------------[ cut here ]------------
WARNING: CPU: 2 PID: 10294 at drivers/block/floppy.c:999 schedule_bh drivers/block/floppy.c:999 [inline]
WARNING: CPU: 2 PID: 10294 at drivers/block/floppy.c:999 floppy_interrupt+0x3cc/0x440 drivers/block/floppy.c:1765
Modules linked in:
CPU: 2 PID: 10294 Comm: syz-executor.0 Not tainted 6.4.0-rc1-syzkaller-00133-g9a48d6046722 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:schedule_bh drivers/block/floppy.c:999 [inline]
RIP: 0010:floppy_interrupt+0x3cc/0x440 drivers/block/floppy.c:1765
Code: 29 d0 8a 89 c6 89 05 63 06 ea 0c e8 8e 27 ff ff 8b 1d 58 06 ea 0c e9 9c fd ff ff e8 fe 20 b3 fc e9 66 fd ff ff e8 e4 5a 60 fc <0f> 0b e9 c9 fe ff ff 48 c7 c7 00 f2 40 8c e8 a1 20 b3 fc e9 5a fc
RSP: 0018:ffffc90000588e58 EFLAGS: 00010046
RAX: 0000000080010001 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff88805d0e2400 RSI: ffffffff8523e9fc RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff852363b0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7378000 CR3: 000000000c571000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 floppy_hardint+0x1b1/0x200 arch/x86/include/asm/floppy.h:66
 __handle_irq_event_percpu+0x22b/0x730 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x263/0xd00 kernel/irq/chip.c:819
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq arch/x86/kernel/irq.c:231 [inline]
 __common_interrupt+0xa1/0x220 arch/x86/kernel/irq.c:250
 common_interrupt+0xa8/0xd0 arch/x86/kernel/irq.c:240
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636
RIP: 0010:__rcu_read_lock+0xca/0xf0 kernel/rcu/tree_plugin.h:406
Code: 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 15 8b 83 3c 04 00 00 3d ff ff ff 3f 7f 03 5b 5d <c3> 0f 0b 5b 5d c3 e8 2b 98 69 00 eb e4 e8 c4 98 69 00 eb a1 e8 1d
RSP: 0018:ffffc9002038f5d0 EFLAGS: 00000293
RAX: 0000000000000001 RBX: ffffea0001408b40 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81e1d2c2 RDI: ffff88805d0e283c
RBP: ffff88803fff9140 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000094001 R12: 000000000005022d
R13: 0000000000000008 R14: 0000000000000001 R15: 00000000f6c00000
 rcu_read_lock include/linux/rcupdate.h:771 [inline]
 page_ext_get+0x17/0x320 mm/page_ext.c:167
 page_table_check_clear.part.0+0x32/0x380 mm/page_table_check.c:73
 page_table_check_clear include/linux/mmzone.h:2003 [inline]
 __page_table_check_pte_clear+0x265/0x2b0 mm/page_table_check.c:155
 page_table_check_pte_clear include/linux/page_table_check.h:55 [inline]
 ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1086 [inline]
 zap_pte_range mm/memory.c:1413 [inline]
 zap_pmd_range mm/memory.c:1563 [inline]
 zap_pud_range mm/memory.c:1592 [inline]
 zap_p4d_range mm/memory.c:1613 [inline]
 unmap_page_range+0x2aa6/0x38e0 mm/memory.c:1634
 unmap_single_vma+0x19a/0x2b0 mm/memory.c:1680
 unmap_vmas+0x234/0x380 mm/memory.c:1719
 exit_mmap+0x190/0x930 mm/mmap.c:3111
 __mmput+0x128/0x4c0 kernel/fork.c:1351
 mmput+0x60/0x70 kernel/fork.c:1373
 exit_mm kernel/exit.c:564 [inline]
 do_exit+0x9d7/0x2960 kernel/exit.c:858
 do_group_exit+0xd4/0x2a0 kernel/exit.c:1021
 get_signal+0x2315/0x25b0 kernel/signal.c:2874
 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
 exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
 exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
 syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
 __do_fast_syscall_32+0x72/0xf0 arch/x86/entry/common.c:181
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7ffa579
Code: Unable to access opcode bytes at 0xf7ffa54f.
RSP: 002b:00000000f7ff567c EFLAGS: 00000296 ORIG_RAX: 00000000000000f0
RAX: fffffffffffffe00 RBX: 00000000f737afc8 RCX: 0000000000000080
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f737afcc
RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 fa                	mov    %edi,%edx
   2:	48 c1 ea 03          	shr    $0x3,%rdx
   6:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx
   a:	48 89 f8             	mov    %rdi,%rax
   d:	83 e0 07             	and    $0x7,%eax
  10:	83 c0 03             	add    $0x3,%eax
  13:	38 d0                	cmp    %dl,%al
  15:	7c 04                	jl     0x1b
  17:	84 d2                	test   %dl,%dl
  19:	75 15                	jne    0x30
  1b:	8b 83 3c 04 00 00    	mov    0x43c(%rbx),%eax
  21:	3d ff ff ff 3f       	cmp    $0x3fffffff,%eax
  26:	7f 03                	jg     0x2b
  28:	5b                   	pop    %rbx
  29:	5d                   	pop    %rbp
* 2a:	c3                   	retq <-- trapping instruction
  2b:	0f 0b                	ud2
  2d:	5b                   	pop    %rbx
  2e:	5d                   	pop    %rbp
  2f:	c3                   	retq
  30:	e8 2b 98 69 00       	callq  0x699860
  35:	eb e4                	jmp    0x1b
  37:	e8 c4 98 69 00       	callq  0x699900
  3c:	eb a1                	jmp    0xffffffdf
  3e:	e8                   	.byte 0xe8
  3f:	1d                   	.byte 0x1d