8<--- cut here --- Unable to handle kernel paging request at virtual address fee00001 [fee00001] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 4807 Comm: syz-executor.0 Not tainted 5.17.0-rc7-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:88 [inline] PC is at io_serial_out+0x38/0x40 drivers/tty/serial/8250/8250_port.c:458 LR is at io_serial_out+0x24/0x40 drivers/tty/serial/8250/8250_port.c:458 pc : [<808e1f10>] lr : [<808e1efc>] psr: 60000093 sp : 855c3d48 ip : 855c3d48 fp : 855c3d64 r10: 00000001 r9 : 00000fff r8 : 854ee200 r7 : a0000013 r6 : 824f1390 r5 : 00000002 r4 : fee00001 r3 : 00000000 r2 : 00000002 r1 : 00000000 r0 : 824f1390 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 8508d700 DAC: 00000000 Register r0 information: non-slab/vmalloc memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1028 Register r5 information: non-paged memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-slab/vmalloc memory Register r8 information: slab kmalloc-512 start 854ee200 pointer offset 0 size 512 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: non-slab/vmalloc memory Register r12 information: non-slab/vmalloc memory Process syz-executor.0 (pid: 4807, stack limit = 0x855c2000) Stack: (0x855c3d48 to 0x855c4000) 3d40: 824f1390 00000000 824f1390 a0000013 855c3d94 855c3d68 3d60: 808e3d48 808e1ee4 808b6740 808def80 ee1bf000 824f1390 00000001 854ee200 3d80: 824f1390 a0000013 855c3da4 855c3d98 808daedc 808e3c18 855c3dc4 855c3da8 3da0: 808dd294 808dae98 ee1bf000 ee1c126c 000000ab ee1bf000 855c3dd4 855c3dc8 3dc0: 808dd304 808dd230 855c3e54 855c3dd8 808bdb1c 808dd300 00000000 ffffffff 3de0: ffffffff 00000000 ffffffff 854ee274 00000001 00000fff 819082b0 55555556 3e00: 00000000 00000000 ee1c1000 855c3e7c 00000001 855c3e7c 00000000 ee1bf000 3e20: 00000001 855c3e7c 806785f4 00000000 85523d80 854ee200 808bea20 00000009 3e40: 20000280 854ee200 855c3e6c 855c3e58 808bea3c 808bd740 00000000 816df31c 3e60: 855c3f14 855c3e70 808b9aa8 808bea2c 00000000 d128f410 ab003231 00000000 3e80: 00000012 00000001 83c7bae8 839f4a80 00000004 00000036 855c3ef4 855c3ea8 3ea0: 80688218 8067e058 00000001 00000054 00000012 855c3ec4 83fd5190 82c137f8 3ec0: 20005412 839f4a0b 855c3eb8 839f4a80 00000004 d128f410 81f290f0 20000280 3ee0: 839f4a80 d128f410 855c3f14 00005412 00000000 839f4a81 20000280 839f4a80 3f00: 00000004 83c7bae8 855c3fa4 855c3f18 804a4c70 808b9290 820a55ec 8209f3b0 3f20: 0012bfc8 84582e00 84583520 820a55f0 00000036 60000010 820a55e8 84582e00 3f40: 820a55f0 00000036 855c3f64 855c3f58 816db108 816dafd4 855c3f84 855c3f68 3f60: 816dae90 816db0f8 60000013 00000000 0012bfc8 d128f410 855c3f9c 00000000 3f80: 00000000 0012bfc8 00000036 802002a4 84582e00 00000036 00000000 855c3fa8 3fa0: 80200060 804a4b6c 00000000 00000000 00000004 00005412 20000280 00000000 3fc0: 00000000 00000000 0012bfc8 00000036 7e88d312 76fbf6d0 7e88d4a4 76fbf20c 3fe0: 76fbf020 76fbf010 000163a0 0004bf80 60000010 00000004 00000000 00000000 Backtrace: [<808e1ed8>] (io_serial_out) from [<808e3d48>] (serial_out drivers/tty/serial/8250/8250.h:120 [inline]) [<808e1ed8>] (io_serial_out) from [<808e3d48>] (serial8250_set_THRI drivers/tty/serial/8250/8250.h:140 [inline]) [<808e1ed8>] (io_serial_out) from [<808e3d48>] (__start_tx drivers/tty/serial/8250/8250_port.c:1568 [inline]) [<808e1ed8>] (io_serial_out) from [<808e3d48>] (serial8250_start_tx+0x13c/0x234 drivers/tty/serial/8250/8250_port.c:1667) r7:a0000013 r6:824f1390 r5:00000000 r4:824f1390 [<808e3c0c>] (serial8250_start_tx) from [<808daedc>] (__uart_start+0x50/0x54 drivers/tty/serial/serial_core.c:127) r7:a0000013 r6:824f1390 r5:854ee200 r4:00000001 [<808dae8c>] (__uart_start) from [<808dd294>] (uart_start+0x70/0xd0 drivers/tty/serial/serial_core.c:137) [<808dd224>] (uart_start) from [<808dd304>] (uart_flush_chars+0x10/0x14 drivers/tty/serial/serial_core.c:548) r7:ee1bf000 r6:000000ab r5:ee1c126c r4:ee1bf000 [<808dd2f4>] (uart_flush_chars) from [<808bdb1c>] (__receive_buf drivers/tty/n_tty.c:1553 [inline]) [<808dd2f4>] (uart_flush_chars) from [<808bdb1c>] (n_tty_receive_buf_common+0x3e8/0x12c8 drivers/tty/n_tty.c:1645) [<808bd734>] (n_tty_receive_buf_common) from [<808bea3c>] (n_tty_receive_buf+0x1c/0x24 drivers/tty/n_tty.c:1674) r10:854ee200 r9:20000280 r8:00000009 r7:808bea20 r6:854ee200 r5:85523d80 r4:00000000 [<808bea20>] (n_tty_receive_buf) from [<808b9aa8>] (tiocsti drivers/tty/tty_io.c:2293 [inline]) [<808bea20>] (n_tty_receive_buf) from [<808b9aa8>] (tty_ioctl+0x824/0xa90 drivers/tty/tty_io.c:2692) [<808b9284>] (tty_ioctl) from [<804a4c70>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<808b9284>] (tty_ioctl) from [<804a4c70>] (do_vfs_ioctl fs/ioctl.c:834 [inline]) [<808b9284>] (tty_ioctl) from [<804a4c70>] (__do_sys_ioctl fs/ioctl.c:872 [inline]) [<808b9284>] (tty_ioctl) from [<804a4c70>] (sys_ioctl+0x110/0xaa0 fs/ioctl.c:860) r10:83c7bae8 r9:00000004 r8:839f4a80 r7:20000280 r6:839f4a81 r5:00000000 r4:00005412 [<804a4b60>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0x855c3fa8 to 0x855c3ff0) 3fa0: 00000000 00000000 00000004 00005412 20000280 00000000 3fc0: 00000000 00000000 0012bfc8 00000036 7e88d312 76fbf6d0 7e88d4a4 76fbf20c 3fe0: 76fbf020 76fbf010 000163a0 0004bf80 r10:00000036 r9:84582e00 r8:802002a4 r7:00000036 r6:0012bfc8 r5:00000000 r4:00000000 Code: e6ef5075 e0844001 e7f34054 e2444612 (e5c45000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef5075 uxtb r5, r5 4: e0844001 add r4, r4, r1 8: e7f34054 ubfx r4, r4, #0, #20 c: e2444612 sub r4, r4, #18874368 ; 0x1200000 * 10: e5c45000 strb r5, [r4] <-- trapping instruction