BUG: unable to handle kernel paging request in preempt_schedule

Kernel	Title	Rank 🛈	Repro	Count	Last	Reported	Patched	Status
linux-5.15	BUG: unable to handle kernel paging request in preempt_schedule_irq origin:upstream	8	C	20	15d	89d	0/3	upstream: reported C repro on 2025/04/28 12:49
upstream	BUG: unable to handle kernel paging request in preempt_schedule_irq kernel	8		1	344d	340d	0/29	auto-obsoleted due to no activity on 2024/11/14 20:10
linux-6.1	BUG: unable to handle kernel paging request in preempt_schedule_irq origin:upstream	8	C	14	25d	32d	0/3	upstream: reported C repro on 2025/06/24 13:48
upstream	KASAN: stack-out-of-bounds Write in preempt_schedule_irq kernel	23		1	111d	106d	0/29	auto-obsoleted due to no activity on 2025/06/06 00:36
loop1: detected capacity change from 0 to 4096
ntfs3: loop1: Different NTFS sector size (1024) and media sector size (512).
BUG: unable to handle page fault for address: ffffed1104f9777f
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffee067 P4D 23ffee067 PUD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 6234 Comm: syz.1.90 Not tainted 6.6.95-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
RIP: 0010:tif_need_resched include/linux/thread_info.h:184 [inline]
RIP: 0010:need_resched include/linux/sched.h:2262 [inline]
RIP: 0010:preempt_schedule_irq+0xed/0x140 kernel/sched/core.c:7013
Code: 8b 44 24 40 fa a9 00 02 00 00 74 05 e8 7c 5a 15 f7 bf 01 00 00 00 e8 92 c3 e4 f6 65 48 8b 1d 9a 19 8d 75 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 9e 48 89 df e8 c4 a4 67 f7 eb 94 48 c7 04 24 0e
RSP: 0018:ffffc9000b836620 EFLAGS: 00010802
RAX: 1ffff11004f97780 RBX: ffff888027cbbc00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8afc6d20 RDI: 00000000ffffffff
RBP: ffffc9000b8366c0 R08: ffffffff8e4a7e2f R09: 1ffffffff1c94fc5
R10: dffffc0000000000 R11: fffffbfff1c94fc6 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc00ffffffff R15: 1ffff92001706cc4
FS:  00007fe520c0b6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1104f9777f CR3: 000000002c7e0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:692
RIP: 0010:__up_read+0xce/0x670 kernel/locking/rwsem.c:1343
Code: fc ff df 41 80 3c 06 00 74 08 4c 89 e7 e8 4a e2 77 00 48 39 5b 68 74 12 80 3d 44 c0 ce 0c 00 0f 84 22 03 00 00 e8 02 a3 b5 02 <48> c7 c0 e0 b2 4a 8e 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f
RSP: 0018:ffffc9000b836780 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff888076faa250 RCX: dffffc0000000000
RDX: 1ffff92001706cf4 RSI: ffffffff8aaac440 RDI: ffff888076faa250
RBP: ffffc9000b836828 R08: ffffffff8e4a7e2f R09: 1ffffffff1c94fc5
R10: dffffc0000000000 R11: fffffbfff1c94fc6 R12: ffff888076faa2b8
R13: ffffc9000b836a98 R14: 1ffff1100edf5457 R15: ffffc9000b836aa8
 filemap_invalidate_unlock_shared include/linux/fs.h:871 [inline]
 page_cache_ra_unbounded+0x69c/0x770 mm/readahead.c:270
 page_cache_sync_readahead include/linux/pagemap.h:1325 [inline]
 filemap_get_pages+0x3ac/0x1e10 mm/filemap.c:2594
 filemap_read+0x3d0/0xec0 mm/filemap.c:2690
 __kernel_read+0x2e3/0x6f0 fs/read_write.c:428
 integrity_kernel_read+0x8a/0xd0 security/integrity/iint.c:221
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
 ima_calc_file_hash+0x978/0x17d0 security/integrity/ima/ima_crypto.c:573
 ima_collect_measurement+0x462/0x980 security/integrity/ima/ima_api.c:290
 process_measurement+0x1074/0x1ad0 security/integrity/ima/ima_main.c:364
 ima_file_check+0xc6/0x100 security/integrity/ima/ima_main.c:562
 do_open fs/namei.c:3634 [inline]
 path_openat+0x2811/0x3190 fs/namei.c:3789
 do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
 do_sys_openat2+0x12c/0x1c0 fs/open.c:1419
 do_sys_open fs/open.c:1434 [inline]
 __do_sys_openat fs/open.c:1450 [inline]
 __se_sys_openat fs/open.c:1445 [inline]
 __x64_sys_openat+0x139/0x160 fs/open.c:1445
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe51fd8e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe520c0b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fe51ffb5fa0 RCX: 00007fe51fd8e929
RDX: 0000000000008042 RSI: 0000200000000040 RDI: ffffffffffffff9c
RBP: 00007fe51fe10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe51ffb5fa0 R15: 00007ffea7b64788
 </TASK>
Modules linked in:
CR2: ffffed1104f9777f
---[ end trace 0000000000000000 ]---
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
RIP: 0010:tif_need_resched include/linux/thread_info.h:184 [inline]
RIP: 0010:need_resched include/linux/sched.h:2262 [inline]
RIP: 0010:preempt_schedule_irq+0xed/0x140 kernel/sched/core.c:7013
Code: 8b 44 24 40 fa a9 00 02 00 00 74 05 e8 7c 5a 15 f7 bf 01 00 00 00 e8 92 c3 e4 f6 65 48 8b 1d 9a 19 8d 75 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 9e 48 89 df e8 c4 a4 67 f7 eb 94 48 c7 04 24 0e
RSP: 0018:ffffc9000b836620 EFLAGS: 00010802
RAX: 1ffff11004f97780 RBX: ffff888027cbbc00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8afc6d20 RDI: 00000000ffffffff
RBP: ffffc9000b8366c0 R08: ffffffff8e4a7e2f R09: 1ffffffff1c94fc5
R10: dffffc0000000000 R11: fffffbfff1c94fc6 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc00ffffffff R15: 1ffff92001706cc4
FS:  00007fe520c0b6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1104f9777f CR3: 000000002c7e0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	8b 44 24 40          	mov    0x40(%rsp),%eax
   4:	fa                   	cli
   5:	a9 00 02 00 00       	test   $0x200,%eax
   a:	74 05                	je     0x11
   c:	e8 7c 5a 15 f7       	call   0xf7155a8d
  11:	bf 01 00 00 00       	mov    $0x1,%edi
  16:	e8 92 c3 e4 f6       	call   0xf6e4c3ad
  1b:	65 48 8b 1d 9a 19 8d 	mov    %gs:0x758d199a(%rip),%rbx        # 0x758d19bd
  22:	75
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1) <-- trapping instruction
  2f:	74 9e                	je     0xffffffcf
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 c4 a4 67 f7       	call   0xf767a4fd
  39:	eb 94                	jmp    0xffffffcf
  3b:	48                   	rex.W
  3c:	c7                   	.byte 0xc7
  3d:	04 24                	add    $0x24,%al
  3f:	0e                   	(bad)