BUG: unable to handle page fault for address: 0000000000055640
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 800000002ab22067 P4D 800000002ab22067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: sync_wq local_pci_probe_callback
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:ioread32+0x1c/0x80 lib/iomap.c:99
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 53 48 89 fb e8 12 eb f8 fc 48 81 fb 00 00 04 00 72 09 e8 04 eb f8 fc <8b> 03 eb 55 48 81 fb 01 00 01 00 72 0a e8 f2 ea f8 fc 89 da ed eb
RSP: 0018:ffffc900000e7950 EFLAGS: 00010293
RAX: ffffffff84ccee3c RBX: 0000000000055640 RCX: ffff88801ca85d00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff11006dbf018 R08: ffffffff8fafa337 R09: 1ffffffff1f5f466
R10: dffffc0000000000 R11: fffffbfff1f5f467 R12: ffff888036df80c8
R13: ffff88802229c0d0 R14: ffff888036df8038 R15: 1ffff11006dbf019
FS:  0000000000000000(0000) GS:ffff888125c3e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000055640 CR3: 0000000040fd6000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 nhi_probe+0xdb/0x890 drivers/thunderbolt/nhi.c:1198
 nhi_pci_probe+0x47a/0x590 drivers/thunderbolt/pci.c:479
 local_pci_probe drivers/pci/pci-driver.c:332 [inline]
 local_pci_probe_callback+0x120/0x1e0 drivers/pci/pci-driver.c:361
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: 0000000000055640
---[ end trace 0000000000000000 ]---
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:ioread32+0x1c/0x80 lib/iomap.c:99
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 53 48 89 fb e8 12 eb f8 fc 48 81 fb 00 00 04 00 72 09 e8 04 eb f8 fc <8b> 03 eb 55 48 81 fb 01 00 01 00 72 0a e8 f2 ea f8 fc 89 da ed eb
RSP: 0018:ffffc900000e7950 EFLAGS: 00010293
RAX: ffffffff84ccee3c RBX: 0000000000055640 RCX: ffff88801ca85d00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff11006dbf018 R08: ffffffff8fafa337 R09: 1ffffffff1f5f466
R10: dffffc0000000000 R11: fffffbfff1f5f467 R12: ffff888036df80c8
R13: ffff88802229c0d0 R14: ffff888036df8038 R15: 1ffff11006dbf019
FS:  0000000000000000(0000) GS:ffff888125c3e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000055640 CR3: 0000000040fd6000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	f3 0f 1e fa          	endbr64
  12:	55                   	push   %rbp
  13:	53                   	push   %rbx
  14:	48 89 fb             	mov    %rdi,%rbx
  17:	e8 12 eb f8 fc       	call   0xfcf8eb2e
  1c:	48 81 fb 00 00 04 00 	cmp    $0x40000,%rbx
  23:	72 09                	jb     0x2e
  25:	e8 04 eb f8 fc       	call   0xfcf8eb2e
* 2a:	8b 03                	mov    (%rbx),%eax <-- trapping instruction
  2c:	eb 55                	jmp    0x83
  2e:	48 81 fb 01 00 01 00 	cmp    $0x10001,%rbx
  35:	72 0a                	jb     0x41
  37:	e8 f2 ea f8 fc       	call   0xfcf8eb2e
  3c:	89 da                	mov    %ebx,%edx
  3e:	ed                   	in     (%dx),%eax
  3f:	eb                   	.byte 0xeb