BUG: unable to handle kernel paging request in bitfill

BUG: unable to handle kernel paging request in bitfill_aligned (2)
Status: upstream: reported on 2020/11/17 20:47
Reported-by: syzbot+a4edd73d589b0b7efbeb@syzkaller.appspotmail.com
First crash: 158d, last: 10d

similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	BUG: unable to handle kernel paging request in bitfill_aligned				1	346d	344d	0/22	closed as dup on 2020/08/16 15:35

Sample crash report:

8<--- cut here ---
Unable to handle kernel paging request at virtual address e03c4000
pgd = 86d07f40
[e03c4000] *pgd=80000080007003, *pmd=844d8003, *pte=00000000
Internal error: Oops: a07 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 10755 Comm: syz-executor.0 Not tainted 5.12.0-rc3-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at __raw_writel arch/arm/include/asm/io.h:95 [inline]
PC is at bitfill_aligned drivers/video/fbdev/core/cfbfillrect.c:65 [inline]
PC is at bitfill_aligned+0x94/0x138 drivers/video/fbdev/core/cfbfillrect.c:35
LR is at bitfill_aligned drivers/video/fbdev/core/cfbfillrect.c:62 [inline]
LR is at bitfill_aligned+0x80/0x138 drivers/video/fbdev/core/cfbfillrect.c:35
pc : [<808f355c>]    lr : [<808f3548>]    psr: 20000013
sp : 86643ad0  ip : 86643b00  fp : 86643afc
r10: 0000a900  r9 : 00000020  r8 : ffffffff
r7 : 00000000  r6 : 00000000  r5 : e03c3000  r4 : 00000000
r3 : e03c4020  r2 : 00000140  r1 : 00000020  r0 : 00000548
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 86d07f40  DAC: fffffffd
Process syz-executor.0 (pid: 10755, stack limit = 0x86642210)
Stack: (0x86643ad0 to 0x86644000)
3ac0:                                     00000000 8452b400 00000000 e03c3000
3ae0: 0000a900 00000000 808f34c8 00000000 86643b4c 86643b00 808f3340 808f34d4
3b00: 0000a900 00000020 86643b04 56b92eae 8452c134 8452ca1c 00480000 00000000
3b20: 00000000 86643b74 8452b400 00000270 00000090 833a7c6c 833a7c6c 83420800
3b40: 86643b6c 86643b50 809b51b4 808f319c 86643ba4 86643b60 8452b400 00000548
3b60: 86643bac 86643b70 808ed840 809b5178 833a7c6c 00000000 00000090 00000548
3b80: 00000270 00000000 00000000 56b92eae 808ed764 833a7b34 8452ca00 82b5a808
3ba0: 86643bc4 86643bb0 808e7814 808ed770 8452b400 833a7b34 86643cac 86643bc8
3bc0: 808ec8ac 808e77bc 86643c64 8452b400 8452b4a8 00000000 86643c2c 00000400
3be0: 00000300 00000400 00000300 00000000 00000000 00000020 00000000 00000010
3c00: 00000008 00000000 00000008 00000008 00000000 00000000 00000008 00000000
3c20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001
3c40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3c60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 56b92eae
3c80: 83420800 83420800 00000000 8452ca00 00000001 00000000 8452ca00 00000000
3ca0: 86643ce4 86643cb0 8095bc9c 808ec604 808df644 808df160 00000000 56b92eae
3cc0: 8452b400 8452b400 83420800 8452ca00 00000001 00000000 86643dc4 86643ce8
3ce0: 808ebb40 8095bbc0 86643d04 86643cf8 8181dacc 00000400 00000300 00000400
3d00: 00000300 00000000 00000000 00000020 00000000 00000010 00000008 00000000
3d20: 00000008 00000008 00000000 00000000 00000008 00000000 00000000 00000000
3d40: 00000000 00000000 00000280 00000000 00000000 00000001 00000000 00000000
3d60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3d80: 00000000 00000000 00000000 00000000 00000000 56b92eae 00000001 833aa120
3da0: 83420800 00000001 00000000 0000003a 83420800 86c3d000 86643de4 86643dc8
3dc0: 8095bea8 808eb994 00000000 86c3d000 00004b3a 83420800 86643e64 86643de8
3de0: 809535a8 8095be08 8181dacc 8181d97c 86643e2c 86643e00 8181c9a4 8181dabc
3e00: 00000000 00000000 81f94a4c 00000103 82bfd371 841a63c0 00000006 00000036
3e20: 86643e54 86643e30 8027ea14 8181c88c 00000000 56b92eae 81f94a4c fffffdfd
3e40: 00004b3a 86c3d000 841a63c0 fffff73a 00000000 86c3d000 86643f0c 86643e68
3e60: 8093f890 80951c38 00000000 56b92eae 836e4560 0000003a 837775e8 0000004b
3e80: 00000001 841a63c0 00000006 00000036 86643eec 86643ea0 80701b40 806f7810
3ea0: 00000001 0000004b 0000003a 86643ebc 857d99d0 83851000 00004b3a 841a630b
3ec0: 86643eb0 841a63c0 00000006 56b92eae 821280c8 00000000 841a63c0 56b92eae
3ee0: 86643f0c 00004b3a 00000000 841a63c1 00000000 841a63c0 00000006 837775e8
3f00: 86643fa4 86643f10 804f33f4 8093f4d8 8020d140 8020e34c 00000000 80200e90
3f20: 828a2438 80200e90 86bd0000 80200060 86643f4c 86643f40 8181dacc 8181d97c
3f40: 86643f74 86643f50 8181cb8c 8181dabc 86643f98 80384d84 828abd1c 80200e90
3f60: 60000093 30c5387d 86643f94 86643f78 828abd1c 56b92eae 00000000 00000000
3f80: 00000000 00000000 00000036 80200224 86642000 00000036 00000000 86643fa8
3fa0: 80200060 804f32e0 00000000 00000000 00000006 00004b3a 00000000 00000000
3fc0: 00000000 00000000 00000000 00000036 7eefd332 76f0e6d0 7eefd4ac 76f0e20c
3fe0: 76f0e048 76f0e038 00018bf8 0004b480 60000010 00000006 00000000 00000000
Backtrace: 
[<808f34c8>] (bitfill_aligned) from [<808f3340>] (sys_fillrect+0x1b0/0x338 drivers/video/fbdev/core/sysfillrect.c:291)
 r10:00000000 r9:808f34c8 r8:00000000 r7:0000a900 r6:e03c3000 r5:00000000
 r4:8452b400 r3:00000000
[<808f3190>] (sys_fillrect) from [<809b51b4>] (drm_fb_helper_sys_fillrect drivers/gpu/drm/drm_fb_helper.c:764 [inline])
[<808f3190>] (sys_fillrect) from [<809b51b4>] (drm_fbdev_fb_fillrect+0x48/0x4c drivers/gpu/drm/drm_fb_helper.c:2258)
 r10:83420800 r9:833a7c6c r8:833a7c6c r7:00000090 r6:00000270 r5:8452b400
 r4:86643b74
[<809b516c>] (drm_fbdev_fb_fillrect) from [<808ed840>] (bit_clear_margins+0xdc/0x104 drivers/video/fbdev/core/bitblit.c:232)
 r5:00000548 r4:8452b400
[<808ed764>] (bit_clear_margins) from [<808e7814>] (fbcon_clear_margins+0x64/0x68 drivers/video/fbdev/core/fbcon.c:1315)
 r7:82b5a808 r6:8452ca00 r5:833a7b34 r4:808ed764
[<808e77b0>] (fbcon_clear_margins) from [<808ec8ac>] (fbcon_switch+0x2b4/0x4ac drivers/video/fbdev/core/fbcon.c:2143)
 r5:833a7b34 r4:8452b400
[<808ec5f8>] (fbcon_switch) from [<8095bc9c>] (redraw_screen+0xe8/0x248 drivers/tty/vt/vt.c:1021)
 r10:00000000 r9:8452ca00 r8:00000000 r7:00000001 r6:8452ca00 r5:00000000
 r4:83420800
[<8095bbb4>] (redraw_screen) from [<808ebb40>] (fbcon_blank+0x1b8/0x250 drivers/video/fbdev/core/fbcon.c:2204)
 r8:00000000 r7:00000001 r6:8452ca00 r5:83420800 r4:8452b400
[<808eb988>] (fbcon_blank) from [<8095bea8>] (do_unblank_screen+0xac/0x17c drivers/tty/vt/vt.c:4405)
 r10:86c3d000 r9:83420800 r8:0000003a r7:00000000 r6:00000001 r5:83420800
 r4:833aa120
[<8095bdfc>] (do_unblank_screen) from [<809535a8>] (vt_kdsetmode drivers/tty/vt/vt_ioctl.c:276 [inline])
[<8095bdfc>] (do_unblank_screen) from [<809535a8>] (vt_k_ioctl drivers/tty/vt/vt_ioctl.c:381 [inline])
[<8095bdfc>] (do_unblank_screen) from [<809535a8>] (vt_ioctl+0x197c/0x1be8 drivers/tty/vt/vt_ioctl.c:713)
 r7:83420800 r6:00004b3a r5:86c3d000 r4:00000000
[<80951c2c>] (vt_ioctl) from [<8093f890>] (tty_ioctl+0x3c4/0xc1c drivers/tty/tty_io.c:2801)
 r10:86c3d000 r9:00000000 r8:fffff73a r7:841a63c0 r6:86c3d000 r5:00004b3a
 r4:fffffdfd
[<8093f4cc>] (tty_ioctl) from [<804f33f4>] (vfs_ioctl fs/ioctl.c:48 [inline])
[<8093f4cc>] (tty_ioctl) from [<804f33f4>] (do_vfs_ioctl fs/ioctl.c:725 [inline])
[<8093f4cc>] (tty_ioctl) from [<804f33f4>] (__do_sys_ioctl fs/ioctl.c:751 [inline])
[<8093f4cc>] (tty_ioctl) from [<804f33f4>] (sys_ioctl+0x120/0xaa4 fs/ioctl.c:739)
 r10:837775e8 r9:00000006 r8:841a63c0 r7:00000000 r6:841a63c1 r5:00000000
 r4:00004b3a
[<804f32d4>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x2c arch/arm/mm/proc-v7.S:64)
Exception stack(0x86643fa8 to 0x86643ff0)
3fa0:                   00000000 00000000 00000006 00004b3a 00000000 00000000
3fc0: 00000000 00000000 00000000 00000036 7eefd332 76f0e6d0 7eefd4ac 76f0e20c
3fe0: 76f0e048 76f0e038 00018bf8 0004b480
 r10:00000036 r9:86642000 r8:80200224 r7:00000036 r6:00000000 r5:00000000
 r4:00000000
Code: 9a000012 e2853020 e1a02000 e2422008 (e5034020) 
---[ end trace f79396727d73633d ]---

Crashes (7):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Title
ci-qemu2-arm32	2021/04/11 07:57	upstream	bf152b0b	bfeda1b1	.config	log	report	info	BUG: unable to handle kernel paging request in bitfill_aligned
ci-qemu2-arm32	2021/04/01 16:56	upstream	bf152b0b	6a81331a	.config	log	report	info	BUG: unable to handle kernel paging request in bitfill_aligned
ci-qemu2-arm32	2021/03/20 18:46	upstream	bf152b0b	878fc870	.config	log	report	info	BUG: unable to handle kernel paging request in bitfill_aligned
ci-qemu2-arm32	2021/03/17 09:38	upstream	1a4431a5	fdb2bb2c	.config	log	report	info	BUG: unable to handle kernel paging request in bitfill_aligned
ci-upstream-kasan-gce-386	2020/11/28 07:23	upstream	99c710c4	486f93ef	.config	log	report	info
ci-upstream-kasan-gce-386	2020/11/16 00:47	upstream	0062442e	1bf9a662	.config	log	report	info
ci-upstream-kasan-gce-386	2020/11/13 18:26	upstream	585e5b17	e1140d25	.config	log	report	info