8<--- cut here --- Unable to handle kernel paging request at virtual address 5bd2a000 [5bd2a000] *pgd=80000080005003, *pmd=00000000 Internal error: Oops: 206 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 21533 Comm: kworker/0:0 Not tainted 6.1.0-rc2-syzkaller #0 Hardware name: ARM-Versatile Express Workqueue: events free_ipc PC is at percpu_counter_add_batch+0x38/0x108 lib/percpu_counter.c:87 LR is at __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:66 pc : [<8081020c>] lr : [<817565a4>] psr: 20000113 sp : ea8a1e28 ip : ea8a1e18 fp : ea8a1e4c r10: 84fc2b40 r9 : 00000000 r8 : 84fc2bac r7 : 7fffffff r6 : 00000000 r5 : 831875e8 r4 : 00000000 r3 : 5bd2a000 r2 : 00000000 r1 : 00000000 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 856a1f80 DAC: fffffffd Register r0 information: NULL pointer Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: NULL pointer Register r5 information: slab kmalloc-cg-1k start 83187400 pointer offset 488 size 1024 Register r6 information: NULL pointer Register r7 information: non-paged memory Register r8 information: slab kmalloc-cg-192 start 84fc2b40 pointer offset 108 size 192 Register r9 information: NULL pointer Register r10 information: slab kmalloc-cg-192 start 84fc2b40 pointer offset 0 size 192 Register r11 information: 2-page vmalloc region starting at 0xea8a0000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671 Register r12 information: 2-page vmalloc region starting at 0xea8a0000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671 Process kworker/0:0 (pid: 21533, stack limit = 0xea8a0000) Stack: (0xea8a1e28 to 0xea8a2000) 1e20: 00000000 84fc2bac 84fc2b40 83187400 84fc2bac 00000000 1e40: ea8a1e94 ea8a1e50 80663868 808101e0 7fffffff 802a0f18 00000006 00000001 1e60: ea8a1e5c 1fa0a51f 831874b8 00000001 831874b8 00000006 83187400 80663760 1e80: 00000000 84fc2b40 ea8a1ecc ea8a1e98 8066ed00 8066376c ea8a1ebc 831874a0 1ea0: 80810160 83187400 00000000 dddd4a40 dddd8200 00000010 856e2280 dddd8215 1ec0: ea8a1ee4 ea8a1ed0 80664d40 8066ec98 83187400 00000000 ea8a1efc ea8a1ee8 1ee0: 8066e82c 80664d18 8232cd6c 848a0b00 ea8a1f44 ea8a1f00 802611c0 8066e7b4 1f00: 80275518 802a0f18 ea8a1f2c ea8a1f18 80262ea4 00000000 dddd4a40 848a0b00 1f20: dddd4a40 848a0b18 dddd4a5c 82204d40 00000008 dddd4a40 ea8a1f84 ea8a1f48 1f40: 802615cc 80260fc0 ea8a1f64 81cffde0 823d7b4e 856e2280 ea8a1f84 8528e500 1f60: 856e2280 80261560 848a0b00 85068cc0 ea6cde8c 00000000 ea8a1fac ea8a1f88 1f80: 80269b24 8026156c 8528e500 80269a38 00000000 00000000 00000000 00000000 1fa0: 00000000 ea8a1fb0 80200100 80269a44 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Backtrace: [<808101d4>] (percpu_counter_add_batch) from [<80663868>] (percpu_counter_add_local include/linux/percpu_counter.h:75 [inline]) [<808101d4>] (percpu_counter_add_batch) from [<80663868>] (percpu_counter_sub_local include/linux/percpu_counter.h:225 [inline]) [<808101d4>] (percpu_counter_add_batch) from [<80663868>] (freeque+0x108/0x16c ipc/msg.c:292) r9:00000000 r8:84fc2bac r7:83187400 r6:84fc2b40 r5:84fc2bac r4:00000000 [<80663760>] (freeque) from [<8066ed00>] (free_ipcs+0x74/0x90 ipc/namespace.c:125) r10:84fc2b40 r9:00000000 r8:80663760 r7:83187400 r6:00000006 r5:831874b8 r4:00000001 [<8066ec8c>] (free_ipcs) from [<80664d40>] (msg_exit_ns+0x34/0x48 ipc/msg.c:1334) r10:dddd8215 r9:856e2280 r8:00000010 r7:dddd8200 r6:dddd4a40 r5:00000000 r4:83187400 [<80664d0c>] (msg_exit_ns) from [<8066e82c>] (free_ipc_ns ipc/namespace.c:138 [inline]) [<80664d0c>] (msg_exit_ns) from [<8066e82c>] (free_ipc+0x84/0xfc ipc/namespace.c:157) r5:00000000 r4:83187400 [<8066e7a8>] (free_ipc) from [<802611c0>] (process_one_work+0x20c/0x5ac kernel/workqueue.c:2289) r5:848a0b00 r4:8232cd6c [<80260fb4>] (process_one_work) from [<802615cc>] (worker_thread+0x6c/0x4e0 kernel/workqueue.c:2436) r10:dddd4a40 r9:00000008 r8:82204d40 r7:dddd4a5c r6:848a0b18 r5:dddd4a40 r4:848a0b00 [<80261560>] (worker_thread) from [<80269b24>] (kthread+0xec/0x11c kernel/kthread.c:376) r10:00000000 r9:ea6cde8c r8:85068cc0 r7:848a0b00 r6:80261560 r5:856e2280 r4:8528e500 [<80269a38>] (kthread) from [<80200100>] (ret_from_fork+0x14/0x34 arch/arm/kernel/entry-common.S:148) Exception stack(0xea8a1fb0 to 0xea8a1ff8) 1fa0: 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80269a38 r4:8528e500 Code: e34801ec eb3d18e0 e5951018 ee1d3f90 (e7918003) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e34801ec movt r0, #33260 ; 0x81ec 4: eb3d18e0 bl 0xf4638c 8: e5951018 ldr r1, [r5, #24] c: ee1d3f90 mrc 15, 0, r3, cr13, cr0, {4} * 10: e7918003 ldr r8, [r1, r3] <-- trapping instruction