rc rc0: IR event FIFO is full!
rc rc0: IR event FIFO is full!
rc rc0: IR event FIFO is full!
rc rc0: IR event FIFO is full!
general protection fault, probably for non-canonical address 0xdffffc000000021b: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: probably user-memory-access in range [0x00000000000010d8-0x00000000000010df]
CPU: 0 PID: 11 Comm: kworker/u8:1 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:ir_raw_event_store_with_filter+0x459/0x960 drivers/media/rc/rc-ir-raw.c:184
Code: 0f b6 04 28 84 c0 0f 85 cc 02 00 00 48 89 e8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 dc 02 00 00 48 8b 2a 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 0c 48 89 df e8 e8 a5 49 fa 48 8b 14 24 48 89 2b
RSP: 0018:ffffc900000075e8 EFLAGS: 00010006
RAX: 000000000000021b RBX: 00000000000010d8 RCX: 8095e098fa58a200
RDX: ffffc90000007780 RSI: 0000000080000100 RDI: 0000000000000000
RBP: 0000000000000080 R08: ffffffff8175c06c R09: fffffbfff1bf9650
R10: dffffc0000000000 R11: fffffbfff1bf9650 R12: ffff88807ccab000
R13: dffffc0000000000 R14: 1ffff1100f9956b7 R15: ffff88807ccab5b8
FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001178 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
sz_push drivers/media/rc/streamzap.c:104 [inline]
sz_push_full_space drivers/media/rc/streamzap.c:132 [inline]
sz_push_half_space drivers/media/rc/streamzap.c:138 [inline]
streamzap_callback+0x856/0x1310 drivers/media/rc/streamzap.c:190
__usb_hcd_giveback_urb+0x373/0x530 drivers/usb/core/hcd.c:1650
dummy_timer+0x8aa/0x3220 drivers/usb/gadget/udc/dummy_hcd.c:1987
call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1843 [inline]
__run_timers kernel/time/timer.c:2408 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2419
run_timer_base kernel/time/timer.c:2428 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
__do_softirq+0x2bc/0x943 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x25b/0x530 kernel/locking/lockdep.c:5758
Code: 2b 00 74 08 4c 89 f7 e8 b3 5a 83 00 f6 44 24 61 02 0f 85 8e 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc90000107420 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92000020e90 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff8baad360 RDI: ffffffff8bfdff00
RBP: ffffc90000107568 R08: ffffffff92cae507 R09: 1ffffffff2595ca0
R10: dffffc0000000000 R11: fffffbfff2595ca1 R12: 1ffff92000020e8c
R13: dffffc0000000000 R14: ffffc90000107480 R15: 0000000000000246
rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
rcu_read_lock include/linux/rcupdate.h:750 [inline]
__pte_offset_map+0x9e/0x380 mm/pgtable-generic.c:285
__pte_offset_map_lock+0xc7/0x300 mm/pgtable-generic.c:369
get_locked_pte include/linux/mm.h:2683 [inline]
__text_poke+0x2c5/0xd30 arch/x86/kernel/alternative.c:1900
text_poke arch/x86/kernel/alternative.c:1985 [inline]
text_poke_bp_batch+0x265/0xb30 arch/x86/kernel/alternative.c:2293
text_poke_flush arch/x86/kernel/alternative.c:2487 [inline]
text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2494
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
static_key_disable_cpuslocked+0xce/0x1c0 kernel/jump_label.c:235
static_key_disable+0x1a/0x20 kernel/jump_label.c:243
toggle_allocation_gate+0x1b8/0x250 mm/kfence/core.c:831
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ir_raw_event_store_with_filter+0x459/0x960 drivers/media/rc/rc-ir-raw.c:184
Code: 0f b6 04 28 84 c0 0f 85 cc 02 00 00 48 89 e8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 dc 02 00 00 48 8b 2a 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 0c 48 89 df e8 e8 a5 49 fa 48 8b 14 24 48 89 2b
RSP: 0018:ffffc900000075e8 EFLAGS: 00010006
RAX: 000000000000021b RBX: 00000000000010d8 RCX: 8095e098fa58a200
RDX: ffffc90000007780 RSI: 0000000080000100 RDI: 0000000000000000
RBP: 0000000000000080 R08: ffffffff8175c06c R09: fffffbfff1bf9650
R10: dffffc0000000000 R11: fffffbfff1bf9650 R12: ffff88807ccab000
R13: dffffc0000000000 R14: 1ffff1100f9956b7 R15: ffff88807ccab5b8
FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001178 CR3: 000000000df32000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax
4: 84 c0 test %al,%al
6: 0f 85 cc 02 00 00 jne 0x2d8
c: 48 89 e8 mov %rbp,%rax
f: 48 c1 e8 03 shr $0x3,%rax
13: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax
18: 84 c0 test %al,%al
1a: 0f 85 dc 02 00 00 jne 0x2fc
20: 48 8b 2a mov (%rdx),%rbp
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 0c je 0x3d
31: 48 89 df mov %rbx,%rdi
34: e8 e8 a5 49 fa call 0xfa49a621
39: 48 8b 14 24 mov (%rsp),%rdx
3d: 48 89 2b mov %rbp,(%rbx)