------------[ cut here ]------------
CPU 0 old state 19 new state 1
WARNING: CPU: 1 PID: 11206 at kernel/rcu/srcutree.c:702 srcu_check_nmi_safety+0x10e/0x130 kernel/rcu/srcutree.c:702
Modules linked in:
CPU: 1 PID: 11206 Comm: syz-executor.2 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:srcu_check_nmi_safety+0x10e/0x130 kernel/rcu/srcutree.c:702
Code: c0 74 11 3c 03 7f 0d 89 54 24 04 e8 4c 57 77 00 8b 54 24 04 8b b3 c8 01 00 00 44 89 e1 48 c7 c7 60 43 2e 8b e8 b3 a5 dc ff 90 <0f> 0b 90 90 e9 7b ff ff ff e8 24 57 77 00 e9 65 ff ff ff e8 4a 57
RSP: 0018:ffffc9000d83f998 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffffe8ffad06c6c0 RCX: ffffc9000d403000
RDX: 0000000000040000 RSI: ffffffff81511296 RDI: 0000000000000001
RBP: ffffc9000fb188a8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000003 R12: 0000000000000001
R13: ffffc9000d83fc60 R14: ffffc9000fb188a8 R15: ffffc9000fb18828
FS:  0000000000000000(0000) GS:ffff88802c100000(0063) knlGS:00000000f5e4db40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f744763c CR3: 000000002259a000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 srcu_read_lock include/linux/srcu.h:213 [inline]
 __kvm_handle_hva_range arch/x86/kvm/../../../virt/kvm/kvm_main.c:615 [inline]
 kvm_mmu_notifier_invalidate_range_start+0x293/0xb10 arch/x86/kvm/../../../virt/kvm/kvm_main.c:799
 mn_hlist_invalidate_range_start mm/mmu_notifier.c:476 [inline]
 __mmu_notifier_invalidate_range_start+0x3b9/0x8f0 mm/mmu_notifier.c:531
 mmu_notifier_invalidate_range_start include/linux/mmu_notifier.h:439 [inline]
 wp_page_copy mm/memory.c:3322 [inline]
 do_wp_page+0x2294/0x3290 mm/memory.c:3683
 handle_pte_fault mm/memory.c:5396 [inline]
 __handle_mm_fault+0x2311/0x53f0 mm/memory.c:5523
 handle_mm_fault+0x476/0xa00 mm/memory.c:5688
 do_user_addr_fault+0x426/0xe50 arch/x86/mm/fault.c:1338
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0023:0xf726d712
Code: 24 0c 88 1c 07 8b 46 08 83 c0 01 89 46 08 83 ea 01 73 d5 8b 5c 24 14 81 fb 00 01 00 00 0f 85 d5 fe ff ff e9 27 ff ff ff 8b 16 <88> 1c 02 83 46 08 01 e9 c2 fe ff ff 83 c4 2c b8 01 00 00 00 5b 5e
RSP: 002b:00000000f5e4cb10 EFLAGS: 00010202
RAX: 0000000000000400 RBX: 0000000000000010 RCX: 0000000000000015
RDX: 00000000eda2d000 RSI: 00000000f5e4cc10 RDI: 00000000000003fe
RBP: 00000000f5e4cb84 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	24 0c                	and    $0xc,%al
   2:	88 1c 07             	mov    %bl,(%rdi,%rax,1)
   5:	8b 46 08             	mov    0x8(%rsi),%eax
   8:	83 c0 01             	add    $0x1,%eax
   b:	89 46 08             	mov    %eax,0x8(%rsi)
   e:	83 ea 01             	sub    $0x1,%edx
  11:	73 d5                	jae    0xffffffe8
  13:	8b 5c 24 14          	mov    0x14(%rsp),%ebx
  17:	81 fb 00 01 00 00    	cmp    $0x100,%ebx
  1d:	0f 85 d5 fe ff ff    	jne    0xfffffef8
  23:	e9 27 ff ff ff       	jmp    0xffffff4f
  28:	8b 16                	mov    (%rsi),%edx
* 2a:	88 1c 02             	mov    %bl,(%rdx,%rax,1) <-- trapping instruction
  2d:	83 46 08 01          	addl   $0x1,0x8(%rsi)
  31:	e9 c2 fe ff ff       	jmp    0xfffffef8
  36:	83 c4 2c             	add    $0x2c,%esp
  39:	b8 01 00 00 00       	mov    $0x1,%eax
  3e:	5b                   	pop    %rbx
  3f:	5e                   	pop    %rsi