BUG: unable to handle page fault for address: ffffea000f416a48
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 237ff3067 P4D 237ff3067 PUD 237ff2067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 541 Comm: syz.1.44 Not tainted 5.4.290-syzkaller-00002-g41adfeb3d639 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:migration_entry_to_page include/linux/swapops.h:195 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1146 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1222 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1251 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1272 [inline]
RIP: 0010:unmap_page_range+0x1210/0x2620 mm/memory.c:1293
Code: 84 24 f0 00 00 00 42 80 3c 20 00 74 08 4c 89 ef e8 25 55 09 00 48 b8 00 00 00 00 00 ea ff ff 48 01 c3 4c 89 ac 24 f8 00 00 00 <4d> 8b 6d 00 44 89 ee 83 e6 01 31 ff e8 2f 6e d9 ff 41 f6 c5 01 48
RSP: 0018:ffff8881e7997880 EFLAGS: 00010282
RAX: ffffea0000000000 RBX: ffffea000f416a40 RCX: 0000000000000000
RDX: ffff8881e85b6e40 RSI: ffffffff85f4ac10 RDI: f000000000000000
RBP: ffff8881e7997a70 R08: ffffffff818adcd9 R09: ffffed103d0b6dc9
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffea000f416a48 R14: 1ffff1103d05de39 R15: ffffffff85f4ac10
FS: 000055558357f500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea000f416a48 CR3: 00000001e7b94000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
unmap_single_vma mm/memory.c:1338 [inline]
unmap_vmas+0x355/0x4b0 mm/memory.c:1370
exit_mmap+0x2bc/0x520 mm/mmap.c:3191
__mmput+0x8e/0x2c0 kernel/fork.c:1101
exit_mm kernel/exit.c:538 [inline]
do_exit+0xc08/0x2bc0 kernel/exit.c:848
do_group_exit+0x138/0x300 kernel/exit.c:984
__do_sys_exit_group kernel/exit.c:995 [inline]
__se_sys_exit_group kernel/exit.c:993 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:993
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f41fe1b9169
Code: Bad RIP value.
RSP: 002b:00007ffffd84b778 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f41fe1b9169
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffffd84b7dc R08: 0000001efd84b86f R09: 00000000000927c0
R10: 0000000000000234 R11: 0000000000000246 R12: 0000000000000009
R13: 00000000000927c0 R14: 00000000000090e2 R15: 00007ffffd84b830
Modules linked in:
CR2: ffffea000f416a48
---[ end trace 1af2da23dff050a5 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:migration_entry_to_page include/linux/swapops.h:195 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1146 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1222 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1251 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1272 [inline]
RIP: 0010:unmap_page_range+0x1210/0x2620 mm/memory.c:1293
Code: 84 24 f0 00 00 00 42 80 3c 20 00 74 08 4c 89 ef e8 25 55 09 00 48 b8 00 00 00 00 00 ea ff ff 48 01 c3 4c 89 ac 24 f8 00 00 00 <4d> 8b 6d 00 44 89 ee 83 e6 01 31 ff e8 2f 6e d9 ff 41 f6 c5 01 48
RSP: 0018:ffff8881e7997880 EFLAGS: 00010282
RAX: ffffea0000000000 RBX: ffffea000f416a40 RCX: 0000000000000000
RDX: ffff8881e85b6e40 RSI: ffffffff85f4ac10 RDI: f000000000000000
RBP: ffff8881e7997a70 R08: ffffffff818adcd9 R09: ffffed103d0b6dc9
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffffea000f416a48 R14: 1ffff1103d05de39 R15: ffffffff85f4ac10
FS: 000055558357f500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f41fe1b913f CR3: 00000001e7b94000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
0: 84 24 f0 test %ah,(%rax,%rsi,8)
3: 00 00 add %al,(%rax)
5: 00 42 80 add %al,-0x80(%rdx)
8: 3c 20 cmp $0x20,%al
a: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
e: 89 ef mov %ebp,%edi
10: e8 25 55 09 00 call 0x9553a
15: 48 b8 00 00 00 00 00 movabs $0xffffea0000000000,%rax
1c: ea ff ff
1f: 48 01 c3 add %rax,%rbx
22: 4c 89 ac 24 f8 00 00 mov %r13,0xf8(%rsp)
29: 00
* 2a: 4d 8b 6d 00 mov 0x0(%r13),%r13 <-- trapping instruction
2e: 44 89 ee mov %r13d,%esi
31: 83 e6 01 and $0x1,%esi
34: 31 ff xor %edi,%edi
36: e8 2f 6e d9 ff call 0xffd96e6a
3b: 41 f6 c5 01 test $0x1,%r13b
3f: 48 rex.W