input: syz0 as /devices/virtual/input/input8
Unable to handle kernel paging request at virtual address ffff8000932ec000
KASAN: probably user-memory-access in range [0x0000000499760000-0x0000000499760007]
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000
  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b049000
[ffff8000932ec000] pgd=0000000000000000, p4d=1000000221341003, pud=1000000221342003, pmd=1000000106640403, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 7850 Comm: syz.9.674 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __raw_writeq arch/arm64/include/asm/io.h:50 [inline]
pc : memcpy_toio+0x140/0x23c lib/iomem_copy.c:116
lr : memcpy_toio+0x158/0x23c lib/iomem_copy.c:113
sp : ffff800092f47390
x29: ffff800092f47390 x28: ffff8000932ebc80 x27: 0000000000000640
x26: ffff800093489c80 x25: 0000000000000000 x24: 1fffe000183a2aeb
x23: dfff800000000000 x22: ffff80009348a000 x21: 00000000000002b8
x20: ffff8000932ec000 x19: ffff80009348a008 x18: 00000000ffffffff
x17: ffff80008a7d6000 x16: 0000000000000007 x15: ffff80008a35fda0
x14: ffff80008a5d5e28 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000080000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000025800000320 x6 : 0000000000000000
x5 : ffff800092f475d0 x4 : ffff800092f47590 x3 : ffff8000868a7e5c
x2 : 0000000000000640 x1 : ffff0000c8730000 x0 : 0000000000000001
Call trace:
 memcpy_toio+0x140/0x23c lib/iomem_copy.c:114 (P)
 iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline]
 drm_fb_memcpy+0x29c/0x4c4 drivers/gpu/drm/drm_format_helper.c:442
 cirrus_primary_plane_helper_atomic_update+0x90c/0xa48 drivers/gpu/drm/tiny/cirrus-qemu.c:358
 drm_atomic_helper_commit_planes+0x4ac/0xb60 drivers/gpu/drm/drm_atomic_helper.c:3038
 drm_atomic_helper_commit_tail+0x54/0x90 drivers/gpu/drm/drm_atomic_helper.c:1989
 commit_tail+0x278/0x3a8 drivers/gpu/drm/drm_atomic_helper.c:2074
 drm_atomic_helper_commit+0x26c/0x280 drivers/gpu/drm/drm_atomic_helper.c:2312
 drm_atomic_commit+0x214/0x280 drivers/gpu/drm/drm_atomic.c:1789
 drm_client_modeset_commit_atomic+0x534/0x6b8 drivers/gpu/drm/drm_client_modeset.c:1104
 drm_client_modeset_commit_locked+0xd0/0x494 drivers/gpu/drm/drm_client_modeset.c:1207
 drm_client_modeset_commit+0x50/0x7c drivers/gpu/drm/drm_client_modeset.c:1233
 __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0x1a0 drivers/gpu/drm/drm_fb_helper.c:138
 drm_fb_helper_restore_fbdev_mode_unlocked+0x28/0x38 drivers/gpu/drm/drm_fb_helper.c:169
 drm_fbdev_client_restore+0x28/0x3c drivers/gpu/drm/clients/drm_fbdev_client.c:45
 drm_client_dev_restore+0x128/0x244 drivers/gpu/drm/drm_client_event.c:118
 drm_lastclose drivers/gpu/drm/drm_file.c:408 [inline]
 drm_release+0x1b0/0x284 drivers/gpu/drm/drm_file.c:441
 __fput+0x338/0x74c fs/file_table.c:512
 ____fput+0x20/0x30 fs/file_table.c:540
 task_work_run+0x1cc/0x25c kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline]
 el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:759
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Code: d343fd09 38f76929 35000169 f85f8268 (f9000288) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d343fd09 	lsr	x9, x8, #3
   4:	38f76929 	ldrsb	w9, [x9, x23]
   8:	35000169 	cbnz	w9, 0x34
   c:	f85f8268 	ldur	x8, [x19, #-8]
* 10:	f9000288 	str	x8, [x20] <-- trapping instruction