BUG: unable to handle page fault for address: 0000000100038ec8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 19ac28067 P4D 19ac28067 PUD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4199 Comm: syz-executor.1 Not tainted 5.4.249-syzkaller-00006-gc83e2462239e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:deref_stack_reg+0x15c/0x1f0 arch/x86/kernel/unwind_orc.c:350
Code: 00 00 00 00 fc ff df 42 80 3c 23 00 74 08 4c 89 f7 e8 e8 15 64 00 48 c7 44 24 40 00 00 00 00 4c 89 ff 4c 89 f6 e8 24 09 00 00 <42> 80 3c 23 00 74 08 4c 89 f7 e8 45 15 64 00 4c 8b 74 24 40 48 8b
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010206
RAX: ffffffff8154d3fa RBX: 0000000000000100 RCX: ffff8881d9a8ee40
RDX: 0000000000000100 RSI: ffffffff812fe0fc RDI: ffff88819629f1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154d03e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000100038dc8
R13: dffffc0000000000 R14: ffffffff812fe0fc R15: ffff88819629f1c0
FS:  00007f2d5b8236c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100038ec8 CR3: 00000001ab636000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1800
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
Modules linked in:
CR2: 0000000100038ec8
---[ end trace 37d724eadbbe13d9 ]---
RIP: 0010:deref_stack_reg+0x15c/0x1f0 arch/x86/kernel/unwind_orc.c:350
Code: 00 00 00 00 fc ff df 42 80 3c 23 00 74 08 4c 89 f7 e8 e8 15 64 00 48 c7 44 24 40 00 00 00 00 4c 89 ff 4c 89 f6 e8 24 09 00 00 <42> 80 3c 23 00 74 08 4c 89 f7 e8 45 15 64 00 4c 8b 74 24 40 48 8b
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010206
RAX: ffffffff8154d3fa RBX: 0000000000000100 RCX: ffff8881d9a8ee40
RDX: 0000000000000100 RSI: ffffffff812fe0fc RDI: ffff88819629f1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154d03e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 0000000100038dc8
R13: dffffc0000000000 R14: ffffffff812fe0fc R15: ffff88819629f1c0
FS:  00007f2d5b8236c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100038ec8 CR3: 00000001ab636000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess), 6 bytes skipped:
   0:	df 42 80             	filds  -0x80(%rdx)
   3:	3c 23                	cmp    $0x23,%al
   5:	00 74 08 4c          	add    %dh,0x4c(%rax,%rcx,1)
   9:	89 f7                	mov    %esi,%edi
   b:	e8 e8 15 64 00       	call   0x6415f8
  10:	48 c7 44 24 40 00 00 	movq   $0x0,0x40(%rsp)
  17:	00 00
  19:	4c 89 ff             	mov    %r15,%rdi
  1c:	4c 89 f6             	mov    %r14,%rsi
  1f:	e8 24 09 00 00       	call   0x948
* 24:	42 80 3c 23 00       	cmpb   $0x0,(%rbx,%r12,1) <-- trapping instruction
  29:	74 08                	je     0x33
  2b:	4c 89 f7             	mov    %r14,%rdi
  2e:	e8 45 15 64 00       	call   0x641578
  33:	4c 8b 74 24 40       	mov    0x40(%rsp),%r14
  38:	48                   	rex.W
  39:	8b                   	.byte 0x8b