Unable to handle kernel paging request at virtual address fbd5200000000022
KASAN: maybe wild-memory-access in range [0xdead000000000110-0xdead000000000117]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[fbd5200000000022] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 8655 Comm: syz-executor.0 Not tainted 6.2.0-rc8-syzkaller-00098-gec35307e18ba #0
Hardware name: linux,dummy-virt (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : nfc_llcp_find_local+0x54/0xfc net/nfc/llcp_core.c:287
lr : nfc_llcp_unregister_device+0x10/0x20c net/nfc/llcp_core.c:1611
sp : ffff800011f97970
x29: ffff800011f97970 x28: ffff00000f31b318 x27: ffff000013a030a0
x26: ffff00000ff21038 x25: 1fffe00001fe4207 x24: 1fffe00001f8e1e4
x23: ffff00000ff23600 x22: ffff00000ff23000 x21: ffff80000f7205c0
x20: dfff800000000000 x19: dead000000000100 x18: ffff00006a936c00
x17: 0000000000000000 x16: 0000000000000000 x15: ffff00006a936bc8
x14: 1ffff000023f2eb6 x13: 0000000000000000 x12: ffff7000023f2f2b
x11: 1ffff000023f2f2a x10: ffff7000023f2f2a x9 : dfff800000000000
x8 : ffff800011f97957 x7 : 00008ffffdc0d0d6 x6 : 0000000000000001
x5 : ffff800011f97950 x4 : ffff7000023f2f2b x3 : ffff80000cb63070
x2 : 1bd5a00000000022 x1 : 0000000000000000 x0 : dead000000000110
Call trace:
 nfc_llcp_find_local+0x54/0xfc net/nfc/llcp_core.c:287
 nfc_llcp_unregister_device+0x10/0x20c net/nfc/llcp_core.c:1611
 nfc_unregister_device+0x120/0x2a0 net/nfc/core.c:1179
 nci_unregister_device+0x1bc/0x280 net/nfc/nci/core.c:1303
 virtual_ncidev_close+0x48/0xb0 drivers/nfc/virtual_ncidev.c:163
 __fput+0x1ac/0x860 fs/file_table.c:320
 ____fput+0x10/0x1c fs/file_table.c:348
 task_work_run+0x12c/0x220 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x920/0x2880 arch/arm64/kernel/signal.c:1137
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x11c/0x140 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0xb8/0xc0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
Code: eb15027f 540001e0 91004260 d343fc02 (38f46842) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	eb15027f 	cmp	x19, x21
   4:	540001e0 	b.eq	0x40  // b.none
   8:	91004260 	add	x0, x19, #0x10
   c:	d343fc02 	lsr	x2, x0, #3
* 10:	38f46842 	ldrsb	w2, [x2, x20] <-- trapping instruction