general protection fault, probably for non-canonical address 0xdffffc000000044c: 0000 [#1] PREEMPT SMP KASAN KASAN: probably user-memory-access in range [0x0000000000002260-0x0000000000002267] CPU: 1 PID: 20121 Comm: kworker/u4:1 Not tainted 6.0.0-rc5-syzkaller-00094-ga335366bad13 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Workqueue: events_unbound flush_to_ldisc RIP: 0010:n_tty_receive_buf_common+0xd4/0x1540 drivers/tty/n_tty.c:1690 Code: 60 48 89 44 24 68 48 89 d8 c7 84 24 80 00 00 00 00 00 00 00 48 c1 e8 03 4c 01 f0 48 89 44 24 70 e8 61 91 21 fd 48 8b 44 24 68 <80> 38 00 0f 85 42 11 00 00 48 8b 44 24 10 4c 8b a0 60 22 00 00 48 RSP: 0018:ffffc90014ed7b30 EFLAGS: 00010293 RAX: dffffc000000044c RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802b1e8000 RSI: ffffffff845a77bf RDI: ffff88802f0463a0 RBP: ffff888022022192 R08: 0000000000000001 R09: ffff88802f046287 R10: ffffed1005e08c50 R11: 0000000000000000 R12: 000000000000000c R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888022022192 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f6f50730 CR3: 0000000017068000 CR4: 00000000003506e0 Call Trace: tty_ldisc_receive_buf+0xa3/0x190 drivers/tty/tty_buffer.c:457 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:39 receive_buf drivers/tty/tty_buffer.c:515 [inline] flush_to_ldisc+0x216/0x700 drivers/tty/tty_buffer.c:565 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:n_tty_receive_buf_common+0xd4/0x1540 drivers/tty/n_tty.c:1690 Code: 60 48 89 44 24 68 48 89 d8 c7 84 24 80 00 00 00 00 00 00 00 48 c1 e8 03 4c 01 f0 48 89 44 24 70 e8 61 91 21 fd 48 8b 44 24 68 <80> 38 00 0f 85 42 11 00 00 48 8b 44 24 10 4c 8b a0 60 22 00 00 48 RSP: 0018:ffffc90014ed7b30 EFLAGS: 00010293 RAX: dffffc000000044c RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802b1e8000 RSI: ffffffff845a77bf RDI: ffff88802f0463a0 RBP: ffff888022022192 R08: 0000000000000001 R09: ffff88802f046287 R10: ffffed1005e08c50 R11: 0000000000000000 R12: 000000000000000c R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888022022192 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000794ce000 CR4: 00000000003506e0 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 48 89 44 24 68 mov %rax,0x68(%rsp) 5: 48 89 d8 mov %rbx,%rax 8: c7 84 24 80 00 00 00 movl $0x0,0x80(%rsp) f: 00 00 00 00 13: 48 c1 e8 03 shr $0x3,%rax 17: 4c 01 f0 add %r14,%rax 1a: 48 89 44 24 70 mov %rax,0x70(%rsp) 1f: e8 61 91 21 fd callq 0xfd219185 24: 48 8b 44 24 68 mov 0x68(%rsp),%rax * 29: 80 38 00 cmpb $0x0,(%rax) <-- trapping instruction 2c: 0f 85 42 11 00 00 jne 0x1174 32: 48 8b 44 24 10 mov 0x10(%rsp),%rax 37: 4c 8b a0 60 22 00 00 mov 0x2260(%rax),%r12 3e: 48 rex.W