==================================================================
BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:86 [inline]
BUG: KASAN: use-after-free in ept_cmpxchg_gpte.constprop.0+0x2e1/0x460 arch/x86/kvm/mmu/paging_tmpl.h:181
Write of size 8 at addr ffff888010000000 by task syz-executor147/12921

CPU: 0 PID: 12921 Comm: syz-executor147 Not tainted 5.10.91-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x81/0xac lib/dump_stack.c:118
 print_address_description.constprop.0+0x24/0x150 mm/kasan/report.c:233
 __kasan_report mm/kasan/report.c:419 [inline]
 kasan_report.cold+0x82/0xdb mm/kasan/report.c:436
 check_region_inline mm/kasan/generic.c:180 [inline]
 kasan_check_range+0x148/0x190 mm/kasan/generic.c:186
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_write include/linux/instrumented.h:86 [inline]
 ept_cmpxchg_gpte.constprop.0+0x2e1/0x460 arch/x86/kvm/mmu/paging_tmpl.h:181
 paging64_update_accessed_dirty_bits arch/x86/kvm/mmu/paging_tmpl.h:287 [inline]
 paging64_walk_addr_generic+0xcce/0x1660 arch/x86/kvm/mmu/paging_tmpl.h:459
 paging64_walk_addr arch/x86/kvm/mmu/paging_tmpl.h:516 [inline]
 paging64_gva_to_gpa+0xc3/0x1d0 arch/x86/kvm/mmu/paging_tmpl.h:971
 kvm_mmu_gva_to_gpa_write arch/x86/kvm/x86.c:5956 [inline]
 emulator_cmpxchg_emulated+0x1a8/0x7d0 arch/x86/kvm/x86.c:6423
 __load_segment_descriptor+0x7e1/0xdc0 arch/x86/kvm/emulate.c:1767
 load_segment_descriptor+0xb9/0x190 arch/x86/kvm/emulate.c:1834
 em_ltr+0x74/0x90 arch/x86/kvm/emulate.c:3803
 x86_emulate_insn+0x43f/0x38c0 arch/x86/kvm/emulate.c:5636
 x86_emulate_instruction+0x5cf/0x1180 arch/x86/kvm/x86.c:7480
 kvm_mmu_page_fault+0x31e/0x1a60 arch/x86/kvm/mmu/mmu.c:5108
 handle_ept_violation+0x1b8/0x490 arch/x86/kvm/vmx/vmx.c:5365
 vmx_handle_exit+0x203/0x1200 arch/x86/kvm/vmx/vmx.c:6074
 vcpu_enter_guest+0x1bb2/0x3cd0 arch/x86/kvm/x86.c:9151
 vcpu_run arch/x86/kvm/x86.c:9216 [inline]
 kvm_arch_vcpu_ioctl_run+0x31f/0x1390 arch/x86/kvm/x86.c:9433
 kvm_vcpu_ioctl+0x38f/0x9d0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3280
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x129/0x1a0 fs/ioctl.c:739
 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fe6736f0f69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe6736731f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe673779278 RCX: 00007fe6736f0f69
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007fe673779270 R08: 0000000000000000 R09: 0000000000000000
R10: 00007fe673673700 R11: 0000000000000246 R12: 00007fe67377927c
R13: 00007ffc9d0d427f R14: 00007fe673673300 R15: 0000000000022000

The buggy address belongs to the page:
page:ffffea0000400000 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x10000
flags: 0x4000000000000000()
raw: 4000000000000000 ffffea0000410008 ffffea00003f0008 0000000000000000
raw: 0000000000000000 000000000000000a 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff88800fffff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88800fffff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888010000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888010000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888010000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================