BUG: unable to handle page fault for address: ffff888001000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation PGD 11201067 P4D 11201067 PUD 11202067 PMD 80000000010001e1 Oops: 0003 [#1] PREEMPT SMP KASAN CPU: 0 PID: 12950 Comm: syz-executor.4 Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:writeb arch/x86/include/asm/io.h:65 [inline] RIP: 0010:vga16fb_fillrect+0x17b0/0x1c10 drivers/video/fbdev/vga16fb.c:923 Code: 00 00 31 ed 31 ff 89 de e8 9d af 26 fd 4c 63 64 24 08 44 8d 7b ff ff 4c 24 04 85 db 74 33 44 89 fb 66 0f 1f 84 00 00 00 00 00 <41> 88 2e 85 db 74 0c 49 ff c6 e8 61 ab 26 fd ff cb eb ed e8 58 ab RSP: 0018:ffffc90003ca6c28 EFLAGS: 00010202 RAX: ffffffff845d9dcb RBX: 0000000000000007 RCX: 0000000000040000 RDX: ffffc900121d9000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 0000000000000000 R08: ffffffff845d9d73 R09: ffffffff845d8e78 R10: 0000000000000002 R11: ffff888038f28000 R12: 0000000000000000 R13: 0000000000000008 R14: ffff888001000000 R15: 0000000000000007 FS: 00007f4404075700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888001000000 CR3: 000000009bd02000 CR4: 00000000003506f0 Call Trace: bit_clear+0x3f9/0x640 drivers/video/fbdev/core/bitblit.c:74 fbcon_scroll+0x4cd/0x4130 drivers/video/fbdev/core/fbcon.c:1784 con_scroll+0x517/0x7b0 drivers/tty/vt/vt.c:630 lf drivers/tty/vt/vt.c:1507 [inline] vc_con_write_normal drivers/tty/vt/vt.c:2851 [inline] do_con_write+0x171a/0xe3b0 drivers/tty/vt/vt.c:2955 con_write+0x20/0x40 drivers/tty/vt/vt.c:3295 n_tty_write+0x646/0x1320 drivers/tty/n_tty.c:2311 do_tty_write drivers/tty/tty_io.c:1038 [inline] file_tty_write+0x5c5/0x9a0 drivers/tty/tty_io.c:1110 do_iter_readv_writev+0x54f/0x740 do_iter_write+0x21e/0x7b0 fs/read_write.c:851 iter_file_splice_write+0x7eb/0xfa0 fs/splice.c:689 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0xe6/0x1c0 fs/splice.c:936 splice_direct_to_actor+0x529/0xd00 fs/splice.c:891 do_splice_direct+0x291/0x3e0 fs/splice.c:979 do_sendfile+0x6fe/0x1040 fs/read_write.c:1245 __do_sys_sendfile64 fs/read_write.c:1310 [inline] __se_sys_sendfile64+0x171/0x1d0 fs/read_write.c:1296 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f4406affae9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4404075188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f4406c12f60 RCX: 00007f4406affae9 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 RBP: 00007f4406b59f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0800000080004103 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffebe18e4cf R14: 00007f4404075300 R15: 0000000000022000 Modules linked in: CR2: ffff888001000000 ---[ end trace 7a98f3a1d56468d2 ]--- RIP: 0010:writeb arch/x86/include/asm/io.h:65 [inline] RIP: 0010:vga16fb_fillrect+0x17b0/0x1c10 drivers/video/fbdev/vga16fb.c:923 Code: 00 00 31 ed 31 ff 89 de e8 9d af 26 fd 4c 63 64 24 08 44 8d 7b ff ff 4c 24 04 85 db 74 33 44 89 fb 66 0f 1f 84 00 00 00 00 00 <41> 88 2e 85 db 74 0c 49 ff c6 e8 61 ab 26 fd ff cb eb ed e8 58 ab RSP: 0018:ffffc90003ca6c28 EFLAGS: 00010202 RAX: ffffffff845d9dcb RBX: 0000000000000007 RCX: 0000000000040000 RDX: ffffc900121d9000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 0000000000000000 R08: ffffffff845d9d73 R09: ffffffff845d8e78 R10: 0000000000000002 R11: ffff888038f28000 R12: 0000000000000000 R13: 0000000000000008 R14: ffff888001000000 R15: 0000000000000007 FS: 00007f4404075700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888001000000 CR3: 000000009bd02000 CR4: 00000000003506f0 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 31 ed xor %ebp,%ebp 4: 31 ff xor %edi,%edi 6: 89 de mov %ebx,%esi 8: e8 9d af 26 fd callq 0xfd26afaa d: 4c 63 64 24 08 movslq 0x8(%rsp),%r12 12: 44 8d 7b ff lea -0x1(%rbx),%r15d 16: ff 4c 24 04 decl 0x4(%rsp) 1a: 85 db test %ebx,%ebx 1c: 74 33 je 0x51 1e: 44 89 fb mov %r15d,%ebx 21: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) 28: 00 00 * 2a: 41 88 2e mov %bpl,(%r14) <-- trapping instruction 2d: 85 db test %ebx,%ebx 2f: 74 0c je 0x3d 31: 49 ff c6 inc %r14 34: e8 61 ab 26 fd callq 0xfd26ab9a 39: ff cb dec %ebx 3b: eb ed jmp 0x2a 3d: e8 .byte 0xe8 3e: 58 pop %rax 3f: ab stos %eax,%es:(%rdi)