------------[ cut here ]------------ kernel BUG at arch/x86/kvm/mmu.c:3311! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 20282 Comm: syz-executor.1 Not tainted 4.19.204-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:transparent_hugepage_adjust+0x520/0x5c0 arch/x86/kvm/mmu.c:3311 Code: ff e8 e4 b4 53 00 48 8b 44 24 10 48 83 e8 01 48 89 04 24 e9 24 fd ff ff 48 89 df e8 5a 89 89 00 e9 1f fb ff ff e8 c0 b4 53 00 <0f> 0b 48 89 ef e8 86 8b 89 00 e9 87 fe ff ff 48 89 df e8 09 8c 89 RSP: 0018:ffff88803f67f688 EFLAGS: 00010216 RAX: 0000000000040000 RBX: ffff88803f67f760 RCX: ffffc90007e85000 RDX: 00000000000030f1 RSI: ffffffff810eddd0 RDI: 0000000000000007 RBP: ffff88803f67f750 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000193 R13: 0000000000000000 R14: 000000000003eb90 R15: 0000000000000000 FS: 00007fbd317a2700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000aa5cf000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tdp_page_fault+0x597/0x680 arch/x86/kvm/mmu.c:4228 kvm_mmu_page_fault+0x199/0x1300 arch/x86/kvm/mmu.c:5374 vmx_handle_exit+0x26c/0xf90 arch/x86/kvm/vmx.c:10168 vcpu_enter_guest arch/x86/kvm/x86.c:7853 [inline] vcpu_run arch/x86/kvm/x86.c:7916 [inline] kvm_arch_vcpu_ioctl_run+0x2770/0x6f60 arch/x86/kvm/x86.c:8116 kvm_vcpu_ioctl+0x493/0xe10 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2846 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665e9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbd317a2188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007ffeaae310df R14: 00007fbd317a2300 R15: 0000000000022000 Modules linked in: ---[ end trace a8c841936edb9a0d ]--- RIP: 0010:transparent_hugepage_adjust+0x520/0x5c0 arch/x86/kvm/mmu.c:3311 Code: ff e8 e4 b4 53 00 48 8b 44 24 10 48 83 e8 01 48 89 04 24 e9 24 fd ff ff 48 89 df e8 5a 89 89 00 e9 1f fb ff ff e8 c0 b4 53 00 <0f> 0b 48 89 ef e8 86 8b 89 00 e9 87 fe ff ff 48 89 df e8 09 8c 89 RSP: 0018:ffff88803f67f688 EFLAGS: 00010216 RAX: 0000000000040000 RBX: ffff88803f67f760 RCX: ffffc90007e85000 RDX: 00000000000030f1 RSI: ffffffff810eddd0 RDI: 0000000000000007 RBP: ffff88803f67f750 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000193 R13: 0000000000000000 R14: 000000000003eb90 R15: 0000000000000000 FS: 00007fbd317a2700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000aa5cf000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: e8 e4 b4 53 00 callq 0x53b4e9 5: 48 8b 44 24 10 mov 0x10(%rsp),%rax a: 48 83 e8 01 sub $0x1,%rax e: 48 89 04 24 mov %rax,(%rsp) 12: e9 24 fd ff ff jmpq 0xfffffd3b 17: 48 89 df mov %rbx,%rdi 1a: e8 5a 89 89 00 callq 0x898979 1f: e9 1f fb ff ff jmpq 0xfffffb43 24: e8 c0 b4 53 00 callq 0x53b4e9 29: 0f 0b ud2 <-- trapping instruction 2b: 48 89 ef mov %rbp,%rdi 2e: e8 86 8b 89 00 callq 0x898bb9 33: e9 87 fe ff ff jmpq 0xfffffebf 38: 48 89 df mov %rbx,%rdi 3b: e8 .byte 0xe8 3c: 09 .byte 0x9 3d: 8c .byte 0x8c 3e: 89 .byte 0x89