general protection fault, probably for non-canonical address 0xdffffc000000044c: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000000002260-0x0000000000002267]
CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound flush_to_ldisc
RIP: 0010:n_tty_receive_buf_common+0xdd/0x4780 drivers/tty/n_tty.c:1653
Code: e8 03 4c 89 6c 24 08 c7 84 24 8c 00 00 00 00 00 00 00 4c 01 f8 48 89 84 24 98 00 00 00 e8 0b 48 3d fd 48 8b 84 24 90 00 00 00 <80> 38 00 0f 85 45 3c 00 00 48 8b 44 24 20 4c 8b a8 60 22 00 00 48
RSP: 0018:ffffc90000cf7af8 EFLAGS: 00010293
RAX: dffffc000000044c RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888010e41d00 RSI: ffffffff843a5ab5 RDI: ffff888068bf13a0
RBP: ffff88823bddc020 R08: 0000000000000001 R09: ffff888068bf1287
R10: ffffed100d17e250 R11: 0000000000000008 R12: 0000000000000139
R13: ffff888068bf1000 R14: ffff88823bddc020 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2df21000 CR3: 000000007e1d9000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 tty_ldisc_receive_buf+0xa3/0x190 drivers/tty/tty_buffer.c:471
 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:39
 receive_buf drivers/tty/tty_buffer.c:491 [inline]
 flush_to_ldisc+0x20d/0x3f0 drivers/tty/tty_buffer.c:543
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace b73be39ecb746bc6 ]---
RIP: 0010:n_tty_receive_buf_common+0xdd/0x4780 drivers/tty/n_tty.c:1653
Code: e8 03 4c 89 6c 24 08 c7 84 24 8c 00 00 00 00 00 00 00 4c 01 f8 48 89 84 24 98 00 00 00 e8 0b 48 3d fd 48 8b 84 24 90 00 00 00 <80> 38 00 0f 85 45 3c 00 00 48 8b 44 24 20 4c 8b a8 60 22 00 00 48
RSP: 0018:ffffc90000cf7af8 EFLAGS: 00010293
RAX: dffffc000000044c RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888010e41d00 RSI: ffffffff843a5ab5 RDI: ffff888068bf13a0
RBP: ffff88823bddc020 R08: 0000000000000001 R09: ffff888068bf1287
R10: ffffed100d17e250 R11: 0000000000000008 R12: 0000000000000139
R13: ffff888068bf1000 R14: ffff88823bddc020 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020caefb8 CR3: 00000000224f2000 CR4: 0000000000350ee0
----------------
Code disassembly (best guess):
   0:	e8 03 4c 89 6c       	callq  0x6c894c08
   5:	24 08                	and    $0x8,%al
   7:	c7 84 24 8c 00 00 00 	movl   $0x0,0x8c(%rsp)
   e:	00 00 00 00
  12:	4c 01 f8             	add    %r15,%rax
  15:	48 89 84 24 98 00 00 	mov    %rax,0x98(%rsp)
  1c:	00
  1d:	e8 0b 48 3d fd       	callq  0xfd3d482d
  22:	48 8b 84 24 90 00 00 	mov    0x90(%rsp),%rax
  29:	00
* 2a:	80 38 00             	cmpb   $0x0,(%rax) <-- trapping instruction
  2d:	0f 85 45 3c 00 00    	jne    0x3c78
  33:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
  38:	4c 8b a8 60 22 00 00 	mov    0x2260(%rax),%r13
  3f:	48                   	rex.W