8<--- cut here --- Unable to handle kernel paging request at virtual address fee00001 [fee00001] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 5778 Comm: syz-executor.1 Not tainted 5.17.0-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:88 [inline] PC is at io_serial_out+0x38/0x40 drivers/tty/serial/8250/8250_port.c:458 LR is at io_serial_out+0x24/0x40 drivers/tty/serial/8250/8250_port.c:458 pc : [<808e9324>] lr : [<808e9310>] psr: 60000093 sp : ed805d48 ip : ed805d48 fp : ed805d64 r10: 00000001 r9 : 00000fff r8 : 84cd8800 r7 : a0000013 r6 : 824f1440 r5 : 00000002 r4 : fee00001 r3 : 00000000 r2 : 00000002 r1 : 00000000 r0 : 824f1440 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 85238480 DAC: 00000000 Register r0 information: non-slab/vmalloc memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1028 Register r5 information: non-paged memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-slab/vmalloc memory Register r8 information: slab kmalloc-cg-512 start 84cd8800 pointer offset 0 size 512 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: 2-page vmalloc region starting at 0xed804000 allocated at kernel_clone+0x9c/0x42c kernel/fork.c:2639 Register r12 information: 2-page vmalloc region starting at 0xed804000 allocated at kernel_clone+0x9c/0x42c kernel/fork.c:2639 Process syz-executor.1 (pid: 5778, stack limit = 0xed804000) Stack: (0xed805d48 to 0xed806000) 5d40: 824f1440 00000000 824f1440 a0000013 ed805d94 ed805d68 5d60: 808eb15c 808e92f8 816f6c2c 80274f64 808c50b8 824f1440 00000001 84cd8800 5d80: 824f1440 a0000013 ed805da4 ed805d98 808e2324 808eb02c ed805dc4 ed805da8 5da0: 808e46dc 808e22e0 ed879000 ed879000 00000000 ed879000 ed805dd4 ed805dc8 5dc0: 808e474c 808e4678 ed805e54 ed805dd8 808c5108 808e4748 ed805dc0 00005412 5de0: ffffffff 00000000 ffffffff 84cd8874 00000001 00000fff 81908eb0 55555556 5e00: 00000001 00000000 ed87b000 ed805e7c 00000001 ed805e7c 00000000 ed879000 5e20: 00000001 ed805e7c 8067c708 00000000 85238540 84cd8800 808c600c 00000009 5e40: 20000000 84cd8800 ed805e6c ed805e58 808c6028 808c4d2c 00000000 816f7eb0 5e60: ed805f14 ed805e70 808c0e88 808c6018 00000001 83b06c18 04000054 853a3900 5e80: 00000004 00000036 ed805ee4 ed805e98 8068c1d4 806821a8 00000001 00000054 5ea0: 00000012 ed805eb4 845056d0 834e8e58 80275412 536ea30b ed805ea8 81f34dc4 5ec0: 20000000 536ea3cb 81f340f4 20000000 853a3900 00005412 ed805ef4 ed805ee8 5ee0: 8068c2d8 536ea3cb ed805f14 00005412 00000000 853a3901 20000000 853a3900 5f00: 00000004 83b06c18 ed805fa4 ed805f18 804a8188 808c0680 820a666c 820a0420 5f20: 0012bfc8 85002280 850029a0 820a6670 00000036 60000010 820a6668 85002280 5f40: 820a6670 00000036 ed805f64 ed805f58 816f4354 816f4220 ed805f84 ed805f68 5f60: 816f40dc 816f4344 60000013 00000000 0012bfc8 536ea3cb ed805f9c 00000000 5f80: 00000000 0012bfc8 00000036 802002a4 85002280 00000036 00000000 ed805fa8 5fa0: 80200060 804a8084 00000000 00000000 00000004 00005412 20000000 00000000 5fc0: 00000000 00000000 0012bfc8 00000036 7eb5d312 76fae6d0 7eb5d4a4 76fae20c 5fe0: 76fae020 76fae010 000163a0 0004bf80 60000010 00000004 00000000 00000000 Backtrace: [<808e92ec>] (io_serial_out) from [<808eb15c>] (serial_out drivers/tty/serial/8250/8250.h:120 [inline]) [<808e92ec>] (io_serial_out) from [<808eb15c>] (serial8250_set_THRI drivers/tty/serial/8250/8250.h:140 [inline]) [<808e92ec>] (io_serial_out) from [<808eb15c>] (__start_tx drivers/tty/serial/8250/8250_port.c:1568 [inline]) [<808e92ec>] (io_serial_out) from [<808eb15c>] (serial8250_start_tx+0x13c/0x234 drivers/tty/serial/8250/8250_port.c:1667) r7:a0000013 r6:824f1440 r5:00000000 r4:824f1440 [<808eb020>] (serial8250_start_tx) from [<808e2324>] (__uart_start+0x50/0x54 drivers/tty/serial/serial_core.c:127) r7:a0000013 r6:824f1440 r5:84cd8800 r4:00000001 [<808e22d4>] (__uart_start) from [<808e46dc>] (uart_start+0x70/0xd0 drivers/tty/serial/serial_core.c:137) [<808e466c>] (uart_start) from [<808e474c>] (uart_flush_chars+0x10/0x14 drivers/tty/serial/serial_core.c:548) r7:ed879000 r6:00000000 r5:ed879000 r4:ed879000 [<808e473c>] (uart_flush_chars) from [<808c5108>] (__receive_buf drivers/tty/n_tty.c:1553 [inline]) [<808e473c>] (uart_flush_chars) from [<808c5108>] (n_tty_receive_buf_common+0x3e8/0x12c8 drivers/tty/n_tty.c:1645) [<808c4d20>] (n_tty_receive_buf_common) from [<808c6028>] (n_tty_receive_buf+0x1c/0x24 drivers/tty/n_tty.c:1674) r10:84cd8800 r9:20000000 r8:00000009 r7:808c600c r6:84cd8800 r5:85238540 r4:00000000 [<808c600c>] (n_tty_receive_buf) from [<808c0e88>] (tiocsti drivers/tty/tty_io.c:2293 [inline]) [<808c600c>] (n_tty_receive_buf) from [<808c0e88>] (tty_ioctl+0x814/0xa68 drivers/tty/tty_io.c:2692) [<808c0674>] (tty_ioctl) from [<804a8188>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<808c0674>] (tty_ioctl) from [<804a8188>] (do_vfs_ioctl fs/ioctl.c:830 [inline]) [<808c0674>] (tty_ioctl) from [<804a8188>] (__do_sys_ioctl fs/ioctl.c:868 [inline]) [<808c0674>] (tty_ioctl) from [<804a8188>] (sys_ioctl+0x110/0xa70 fs/ioctl.c:856) r10:83b06c18 r9:00000004 r8:853a3900 r7:20000000 r6:853a3901 r5:00000000 r4:00005412 [<804a8078>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0xed805fa8 to 0xed805ff0) 5fa0: 00000000 00000000 00000004 00005412 20000000 00000000 5fc0: 00000000 00000000 0012bfc8 00000036 7eb5d312 76fae6d0 7eb5d4a4 76fae20c 5fe0: 76fae020 76fae010 000163a0 0004bf80 r10:00000036 r9:85002280 r8:802002a4 r7:00000036 r6:0012bfc8 r5:00000000 r4:00000000 Code: e6ef5075 e0844001 e7f34054 e2444612 (e5c45000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef5075 uxtb r5, r5 4: e0844001 add r4, r4, r1 8: e7f34054 ubfx r4, r4, #0, #20 c: e2444612 sub r4, r4, #18874368 ; 0x1200000 * 10: e5c45000 strb r5, [r4] <-- trapping instruction