------------[ cut here ]------------
pte_uffd_wp(pte) && pte_write(pte)
WARNING: mm/page_table_check.c:191 at page_table_check_pte_flags mm/page_table_check.c:191 [inline], CPU#1: syz.1.6901/32115
WARNING: mm/page_table_check.c:191 at __page_table_check_ptes_set+0x111/0x320 mm/page_table_check.c:207, CPU#1: syz.1.6901/32115
Modules linked in:
CPU: 1 UID: 0 PID: 32115 Comm: syz.1.6901 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:page_table_check_pte_flags mm/page_table_check.c:191 [inline]
RIP: 0010:__page_table_check_ptes_set+0x111/0x320 mm/page_table_check.c:207
Code: 4c 89 ee 48 81 e6 9e fe ff ff 41 0f 95 c7 31 ff e8 04 ba 8b ff 44 84 fb 75 15 e8 1a b5 8b ff e9 84 00 00 00 e8 10 b5 8b ff 90 <0f> 0b 90 eb 79 4c 89 e8 48 d1 e8 49 bf 00 00 00 00 00 00 00 7c 49
RSP: 0000:ffffc9000de5f9d0 EFLAGS: 00010283
RAX: ffffffff8238c240 RBX: ffff888032edbd40 RCX: 0000000000080000
RDX: ffffc90013231000 RSI: 00000000000013b8 RDI: 00000000000013b9
RBP: 0000000000000001 R08: ffffea0001101687 R09: 1ffffd40002202d0
R10: dffffc0000000000 R11: fffff940002202d1 R12: 0000000000000000
R13: 000000004405ac67 R14: ffff8880567aeff0 R15: ffff888032edbd40
FS: 0000000000000000(0000) GS:ffff8881257f5000(0063) knlGS:00000000f5436b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080ffe000 CR3: 0000000031dcc000 CR4: 00000000003526f0
Call Trace:
<TASK>
page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
set_ptes include/linux/pgtable.h:292 [inline]
do_swap_page+0x55db/0x5e10 mm/memory.c:5013
handle_pte_fault mm/memory.c:6279 [inline]
__handle_mm_fault mm/memory.c:6414 [inline]
handle_mm_fault+0x12d2/0x32a0 mm/memory.c:6583
do_user_addr_fault+0xa73/0x1360 arch/x86/mm/fault.c:1334
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0023:0xf7060360
Code: 50 6a 00 e8 32 74 14 00 8b 5c 24 2c 8b 4c 24 28 83 c4 20 8b 55 40 89 03 03 11 85 f6 74 18 31 c0 2e 8d b4 26 00 00 00 00 66 90 <89> 02 83 c0 01 83 c2 04 39 c6 75 f4 83 c4 1c 89 f8 5b 5e 5f 5d c3
RSP: 002b:00000000f54364f0 EFLAGS: 00010202
RAX: 0000000000000800 RBX: 0000000080000280 RCX: 0000000080000000
RDX: 0000000080ffdfff RSI: 0000000000000efe RDI: 00000000ffffffff
RBP: 0000000080000140 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
----------------
Code disassembly (best guess):
0: 50 push %rax
1: 6a 00 push $0x0
3: e8 32 74 14 00 call 0x14743a
8: 8b 5c 24 2c mov 0x2c(%rsp),%ebx
c: 8b 4c 24 28 mov 0x28(%rsp),%ecx
10: 83 c4 20 add $0x20,%esp
13: 8b 55 40 mov 0x40(%rbp),%edx
16: 89 03 mov %eax,(%rbx)
18: 03 11 add (%rcx),%edx
1a: 85 f6 test %esi,%esi
1c: 74 18 je 0x36
1e: 31 c0 xor %eax,%eax
20: 2e 8d b4 26 00 00 00 cs lea 0x0(%rsi,%riz,1),%esi
27: 00
28: 66 90 xchg %ax,%ax
* 2a: 89 02 mov %eax,(%rdx) <-- trapping instruction
2c: 83 c0 01 add $0x1,%eax
2f: 83 c2 04 add $0x4,%edx
32: 39 c6 cmp %eax,%esi
34: 75 f4 jne 0x2a
36: 83 c4 1c add $0x1c,%esp
39: 89 f8 mov %edi,%eax
3b: 5b pop %rbx
3c: 5e pop %rsi
3d: 5f pop %rdi
3e: 5d pop %rbp
3f: c3 ret