security_inode_getattr+0x12b/0x310 security/security.c:1909
 vfs_getattr fs/stat.c:259 [inline]
 vfs_fstat fs/stat.c:281 [inline]
 __do_sys_newfstat fs/stat.c:551 [inline]
 __se_sys_newfstat+0x133/0x440 fs/stat.c:546
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
------------[ cut here ]------------
kernel BUG at mm/filemap.c:859!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6401 Comm: syz.1.182 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__filemap_add_folio+0x128c/0x1400 mm/filemap.c:858
Code: ff 4c 89 f7 48 c7 c6 20 0f 19 8c e8 fe 5e 1f ff 90 0f 0b e8 d6 3e bf ff 48 8b 7c 24 20 48 c7 c6 e0 03 19 8c e8 e5 5e 1f ff 90 <0f> 0b e8 bd 3e bf ff 4c 89 f7 48 c7 c6 20 0f 19 8c e8 ce 5e 1f ff
RSP: 0018:ffffc9000ee76fa0 EFLAGS: 00010246
RAX: e59620a5b4119800 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 0000000000000000 RSI: ffffffff8e82b24f RDI: ffff88802819ddc0
RBP: ffffc9000ee77138 R08: ffff8880b8424713 R09: 1ffff110170848e2
R10: dffffc0000000000 R11: ffffed10170848e3 R12: dffffc0000000000
R13: ffff888026261440 R14: 0000000000000003 R15: ffff888026261558
FS:  00007f42b35516c0(0000) GS:ffff88812485b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000080 CR3: 000000007639a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 filemap_add_folio+0x251/0x4e0 mm/filemap.c:972
 ra_alloc_folio mm/readahead.c:470 [inline]
 page_cache_ra_order+0x6d1/0xee0 mm/readahead.c:535
 do_sync_mmap_readahead+0x75e/0x990 mm/filemap.c:3443
 filemap_fault+0x7d9/0x13b0 mm/filemap.c:3597
 __do_fault+0x138/0x2a0 mm/memory.c:5534
 do_read_fault mm/memory.c:5969 [inline]
 do_fault mm/memory.c:6103 [inline]
 do_pte_missing+0x2215/0x34b0 mm/memory.c:4663
 handle_pte_fault mm/memory.c:6527 [inline]
 __handle_mm_fault mm/memory.c:6676 [inline]
 handle_mm_fault+0x1a53/0x3750 mm/memory.c:6843
 do_user_addr_fault+0x7f6/0x1480 arch/x86/mm/fault.c:1394
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0010:rep_movs_alternative+0x30/0xa0 arch/x86/lib/copy_user_64.S:60
Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 8d 71 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08
RSP: 0018:ffffc9000ee779f8 EFLAGS: 00050216
RAX: 00007ffffffff001 RBX: 0000000000000020 RCX: 0000000000000020
RDX: 0000000000000001 RSI: 0000200000000080 RDI: ffffc9000ee77af0
RBP: ffffc9000ee77ea8 R08: ffffc9000ee77b0f R09: 1ffff92001dcef61
R10: dffffc0000000000 R11: fffff52001dcef62 R12: 000000004020ae46
R13: ffffc9000ee77af0 R14: ffffc9000ee77af0 R15: 0000200000000080
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:141 [inline]
 _inline_copy_from_user include/linux/uaccess.h:185 [inline]
 _copy_from_user+0x7a/0xb0 lib/usercopy.c:18
 copy_from_user include/linux/uaccess.h:222 [inline]
 kvm_vm_ioctl+0x799/0xd30 virt/kvm/kvm_main.c:5213
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f42b539e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f42b3551028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f42b5626450 RCX: 00007f42b539e159
RDX: 0000200000000080 RSI: 000000004020ae46 RDI: 0000000000000006
RBP: 00007f42b543506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f42b56264e8 R14: 00007f42b5626450 R15: 00007ffcbc0f4c28
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	83 f9 08             	cmp    $0x8,%ecx
   3:	73 25                	jae    0x2a
   5:	85 c9                	test   %ecx,%ecx
   7:	74 0f                	je     0x18
   9:	8a 06                	mov    (%rsi),%al
   b:	88 07                	mov    %al,(%rdi)
   d:	48 ff c7             	inc    %rdi
  10:	48 ff c6             	inc    %rsi
  13:	48 ff c9             	dec    %rcx
  16:	75 f1                	jne    0x9
  18:	e9 8d 71 04 00       	jmp    0x471aa
  1d:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  24:	00 00 00
  27:	0f 1f 00             	nopl   (%rax)
* 2a:	48 8b 06             	mov    (%rsi),%rax <-- trapping instruction
  2d:	48 89 07             	mov    %rax,(%rdi)
  30:	48 83 c6 08          	add    $0x8,%rsi
  34:	48 83 c7 08          	add    $0x8,%rdi
  38:	83 e9 08             	sub    $0x8,%ecx
  3b:	74 db                	je     0x18
  3d:	83 f9 08             	cmp    $0x8,%ecx