general protection fault, probably for non-canonical address 0xdffffc000000044c: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000000002260-0x0000000000002267]
CPU: 0 PID: 770 Comm: kworker/u4:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_unbound flush_to_ldisc
RIP: 0010:n_tty_receive_buf_common+0x17a/0x1350 drivers/tty/n_tty.c:1700
Code: ff ff 48 c1 e8 03 48 89 85 d8 fe ff ff 48 89 8d 70 ff ff ff 48 c1 e9 03 48 89 8d 10 ff ff ff 4c 89 75 a0 48 8b 85 c8 fe ff ff <42> 80 3c 28 00 74 0c 48 8b bd d0 fe ff ff e8 a3 aa fa fe 48 8b bd
RSP: 0018:ffffc900110afa70 EFLAGS: 00010203
RAX: 000000000000044c RBX: ffff888113f79800 RCX: 000000000000000b
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900110afbc8 R08: dffffc0000000000 R09: ffffed10227ef320
R10: ffffed10227ef320 R11: 1ffff110227ef31f R12: 000000000000005d
R13: dffffc0000000000 R14: ffff888113f799f8 R15: 000000000000044c
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2702c5 CR3: 000000013040c000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
n_tty_receive_buf2+0x31/0x40 drivers/tty/n_tty.c:1767
tty_ldisc_receive_buf+0xb5/0x180 drivers/tty/tty_buffer.c:457
tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:39
receive_buf drivers/tty/tty_buffer.c:515 [inline]
flush_to_ldisc+0x2e1/0x820 drivers/tty/tty_buffer.c:565
process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:n_tty_receive_buf_common+0x17a/0x1350 drivers/tty/n_tty.c:1700
Code: ff ff 48 c1 e8 03 48 89 85 d8 fe ff ff 48 89 8d 70 ff ff ff 48 c1 e9 03 48 89 8d 10 ff ff ff 4c 89 75 a0 48 8b 85 c8 fe ff ff <42> 80 3c 28 00 74 0c 48 8b bd d0 fe ff ff e8 a3 aa fa fe 48 8b bd
RSP: 0018:ffffc900110afa70 EFLAGS: 00010203
RAX: 000000000000044c RBX: ffff888113f79800 RCX: 000000000000000b
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900110afbc8 R08: dffffc0000000000 R09: ffffed10227ef320
R10: ffffed10227ef320 R11: 1ffff110227ef31f R12: 000000000000005d
R13: dffffc0000000000 R14: ffff888113f799f8 R15: 000000000000044c
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e620ff8 CR3: 0000000120e7e000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 48 c1 e8 03 shr $0x3,%rax
4: 48 89 85 d8 fe ff ff mov %rax,-0x128(%rbp)
b: 48 89 8d 70 ff ff ff mov %rcx,-0x90(%rbp)
12: 48 c1 e9 03 shr $0x3,%rcx
16: 48 89 8d 10 ff ff ff mov %rcx,-0xf0(%rbp)
1d: 4c 89 75 a0 mov %r14,-0x60(%rbp)
21: 48 8b 85 c8 fe ff ff mov -0x138(%rbp),%rax
* 28: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2d: 74 0c je 0x3b
2f: 48 8b bd d0 fe ff ff mov -0x130(%rbp),%rdi
36: e8 a3 aa fa fe call 0xfefaaade
3b: 48 rex.W
3c: 8b .byte 0x8b
3d: bd .byte 0xbd