endbr64
  26:	48 8b 0c 24          	mov    (%rsp),%rcx
* 2a:	89 f2                	mov    %esi,%edx <-- trapping instruction
  2c:	89 fe                	mov    %edi,%esi
  2e:	bf 05 00 00 00       	mov    $0x5,%edi
  33:	e9 1a fe ff ff       	jmpq   0xfffffe52
  38:	66                   	data16
  39:	2e                   	cs
  3a:	0f                   	.byte 0xf
  3b:	1f                   	(bad)
  3c:	84 00                	test   %al,(%rax)