Re: [syzbot] [sound?] BUG: unable to handle kernel paging request in snd_hdac_bus_parse_capabilities

[syzbot <syzbot+10cd2d1efe8eeb604bee@syzkaller.appspotmail.com>]

syzbot has found a reproducer for the following issue on:

HEAD commit:    f5bbbfec59b4 Merge tag 'probes-fixes-v7.2-rc7' of git://gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=142eb479580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
dashboard link: https://syzkaller.appspot.com/bug?extid=10cd2d1efe8eeb604bee
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=103a1149580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+10cd2d1efe8eeb604bee@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: 000000000001c0b4
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 1039 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events azx_probe_work
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:snd_hdac_bus_parse_capabilities+0x42/0x6d0 sound/hda/core/controller.c:412
Code: 97 f8 48 8d 45 20 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f8 05 00 00 48 8b 45 20 <66> 44 8b 68 14 4c 8b 7c 24 10 48 89 e8 45 0f b7 ed 45 31 f6 48 ba
RSP: 0018:ffffc90005537ab0 EFLAGS: 00010246
RAX: 000000000001c0a0 RBX: ffff888027304058 RCX: ffffffff897e8c06
RDX: 1ffff11004e6080b RSI: ffffffff8972cfca RDI: ffff888027304038
RBP: ffff888027304038 R08: 0000000000000005 R09: 0000000000000003
R10: 0000000000000003 R11: 000000000000759b R12: 0000000000000003
R13: ffff8880294e4f44 R14: ffff888022d6c000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d5eec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000001c0b4 CR3: 000000005526e000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 azx_first_init sound/hda/controllers/intel.c:1936 [inline]
 azx_probe_continue sound/hda/controllers/intel.c:2365 [inline]
 azx_probe_work+0x1d8e/0x2640 sound/hda/controllers/intel.c:1737
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: 000000000001c0b4
---[ end trace 0000000000000000 ]---
RIP: 0010:readw arch/x86/include/asm/io.h:58 [inline]
RIP: 0010:snd_hdac_reg_readw include/sound/hdaudio.h:458 [inline]
RIP: 0010:snd_hdac_bus_parse_capabilities+0x42/0x6d0 sound/hda/core/controller.c:412
Code: 97 f8 48 8d 45 20 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f8 05 00 00 48 8b 45 20 <66> 44 8b 68 14 4c 8b 7c 24 10 48 89 e8 45 0f b7 ed 45 31 f6 48 ba
RSP: 0018:ffffc90005537ab0 EFLAGS: 00010246
RAX: 000000000001c0a0 RBX: ffff888027304058 RCX: ffffffff897e8c06
RDX: 1ffff11004e6080b RSI: ffffffff8972cfca RDI: ffff888027304038
RBP: ffff888027304038 R08: 0000000000000005 R09: 0000000000000003
R10: 0000000000000003 R11: 000000000000759b R12: 0000000000000003
R13: ffff8880294e4f44 R14: ffff888022d6c000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d5eec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000001c0b4 CR3: 000000005526e000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	97                   	xchg   %eax,%edi
   1:	f8                   	clc
   2:	48 8d 45 20          	lea    0x20(%rbp),%rax
   6:	48 89 c2             	mov    %rax,%rdx
   9:	48 89 44 24 10       	mov    %rax,0x10(%rsp)
   e:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  15:	fc ff df
  18:	48 c1 ea 03          	shr    $0x3,%rdx
  1c:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  20:	0f 85 f8 05 00 00    	jne    0x61e
  26:	48 8b 45 20          	mov    0x20(%rbp),%rax
* 2a:	66 44 8b 68 14       	mov    0x14(%rax),%r13w <-- trapping instruction
  2f:	4c 8b 7c 24 10       	mov    0x10(%rsp),%r15
  34:	48 89 e8             	mov    %rbp,%rax
  37:	45 0f b7 ed          	movzwl %r13w,%r13d
  3b:	45 31 f6             	xor    %r14d,%r14d
  3e:	48                   	rex.W
  3f:	ba                   	.byte 0xba


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.