kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 6537 Comm: syzkaller334812 Not tainted 4.15.0-rc4-next-20171221+ #78
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:76
RSP: 0018:ffff8801db307ca8 EFLAGS: 00010006
RAX: ffff8801c19e2280 RBX: 00000000001606e0 RCX: ffffffff811a47f2
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 00000000001606e0
RBP: ffff8801db307ca8 R08: 1ffff10039f6cd8b R09: 0000000000000004
R10: ffff8801cfb67120 R11: 0000000000000002 R12: 0000000000000006
R13: ffff8801c19e2280 R14: ffff8801db31a130 R15: ffff8801db31a130
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000006422006 CR4: 00000000001626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline]
 __cr4_set arch/x86/include/asm/tlbflush.h:252 [inline]
 cr4_clear_bits arch/x86/include/asm/tlbflush.h:275 [inline]
 kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3737 [inline]
 hardware_disable+0x34a/0x4b0 arch/x86/kvm/vmx.c:3743
 kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:8110
 hardware_disable_nolock+0x30/0x40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3283
 flush_smp_call_function_queue+0x1f4/0x570 kernel/smp.c:243
 generic_smp_call_function_single_interrupt+0x13/0x30 kernel/smp.c:192
 smp_call_function_single_interrupt+0x103/0x640 arch/x86/kernel/smp.c:295
 call_function_single_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:942
 </IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x50 kernel/kcov.c:94
RSP: 0018:ffff8801cfb67218 EFLAGS: 00000296 ORIG_RAX: ffffffffffffff04
RAX: ffff8801c19e2280 RBX: 0000000000001000 RCX: ffffffff819b38b0
RDX: 0000000000001000 RSI: ffffea0007328f00 RDI: ffff8801cfb677d0
RBP: ffff8801cfb67218 R08: 1ffff10039f6cd8b R09: 0000000000000004
R10: ffff8801cfb67120 R11: 0000000000000002 R12: ffff8801cfb677d0
R13: ffffea0007328f00 R14: ffffea0007328f00 R15: 000000000000000f
 __tlb_remove_page_size+0x1e/0x4e0 mm/memory.c:306
 __tlb_remove_page include/asm-generic/tlb.h:150 [inline]
 zap_pte_range mm/memory.c:1340 [inline]
 zap_pmd_range mm/memory.c:1441 [inline]
 zap_pud_range mm/memory.c:1470 [inline]
 zap_p4d_range mm/memory.c:1491 [inline]
 unmap_page_range+0x10e4/0x22e0 mm/memory.c:1512
 unmap_single_vma+0x15f/0x2d0 mm/memory.c:1557
 unmap_vmas+0xf1/0x1b0 mm/memory.c:1587
 exit_mmap+0x23a/0x500 mm/mmap.c:3031
 __mmput kernel/fork.c:965 [inline]
 mmput+0x223/0x6c0 kernel/fork.c:986
 exit_mm kernel/exit.c:544 [inline]
 do_exit+0x90a/0x1ad0 kernel/exit.c:856
 do_group_exit+0x149/0x400 kernel/exit.c:972
 SYSC_exit_group kernel/exit.c:983 [inline]
 SyS_exit_group+0x1d/0x20 kernel/exit.c:981
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x44e379
RSP: 002b:00007f5be808d708 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000006e0c24 RCX: 000000000044e379
RDX: 000000000044e379 RSI: 0000000000000000 RDI: 000000000000000b
RBP: 00000000006e0c20 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000006e0c20 R11: 0000000000000202 R12: 0000000000000000
R13: 00007fffbd8f6c6f R14: 00007f5be808e9c0 R15: 0000000000000013
Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d 
RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:76 RSP: ffff8801db307ca8
---[ end trace 769280d3a3bad01e ]---