==================================================================
BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:86 [inline]
BUG: KASAN: use-after-free in paging64_cmpxchg_gpte arch/x86/kvm/mmu/paging_tmpl.h:181 [inline]
BUG: KASAN: use-after-free in paging64_update_accessed_dirty_bits+0x5eb/0xa60 arch/x86/kvm/mmu/paging_tmpl.h:287
Write of size 8 at addr ffff888010000000 by task syz-executor.2/851

CPU: 1 PID: 851 Comm: syz-executor.2 Not tainted 5.10.77-syzkaller-01258-g76698ea35fd3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
 __kasan_report+0x142/0x220 mm/kasan/report.c:419
 kasan_report+0x51/0x70 mm/kasan/report.c:436
 check_region_inline mm/kasan/generic.c:135 [inline]
 kasan_check_range+0x2b6/0x2f0 mm/kasan/generic.c:186
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_write include/linux/instrumented.h:86 [inline]
 paging64_cmpxchg_gpte arch/x86/kvm/mmu/paging_tmpl.h:181 [inline]
 paging64_update_accessed_dirty_bits+0x5eb/0xa60 arch/x86/kvm/mmu/paging_tmpl.h:287
 paging64_walk_addr_generic+0xc76/0x1470 arch/x86/kvm/mmu/paging_tmpl.h:459
 paging64_walk_addr arch/x86/kvm/mmu/paging_tmpl.h:516 [inline]
 paging64_gva_to_gpa+0xd8/0x1b0 arch/x86/kvm/mmu/paging_tmpl.h:971
 kvm_mmu_gva_to_gpa_write arch/x86/kvm/x86.c:5956 [inline]
 emulator_cmpxchg_emulated+0x1b8/0x840 arch/x86/kvm/x86.c:6423
 __load_segment_descriptor+0xe18/0x1560 arch/x86/kvm/emulate.c:1767
 load_segment_descriptor arch/x86/kvm/emulate.c:1834 [inline]
 em_ltr+0xb9/0xe0 arch/x86/kvm/emulate.c:3803
 x86_emulate_insn+0xa79/0x63e0 arch/x86/kvm/emulate.c:5636
 x86_emulate_instruction+0x1087/0x2730 arch/x86/kvm/x86.c:7480
 kvm_mmu_page_fault+0x45e/0x550 arch/x86/kvm/mmu/mmu.c:5108
 handle_ept_violation+0x2e2/0x470 arch/x86/kvm/vmx/vmx.c:5361
 vmx_handle_exit+0x3b9/0xd20 arch/x86/kvm/vmx/vmx.c:6070
 vcpu_enter_guest+0x24b1/0x3a80 arch/x86/kvm/x86.c:9151
 vcpu_run+0x332/0xc20 arch/x86/kvm/x86.c:9216
 kvm_arch_vcpu_ioctl_run+0x4d7/0x9d0 arch/x86/kvm/x86.c:9433
 kvm_vcpu_ioctl+0x799/0xd70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3277
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0x115/0x190 fs/ioctl.c:739
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:739
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f369ba3eae9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f36997b5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f369bb51f60 RCX: 00007f369ba3eae9
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006
RBP: 00007f369ba98f25 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd89dbfe7f R14: 00007f36997b5300 R15: 0000000000022000

The buggy address belongs to the page:
page:ffffea0000400000 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x10000
flags: 0x4000000000000000()
raw: 4000000000000000 ffffea0000410008 ffffea00003f0008 0000000000000000
raw: 0000000000000000 000000000000000a 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff88800fffff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88800fffff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888010000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888010000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888010000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================