[syzbot] [intel-wired-lan?] BUG: unable to handle kernel paging request in e1000_get_variants_82571

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 848acc8ffe1b Merge tag 'fsverity-for-linus' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15ae93b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782
dashboard link: https://syzkaller.appspot.com/bug?extid=0ddf1022b4d5c391c09b
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=178b7649580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117c6cc6580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32c9dc084aaa/disk-848acc8f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b7604244b0a9/vmlinux-848acc8f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4cd321f6fe47/bzImage-848acc8f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0ddf10...@syzkaller.appspotmail.com

e1000e 0000:00:03.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
e1000e 0000:00:03.0 0000:00:03.0 (uninitialized): Failed to initialize MSI interrupts. Falling back to legacy interrupts.
BUG: unable to handle page fault for address: ffffc900035b4b58
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 13fe5c067 P4D 13fe5c067 PUD 1cae3067 PMD 22725067 PTE 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: sync_wq local_pci_probe_callback
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:__er32 drivers/net/ethernet/intel/e1000e/e1000.h:604 [inline]
RIP: 0010:e1000_init_mac_params_82571 drivers/net/ethernet/intel/e1000e/82571.c:278 [inline]
RIP: 0010:e1000_get_variants_82571+0xe08/0x1c30 drivers/net/ethernet/intel/e1000e/82571.c:320
Code: f6 ff ff e8 da 1f 0f fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f7 0b 00 00 49 8b 87 00 07 00 00 <8b> a8 58 5b 00 00 89 e8 31 ff 83 e0 02 89 c6 89 44 24 10 e8 10 1a
RSP: 0018:ffffc900000f7a00 EFLAGS: 00010246
RAX: ffffc900035af000 RBX: ffff88807ed91694 RCX: ffffffff86fb44f8
RDX: 1ffff1100fdb22b8 RSI: ffffffff86fb4506 RDI: ffff88801eaa2540
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff9200001ef45
R13: ffff88807ed915c0 R14: ffff88807ed915b8 R15: ffff88807ed90ec0
FS: 0000000000000000(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900035b4b58 CR3: 0000000073af9000 CR4: 00000000003526f0
Call Trace:
<TASK>
e1000_probe+0x1123/0x36b0 drivers/net/ethernet/intel/e1000e/netdev.c:7494
local_pci_probe+0xdd/0x1b0 drivers/pci/pci-driver.c:332
local_pci_probe_callback+0x35/0x80 drivers/pci/pci-driver.c:361
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
CR2: ffffc900035b4b58
---[ end trace 0000000000000000 ]---
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:__er32 drivers/net/ethernet/intel/e1000e/e1000.h:604 [inline]
RIP: 0010:e1000_init_mac_params_82571 drivers/net/ethernet/intel/e1000e/82571.c:278 [inline]
RIP: 0010:e1000_get_variants_82571+0xe08/0x1c30 drivers/net/ethernet/intel/e1000e/82571.c:320
Code: f6 ff ff e8 da 1f 0f fb 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 f7 0b 00 00 49 8b 87 00 07 00 00 <8b> a8 58 5b 00 00 89 e8 31 ff 83 e0 02 89 c6 89 44 24 10 e8 10 1a
RSP: 0018:ffffc900000f7a00 EFLAGS: 00010246
RAX: ffffc900035af000 RBX: ffff88807ed91694 RCX: ffffffff86fb44f8
RDX: 1ffff1100fdb22b8 RSI: ffffffff86fb4506 RDI: ffff88801eaa2540
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff9200001ef45
R13: ffff88807ed915c0 R14: ffff88807ed915b8 R15: ffff88807ed90ec0
FS: 0000000000000000(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900035b4b58 CR3: 0000000073af9000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: f6 ff idiv %bh
2: ff ljmp (bad)
3: e8 da 1f 0f fb call 0xfb0f1fe2
8: 4c 89 ea mov %r13,%rdx
b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
12: fc ff df
15: 48 c1 ea 03 shr $0x3,%rdx
19: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
1d: 0f 85 f7 0b 00 00 jne 0xc1a
23: 49 8b 87 00 07 00 00 mov 0x700(%r15),%rax
* 2a: 8b a8 58 5b 00 00 mov 0x5b58(%rax),%ebp <-- trapping instruction
30: 89 e8 mov %ebp,%eax
32: 31 ff xor %edi,%edi
34: 83 e0 02 and $0x2,%eax
37: 89 c6 mov %eax,%esi
39: 89 44 24 10 mov %eax,0x10(%rsp)
3d: e8 .byte 0xe8
3e: 10 1a adc %bl,(%rdx)


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup