BUG: unable to handle page fault for address: ffffed1800000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23fff2067 P4D 23fff2067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1466 Comm: syz.4.315 Not tainted 5.15.178-syzkaller-00013-g7d1f9b5c2ff5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:173 [inline] RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:283 [inline] RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:303 [inline] RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:314 [inline] RIP: 0010:vma_interval_tree_remove+0x8a4/0xba0 mm/interval_tree.c:23 Code: 31 ff e8 ff fa ca ff 4d 89 fd 49 83 e5 fc 74 3d e8 b1 f6 ca ff 4d 8d 75 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 ae 61 0d 00 4c 89 eb 48 83 c3 08 48 RSP: 0018:ffffc90000cb75d0 EFLAGS: 00010a02 RAX: 1ffff11800000010 RBX: ffff88810c43d620 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88c000000070 RDI: 0000000000000000 RBP: ffffc90000cb7638 R08: ffffffff81a575f1 R09: ffffed1021265d93 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88812f9d6748 R13: ffff88c000000070 R14: ffff88c000000080 R15: ffff88c000000071 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed1800000010 CR3: 0000000126342000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: __remove_shared_vm_struct mm/mmap.c:159 [inline] unlink_file_vma+0xd9/0xf0 mm/mmap.c:174 free_pgtables+0x13f/0x280 mm/memory.c:490 exit_mmap+0x47c/0x990 mm/mmap.c:3235 __mmput+0x95/0x310 kernel/fork.c:1180 mmput+0x5b/0x170 kernel/fork.c:1203 exit_mm kernel/exit.c:554 [inline] do_exit+0xb9c/0x2ca0 kernel/exit.c:867 do_group_exit+0x141/0x310 kernel/exit.c:1002 get_signal+0x7a3/0x1630 kernel/signal.c:2907 arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:214 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:320 irqentry_exit+0x12/0x40 kernel/entry/common.c:411 exc_page_fault+0x47a/0x7f0 arch/x86/mm/fault.c:1568 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:606 RIP: 0033:0x7f8a767d8757 Code: Unable to access opcode bytes at RIP 0x7f8a767d872d. RSP: 002b:00007f8a74f41120 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f8a76917169 RDX: 00007f8a74f41140 RSI: 00007f8a74f41270 RDI: 000000000000000b RBP: 00007f8a769982a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f8a76b30080 R15: 00007ffe03f70fb8 Modules linked in: CR2: ffffed1800000010 ---[ end trace 89e74999453aa60d ]--- RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:173 [inline] RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:283 [inline] RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:303 [inline] RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:314 [inline] RIP: 0010:vma_interval_tree_remove+0x8a4/0xba0 mm/interval_tree.c:23 Code: 31 ff e8 ff fa ca ff 4d 89 fd 49 83 e5 fc 74 3d e8 b1 f6 ca ff 4d 8d 75 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 ae 61 0d 00 4c 89 eb 48 83 c3 08 48 RSP: 0018:ffffc90000cb75d0 EFLAGS: 00010a02 RAX: 1ffff11800000010 RBX: ffff88810c43d620 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88c000000070 RDI: 0000000000000000 RBP: ffffc90000cb7638 R08: ffffffff81a575f1 R09: ffffed1021265d93 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88812f9d6748 R13: ffff88c000000070 R14: ffff88c000000080 R15: ffff88c000000071 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed1800000010 CR3: 0000000126342000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: 31 ff xor %edi,%edi 2: e8 ff fa ca ff call 0xffcafb06 7: 4d 89 fd mov %r15,%r13 a: 49 83 e5 fc and $0xfffffffffffffffc,%r13 e: 74 3d je 0x4d 10: e8 b1 f6 ca ff call 0xffcaf6c6 15: 4d 8d 75 10 lea 0x10(%r13),%r14 19: 4c 89 f0 mov %r14,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 ae 61 0d 00 call 0xd61e6 38: 4c 89 eb mov %r13,%rbx 3b: 48 83 c3 08 add $0x8,%rbx 3f: 48 rex.W