BUG: unable to handle page fault for address: ffffc9000396a330
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 11800067 P4D 11800067
PUD 119c9067
PMD 1cced067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3612 Comm: syz-executor306 Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:29 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:28 [inline]
RIP: 0010:kvm_arch_hardware_enable+0x2ab/0x840 arch/x86/kvm/x86.c:11847
Code: 48 89 e8 48 b9 00 00 00 00 00 fc ff df 48 c1 e8 03 0f b6 14 08 48 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ed 04 00 00 <41> 8b 95 30 13 00 00 4d 8d b5 40 12 00 00 b9 08 00 00 00 4c 89 fe
RSP: 0018:ffffc900001e0ea0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81120fe0
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc9000396a330
RBP: ffffc9000396a330 R08: 0000000000000000 R09: 0000000000000003
R10: fffff5200072d466 R11: 0000000000000001 R12: 0000000000000000
R13: ffffc90003969000 R14: 0023001000000000 R15: ffffc900001e0ef8
FS: 0000555555d75300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000396a330 CR3: 0000000071c38000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hardware_enable_nolock+0xa7/0x140 arch/x86/kvm/../../../virt/kvm/kvm_main.c:5007
__flush_smp_call_function_queue+0x205/0x9a0 kernel/smp.c:631
__sysvec_call_function_single+0x95/0x3d0 arch/x86/kernel/smp.c:248
sysvec_call_function_single+0x8e/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:657
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 8a 76 dd f7 48 89 ef e8 12 f8 dd f7 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 13 b9 d0 f7 65 8b 05 3c 72 80 76 85 c0 74 0a 5b 5d c3 e8 30 81
RSP: 0018:ffffc900038efc88 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000200 RCX: 1ffffffff211c6ce
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff88802755d340 R08: 0000000000000001 R09: ffffffff908db957
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88801f710000
R13: ffff88802755d340 R14: ffffc900038efd20 R15: 0000000000000246
spin_unlock_irqrestore include/linux/spinlock.h:404 [inline]
do_notify_parent_cldstop+0x569/0xa40 kernel/signal.c:2190
ptrace_stop.part.0+0x834/0xa80 kernel/signal.c:2293
ptrace_stop kernel/signal.c:2232 [inline]
ptrace_do_notify+0x215/0x2b0 kernel/signal.c:2344
ptrace_notify+0xc4/0x140 kernel/signal.c:2356
ptrace_report_syscall include/linux/ptrace.h:420 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:482 [inline]
syscall_exit_work kernel/entry/common.c:249 [inline]
syscall_exit_to_user_mode_prepare+0x129/0x280 kernel/entry/common.c:276
__syscall_exit_to_user_mode_work kernel/entry/common.c:281 [inline]
syscall_exit_to_user_mode+0x9/0x50 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fc367c90a56
Code: 0f 1f 40 00 31 c9 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 49 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 90 48 83 ec 28 89 54 24 14 48 89 74 24
RSP: 002b:00007ffff927cd18 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: 0000000000000000 RBX: 000000000000c141 RCX: 00007fc367c90a56
RDX: 0000000040000001 RSI: 00007ffff927cd2c RDI: 00000000ffffffff
RBP: 0000000000000e24 R08: 0000000000000031 R09: 00007ffff929e080
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffff927cd2c
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: ffffc9000396a330
---[ end trace 0000000000000000 ]---
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:29 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:28 [inline]
RIP: 0010:kvm_arch_hardware_enable+0x2ab/0x840 arch/x86/kvm/x86.c:11847
Code: 48 89 e8 48 b9 00 00 00 00 00 fc ff df 48 c1 e8 03 0f b6 14 08 48 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ed 04 00 00 <41> 8b 95 30 13 00 00 4d 8d b5 40 12 00 00 b9 08 00 00 00 4c 89 fe
RSP: 0018:ffffc900001e0ea0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81120fe0
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc9000396a330
RBP: ffffc9000396a330 R08: 0000000000000000 R09: 0000000000000003
R10: fffff5200072d466 R11: 0000000000000001 R12: 0000000000000000
R13: ffffc90003969000 R14: 0023001000000000 R15: ffffc900001e0ef8
FS: 0000555555d75300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000396a330 CR3: 0000000071c38000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 89 e8 mov %rbp,%rax
3: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
a: fc ff df
d: 48 c1 e8 03 shr $0x3,%rax
11: 0f b6 14 08 movzbl (%rax,%rcx,1),%edx
15: 48 89 e8 mov %rbp,%rax
18: 83 e0 07 and $0x7,%eax
1b: 83 c0 03 add $0x3,%eax
1e: 38 d0 cmp %dl,%al
20: 7c 08 jl 0x2a
22: 84 d2 test %dl,%dl
24: 0f 85 ed 04 00 00 jne 0x517
* 2a: 41 8b 95 30 13 00 00 mov 0x1330(%r13),%edx <-- trapping instruction
31: 4d 8d b5 40 12 00 00 lea 0x1240(%r13),%r14
38: b9 08 00 00 00 mov $0x8,%ecx
3d: 4c 89 fe mov %r15,%rsi