------------[ cut here ]------------ kernel BUG at arch/x86/kvm/../../../virt/kvm/kvm_main.c:516! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 26607 Comm: syz-executor.4 Not tainted 5.10.90-syzkaller-00837-ga1bb21475ef8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kvm_mmu_notifier_invalidate_range_end+0xb2/0xc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:516 Code: 49 8b 1e 48 c7 c7 ff ff ff ff 48 89 de e8 f6 80 64 00 48 85 db 78 0e e8 2c 7c 64 00 5b 41 5c 41 5e 41 5f 5d c3 e8 1e 7c 64 00 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 55 48 89 e5 41 57 41 56 RSP: 0000:ffffc90007a47050 EFLAGS: 00010293 RAX: ffffffff810867e2 RBX: ffffffffffffffff RCX: ffff8881116de2c0 RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff RBP: ffffc90007a47070 R08: ffffffff810867ca R09: 0000000000000003 R10: fffff52000f48df9 R11: 0000000000000004 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffffc90007a52160 R15: ffffc90007a49000 FS: 00007f4800a9c700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002024b030 CR3: 000000011abdc000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mn_hlist_invalidate_end mm/mmu_notifier.c:583 [inline] __mmu_notifier_invalidate_range_end+0x246/0x300 mm/mmu_notifier.c:603 mmu_notifier_invalidate_range_only_end include/linux/mmu_notifier.h:495 [inline] wp_page_copy+0xea0/0x17b0 mm/memory.c:3235 do_wp_page+0x73b/0xc80 mm/memory.c:3438 handle_pte_fault+0x575/0xac0 mm/memory.c:4721 __handle_mm_fault mm/memory.c:4845 [inline] handle_mm_fault+0x11c9/0x1a40 mm/memory.c:5198 do_user_addr_fault+0x6a2/0xd70 arch/x86/mm/fault.c:1396 handle_page_fault arch/x86/mm/fault.c:1462 [inline] exc_page_fault+0x98/0x2d0 arch/x86/mm/fault.c:1518 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:571 RIP: 0010:__put_user_nocheck_4+0x3/0x11 Code: 00 00 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 0f 1f 44 00 00 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb <89> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb f9 ef ff ff ff 7f RSP: 0000:ffffc90007a47878 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 000000002024b030 RCX: 000000002024b030 RDX: ffff8881116de2c0 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90007a47a10 R08: ffffffff83c55b6d R09: ffffed1021722b8d R10: ffffed1021722b8d R11: 0000000000000000 R12: 0000000000000000 R13: 000000002024b000 R14: ffffffff842d3240 R15: 0000000000000002 ___sys_recvmsg net/socket.c:2608 [inline] do_recvmmsg+0x6e4/0x1660 net/socket.c:2708 __sys_recvmmsg net/socket.c:2787 [inline] __do_sys_recvmmsg net/socket.c:2810 [inline] __se_sys_recvmmsg net/socket.c:2803 [inline] __x64_sys_recvmmsg+0x195/0x240 net/socket.c:2803 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f48019cae99 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4800a9c168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007f4801ade370 RCX: 00007f48019cae99 RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007f4801a24ff1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffcdc6c530f R14: 00007f4800a9c300 R15: 0000000000022000 Modules linked in: ---[ end trace 73302ced95ba8f1f ]--- RIP: 0010:kvm_mmu_notifier_invalidate_range_end+0xb2/0xc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:516 Code: 49 8b 1e 48 c7 c7 ff ff ff ff 48 89 de e8 f6 80 64 00 48 85 db 78 0e e8 2c 7c 64 00 5b 41 5c 41 5e 41 5f 5d c3 e8 1e 7c 64 00 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 55 48 89 e5 41 57 41 56 RSP: 0000:ffffc90007a47050 EFLAGS: 00010293 RAX: ffffffff810867e2 RBX: ffffffffffffffff RCX: ffff8881116de2c0 RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff RBP: ffffc90007a47070 R08: ffffffff810867ca R09: 0000000000000003 R10: fffff52000f48df9 R11: 0000000000000004 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffffc90007a52160 R15: ffffc90007a49000 FS: 00007f4800a9c700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002024b030 CR3: 000000011abdc000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 48 39 d9 cmp %rbx,%rcx 5: 73 54 jae 0x5b 7: 0f 01 cb stac a: 66 89 01 mov %ax,(%rcx) d: 31 c9 xor %ecx,%ecx f: 0f 01 ca clac 12: c3 retq 13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 18: 48 bb fd ef ff ff ff movabs $0x7fffffffeffd,%rbx 1f: 7f 00 00 22: 48 39 d9 cmp %rbx,%rcx 25: 73 34 jae 0x5b 27: 0f 01 cb stac * 2a: 89 01 mov %eax,(%rcx) <-- trapping instruction 2c: 31 c9 xor %ecx,%ecx 2e: 0f 01 ca clac 31: c3 retq 32: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 38: 48 rex.W 39: bb f9 ef ff ff mov $0xffffeff9,%ebx 3e: ff (bad) 3f: 7f .byte 0x7f