8<--- cut here --- Unable to handle kernel paging request at virtual address fee00001 [fee00001] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 5072 Comm: syz-executor.0 Not tainted 5.17.0-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:88 [inline] PC is at io_serial_out+0x38/0x40 drivers/tty/serial/8250/8250_port.c:458 LR is at io_serial_out+0x24/0x40 drivers/tty/serial/8250/8250_port.c:458 pc : [<808e6eb4>] lr : [<808e6ea0>] psr: 60000093 sp : ecc01d48 ip : ecc01d48 fp : ecc01d64 r10: 00000001 r9 : 00000fff r8 : 85360c00 r7 : a0000013 r6 : 824f0418 r5 : 00000002 r4 : fee00001 r3 : 00000000 r2 : 00000002 r1 : 00000000 r0 : 824f0418 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 857a5200 DAC: 00000000 Register r0 information: non-slab/vmalloc memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1028 Register r5 information: non-paged memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-slab/vmalloc memory Register r8 information: slab kmalloc-cg-512 start 85360c00 pointer offset 0 size 512 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: 2-page vmalloc region starting at 0xecc00000 allocated at kernel_clone+0x9c/0x42c kernel/fork.c:2636 Register r12 information: 2-page vmalloc region starting at 0xecc00000 allocated at kernel_clone+0x9c/0x42c kernel/fork.c:2636 Process syz-executor.0 (pid: 5072, stack limit = 0xecc00000) Stack: (0xecc01d48 to 0xecc02000) 1d40: 824f0418 00000000 824f0418 a0000013 ecc01d94 ecc01d68 1d60: 808e8cec 808e6e88 00001244 ecc3d000 85360c00 824f0418 00000001 85360c00 1d80: 824f0418 a0000013 ecc01da4 ecc01d98 808dfeb4 808e8bbc ecc01dc4 ecc01da8 1da0: 808e226c 808dfe70 ecc3b000 ecc3d26c 00000001 ecc3b000 ecc01dd4 ecc01dc8 1dc0: 808e22dc 808e2208 ecc01e54 ecc01dd8 808c2c50 808e22d8 ecc01dc0 00005412 1de0: ffffffff 00000000 ffffffff 85360c74 00000001 00000fff 819085b0 55555556 1e00: 00000000 00000000 ecc3d000 ecc01e7c 00000001 ecc01e7c 00000000 ecc3b000 1e20: 00000001 ecc01e7c 8067c728 00000000 858a4700 85360c00 808c3b54 00000009 1e40: 20000bc0 85360c00 ecc01e6c ecc01e58 808c3b70 808c2874 00000000 816f41e0 1e60: ecc01f14 ecc01e70 808bebf0 808c3b60 00000001 83a919e0 01000054 85697400 1e80: 00000006 00000036 ecc01ee4 ecc01e98 8068c2f0 806821ac 00000001 00000054 1ea0: 00000012 ecc01eb4 83df2f10 82c1f6e8 80275412 536ea30b ecc01ea8 81f2fdc4 1ec0: 20000bc0 536ea3cb 81f2f0f4 20000bc0 85697480 00005412 ecc01ef4 ecc01ee8 1ee0: 8068c3f4 536ea3cb ecc01f14 00005412 00000000 85697481 20000bc0 85697480 1f00: 00000006 83a919e0 ecc01fa4 ecc01f18 804a7fbc 808be3c8 820a666c 820a0420 1f20: 0012bfc8 839e1700 839e1e20 820a6670 00000036 60000010 820a6668 839e1700 1f40: 820a6670 00000036 ecc01f64 ecc01f58 816f068c 816f0558 ecc01f84 ecc01f68 1f60: 816f0414 816f067c 60000013 00000000 0012bfc8 536ea3cb ecc01f9c 00000000 1f80: 00000000 0012bfc8 00000036 802002a4 839e1700 00000036 00000000 ecc01fa8 1fa0: 80200060 804a7eb8 00000000 00000000 00000006 00005412 20000bc0 00000000 1fc0: 00000000 00000000 0012bfc8 00000036 7ea88312 76f106d0 7ea884a4 76f1020c 1fe0: 76f10020 76f10010 000163a0 0004bf80 60000010 00000006 00000000 00000000 Backtrace: [<808e6e7c>] (io_serial_out) from [<808e8cec>] (serial_out drivers/tty/serial/8250/8250.h:120 [inline]) [<808e6e7c>] (io_serial_out) from [<808e8cec>] (serial8250_set_THRI drivers/tty/serial/8250/8250.h:140 [inline]) [<808e6e7c>] (io_serial_out) from [<808e8cec>] (__start_tx drivers/tty/serial/8250/8250_port.c:1568 [inline]) [<808e6e7c>] (io_serial_out) from [<808e8cec>] (serial8250_start_tx+0x13c/0x234 drivers/tty/serial/8250/8250_port.c:1667) r7:a0000013 r6:824f0418 r5:00000000 r4:824f0418 [<808e8bb0>] (serial8250_start_tx) from [<808dfeb4>] (__uart_start+0x50/0x54 drivers/tty/serial/serial_core.c:127) r7:a0000013 r6:824f0418 r5:85360c00 r4:00000001 [<808dfe64>] (__uart_start) from [<808e226c>] (uart_start+0x70/0xd0 drivers/tty/serial/serial_core.c:137) [<808e21fc>] (uart_start) from [<808e22dc>] (uart_flush_chars+0x10/0x14 drivers/tty/serial/serial_core.c:548) r7:ecc3b000 r6:00000001 r5:ecc3d26c r4:ecc3b000 [<808e22cc>] (uart_flush_chars) from [<808c2c50>] (__receive_buf drivers/tty/n_tty.c:1553 [inline]) [<808e22cc>] (uart_flush_chars) from [<808c2c50>] (n_tty_receive_buf_common+0x3e8/0x12c8 drivers/tty/n_tty.c:1645) [<808c2868>] (n_tty_receive_buf_common) from [<808c3b70>] (n_tty_receive_buf+0x1c/0x24 drivers/tty/n_tty.c:1674) r10:85360c00 r9:20000bc0 r8:00000009 r7:808c3b54 r6:85360c00 r5:858a4700 r4:00000000 [<808c3b54>] (n_tty_receive_buf) from [<808bebf0>] (tiocsti drivers/tty/tty_io.c:2293 [inline]) [<808c3b54>] (n_tty_receive_buf) from [<808bebf0>] (tty_ioctl+0x834/0xa88 drivers/tty/tty_io.c:2692) [<808be3bc>] (tty_ioctl) from [<804a7fbc>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<808be3bc>] (tty_ioctl) from [<804a7fbc>] (do_vfs_ioctl fs/ioctl.c:830 [inline]) [<808be3bc>] (tty_ioctl) from [<804a7fbc>] (__do_sys_ioctl fs/ioctl.c:868 [inline]) [<808be3bc>] (tty_ioctl) from [<804a7fbc>] (sys_ioctl+0x110/0xa70 fs/ioctl.c:856) r10:83a919e0 r9:00000006 r8:85697480 r7:20000bc0 r6:85697481 r5:00000000 r4:00005412 [<804a7eac>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0xecc01fa8 to 0xecc01ff0) 1fa0: 00000000 00000000 00000006 00005412 20000bc0 00000000 1fc0: 00000000 00000000 0012bfc8 00000036 7ea88312 76f106d0 7ea884a4 76f1020c 1fe0: 76f10020 76f10010 000163a0 0004bf80 r10:00000036 r9:839e1700 r8:802002a4 r7:00000036 r6:0012bfc8 r5:00000000 r4:00000000 Code: e6ef5075 e0844001 e7f34054 e2444612 (e5c45000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef5075 uxtb r5, r5 4: e0844001 add r4, r4, r1 8: e7f34054 ubfx r4, r4, #0, #20 c: e2444612 sub r4, r4, #18874368 ; 0x1200000 * 10: e5c45000 strb r5, [r4] <-- trapping instruction