------------[ cut here ]------------
kernel BUG at arch/x86/kvm/x86.c:357!
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/x86.c:357!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 16139 Comm: syz-executor0 Not tainted 4.20.0+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357
Code: e8 3c a6 75 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 17 a6 75 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54
RSP: 0018:ffff88805fc7f5c8 EFLAGS: 00010216
RAX: 0000000000040000 RBX: ffff88805ddc3810 RCX: ffffc90005ff2000
RDX: 00000000000005e5 RSI: ffffffff810bdb99 RDI: 0000000000000007
RBP: ffff88805fc7f5c8 R08: ffff88805d3f2240 R09: ffff8880896c5000
R10: ffffed10112d8bff R11: ffff8880896c5fff R12: 1ffff1100bf8febe
R13: ffff88805fc7f610 R14: ffff88805fc7f670 R15: ffff8880896c5000
FS:  0000000000000000(0000) GS:ffff8880ae600000(0063) knlGS:00000000f5edfb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f5f22db0 CR3: 0000000057d41000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 vmcs_clear arch/x86/kvm/vmx/ops.h:185 [inline]
 loaded_vmcs_init+0xcb/0x320 arch/x86/kvm/vmx/vmx.c:565
 alloc_loaded_vmcs+0x81/0x170 arch/x86/kvm/vmx/vmx.c:2442
 vmx_create_vcpu+0x262/0x26d7 arch/x86/kvm/vmx/vmx.c:6724
 kvm_arch_vcpu_create+0xea/0x220 arch/x86/kvm/x86.c:8712
 kvm_vm_ioctl_create_vcpu arch/x86/kvm/../../../virt/kvm/kvm_main.c:2560 [inline]
 kvm_vm_ioctl+0x5d9/0x1fe0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3089
 kvm_vm_compat_ioctl+0x13c/0x420 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3302
 __do_compat_sys_ioctl fs/compat_ioctl.c:1052 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:998 [inline]
 __ia32_compat_sys_ioctl+0x197/0x620 fs/compat_ioctl.c:998
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x333/0xf98 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f04869
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f5edf0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000ae41
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/x86.c:357!
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 16139 Comm: syz-executor0 Tainted: G      D           4.20.0+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357
Code: e8 3c a6 75 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 17 a6 75 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54
RSP: 0018:ffff8880ae607c78 EFLAGS: 00010006
RAX: ffff88805d3f2240 RBX: ffff88808bba3810 RCX: ffffffff8139c3ba
RDX: 0000000000010000 RSI: ffffffff810bdb99 RDI: 0000000000000007
RBP: ffff8880ae607c78 R08: ffff88805d3f2240 R09: ffffed1015cc5ba9
R10: ffffed1015cc5ba8 R11: ffff8880ae62dd47 R12: 1ffff11015cc0f94
R13: ffff8880ae607cc0 R14: ffff8880ae607d20 R15: ffff88809b18e000
FS:  0000000000000000(0000) GS:ffff8880ae600000(0063) knlGS:00000000f5edfb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff8880ae607cc0 CR3: 0000000057d41000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 vmcs_clear arch/x86/kvm/vmx/ops.h:185 [inline]
 loaded_vmcs_init+0xcb/0x320 arch/x86/kvm/vmx/vmx.c:565
 __loaded_vmcs_clear+0x2c1/0x520 arch/x86/kvm/vmx/vmx.c:632
 flush_smp_call_function_queue+0x1bb/0x640 kernel/smp.c:243
 generic_smp_call_function_single_interrupt+0x13/0x2b kernel/smp.c:192
 smp_call_function_single_interrupt+0x117/0x640 arch/x86/kernel/smp.c:296
 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 </IRQ>
RIP: 0010:preempt_schedule_irq+0xab/0x140 kernel/sched/core.c:3699
Code: 00 00 e8 98 24 67 f9 e8 f3 0d 97 f9 4c 89 f0 48 c1 e8 03 80 3c 18 00 75 6c 48 83 3d 4e aa a1 01 00 74 5e fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 2b d2 ff ff 48 c7 c0 38 4f 92 89 48 c1 e8 03 80
RSP: 0018:ffff88805fc7f308 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff04
RAX: 1ffffffff13249e8 RBX: dffffc0000000000 RCX: 1ffffffff14b688e
RDX: 0000000000000000 RSI: ffffffff8187b384 RDI: ffffffff87f0a4dd
RBP: ffff88805fc7f328 R08: ffff88805d3f2240 R09: ffffed1015cc59d2
R10: ffffed1015cc59d1 R11: ffff8880ae62ce8b R12: ffffed100ba7e448
R13: ffff88805d3f2240 R14: ffffffff89924f40 R15: 0000000000000000
 retint_kernel+0x1b/0x2d
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:766 [inline]
RIP: 0010:oops_end+0x61/0xf0 arch/x86/kernel/dumpstack.c:343
Code: 00 00 00 c7 05 bc 94 62 08 ff ff ff ff e8 b7 35 1e 00 83 2d 98 9d 6b 09 01 74 36 48 83 3d 16 a6 65 08 00 74 53 48 89 df 57 9d <0f> 1f 44 00 00 e8 65 3d 1e 00 be 02 00 00 00 48 c7 c7 c0 46 98 8a
RSP: 0018:ffff88805fc7f3e8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff02
RAX: 0000000000040000 RBX: 0000000000000286 RCX: ffffc90005ff2000
RDX: 0000000000040000 RSI: ffffffff814adee9 RDI: 0000000000000286
RBP: ffff88805fc7f400 R08: ffff88805d3f2240 R09: fffffbfff14b688f
R10: fffffbfff14b688e R11: ffffffff8a5b4477 R12: ffff88805fc7f518
R13: 000000000000000b R14: ffffffff8844ec20 R15: 0000000000000000
 die+0x3e/0x48 arch/x86/kernel/dumpstack.c:405
 do_trap_no_signal arch/x86/kernel/traps.c:211 [inline]
 do_trap+0x101/0x230 arch/x86/kernel/traps.c:250
 do_error_trap+0xd6/0x200 arch/x86/kernel/traps.c:277
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973
RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357
Code: e8 3c a6 75 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 17 a6 75 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54
RSP: 0018:ffff88805fc7f5c8 EFLAGS: 00010216
RAX: 0000000000040000 RBX: ffff88805ddc3810 RCX: ffffc90005ff2000
RDX: 00000000000005e5 RSI: ffffffff810bdb99 RDI: 0000000000000007
RBP: ffff88805fc7f5c8 R08: ffff88805d3f2240 R09: ffff8880896c5000
R10: ffffed10112d8bff R11: ffff8880896c5fff R12: 1ffff1100bf8febe
R13: ffff88805fc7f610 R14: ffff88805fc7f670 R15: ffff8880896c5000
 vmcs_clear arch/x86/kvm/vmx/ops.h:185 [inline]
 loaded_vmcs_init+0xcb/0x320 arch/x86/kvm/vmx/vmx.c:565
 alloc_loaded_vmcs+0x81/0x170 arch/x86/kvm/vmx/vmx.c:2442
 vmx_create_vcpu+0x262/0x26d7 arch/x86/kvm/vmx/vmx.c:6724
 kvm_arch_vcpu_create+0xea/0x220 arch/x86/kvm/x86.c:8712
 kvm_vm_ioctl_create_vcpu arch/x86/kvm/../../../virt/kvm/kvm_main.c:2560 [inline]
 kvm_vm_ioctl+0x5d9/0x1fe0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3089
 kvm_vm_compat_ioctl+0x13c/0x420 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3302
 __do_compat_sys_ioctl fs/compat_ioctl.c:1052 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:998 [inline]
 __ia32_compat_sys_ioctl+0x197/0x620 fs/compat_ioctl.c:998
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x333/0xf98 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f04869
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f5edf0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000ae41
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 35407db36b8355c1 ]---
RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357
Code: e8 3c a6 75 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 17 a6 75 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54
RSP: 0018:ffff88805fc7f5c8 EFLAGS: 00010216
RAX: 0000000000040000 RBX: ffff88805ddc3810 RCX: ffffc90005ff2000
RDX: 00000000000005e5 RSI: ffffffff810bdb99 RDI: 0000000000000007
RBP: ffff88805fc7f5c8 R08: ffff88805d3f2240 R09: ffff8880896c5000
R10: ffffed10112d8bff R11: ffff8880896c5fff R12: 1ffff1100bf8febe
R13: ffff88805fc7f610 R14: ffff88805fc7f670 R15: ffff8880896c5000
FS:  0000000000000000(0000) GS:ffff8880ae600000(0063) knlGS:00000000f5edfb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff8880ae607cc0 CR3: 0000000057d41000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400