BUG: unable to handle page fault for address: ffffc9000387eb58
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 17c00067 P4D 17c00067 PUD 19e4a067 PMD 21387067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 970 Comm: kworker/0:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:readl arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:__er32 drivers/net/ethernet/intel/e1000e/e1000.h:601 [inline]
RIP: 0010:e1000_init_mac_params_82571 drivers/net/ethernet/intel/e1000e/82571.c:278 [inline]
RIP: 0010:e1000_get_variants_82571+0x5fa/0x1bd0 drivers/net/ethernet/intel/e1000e/82571.c:320
Code: fe e8 fa f9 a8 fb 41 83 ff 02 73 64 4c 8b 64 24 38 43 80 3c 2c 00 4c 8d b3 80 06 00 00 74 08 4c 89 f7 e8 99 78 01 fc 49 8b 06 <44> 8b b8 58 5b 00 00 44 89 fe 83 e6 02 31 ff e8 c2 f9 a8 fb 44 89
RSP: 0018:ffffc90004237900 EFLAGS: 00010246
RAX: ffffc90003879000 RBX: ffff88805d2a0d00 RCX: 0000000000000000
RDX: ffff888022cb3c00 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc900042379f0 R08: ffff888022cb3c00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: 1ffff1100ba54270
R13: dffffc0000000000 R14: ffff88805d2a1380 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000387eb58 CR3: 000000005daad000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 e1000_probe+0xb43/0x2990 drivers/net/ethernet/intel/e1000e/netdev.c:7479
 local_pci_probe+0xc9/0x150 drivers/pci/pci-driver.c:324
 work_for_cpu_fn+0x54/0x80 kernel/workqueue.c:5704
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: ffffc9000387eb58
---[ end trace 0000000000000000 ]---
RIP: 0010:readl arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:__er32 drivers/net/ethernet/intel/e1000e/e1000.h:601 [inline]
RIP: 0010:e1000_init_mac_params_82571 drivers/net/ethernet/intel/e1000e/82571.c:278 [inline]
RIP: 0010:e1000_get_variants_82571+0x5fa/0x1bd0 drivers/net/ethernet/intel/e1000e/82571.c:320
Code: fe e8 fa f9 a8 fb 41 83 ff 02 73 64 4c 8b 64 24 38 43 80 3c 2c 00 4c 8d b3 80 06 00 00 74 08 4c 89 f7 e8 99 78 01 fc 49 8b 06 <44> 8b b8 58 5b 00 00 44 89 fe 83 e6 02 31 ff e8 c2 f9 a8 fb 44 89
RSP: 0018:ffffc90004237900 EFLAGS: 00010246
RAX: ffffc90003879000 RBX: ffff88805d2a0d00 RCX: 0000000000000000
RDX: ffff888022cb3c00 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc900042379f0 R08: ffff888022cb3c00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: 1ffff1100ba54270
R13: dffffc0000000000 R14: ffff88805d2a1380 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000387eb58 CR3: 000000005daad000 CR4: 00000000003506f0
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 fa f9 a8 fb       	call   0xfba8f9ff
   5:	41 83 ff 02          	cmp    $0x2,%r15d
   9:	73 64                	jae    0x6f
   b:	4c 8b 64 24 38       	mov    0x38(%rsp),%r12
  10:	43 80 3c 2c 00       	cmpb   $0x0,(%r12,%r13,1)
  15:	4c 8d b3 80 06 00 00 	lea    0x680(%rbx),%r14
  1c:	74 08                	je     0x26
  1e:	4c 89 f7             	mov    %r14,%rdi
  21:	e8 99 78 01 fc       	call   0xfc0178bf
  26:	49 8b 06             	mov    (%r14),%rax
* 29:	44 8b b8 58 5b 00 00 	mov    0x5b58(%rax),%r15d <-- trapping instruction
  30:	44 89 fe             	mov    %r15d,%esi
  33:	83 e6 02             	and    $0x2,%esi
  36:	31 ff                	xor    %edi,%edi
  38:	e8 c2 f9 a8 fb       	call   0xfba8f9ff
  3d:	44                   	rex.R
  3e:	89                   	.byte 0x89