kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 29374 Comm: syz-executor0 Not tainted 4.20.0-rc4+ #260
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvm_apic_hw_enabled arch/x86/kvm/lapic.h:169 [inline]
RIP: 0010:vcpu_scan_ioapic arch/x86/kvm/x86.c:7449 [inline]
RIP: 0010:vcpu_enter_guest arch/x86/kvm/x86.c:7602 [inline]
RIP: 0010:vcpu_run arch/x86/kvm/x86.c:7874 [inline]
RIP: 0010:kvm_arch_vcpu_ioctl_run+0x5296/0x7320 arch/x86/kvm/x86.c:8074
Code: 03 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 b4 1e 00 00 49 8b 9f e0 03 00 00 48 8d bb 88 00 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 8a 1e 00 00 48 8b 9b 88 00 00 00 48 8d bb d8
RSP: 0018:ffff8881b49575a0 EFLAGS: 00010206
RAX: 0000000000000011 RBX: 0000000000000000 RCX: ffffc90005dd6000
RDX: 00000000000000cd RSI: ffffffff81103a68 RDI: 0000000000000088
RBP: ffff8881b4957940 R08: ffff888188552080 R09: 0000000000000008
R10: 0000000000000028 R11: ffffffff810feb0f R12: dffffc0000000000
R13: 0000000000000000 R14: ffffc90013261db8 R15: ffff8881b93f1500
FS:  0000000000000000(0000) GS:ffff8881dae00000(0063) knlGS:00000000f5f34b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000020000000 CR3: 000000018aa11000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 kvm_vcpu_ioctl+0x5c8/0x1150 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2596
 kvm_vcpu_compat_ioctl+0x210/0x4a0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2791
 __do_compat_sys_ioctl fs/compat_ioctl.c:1052 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:998 [inline]
 __ia32_compat_sys_ioctl+0x20e/0x630 fs/compat_ioctl.c:998
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f38a29
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f5f340cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000000ae80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
kobject: 'loop1' (00000000f2d17716): kobject_uevent_env
kobject: 'loop1' (00000000f2d17716): fill_kobj_path: path = '/devices/virtual/block/loop1'
---[ end trace fdb19545f724004c ]---
kobject: 'loop3' (000000006adf80d5): kobject_uevent_env
RIP: 0010:kvm_apic_hw_enabled arch/x86/kvm/lapic.h:169 [inline]
RIP: 0010:vcpu_scan_ioapic arch/x86/kvm/x86.c:7449 [inline]
RIP: 0010:vcpu_enter_guest arch/x86/kvm/x86.c:7602 [inline]
RIP: 0010:vcpu_run arch/x86/kvm/x86.c:7874 [inline]
RIP: 0010:kvm_arch_vcpu_ioctl_run+0x5296/0x7320 arch/x86/kvm/x86.c:8074
kobject: 'loop3' (000000006adf80d5): fill_kobj_path: path = '/devices/virtual/block/loop3'
Code: 03 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 b4 1e 00 00 49 8b 9f e0 03 00 00 48 8d bb 88 00 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 8a 1e 00 00 48 8b 9b 88 00 00 00 48 8d bb d8
kobject: 'loop4' (00000000e88362f0): kobject_uevent_env
RSP: 0018:ffff8881b49575a0 EFLAGS: 00010206
kobject: 'loop4' (00000000e88362f0): fill_kobj_path: path = '/devices/virtual/block/loop4'
RAX: 0000000000000011 RBX: 0000000000000000 RCX: ffffc90005dd6000
RDX: 00000000000000cd RSI: ffffffff81103a68 RDI: 0000000000000088
kobject: 'loop3' (000000006adf80d5): kobject_uevent_env
RBP: ffff8881b4957940 R08: ffff888188552080 R09: 0000000000000008
kobject: 'loop3' (000000006adf80d5): fill_kobj_path: path = '/devices/virtual/block/loop3'
R10: 0000000000000028 R11: ffffffff810feb0f R12: dffffc0000000000
kobject: 'loop4' (00000000e88362f0): kobject_uevent_env
R13: 0000000000000000 R14: ffffc90013261db8 R15: ffff8881b93f1500
kobject: 'loop4' (00000000e88362f0): fill_kobj_path: path = '/devices/virtual/block/loop4'
FS:  0000000000000000(0000) GS:ffff8881daf00000(0063) knlGS:00000000f5f34b40
kobject: 'loop3' (000000006adf80d5): kobject_uevent_env
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
kobject: 'loop3' (000000006adf80d5): fill_kobj_path: path = '/devices/virtual/block/loop3'
CR2: 000000000811f0f0 CR3: 000000018aa11000 CR4: 00000000001426e0
kobject: 'loop2' (00000000fb80c176): kobject_uevent_env
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kobject: 'loop2' (00000000fb80c176): fill_kobj_path: path = '/devices/virtual/block/loop2'
kobject: 'rx-0' (0000000010b76116): kobject_cleanup, parent 000000008f72971b
kobject: 'loop2' (00000000fb80c176): kobject_uevent_env
kobject: 'loop2' (00000000fb80c176): fill_kobj_path: path = '/devices/virtual/block/loop2'
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
kobject: 'rx-0' (0000000010b76116): auto cleanup 'remove' event
kobject: 'rx-0' (0000000010b76116): kobject_uevent_env