BUG: unable to handle page fault for address: 000000000001c0a0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5320 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events azx_probe_work
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:azx_first_init sound/hda/controllers/intel.c:1953 [inline]
RIP: 0010:azx_probe_continue sound/hda/controllers/intel.c:2365 [inline]
RIP: 0010:azx_probe_work+0x969/0x2860 sound/hda/controllers/intel.c:1737
Code: 8b 7c 24 38 0f 85 01 1b 00 00 66 45 89 27 48 8b 7c 24 48 e8 e9 f8 84 fb 42 80 3c 2b 00 74 08 4c 89 f7 e8 ea 4b 9f f8 49 8b 06 <66> 8b 00 89 44 24 30 0f 1f 44 00 00 e8 36 19 30 f8 48 8b 9c 24 88
RSP: 0000:ffffc9000f74f940 EFLAGS: 00010246
RAX: 000000000001c0a0 RBX: 1ffff11007c1900b RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff8e231ffb RDI: 00000000ffffffff
RBP: ffffc9000f74faf0 R08: ffffffff9057c237 R09: 1ffffffff20af846
R10: dffffc0000000000 R11: fffffbfff20af847 R12: 000000000000002a
R13: dffffc0000000000 R14: ffff88803e0c8058 R15: ffff88803e0c8890
FS:  0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000001c0a0 CR3: 00000000407b4000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: 000000000001c0a0
---[ end trace 0000000000000000 ]---
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:azx_first_init sound/hda/controllers/intel.c:1953 [inline]
RIP: 0010:azx_probe_continue sound/hda/controllers/intel.c:2365 [inline]
RIP: 0010:azx_probe_work+0x969/0x2860 sound/hda/controllers/intel.c:1737
Code: 8b 7c 24 38 0f 85 01 1b 00 00 66 45 89 27 48 8b 7c 24 48 e8 e9 f8 84 fb 42 80 3c 2b 00 74 08 4c 89 f7 e8 ea 4b 9f f8 49 8b 06 <66> 8b 00 89 44 24 30 0f 1f 44 00 00 e8 36 19 30 f8 48 8b 9c 24 88
RSP: 0000:ffffc9000f74f940 EFLAGS: 00010246
RAX: 000000000001c0a0 RBX: 1ffff11007c1900b RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff8e231ffb RDI: 00000000ffffffff
RBP: ffffc9000f74faf0 R08: ffffffff9057c237 R09: 1ffffffff20af846
R10: dffffc0000000000 R11: fffffbfff20af847 R12: 000000000000002a
R13: dffffc0000000000 R14: ffff88803e0c8058 R15: ffff88803e0c8890
FS:  0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000001c0a0 CR3: 00000000407b4000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	8b 7c 24 38          	mov    0x38(%rsp),%edi
   4:	0f 85 01 1b 00 00    	jne    0x1b0b
   a:	66 45 89 27          	mov    %r12w,(%r15)
   e:	48 8b 7c 24 48       	mov    0x48(%rsp),%rdi
  13:	e8 e9 f8 84 fb       	call   0xfb84f901
  18:	42 80 3c 2b 00       	cmpb   $0x0,(%rbx,%r13,1)
  1d:	74 08                	je     0x27
  1f:	4c 89 f7             	mov    %r14,%rdi
  22:	e8 ea 4b 9f f8       	call   0xf89f4c11
  27:	49 8b 06             	mov    (%r14),%rax
* 2a:	66 8b 00             	mov    (%rax),%ax <-- trapping instruction
  2d:	89 44 24 30          	mov    %eax,0x30(%rsp)
  31:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  36:	e8 36 19 30 f8       	call   0xf8301971
  3b:	48                   	rex.W
  3c:	8b                   	.byte 0x8b
  3d:	9c                   	pushf
  3e:	24 88                	and    $0x88,%al