------------[ cut here ]------------ virt_to_phys used for non-linear address: 00000000004e8ca5 (0xdead4ead00000000) WARNING: CPU: 0 PID: 6440 at arch/arm64/mm/physaddr.c:15 __virt_to_phys+0x88/0xa0 arch/arm64/mm/physaddr.c:17 Modules linked in: CPU: 0 PID: 6440 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : __virt_to_phys+0x88/0xa0 arch/arm64/mm/physaddr.c:17 lr : __virt_to_phys+0x84/0xa0 arch/arm64/mm/physaddr.c:12 sp : ffff800022bc74b0 x29: ffff800022bc74b0 x28: ffff0000e1616258 x27: ffff800012007540 x26: ffff0000e1616308 x25: ffff800012007540 x24: dfff800000000000 x23: dfff800000000000 x22: ffff700004578ebc x21: 0000000000040000 x20: deae4ead00000000 x19: dead4ead00000000 x18: 1fffe00033c2177e x17: ffff8000163dd000 x16: ffff8000082de324 x15: 0000000040000000 x14: 0000000000000001 x13: 1fffe00033c23e88 x12: 0000000000000000 x11: ff0080000a932840 x10: 0000000000000003 x9 : 0a19ebff2a090800 x8 : ffff800014db2000 x7 : ffff80000825b754 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : ffff800011cfdca0 x0 : ffff800187dd5000 Call trace: __virt_to_phys+0x88/0xa0 arch/arm64/mm/physaddr.c:17 virt_to_folio include/linux/mm.h:913 [inline] kfree+0x8c/0x1a8 mm/slab_common.c:980 kvfree+0x40/0x50 mm/util.c:627 run_close fs/ntfs3/ntfs_fs.h:938 [inline] indx_clear+0x40/0x8c fs/ntfs3/index.c:910 ni_clear+0x238/0x550 fs/ntfs3/frecord.c:123 ntfs_evict_inode+0x8c/0xb8 fs/ntfs3/inode.c:1794 evict+0x3d8/0x81c fs/inode.c:703 iput_final fs/inode.c:1832 [inline] iput+0x728/0x7e8 fs/inode.c:1858 dentry_unlink_inode+0x360/0x438 fs/dcache.c:405 __dentry_kill+0x318/0x590 fs/dcache.c:611 shrink_dentry_list+0x404/0x7d0 fs/dcache.c:1206 shrink_dcache_parent+0xb0/0x364 fs/dcache.c:-1 do_one_tree+0x2c/0xf4 fs/dcache.c:1689 shrink_dcache_for_umount+0x6c/0x118 fs/dcache.c:1706 generic_shutdown_super+0x6c/0x32c fs/super.c:473 kill_block_super+0x78/0xe0 fs/super.c:1481 deactivate_locked_super+0xb4/0x128 fs/super.c:332 deactivate_super+0xe4/0x104 fs/super.c:363 cleanup_mnt+0x3a8/0x430 fs/namespace.c:1191 __cleanup_mnt+0x20/0x30 fs/namespace.c:1198 task_work_run+0x1f4/0x280 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1166 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589 irq event stamp: 233142 hardirqs last enabled at (233141): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1375 [inline] hardirqs last enabled at (233141): [] finish_lock_switch+0xb0/0x1c8 kernel/sched/core.c:5016 hardirqs last disabled at (233142): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (233124): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (233124): [] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624 softirqs last disabled at (232989): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- Unable to handle kernel paging request at virtual address 007ab33abad70008 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [007ab33abad70008] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6440 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : _compound_head include/linux/page-flags.h:253 [inline] pc : virt_to_folio include/linux/mm.h:915 [inline] pc : kfree+0xa0/0x1a8 mm/slab_common.c:980 lr : virt_to_folio include/linux/mm.h:913 [inline] lr : kfree+0x8c/0x1a8 mm/slab_common.c:980 sp : ffff800022bc74d0 x29: ffff800022bc74d0 x28: ffff0000e1616258 x27: ffff800012007540 x26: ffff0000e1616308 x25: ffff800012007540 x24: dfff800000000000 x23: dfff800000000000 x22: ffff700004578ebc x21: 0000000000040000 x20: ffff80000878b090 x19: dead4ead00000000 x18: 1fffe00033c2177e x17: ffff8000163dd000 x16: ffff8000082de324 x15: 0000000040000000 x14: 0000000000000001 x13: 1fffe00033c23e88 x12: 0000000000000000 x11: ff0080000a932840 x10: 0000000000000003 x9 : 037ab73abad70000 x8 : 037ab33abad70000 x7 : ffff80000825b754 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : ffff800011cfdca0 x0 : deadceaef5c00000 Call trace: virt_to_folio include/linux/mm.h:913 [inline] kfree+0xa0/0x1a8 mm/slab_common.c:980 kvfree+0x40/0x50 mm/util.c:627 run_close fs/ntfs3/ntfs_fs.h:938 [inline] indx_clear+0x40/0x8c fs/ntfs3/index.c:910 ni_clear+0x238/0x550 fs/ntfs3/frecord.c:123 ntfs_evict_inode+0x8c/0xb8 fs/ntfs3/inode.c:1794 evict+0x3d8/0x81c fs/inode.c:703 iput_final fs/inode.c:1832 [inline] iput+0x728/0x7e8 fs/inode.c:1858 dentry_unlink_inode+0x360/0x438 fs/dcache.c:405 __dentry_kill+0x318/0x590 fs/dcache.c:611 shrink_dentry_list+0x404/0x7d0 fs/dcache.c:1206 shrink_dcache_parent+0xb0/0x364 fs/dcache.c:-1 do_one_tree+0x2c/0xf4 fs/dcache.c:1689 shrink_dcache_for_umount+0x6c/0x118 fs/dcache.c:1706 generic_shutdown_super+0x6c/0x32c fs/super.c:473 kill_block_super+0x78/0xe0 fs/super.c:1481 deactivate_locked_super+0xb4/0x128 fs/super.c:332 deactivate_super+0xe4/0x104 fs/super.c:363 cleanup_mnt+0x3a8/0x430 fs/namespace.c:1191 __cleanup_mnt+0x20/0x30 fs/namespace.c:1198 task_work_run+0x1f4/0x280 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1166 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589 Code: b25657e8 927acd29 cb151929 8b080128 (f9400509) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: b25657e8 mov x8, #0xfffffc0000000000 // #-4398046511104 4: 927acd29 and x9, x9, #0x3ffffffffffffc0 8: cb151929 sub x9, x9, x21, lsl #6 c: 8b080128 add x8, x9, x8 * 10: f9400509 ldr x9, [x8, #8] <-- trapping instruction