------------[ cut here ]------------ WARNING: CPU: 2 PID: 2908 at drivers/block/floppy.c:1000 schedule_bh+0x5f/0x70 drivers/block/floppy.c:1000 Modules linked in: CPU: 2 PID: 2908 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:schedule_bh+0x5f/0x70 drivers/block/floppy.c:1000 Code: 77 7c fc fc 48 89 2d a0 70 00 0c 5b 48 c7 c2 00 42 6a 8c 48 8b 35 71 75 00 0c bf 08 00 00 00 5d e9 a6 fd d0 fc e8 51 7c fc fc <0f> 0b eb d1 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 e8 3b 7c fc fc RSP: 0018:ffffc90000780c78 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100 RDX: ffff88806e78a2c0 RSI: ffffffff847a681f RDI: 0000000000000003 RBP: ffffffff847a8d30 R08: 0000000000000000 R09: ffffffff8c6a4207 R10: ffffffff847a67ef R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff847a8d30 R14: 0000000000000000 R15: ffff888010de5000 FS: 00007f2c73c0f700(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000010c CR3: 000000004a955000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: floppy_interrupt+0x228/0x340 drivers/block/floppy.c:1766 floppy_hardint+0x1a7/0x200 arch/x86/include/asm/floppy.h:66 __handle_irq_event_percpu+0x303/0x8f0 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:198 [inline] handle_irq_event+0x102/0x280 kernel/irq/handle.c:215 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:822 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x9d/0x210 arch/x86/kernel/irq.c:250 common_interrupt+0x4d/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 RIP: 0010:__do_softirq+0x196/0x9c2 kernel/softirq.c:544 Code: 00 48 01 f0 48 89 44 24 18 48 c7 c7 c0 8f aa 89 e8 ff 3d c4 ff 65 66 c7 05 75 8f 83 76 00 00 e8 c0 27 fd f7 fb b8 ff ff ff ff <48> c7 c3 c0 a0 80 8b 41 0f bc c5 41 89 c7 41 83 c7 01 75 47 e9 bd RSP: 0018:ffffc90000780f70 EFLAGS: 00000206 RAX: 00000000ffffffff RBX: ffff88806e78a2c0 RCX: 1ffffffff1ff716e RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff888011a861c0 R08: 0000000000000001 R09: ffffffff8ff76aaf R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000202 R14: 0000000000000000 R15: 0000000000000000 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:prep_new_page mm/page_alloc.c:2429 [inline] RIP: 0010:get_page_from_freelist+0xa76/0x2f50 mm/page_alloc.c:4149 Code: e8 bf 39 ff ff 85 c0 0f 85 93 19 00 00 44 8b 7c 24 10 8b 94 24 84 00 00 00 48 8b 7c 24 28 44 89 fe e8 6e 8d ff ff 8b 5c 24 14 <83> e3 04 45 85 ff 0f 84 bd 18 00 00 f7 84 24 84 00 00 00 00 00 04 RSP: 0018:ffffc9002115f300 EFLAGS: 00000212 RAX: 000000000000b209 RBX: 0000000000000881 RCX: ffffc90022dfc000 RDX: 0000000000040000 RSI: ffffffff81b3a8d2 RDI: 0000000000000003 RBP: 000000000003d440 R08: 0000000000000001 R09: 0000000000000000 R10: ffffffff81c434e2 R11: 000000000000001f R12: 0000000000000001 R13: dffffc0000000000 R14: ffff88807ffd6700 R15: 0000000000000000 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369 alloc_pages_vma+0xf3/0x7d0 mm/mempolicy.c:2152 shmem_alloc_page+0x11f/0x1f0 mm/shmem.c:1579 shmem_alloc_and_acct_page+0x161/0x8c0 mm/shmem.c:1604 shmem_getpage_gfp+0x643/0x22d0 mm/shmem.c:1902 shmem_getpage mm/shmem.c:150 [inline] shmem_file_read_iter+0x583/0xd40 mm/shmem.c:2547 call_read_iter include/linux/fs.h:2156 [inline] generic_file_splice_read+0x453/0x6d0 fs/splice.c:311 do_splice_to+0x1bf/0x250 fs/splice.c:796 splice_direct_to_actor+0x2c2/0x8c0 fs/splice.c:870 do_splice_direct+0x1b3/0x280 fs/splice.c:979 do_sendfile+0xaf2/0x1250 fs/read_write.c:1245 __do_sys_sendfile64 fs/read_write.c:1310 [inline] __se_sys_sendfile64 fs/read_write.c:1296 [inline] __x64_sys_sendfile64+0x1cc/0x210 fs/read_write.c:1296 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f2c74cbaae9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2c73c0f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f2c74dce028 RCX: 00007f2c74cbaae9 RDX: 0000000000000000 RSI: 0000000000000010 RDI: 000000000000000f RBP: 00007f2c74d14ff7 R08: 0000000000000000 R09: 0000000000000000 R10: 02008000fffffffe R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc502bfd2f R14: 00007f2c73c0f300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 00 48 01 add %cl,0x1(%rax) 3: f0 48 89 44 24 18 lock mov %rax,0x18(%rsp) 9: 48 c7 c7 c0 8f aa 89 mov $0xffffffff89aa8fc0,%rdi 10: e8 ff 3d c4 ff callq 0xffc43e14 15: 65 66 c7 05 75 8f 83 movw $0x0,%gs:0x76838f75(%rip) # 0x76838f94 1c: 76 00 00 1f: e8 c0 27 fd f7 callq 0xf7fd27e4 24: fb sti 25: b8 ff ff ff ff mov $0xffffffff,%eax * 2a: 48 c7 c3 c0 a0 80 8b mov $0xffffffff8b80a0c0,%rbx <-- trapping instruction 31: 41 0f bc c5 bsf %r13d,%eax 35: 41 89 c7 mov %eax,%r15d 38: 41 83 c7 01 add $0x1,%r15d 3c: 75 47 jne 0x85 3e: e9 .byte 0xe9 3f: bd .byte 0xbd