8<--- cut here --- Unable to handle kernel paging request at virtual address fee02f03 when write [fee02f03] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 6154 Comm: syz.7.8435 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:99 [inline] PC is at subdev_8255_io drivers/comedi/drivers/comedi_8255.c:47 [inline] PC is at subdev_8255_io+0x60/0x6c drivers/comedi/drivers/comedi_8255.c:43 LR is at subdev_8255_io drivers/comedi/drivers/comedi_8255.c:47 [inline] LR is at subdev_8255_io+0x4c/0x6c drivers/comedi/drivers/comedi_8255.c:43 pc : [<81555eb0>] lr : [<81555e9c>] psr: 60000013 sp : dfaa1cb8 ip : dfaa1cb8 fp : dfaa1cd4 r10: 00002f00 r9 : 00000004 r8 : dfaa1da4 r7 : 00000000 r6 : 0000009b r5 : 85481f00 r4 : 00002f03 r3 : 0000009b r2 : fee02f03 r1 : 00000001 r0 : 85481f00 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 929e1fc0 DAC: fffffffd Register r0 information: slab kmalloc-192 start 85481f00 pointer offset 0 size 192 Register r1 information: non-paged memory Register r2 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:974 Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: slab kmalloc-192 start 85481f00 pointer offset 0 size 192 Register r6 information: non-paged memory Register r7 information: NULL pointer Register r8 information: 2-page vmalloc region starting at 0xdfaa0000 allocated at kernel_clone+0xc4/0x440 kernel/fork.c:2784 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: 2-page vmalloc region starting at 0xdfaa0000 allocated at kernel_clone+0xc4/0x440 kernel/fork.c:2784 Register r12 information: 2-page vmalloc region starting at 0xdfaa0000 allocated at kernel_clone+0xc4/0x440 kernel/fork.c:2784 Process syz.7.8435 (pid: 6154, stack limit = 0xdfaa0000) Stack: (0xdfaa1cb8 to 0xdfaa2000) 1ca0: 81555e50 00002f00 1cc0: 85481f00 00000000 dfaa1cf4 dfaa1cd8 81555b8c 81555e5c 00002f00 80577d60 1ce0: 9b603000 9b603000 dfaa1d14 dfaa1cf8 81555f44 81555b40 85481f00 00000000 1d00: 9b603000 00000000 dfaa1d54 dfaa1d18 815560f4 81555ec8 ffffffff 00000004 1d20: 8341e340 00000000 00000000 835dfbe8 85481f00 00000000 dfaa1d90 85481f00 1d40: 00000000 83736fe0 dfaa1d8c dfaa1d58 81544aec 8155608c b5403587 00000000 1d60: 00000001 20000640 85481f00 b5403587 40946400 00000001 00000003 9294cb00 1d80: dfaa1e4c dfaa1d90 81540308 815449f0 35353238 00000000 00000000 00000000 1da0: 00000000 00002f00 00000005 0000d09a ffffffff 00000005 00000000 20000004 1dc0: 00000003 00000000 7fffffff 00000008 00000002 10000004 00000008 0000ffff 1de0: 00000006 00000003 000007ff 00000830 00000000 00010000 00000009 00000800 1e00: 00000101 00000002 00007ffe 00300000 00000003 00000004 00000005 0000070f 1e20: 00000000 68593290 00000000 86c7c200 85481f00 20000640 40946400 00000001 1e40: dfaa1f14 dfaa1e50 81541618 81540248 8276ba64 84f665e0 00000064 8538a1bc 1e60: dfaa1ee4 dfaa1e70 8085c254 808525b4 00000064 85481f30 00000000 dfaa1e90 1e80: 00000000 83f7d810 840d6110 40946400 0000000b 00000000 dfaa1e84 00000000 1ea0: 00000000 00000000 00000000 00000000 00000000 68593290 00000000 86c7c200 1ec0: 40946400 20000640 20000640 86c7c200 00000003 9294cb00 dfaa1ef4 dfaa1ee8 1ee0: 8085c384 68593290 dfaa1f14 00000000 86c7c201 40946400 20000640 86c7c200 1f00: 00000003 9294cb00 dfaa1fa4 dfaa1f18 805f26e4 815412d0 ecac8b10 9294cb00 1f20: dfaa1f3c dfaa1f30 81c0a1b4 81c0a080 dfaa1f54 dfaa1f40 8025cbac 80292440 1f40: dfaa1fb0 40000000 dfaa1f84 dfaa1f58 80222bfc 8025cb64 00000000 8341a10c 1f60: dfaa1fb0 0013ee90 ecac8b10 80222b50 00000000 68593290 dfaa1fac 00000000 1f80: 00000000 00356310 00000036 8020029c 9294cb00 00000036 00000000 dfaa1fa8 1fa0: 80200060 805f24ac 00000000 00000000 00000003 40946400 20000640 00000000 1fc0: 00000000 00000000 00356310 00000036 003562d8 00000000 00000001 76f600dc 1fe0: 76f5fe88 76f5fe78 0001903c 00130cf0 60000010 00000003 00000000 00000000 Call trace: [<81555e50>] (subdev_8255_io) from [<81555b8c>] (subdev_8255_do_config+0x58/0x60 drivers/comedi/drivers/comedi_8255.c:115) r7:00000000 r6:85481f00 r5:00002f00 r4:81555e50 [<81555b34>] (subdev_8255_do_config) from [<81555f44>] (__subdev_8255_init drivers/comedi/drivers/comedi_8255.c:172 [inline]) [<81555b34>] (subdev_8255_do_config) from [<81555f44>] (subdev_8255_io_init+0x88/0x98 drivers/comedi/drivers/comedi_8255.c:192) r4:9b603000 [<81555ebc>] (subdev_8255_io_init) from [<815560f4>] (dev_8255_attach drivers/comedi/drivers/8255.c:84 [inline]) [<81555ebc>] (subdev_8255_io_init) from [<815560f4>] (dev_8255_attach+0x74/0x138 drivers/comedi/drivers/8255.c:46) r7:00000000 r6:9b603000 r5:00000000 r4:85481f00 [<81556080>] (dev_8255_attach) from [<81544aec>] (comedi_device_attach+0x108/0x244 drivers/comedi/drivers.c:1101) r10:83736fe0 r9:00000000 r8:85481f00 r7:dfaa1d90 r6:00000000 r5:85481f00 r4:835dfbe8 [<815449e4>] (comedi_device_attach) from [<81540308>] (do_devconfig_ioctl+0xcc/0x218 drivers/comedi/comedi_fops.c:931) r10:9294cb00 r9:00000003 r8:00000001 r7:40946400 r6:b5403587 r5:85481f00 r4:20000640 [<8154023c>] (do_devconfig_ioctl) from [<81541618>] (comedi_unlocked_ioctl+0x354/0x1db8 drivers/comedi/comedi_fops.c:2303) r8:00000001 r7:40946400 r6:20000640 r5:85481f00 r4:86c7c200 [<815412c4>] (comedi_unlocked_ioctl) from [<805f26e4>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<815412c4>] (comedi_unlocked_ioctl) from [<805f26e4>] (do_vfs_ioctl fs/ioctl.c:551 [inline]) [<815412c4>] (comedi_unlocked_ioctl) from [<805f26e4>] (__do_sys_ioctl fs/ioctl.c:595 [inline]) [<815412c4>] (comedi_unlocked_ioctl) from [<805f26e4>] (sys_ioctl+0x244/0xb5c fs/ioctl.c:583) r10:9294cb00 r9:00000003 r8:86c7c200 r7:20000640 r6:40946400 r5:86c7c201 r4:00000000 [<805f24a0>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfaa1fa8 to 0xdfaa1ff0) 1fa0: 00000000 00000000 00000003 40946400 20000640 00000000 1fc0: 00000000 00000000 00356310 00000036 003562d8 00000000 00000001 76f600dc 1fe0: 76f5fe88 76f5fe78 0001903c 00130cf0 r10:00000036 r9:9294cb00 r8:8020029c r7:00000036 r6:00356310 r5:00000000 r4:00000000 Code: e6ef3076 e0842002 e7f32052 e2422612 (e5c23000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef3076 uxtb r3, r6 4: e0842002 add r2, r4, r2 8: e7f32052 ubfx r2, r2, #0, #20 c: e2422612 sub r2, r2, #18874368 @ 0x1200000 * 10: e5c23000 strb r3, [r2] <-- trapping instruction