BUG: unable to handle page fault for address: ffffdc0000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 100026067 P4D 100026067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-rc1-syzkaller-00028-g4dce3b375179 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:165 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:286 [inline]
RIP: 0010:rb_erase+0x21a/0x1210 lib/rbtree.c:443
Code: ea 03 80 3c 02 00 0f 85 b8 0f 00 00 49 89 5e 08 48 85 c9 74 4f 48 89 ca 48 83 cd 01 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 0f 00 00 48 b8 00 00 00 00 00 fc ff df 48 89
RSP: 0000:ffffc90000178bb0 EFLAGS: 00010806
RAX: dffffc0000000000 RBX: ffff88810e690090 RCX: ffff000000000000
RDX: 1fffe00000000000 RSI: ffff88810e690090 RDI: 1ffff11021ccc732
RBP: ffff88810e693991 R08: 0000000000000000 R09: ffff8881f6837bf8
R10: ffff8881f6837cc0 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88810e445610 R14: 0000000000000000 R15: ffff8881f6837bf0
FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffdc0000000000 CR3: 0000000007825000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
rb_erase_cached include/linux/rbtree.h:126 [inline]
__dequeue_entity kernel/sched/fair.c:634 [inline]
dequeue_entity kernel/sched/fair.c:4535 [inline]
dequeue_task_fair+0x24e/0x16a0 kernel/sched/fair.c:5835
detach_task kernel/sched/fair.c:7980 [inline]
detach_tasks kernel/sched/fair.c:8118 [inline]
load_balance+0xe4b/0x2be0 kernel/sched/fair.c:10164
rebalance_domains+0x65a/0xc30 kernel/sched/fair.c:10561
__do_softirq+0x1c0/0x9a9 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x113/0x170 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1106
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt+0x6f/0xb0 drivers/acpi/processor_idle.c:113
Code: fb 84 db 74 06 5b e9 50 61 50 fb e8 4b 61 50 fb e8 36 ce 56 fb 66 90 e8 3f 61 50 fb 0f 00 2d a8 72 76 00 e8 33 61 50 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 fe 5d 50 fb 48 85 db
RSP: 0000:ffffc9000010fd20 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8881002d5580 RSI: ffffffff85f5a7bd RDI: 0000000000000000
RBP: ffff888109ac1064 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000001 R14: ffff888109ac1000 R15: ffff88810c971004
acpi_idle_do_entry drivers/acpi/processor_idle.c:555 [inline]
acpi_idle_enter+0x524/0x6a0 drivers/acpi/processor_idle.c:692
cpuidle_enter_state+0x1ab/0xd30 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3e8/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:262
secondary_startup_64_no_verify+0xce/0xdb
</TASK>
Modules linked in:
CR2: ffffdc0000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:165 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:286 [inline]
RIP: 0010:rb_erase+0x21a/0x1210 lib/rbtree.c:443
Code: ea 03 80 3c 02 00 0f 85 b8 0f 00 00 49 89 5e 08 48 85 c9 74 4f 48 89 ca 48 83 cd 01 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 0f 00 00 48 b8 00 00 00 00 00 fc ff df 48 89
RSP: 0000:ffffc90000178bb0 EFLAGS: 00010806
RAX: dffffc0000000000 RBX: ffff88810e690090 RCX: ffff000000000000
RDX: 1fffe00000000000 RSI: ffff88810e690090 RDI: 1ffff11021ccc732
RBP: ffff88810e693991 R08: 0000000000000000 R09: ffff8881f6837bf8
R10: ffff8881f6837cc0 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88810e445610 R14: 0000000000000000 R15: ffff8881f6837bf0
FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffdc0000000000 CR3: 0000000007825000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax
6: 85 b8 0f 00 00 49 test %edi,0x4900000f(%rax)
c: 89 5e 08 mov %ebx,0x8(%rsi)
f: 48 85 c9 test %rcx,%rcx
12: 74 4f je 0x63
14: 48 89 ca mov %rcx,%rdx
17: 48 83 cd 01 or $0x1,%rbp
1b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
22: fc ff df
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 0f 85 a2 0f 00 00 jne 0xfd5
33: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3a: fc ff df
3d: 48 rex.W
3e: 89 .byte 0x89