------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:171!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5103 Comm: syz.0.0 Not tainted 6.11.0-syzkaller-10669-g11a299a7933e #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:sg_page include/linux/scatterlist.h:171 [inline]
RIP: 0010:sg_phys include/linux/scatterlist.h:389 [inline]
RIP: 0010:perf_trace_dma_unmap_sg+0x784/0x790 include/trace/events/dma.h:224
Code: 00 48 8b 54 24 08 e9 6b fe ff ff e8 46 7e 17 00 48 c7 c7 60 79 94 8e 4c 89 f6 e8 07 f2 76 03 e9 5b fa ff ff e8 2d 7e 17 00 90 <0f> 0b e8 35 0d 47 0a 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0000:ffffc90000007aa0 EFLAGS: 00010006
RAX: ffffffff817d3713 RBX: ffff888000595f88 RCX: ffff888000900000
RDX: 0000000000010000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000007bd0 R08: ffffffff817d340b R09: 322e66313a30303a
R10: dffffc0000000000 R11: fffff91ffff88a30 R12: 0000000000000008
R13: ffff8880329e0b41 R14: ffff888000595fa8 R15: dffffc0000000000
FS: 00007ff9587316c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffb1bece004 CR3: 000000001ce08000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_dma_unmap_sg+0x1c2/0x230 include/trace/events/dma.h:224
dma_unmap_sg_attrs+0x49/0xe0 kernel/dma/mapping.c:308
ata_sg_clean drivers/ata/libata-core.c:4627 [inline]
__ata_qc_complete+0x1ae/0x5b0 drivers/ata/libata-core.c:4720
ata_qc_complete_multiple+0x1a3/0x280 drivers/ata/libata-sata.c:789
ahci_qc_complete drivers/ata/libahci.c:1881 [inline]
ahci_handle_port_interrupt+0x422/0x650 drivers/ata/libahci.c:1948
ahci_port_intr drivers/ata/libahci.c:1959 [inline]
ahci_handle_port_intr+0x18e/0x2c0 drivers/ata/libahci.c:1990
ahci_single_level_irq_intr+0xa1/0xf0 drivers/ata/libahci.c:2024
__handle_irq_event_percpu+0x29a/0xa80 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0x89/0x1f0 kernel/irq/handle.c:210
handle_edge_irq+0x25f/0xc20 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0x136/0x230 arch/x86/kernel/irq.c:285
common_interrupt+0xb4/0xd0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:finish_task_switch+0x1ea/0x870 kernel/sched/core.c:5189
Code: c9 50 e8 79 fa 0b 00 48 83 c4 08 4c 89 f7 e8 4d 39 00 00 0f 1f 44 00 00 4c 89 f7 e8 80 e6 69 0a e8 fb 59 38 00 fb 48 8b 5d c0 <48> 8d bb f8 15 00 00 48 89 f8 48 c1 e8 03 49 be 00 00 00 00 00 fc
RSP: 0000:ffffc90002d1f7a8 EFLAGS: 00000286
RAX: 3fc60ed98a3cd400 RBX: ffff888000900000 RCX: ffffffff9a3bf903
RDX: dffffc0000000000 RSI: ffffffff8c0aca40 RDI: ffffffff8c6100a0
RBP: ffffc90002d1f7f0 R08: ffffffff901ce56f R09: 1ffffffff2039cad
R10: dffffc0000000000 R11: fffffbfff2039cae R12: 1ffff11003f87f14
R13: dffffc0000000000 R14: ffff88801fc3ea80 R15: ffff88801fc3f8a0
context_switch kernel/sched/core.c:5318 [inline]
__schedule+0x189d/0x4b30 kernel/sched/core.c:6675
__schedule_loop kernel/sched/core.c:6752 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6767
futex_wait_queue+0x14e/0x1d0 kernel/futex/waitwake.c:370
__futex_wait+0x17f/0x320 kernel/futex/waitwake.c:669
futex_wait+0x101/0x360 kernel/futex/waitwake.c:697
do_futex+0x33b/0x560 kernel/futex/syscalls.c:102
__do_sys_futex kernel/futex/syscalls.c:179 [inline]
__se_sys_futex+0x3f9/0x480 kernel/futex/syscalls.c:160
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff95797df39
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff9587310e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007ff957b35f88 RCX: 00007ff95797df39
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff957b35f88
RBP: 00007ff957b35f80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff957b35f8c
R13: 0000000000000000 R14: 00007ffc71420c40 R15: 00007ffc71420d28
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:sg_page include/linux/scatterlist.h:171 [inline]
RIP: 0010:sg_phys include/linux/scatterlist.h:389 [inline]
RIP: 0010:perf_trace_dma_unmap_sg+0x784/0x790 include/trace/events/dma.h:224
Code: 00 48 8b 54 24 08 e9 6b fe ff ff e8 46 7e 17 00 48 c7 c7 60 79 94 8e 4c 89 f6 e8 07 f2 76 03 e9 5b fa ff ff e8 2d 7e 17 00 90 <0f> 0b e8 35 0d 47 0a 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0000:ffffc90000007aa0 EFLAGS: 00010006
RAX: ffffffff817d3713 RBX: ffff888000595f88 RCX: ffff888000900000
RDX: 0000000000010000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000007bd0 R08: ffffffff817d340b R09: 322e66313a30303a
R10: dffffc0000000000 R11: fffff91ffff88a30 R12: 0000000000000008
R13: ffff8880329e0b41 R14: ffff888000595fa8 R15: dffffc0000000000
FS: 00007ff9587316c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffb1bece004 CR3: 000000001ce08000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: c9 leave
1: 50 push %rax
2: e8 79 fa 0b 00 call 0xbfa80
7: 48 83 c4 08 add $0x8,%rsp
b: 4c 89 f7 mov %r14,%rdi
e: e8 4d 39 00 00 call 0x3960
13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
18: 4c 89 f7 mov %r14,%rdi
1b: e8 80 e6 69 0a call 0xa69e6a0
20: e8 fb 59 38 00 call 0x385a20
25: fb sti
26: 48 8b 5d c0 mov -0x40(%rbp),%rbx
* 2a: 48 8d bb f8 15 00 00 lea 0x15f8(%rbx),%rdi <-- trapping instruction
31: 48 89 f8 mov %rdi,%rax
34: 48 c1 e8 03 shr $0x3,%rax
38: 49 rex.WB
39: be 00 00 00 00 mov $0x0,%esi
3e: 00 fc add %bh,%ah