Unable to handle kernel paging request at virtual address fbd5200000000022
KASAN: maybe wild-memory-access in range [0xdead000000000110-0xdead000000000117]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[fbd5200000000022] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 20952 Comm: syz-executor.0 Not tainted 6.4.0-rc3-syzkaller-00190-g0d85b27b0cc6 #0
Hardware name: linux,dummy-virt (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : nfc_llcp_find_local+0x54/0xf4 net/nfc/llcp_core.c:287
lr : nfc_llcp_unregister_device+0x10/0x20c net/nfc/llcp_core.c:1611
sp : ffff8000191f7970
x29: ffff8000191f7970 x28: ffff00000f334bc0 x27: ffff0000167824a0
x26: ffff00002f332038 x25: 1fffe00005e66407 x24: 1fffe0000170f634
x23: ffff00002f337600 x22: ffff00002f337000 x21: ffff80000f7bcf00
x20: dfff800000000000 x19: dead000000000100 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 1ffff0000323eec4
x14: 00000000f1f1f1f1 x13: 0000000000000007 x12: ffff70000323ef2b
x11: 1ffff0000323ef2a x10: ffff70000323ef2a x9 : dfff800000000000
x8 : ffff8000191f7957 x7 : 00008ffffcdc10d6 x6 : 0000000000000001
x5 : ffff8000191f7950 x4 : ffff70000323ef2b x3 : ffff80000cb3bf30
x2 : 1bd5a00000000022 x1 : 0000000000000000 x0 : dead000000000110
Call trace:
 nfc_llcp_find_local+0x54/0xf4 net/nfc/llcp_core.c:287
 nfc_llcp_unregister_device+0x10/0x20c net/nfc/llcp_core.c:1611
 nfc_unregister_device+0x120/0x298 net/nfc/core.c:1179
 nci_unregister_device+0x1c0/0x280 net/nfc/nci/core.c:1303
 virtual_ncidev_close+0x48/0xb0 drivers/nfc/virtual_ncidev.c:163
 __fput+0x1ac/0x860 fs/file_table.c:321
 ____fput+0x10/0x1c fs/file_table.c:349
 task_work_run+0x124/0x20c kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x908/0x26b4 arch/arm64/kernel/signal.c:1304
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x10c/0x130 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0xb8/0xbc arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: eb15027f 540001e0 91004260 d343fc02 (38f46842) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	eb15027f 	cmp	x19, x21
   4:	540001e0 	b.eq	0x40  // b.none
   8:	91004260 	add	x0, x19, #0x10
   c:	d343fc02 	lsr	x2, x0, #3
* 10:	38f46842 	ldrsb	w2, [x2, x20] <-- trapping instruction