BUG: unable to handle page fault for address: 0000000000055640
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 5f69b067 P4D 5f69b067 PUD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4231 Comm: kworker/0:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:ioread32+0x18/0x80 lib/iomap.c:90
Code: b7 c0 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 55 53 48 89 fb e8 36 fd 8c fd 48 81 fb 00 00 04 00 72 09 e8 28 fd 8c fd <8b> 03 eb 58 48 81 fb 01 00 01 00 72 0b e8 16 fd 8c fd 0f b7 d3 ed
RSP: 0018:ffffc900031afae8 EFLAGS: 00010293
RAX: ffffffff83ebff88 RBX: 0000000000055640 RCX: ffff888021f31dc0
RDX: 0000000000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000055640
RBP: ffffc900031afbd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 0000000000055640
R13: ffffffff8a7ed398 R14: 1ffff92000635f68 R15: ffff8880621e9828
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000055640 CR3: 0000000063baf000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 nhi_probe+0x225/0xb40 drivers/thunderbolt/nhi.c:1281
 local_pci_probe+0xc5/0x150 drivers/pci/pci-driver.c:323
 work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5217
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 process_scheduled_works kernel/workqueue.c:2373 [inline]
 worker_thread+0xe01/0x12a0 kernel/workqueue.c:2462
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Modules linked in:
CR2: 0000000000055640
---[ end trace 89ccecc4a95c6c31 ]---
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:ioread32+0x18/0x80 lib/iomap.c:90
Code: b7 c0 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 55 53 48 89 fb e8 36 fd 8c fd 48 81 fb 00 00 04 00 72 09 e8 28 fd 8c fd <8b> 03 eb 58 48 81 fb 01 00 01 00 72 0b e8 16 fd 8c fd 0f b7 d3 ed
RSP: 0018:ffffc900031afae8 EFLAGS: 00010293
RAX: ffffffff83ebff88 RBX: 0000000000055640 RCX: ffff888021f31dc0
RDX: 0000000000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000055640
RBP: ffffc900031afbd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 0000000000055640
R13: ffffffff8a7ed398 R14: 1ffff92000635f68 R15: ffff8880621e9828
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000055640 CR3: 0000000063baf000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	b7 c0                	mov    $0xc0,%bh
   2:	5b                   	pop    %rbx
   3:	5d                   	pop    %rbp
   4:	c3                   	ret
   5:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
   c:	00 00 00
   f:	0f 1f 00             	nopl   (%rax)
  12:	55                   	push   %rbp
  13:	53                   	push   %rbx
  14:	48 89 fb             	mov    %rdi,%rbx
  17:	e8 36 fd 8c fd       	call   0xfd8cfd52
  1c:	48 81 fb 00 00 04 00 	cmp    $0x40000,%rbx
  23:	72 09                	jb     0x2e
  25:	e8 28 fd 8c fd       	call   0xfd8cfd52
* 2a:	8b 03                	mov    (%rbx),%eax <-- trapping instruction
  2c:	eb 58                	jmp    0x86
  2e:	48 81 fb 01 00 01 00 	cmp    $0x10001,%rbx
  35:	72 0b                	jb     0x42
  37:	e8 16 fd 8c fd       	call   0xfd8cfd52
  3c:	0f b7 d3             	movzwl %bx,%edx
  3f:	ed                   	in     (%dx),%eax