zap_pte_range mm/memory.c:1330 [inline]
 zap_pmd_range mm/memory.c:1368 [inline]
 zap_pud_range mm/memory.c:1397 [inline]
 zap_p4d_range mm/memory.c:1418 [inline]
 unmap_page_range+0x12ef/0x1eb0 mm/memory.c:1439
 unmap_vmas+0x14c/0x280 mm/memory.c:1516
 exit_mmap+0x245/0x4c0 mm/mmap.c:3220
 __mmput+0xeb/0x3e0 kernel/fork.c:1082
 exit_mm kernel/exit.c:501 [inline]
 do_exit+0x9e9/0x2570 kernel/exit.c:812
 do_group_exit+0xe7/0x290 kernel/exit.c:922
 get_signal+0x36c/0x1c30 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:201
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
------------[ cut here ]------------
kernel BUG at include/linux/memcontrol.h:387!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5870 Comm: syz-executor331 Not tainted 5.11.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:page_memcg_rcu include/linux/memcontrol.h:387 [inline]
RIP: 0010:workingset_activation+0x44e/0x600 mm/workingset.c:408
Code: df 48 c1 e8 03 80 3c 10 00 0f 85 b5 01 00 00 48 8b 1d 1e 1f a1 0a e9 e5 fd ff ff 48 c7 c6 e0 68 94 88 48 89 ef e8 22 0d 00 00 <0f> 0b 0f 1f 44 00 00 80 3d a9 e5 8c 0a 00 0f 85 b4 fd ff ff 48 c7
RSP: 0018:ffffc90001d6f848 EFLAGS: 00010283
RAX: 0000000000000000 RBX: ffffea0000dd0000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff88dd2440 RDI: ffff88801112200a
RBP: ffffea0000dd0000 R08: 0000000000000029 R09: ffff8880b9f4c827
R10: ffffed10173e9904 R11: 535f7972746e6520 R12: ffffea0000dd0008
R13: ffffea0000dd0000 R14: ffffea0000dd0034 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8cfa45f1f0 CR3: 000000001f164000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 mmu_spte_clear_track_bits+0x12f/0x240 arch/x86/kvm/mmu/mmu.c:567
 drop_spte+0x1c/0x990 arch/x86/kvm/mmu/mmu.c:1070
 mmu_page_zap_pte+0x267/0x2d0 arch/x86/kvm/mmu/mmu.c:2246
 kvm_mmu_page_unlink_children arch/x86/kvm/mmu/mmu.c:2277 [inline]
 __kvm_mmu_prepare_zap_page+0x16a/0x1220 arch/x86/kvm/mmu/mmu.c:2325
 kvm_mmu_zap_all+0xe0/0x240 arch/x86/kvm/mmu/mmu.c:5689
 kvm_mmu_notifier_release+0x4b/0x80 arch/x86/kvm/../../../virt/kvm/kvm_main.c:596
 mn_hlist_release mm/mmu_notifier.c:319 [inline]
 __mmu_notifier_release+0x183/0x530 mm/mmu_notifier.c:357
 mmu_notifier_release include/linux/mmu_notifier.h:409 [inline]
 exit_mmap+0x3bd/0x4c0 mm/mmap.c:3174
 __mmput+0xeb/0x3e0 kernel/fork.c:1082
 exit_mm kernel/exit.c:501 [inline]
 do_exit+0x9e9/0x2570 kernel/exit.c:812
 do_group_exit+0xe7/0x290 kernel/exit.c:922
 __do_sys_exit_group kernel/exit.c:933 [inline]
 __se_sys_exit_group kernel/exit.c:931 [inline]
 __x64_sys_exit_group+0x35/0x40 kernel/exit.c:931
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f8cfa3e91d9
Code: Unable to access opcode bytes at RIP 0x7f8cfa3e91af.
RSP: 002b:00007ffc683546f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f8cfa45e350 RCX: 00007f8cfa3e91d9
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000246 R12: 00007f8cfa45e350
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
Modules linked in:
---[ end trace 0a25222621a30c62 ]---
RIP: 0010:page_memcg_rcu include/linux/memcontrol.h:387 [inline]
RIP: 0010:workingset_activation+0x44e/0x600 mm/workingset.c:408
Code: df 48 c1 e8 03 80 3c 10 00 0f 85 b5 01 00 00 48 8b 1d 1e 1f a1 0a e9 e5 fd ff ff 48 c7 c6 e0 68 94 88 48 89 ef e8 22 0d 00 00 <0f> 0b 0f 1f 44 00 00 80 3d a9 e5 8c 0a 00 0f 85 b4 fd ff ff 48 c7
RSP: 0018:ffffc90001d6f848 EFLAGS: 00010283
RAX: 0000000000000000 RBX: ffffea0000dd0000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff88dd2440 RDI: ffff88801112200a
RBP: ffffea0000dd0000 R08: 0000000000000029 R09: ffff8880b9f4c827
R10: ffffed10173e9904 R11: 535f7972746e6520 R12: ffffea0000dd0008
R13: ffffea0000dd0000 R14: ffffea0000dd0034 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8cfa45f1f0 CR3: 000000001f164000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400