pte_list_remove: 00000000d1227865 0->BUG
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/mmu.c:1208!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4167 Comm: syzkaller701584 Not tainted 4.15.0+ #300
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1207
RSP: 0018:ffff8801b38d7260 EFLAGS: 00010286
RAX: 0000000000000028 RBX: ffff8801d514f3d0 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 1ffff1003671ae01 RDI: ffffed003671ae40
RBP: ffff8801b38d72a0 R08: 1ffff1003671ad98 R09: 0000000000000000
R10: ffff8801b38d7438 R11: 0000000000000000 R12: ffff8801c1637078
R13: 0000000000000000 R14: ffff8801c1620210 R15: ffff8801c1620238
FS:  00007f6f148b6700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001b4b0a005 CR4: 00000000001626e0
Call Trace:
 rmap_remove arch/x86/kvm/mmu.c:1284 [inline]
 drop_spte+0x15a/0x250 arch/x86/kvm/mmu.c:1366
 kvm_zap_rmapp+0x7e/0xd0 arch/x86/kvm/mmu.c:1620
 kvm_unmap_rmapp+0x1d/0x30 arch/x86/kvm/mmu.c:1631
 kvm_handle_hva_range+0x3ed/0x6e0 arch/x86/kvm/mmu.c:1785
 kvm_unmap_hva_range+0x2e/0x40 arch/x86/kvm/mmu.c:1811
 kvm_mmu_notifier_invalidate_range_start+0xa1/0x140 arch/x86/kvm/../../../virt/kvm/kvm_main.c:361
 __mmu_notifier_invalidate_range_start+0x1cd/0x2d0 mm/mmu_notifier.c:186
 mmu_notifier_invalidate_range_start include/linux/mmu_notifier.h:284 [inline]
 unmap_vmas+0x14b/0x1b0 mm/memory.c:1589
 unmap_region+0x2b9/0x4f0 mm/mmap.c:2511
 do_munmap+0x726/0xdf0 mm/mmap.c:2726
 mmap_region+0x59e/0x15a0 mm/mmap.c:1646
 do_mmap+0x6c0/0xe00 mm/mmap.c:1483
 do_mmap_pgoff include/linux/mm.h:2223 [inline]
 vm_mmap_pgoff+0x1de/0x280 mm/util.c:355
 SYSC_mmap_pgoff mm/mmap.c:1533 [inline]
 SyS_mmap_pgoff+0x23b/0x5f0 mm/mmap.c:1491
 SYSC_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
 SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:91
 do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x4489c9
RSP: 002b:00007f6f148b5d98 EFLAGS: 00000212 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00000000006ddc3c RCX: 00000000004489c9
RDX: 0000000000000003 RSI: 0000000000fff000 RDI: 0000000020000000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000000032 R11: 0000000000000212 R12: 00000000006ddc38
R13: 6d766b2f7665642f R14: 00007f6f148b69c0 R15: 0000000000000001
Code: 49 85 61 00 48 8b 75 d0 48 c7 c7 e0 69 e2 85 e8 21 29 4b 00 0f 0b e8 32 85 61 00 48 8b 75 d0 48 c7 c7 a0 69 e2 85 e8 0a 29 4b 00 <0f> 0b 4c 89 ef e8 48 d1 99 00 e9 01 fe ff ff 0f 1f 00 55 48 89 
RIP: pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1207 RSP: ffff8801b38d7260
---[ end trace 6b5adc1e14e4ed89 ]---