8<--- cut here --- Unable to handle kernel paging request at virtual address e02de040 [e02de040] *pgd=80000080007003, *pmd=83aec003, *pte=00000000 Internal error: Oops: a07 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 18737 Comm: syz-executor.1 Not tainted 5.17.0-syzkaller #0 Hardware name: ARM-Versatile Express PC is at fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline] PC is at sys_imageblit+0x5c0/0x7c4 drivers/video/fbdev/core/sysimgblt.c:323 LR is at 0xea909a88 pc : [<808888bc>] lr : [] psr: 20000013 sp : ea909a00 ip : 82892ea9 fp : ea909ab4 r10: 00000064 r9 : 82892e46 r8 : e02de040 r7 : 00000001 r6 : 82892e45 r5 : 82933400 r4 : 0000000e r3 : 82892e46 r2 : e02de080 r1 : 00000001 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 8528c600 DAC: 00000000 Register r0 information: NULL pointer Register r1 information: non-paged memory Register r2 information: non-paged memory Register r3 information: slab kmalloc-8k start 82892000 pointer offset 3654 size 8192 Register r4 information: non-paged memory Register r5 information: slab kmalloc-1k start 82933400 pointer offset 0 size 1024 Register r6 information: slab kmalloc-8k start 82892000 pointer offset 3653 size 8192 Register r7 information: non-paged memory Register r8 information: non-paged memory Register r9 information: slab kmalloc-8k start 82892000 pointer offset 3654 size 8192 Register r10 information: non-paged memory Register r11 information: 2-page vmalloc region starting at 0xea908000 allocated at kernel_clone+0x9c/0x42c kernel/fork.c:2639 Register r12 information: slab kmalloc-8k start 82892000 pointer offset 3753 size 8192 Process syz-executor.1 (pid: 18737, stack limit = 0xea908000) Stack: (0xea909a00 to 0xea90a000) 9a00: 00000000 00000063 000000c7 0000018f 00000c80 00000000 000000c8 00000c80 9a20: 00000000 00000190 00000c80 00000064 00000000 00000064 00000320 e02de040 9a40: 802923f0 00000000 00aaaaaa 8028c74c 000f90c0 851dd800 ea909a9c ea909a68 9a60: 802efe10 8109446c 013c29f1 01ffffff 0002fbd0 00000000 00000000 00000000 9a80: ea909a9c 536ea3cb 816f555c ea909b3c 82933400 00000064 8531d584 00000000 9aa0: 000001ff 82888400 ea909ad4 ea909ab8 8091c2cc 80888308 00000032 00000001 9ac0: ffffffff 82892eaa ea909ba4 ea909ad8 80881c9c 8091c290 0000000f 816f5448 9ae0: ea909b04 ea909af0 8288855c ffffffff ffffffff 829335b8 00000000 00000000 9b00: 00000000 00000111 82933400 00000032 8531d520 00000032 ea909b4c 84423980 9b20: 8026bcbc 84423980 00000000 00000002 0000001e 00000002 82967000 00000010 9b40: 0000031b 00000320 0000000f 00000007 00000000 ea909c01 82892e46 00000801 9b60: 80448d5c 00000000 816f7e48 82967c00 ea909ba4 536ea3cb ea909ba4 82888400 9b80: 8531d520 00000032 82933400 80881a7c 00000035 00000007 ea909bec ea909ba8 9ba0: 8087d050 80881a88 00000035 00000001 00000007 00000000 80200bb4 00000007 9bc0: 00000a90 8531d584 8087cf68 00000000 82888400 00000035 8531d584 00000033 9be0: ea909c34 ea909bf0 808da42c 8087cf74 00000001 ea909c10 00000000 00000001 9c00: 00000035 536ea3cb ea909c24 00000032 82888400 8531d520 00000001 00000400 9c20: 00000040 00000033 ea909c64 ea909c38 808ddf4c 808da328 ea909c48 536ea3cb 9c40: 00000000 536ea3cb 82343290 853ec010 00000000 00000033 ea909c7c ea909c68 9c60: 808d540c 808dde6c 82888400 853ec010 ea909d04 ea909c80 808dcfec 808d53d0 9c80: ddeb5670 00000002 853bc000 80000013 ea909cbc ea909ca0 804149c0 80476358 9ca0: ea909dfc 85030000 85618800 00100cc0 84c10000 00000080 80414a04 80414964 9cc0: 00001980 00000000 00000000 00000001 816fddf8 536ea3cb 85030000 82888400 9ce0: 853ec010 00000010 00000033 00000400 0000e020 00000020 ea909d14 ea909d08 9d00: 808dd0a4 808dcafc ea909d44 ea909d18 8087ed18 808dd090 00000200 824efb90 9d20: 0000003f 0000003e 00000200 ea909d9c 824ee000 a4501ee1 ea909d94 ea909d48 9d40: 8087f1e8 8087ec14 853bc010 00000001 824f0504 82888400 00000010 853bc000 9d60: 00003c00 853bc010 00008000 ea909dfc 82888400 00004b72 00000072 84147300 9d80: 82888400 00000001 ea909dec ea909d98 808e1750 8087efc4 80684930 00000010 9da0: 0000000f 00000200 85030000 803b84b0 84147300 85618800 00004b72 8398d240 9dc0: 84147300 82888400 20000440 536ea3cb 20000440 85618800 00004b72 00000072 9de0: ea909e6c ea909df0 808d38ec 808e1498 00000002 82888400 00000000 00000000 9e00: 00000000 00000010 0000000f 00000200 20000040 00000000 00000000 00000000 9e20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 536ea3cb 9e40: 00000000 fffffdfd 00004b72 85618800 8398d240 fffff772 20000440 85618800 9e60: ea909f14 ea909e70 808c1390 808d22b8 20000440 82a9c438 0000004b 8398d240 9e80: 00000004 00000036 ea909ee4 ea909e98 8068c094 80682078 00000001 0000004b 9ea0: 00000072 ea909eb4 84cf9490 82c3a550 ea904b72 536ea30b ea909ea8 81f34dc4 9ec0: 20000440 536ea3cb 81f340f4 20000440 8398d240 00004b72 ea909ef4 ea909ee8 9ee0: 8068c198 536ea3cb ea909f14 00004b72 00000000 8398d241 20000440 8398d240 9f00: 00000004 82a9c438 ea909fa4 ea909f18 804a8104 808c1008 820a666c 820a0420 9f20: 0012bfc8 84147300 84147a20 820a6670 00000036 60000010 820a6668 84147300 9f40: 820a6670 00000036 ea909f64 ea909f58 816f557c 816f5448 ea909f84 ea909f68 9f60: 816f5304 816f556c 60000013 00000000 0012bfc8 536ea3cb ea909f9c 00000000 9f80: 00000000 0012bfc8 00000036 802002a4 84147300 00000036 00000000 ea909fa8 9fa0: 80200060 804a8000 00000000 00000000 00000004 00004b72 20000440 00000000 9fc0: 00000000 00000000 0012bfc8 00000036 7eb1f312 76ffa6d0 7eb1f4a4 76ffa20c 9fe0: 76ffa020 76ffa010 000163a0 0004bf80 60000010 00000004 00000000 00000000 Backtrace: [<808882fc>] (sys_imageblit) from [<8091c2cc>] (drm_fb_helper_sys_imageblit drivers/gpu/drm/drm_fb_helper.c:826 [inline]) [<808882fc>] (sys_imageblit) from [<8091c2cc>] (drm_fbdev_fb_imageblit+0x48/0x4c drivers/gpu/drm/drm_fb_helper.c:2327) r10:82888400 r9:000001ff r8:00000000 r7:8531d584 r6:00000064 r5:82933400 r4:ea909b3c [<8091c284>] (drm_fbdev_fb_imageblit) from [<80881c9c>] (bit_putcs_unaligned drivers/video/fbdev/core/bitblit.c:139 [inline]) [<8091c284>] (drm_fbdev_fb_imageblit) from [<80881c9c>] (bit_putcs+0x220/0x470 drivers/video/fbdev/core/bitblit.c:188) r5:82892eaa r4:ffffffff [<80881a7c>] (bit_putcs) from [<8087d050>] (fbcon_putcs+0xe8/0xf0 drivers/video/fbdev/core/fbcon.c:1296) r10:00000007 r9:00000035 r8:80881a7c r7:82933400 r6:00000032 r5:8531d520 r4:82888400 [<8087cf68>] (fbcon_putcs) from [<808da42c>] (do_update_region+0x110/0x1ac drivers/tty/vt/vt.c:676) r10:00000033 r9:8531d584 r8:00000035 r7:82888400 r6:00000000 r5:8087cf68 r4:8531d584 [<808da31c>] (do_update_region) from [<808ddf4c>] (invert_screen+0xec/0x22c drivers/tty/vt/vt.c:800) r10:00000033 r9:00000040 r8:00000400 r7:00000001 r6:8531d520 r5:82888400 r4:00000032 [<808dde60>] (invert_screen) from [<808d540c>] (highlight drivers/tty/vt/selection.c:57 [inline]) [<808dde60>] (invert_screen) from [<808d540c>] (clear_selection drivers/tty/vt/selection.c:84 [inline]) [<808dde60>] (invert_screen) from [<808d540c>] (clear_selection+0x48/0x54 drivers/tty/vt/selection.c:80) r7:00000033 r6:00000000 r5:853ec010 r4:82343290 [<808d53c4>] (clear_selection) from [<808dcfec>] (vc_do_resize+0x4fc/0x594 drivers/tty/vt/vt.c:1257) r5:853ec010 r4:82888400 [<808dcaf0>] (vc_do_resize) from [<808dd0a4>] (vc_resize+0x20/0x24 drivers/tty/vt/vt.c:1362) r10:00000020 r9:0000e020 r8:00000400 r7:00000033 r6:00000010 r5:853ec010 r4:82888400 [<808dd084>] (vc_resize) from [<8087ed18>] (fbcon_do_set_font+0x110/0x30c drivers/video/fbdev/core/fbcon.c:2442) [<8087ec08>] (fbcon_do_set_font) from [<8087f1e8>] (fbcon_set_font+0x230/0x260 drivers/video/fbdev/core/fbcon.c:2528) r10:a4501ee1 r9:824ee000 r8:ea909d9c r7:00000200 r6:0000003e r5:0000003f r4:824efb90 r3:00000200 [<8087efb8>] (fbcon_set_font) from [<808e1750>] (con_font_set drivers/tty/vt/vt.c:4666 [inline]) [<8087efb8>] (fbcon_set_font) from [<808e1750>] (con_font_op+0x2c4/0x3b4 drivers/tty/vt/vt.c:4710) r10:00000001 r9:82888400 r8:84147300 r7:00000072 r6:00004b72 r5:82888400 r4:ea909dfc [<808e148c>] (con_font_op) from [<808d38ec>] (vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline]) [<808e148c>] (con_font_op) from [<808d38ec>] (vt_ioctl+0x1640/0x1a2c drivers/tty/vt/vt_ioctl.c:752) r7:00000072 r6:00004b72 r5:85618800 r4:20000440 [<808d22ac>] (vt_ioctl) from [<808c1390>] (tty_ioctl+0x394/0xa68 drivers/tty/tty_io.c:2778) r10:85618800 r9:20000440 r8:fffff772 r7:8398d240 r6:85618800 r5:00004b72 r4:fffffdfd [<808c0ffc>] (tty_ioctl) from [<804a8104>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<808c0ffc>] (tty_ioctl) from [<804a8104>] (do_vfs_ioctl fs/ioctl.c:830 [inline]) [<808c0ffc>] (tty_ioctl) from [<804a8104>] (__do_sys_ioctl fs/ioctl.c:868 [inline]) [<808c0ffc>] (tty_ioctl) from [<804a8104>] (sys_ioctl+0x110/0xa70 fs/ioctl.c:856) r10:82a9c438 r9:00000004 r8:8398d240 r7:20000440 r6:8398d241 r5:00000000 r4:00004b72 [<804a7ff4>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0xea909fa8 to 0xea909ff0) 9fa0: 00000000 00000000 00000004 00004b72 20000440 00000000 9fc0: 00000000 00000000 0012bfc8 00000036 7eb1f312 76ffa6d0 7eb1f4a4 76ffa20c 9fe0: 76ffa020 76ffa010 000163a0 0004bf80 r10:00000036 r9:84147300 r8:802002a4 r7:00000036 r6:0012bfc8 r5:00000000 r4:00000000 Code: e15c0003 e00703a0 e08e0100 e5100044 (e5020040) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e15c0003 cmp ip, r3 4: e00703a0 and r0, r7, r0, lsr #7 8: e08e0100 add r0, lr, r0, lsl #2 c: e5100044 ldr r0, [r0, #-68] ; 0xffffffbc * 10: e5020040 str r0, [r2, #-64] ; 0xffffffc0 <-- trapping instruction