general protection fault, probably for non-canonical address 0xe5ce069f03c59d5a: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0x2e7054f81e2cead0-0x2e7054f81e2cead7]
CPU: 1 PID: 3599 Comm: syz.5.793 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:173 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:283 [inline]
RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:303 [inline]
RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:314 [inline]
RIP: 0010:vma_interval_tree_remove+0x788/0xaf0 mm/interval_tree.c:23
Code: 4c 89 fb 48 83 e3 fc 0f 84 a8 00 00 00 4c 89 7d d0 4c 89 65 c8 4c 8d 63 10 4d 89 e7 49 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 07 00 74 08 4c 89 e7 e8 89 7f 0c 00 48 8b 45 b8 49 39 04
RSP: 0018:ffffc90002367780 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 2e7054f81e2ceac0 RCX: ffff888133235000
RDX: 0000000000000000 RSI: 2e7054f81e2ceac0 RDI: 0000000000000000
RBP: ffffc900023677d8 R08: ffff88810d038367 R09: 1ffff11021a0706c
R10: dffffc0000000000 R11: ffffed1021a0706d R12: 2e7054f81e2cead0
R13: ffff8881ffff8881 R14: ffff8881ffff8881 R15: 05ce0a9f03c59d5a
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0eac77ff8 CR3: 0000000125ab0000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000200000000080 DR2: 0000200000000080
DR3: 0000200000000080 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 __remove_shared_vm_struct mm/mmap.c:160 [inline]
 unlink_file_vma+0xda/0xf0 mm/mmap.c:175
 free_pgtables+0x139/0x280 mm/memory.c:492
 exit_mmap+0x433/0x8b0 mm/mmap.c:3247
 __mmput+0x92/0x300 kernel/fork.c:1191
 mmput+0x50/0x150 kernel/fork.c:1214
 exit_mm kernel/exit.c:561 [inline]
 do_exit+0xacc/0x29a0 kernel/exit.c:883
 do_group_exit+0x149/0x310 kernel/exit.c:1010
 get_signal+0x64f/0x1430 kernel/signal.c:2920
 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:157 [inline]
 exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:217
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:323
 irqentry_exit+0x12/0x40 kernel/entry/common.c:414
 exc_page_fault+0x5e/0xb0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:606
RIP: 0033:0x13100000004
Code: Unable to access opcode bytes at RIP 0x130ffffffda.
RSP: 002b:00002000000002c8 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fa0ec4e9090 RCX: 00007fa0ec2611d9
RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000000
RBP: 00007fa0ec2f8888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa0ec4e9128 R14: 00007fa0ec4e9090 R15: 00007ffc3ee994c8
 </TASK>
Modules linked in:
---[ end trace e44174b327d84852 ]---
RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:173 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:283 [inline]
RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:303 [inline]
RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:314 [inline]
RIP: 0010:vma_interval_tree_remove+0x788/0xaf0 mm/interval_tree.c:23
Code: 4c 89 fb 48 83 e3 fc 0f 84 a8 00 00 00 4c 89 7d d0 4c 89 65 c8 4c 8d 63 10 4d 89 e7 49 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 07 00 74 08 4c 89 e7 e8 89 7f 0c 00 48 8b 45 b8 49 39 04
RSP: 0018:ffffc90002367780 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 2e7054f81e2ceac0 RCX: ffff888133235000
RDX: 0000000000000000 RSI: 2e7054f81e2ceac0 RDI: 0000000000000000
RBP: ffffc900023677d8 R08: ffff88810d038367 R09: 1ffff11021a0706c
R10: dffffc0000000000 R11: ffffed1021a0706d R12: 2e7054f81e2cead0
R13: ffff8881ffff8881 R14: ffff8881ffff8881 R15: 05ce0a9f03c59d5a
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0eac77ff8 CR3: 000000010d6cc000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000200000000080 DR2: 0000200000000080
DR3: 0000200000000080 DR6: 00000000ffff0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0:	4c 89 fb             	mov    %r15,%rbx
   3:	48 83 e3 fc          	and    $0xfffffffffffffffc,%rbx
   7:	0f 84 a8 00 00 00    	je     0xb5
   d:	4c 89 7d d0          	mov    %r15,-0x30(%rbp)
  11:	4c 89 65 c8          	mov    %r12,-0x38(%rbp)
  15:	4c 8d 63 10          	lea    0x10(%rbx),%r12
  19:	4d 89 e7             	mov    %r12,%r15
  1c:	49 c1 ef 03          	shr    $0x3,%r15
  20:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  27:	fc ff df
* 2a:	41 80 3c 07 00       	cmpb   $0x0,(%r15,%rax,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 e7             	mov    %r12,%rdi
  34:	e8 89 7f 0c 00       	call   0xc7fc2
  39:	48 8b 45 b8          	mov    -0x48(%rbp),%rax
  3d:	49                   	rex.WB
  3e:	39                   	.byte 0x39
  3f:	04                   	.byte 0x4