BUG: unable to handle page fault for address: 0000000100038ec8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 19ac28067 P4D 19ac28067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4199 Comm: syz-executor.1 Not tainted 5.4.249-syzkaller-00006-gc83e2462239e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:deref_stack_reg+0x15c/0x1f0 arch/x86/kernel/unwind_orc.c:350
Code: 00 00 00 00 fc ff df 42 80 3c 23 00 74 08 4c 89 f7 e8 e8 15 64 00 48 c7 44 24 40 00 00 00 00 4c 89 ff 4c 89 f6 e8 24 09 00 00 <42> 80 3c 23 00 74 08 4c 89 f7 e8 45 15 64 00 4c 8b 74 24 40 48 8b
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010206
RAX: ffffffff8154d3fa RBX: 0000000000000100 RCX: ffff8881d9a8ee40
RDX: 0000000000000100 RSI: ffffffff812fe0fc RDI: ffff88819629f1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154d03e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000100038dc8
R13: dffffc0000000000 R14: ffffffff812fe0fc R15: ffff88819629f1c0
FS: 00007f2d5b8236c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100038ec8 CR3: 00000001ab636000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1800
__do_softirq+0x23b/0x6b7 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x195/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:538 [inline]
smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
</IRQ>
Modules linked in:
CR2: 0000000100038ec8
---[ end trace 37d724eadbbe13d9 ]---
RIP: 0010:deref_stack_reg+0x15c/0x1f0 arch/x86/kernel/unwind_orc.c:350
Code: 00 00 00 00 fc ff df 42 80 3c 23 00 74 08 4c 89 f7 e8 e8 15 64 00 48 c7 44 24 40 00 00 00 00 4c 89 ff 4c 89 f6 e8 24 09 00 00 <42> 80 3c 23 00 74 08 4c 89 f7 e8 45 15 64 00 4c 8b 74 24 40 48 8b
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010206
RAX: ffffffff8154d3fa RBX: 0000000000000100 RCX: ffff8881d9a8ee40
RDX: 0000000000000100 RSI: ffffffff812fe0fc RDI: ffff88819629f1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154d03e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000100038dc8
R13: dffffc0000000000 R14: ffffffff812fe0fc R15: ffff88819629f1c0
FS: 00007f2d5b8236c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100038ec8 CR3: 00000001ab636000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess), 6 bytes skipped:
0: df 42 80 filds -0x80(%rdx)
3: 3c 23 cmp $0x23,%al
5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
9: 89 f7 mov %esi,%edi
b: e8 e8 15 64 00 call 0x6415f8
10: 48 c7 44 24 40 00 00 movq $0x0,0x40(%rsp)
17: 00 00
19: 4c 89 ff mov %r15,%rdi
1c: 4c 89 f6 mov %r14,%rsi
1f: e8 24 09 00 00 call 0x948
* 24: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1) <-- trapping instruction
29: 74 08 je 0x33
2b: 4c 89 f7 mov %r14,%rdi
2e: e8 45 15 64 00 call 0x641578
33: 4c 8b 74 24 40 mov 0x40(%rsp),%r14
38: 48 rex.W
39: 8b .byte 0x8b