8<--- cut here --- Unable to handle kernel paging request at virtual address fee00001 [fee00001] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 25298 Comm: syz-executor.0 Not tainted 5.17.0-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:88 [inline] PC is at io_serial_out+0x38/0x40 drivers/tty/serial/8250/8250_port.c:458 LR is at io_serial_out+0x24/0x40 drivers/tty/serial/8250/8250_port.c:458 pc : [<808e4a00>] lr : [<808e49ec>] psr: 60000093 sp : 850fbd48 ip : 850fbd48 fp : 850fbd64 r10: 00000001 r9 : 00000fff r8 : 82959600 r7 : a0000013 r6 : 824f0418 r5 : 00000002 r4 : fee00001 r3 : 00000000 r2 : 00000002 r1 : 00000000 r0 : 824f0418 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 83e76600 DAC: fffffffd Register r0 information: non-slab/vmalloc memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1028 Register r5 information: non-paged memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-slab/vmalloc memory Register r8 information: slab kmalloc-512 start 82959600 pointer offset 0 size 512 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: non-slab/vmalloc memory Register r12 information: non-slab/vmalloc memory Process syz-executor.0 (pid: 25298, stack limit = 0x850fa000) Stack: (0x850fbd48 to 0x850fc000) bd40: 824f0418 00000000 824f0418 a0000013 850fbd94 850fbd68 bd60: 808e6838 808e49d4 808b9230 808e1a70 ecfab000 824f0418 00000001 82959600 bd80: 824f0418 a0000013 850fbda4 850fbd98 808dd9cc 808e6708 850fbdc4 850fbda8 bda0: 808dfd84 808dd988 ecfab000 ecfad26c 0000008e ecfab000 850fbdd4 850fbdc8 bdc0: 808dfdf4 808dfd20 850fbe54 850fbdd8 808c060c 808dfdf0 816de044 802756a0 bde0: 808c76fc a0000013 850fbe6c 82959674 00000001 00000fff 819082b0 55555556 be00: 00000000 00000000 ecfad000 850fbe7c 00000001 850fbe7c 00000000 ecfab000 be20: 00000001 850fbe7c 850fbe48 00000000 85fdb940 82959600 808c1510 00000009 be40: 20000040 82959600 850fbe6c 850fbe58 808c152c 808c0230 00000000 816df7e4 be60: 850fbf14 850fbe70 808bc598 808c151c 00000001 83cb5900 8e000054 85543800 be80: 00000003 00000036 850fbee4 850fbe98 80689c60 8067fb20 00000001 00000054 bea0: 00000012 850fbeb4 835b6490 838962a8 80275412 536ea30b 850fbea8 81f29dc4 bec0: 20000040 536ea3cb 81f290f4 20000040 85543840 00005412 850fbef4 850fbee8 bee0: 80689d64 536ea3cb 850fbf14 00005412 00000000 85543841 20000040 85543840 bf00: 00000003 83cb5900 850fbfa4 850fbf18 804a4e04 808bbd80 820a55ec 8209f3b0 bf20: 0012bfc8 84792280 847929a0 820a55f0 00000036 60000010 820a55e8 84792280 bf40: 820a55f0 00000036 850fbf64 850fbf58 816db5f0 816db4bc 850fbf84 850fbf68 bf60: 816db378 816db5e0 60000013 00000000 0012bfc8 536ea3cb 850fbf9c 00000000 bf80: 00000000 0012bfc8 00000036 802002a4 84792280 00000036 00000000 850fbfa8 bfa0: 80200060 804a4d00 00000000 00000000 00000003 00005412 20000040 00000000 bfc0: 00000000 00000000 0012bfc8 00000036 7eec0312 76f2d6d0 7eec04a4 76f2d20c bfe0: 76f2d020 76f2d010 000163a0 0004bf80 60000010 00000003 00000000 00000000 Backtrace: [<808e49c8>] (io_serial_out) from [<808e6838>] (serial_out drivers/tty/serial/8250/8250.h:120 [inline]) [<808e49c8>] (io_serial_out) from [<808e6838>] (serial8250_set_THRI drivers/tty/serial/8250/8250.h:140 [inline]) [<808e49c8>] (io_serial_out) from [<808e6838>] (__start_tx drivers/tty/serial/8250/8250_port.c:1568 [inline]) [<808e49c8>] (io_serial_out) from [<808e6838>] (serial8250_start_tx+0x13c/0x234 drivers/tty/serial/8250/8250_port.c:1667) r7:a0000013 r6:824f0418 r5:00000000 r4:824f0418 [<808e66fc>] (serial8250_start_tx) from [<808dd9cc>] (__uart_start+0x50/0x54 drivers/tty/serial/serial_core.c:127) r7:a0000013 r6:824f0418 r5:82959600 r4:00000001 [<808dd97c>] (__uart_start) from [<808dfd84>] (uart_start+0x70/0xd0 drivers/tty/serial/serial_core.c:137) [<808dfd14>] (uart_start) from [<808dfdf4>] (uart_flush_chars+0x10/0x14 drivers/tty/serial/serial_core.c:548) r7:ecfab000 r6:0000008e r5:ecfad26c r4:ecfab000 [<808dfde4>] (uart_flush_chars) from [<808c060c>] (__receive_buf drivers/tty/n_tty.c:1553 [inline]) [<808dfde4>] (uart_flush_chars) from [<808c060c>] (n_tty_receive_buf_common+0x3e8/0x12c8 drivers/tty/n_tty.c:1645) [<808c0224>] (n_tty_receive_buf_common) from [<808c152c>] (n_tty_receive_buf+0x1c/0x24 drivers/tty/n_tty.c:1674) r10:82959600 r9:20000040 r8:00000009 r7:808c1510 r6:82959600 r5:85fdb940 r4:00000000 [<808c1510>] (n_tty_receive_buf) from [<808bc598>] (tiocsti drivers/tty/tty_io.c:2293 [inline]) [<808c1510>] (n_tty_receive_buf) from [<808bc598>] (tty_ioctl+0x824/0xa90 drivers/tty/tty_io.c:2692) [<808bbd74>] (tty_ioctl) from [<804a4e04>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<808bbd74>] (tty_ioctl) from [<804a4e04>] (do_vfs_ioctl fs/ioctl.c:830 [inline]) [<808bbd74>] (tty_ioctl) from [<804a4e04>] (__do_sys_ioctl fs/ioctl.c:868 [inline]) [<808bbd74>] (tty_ioctl) from [<804a4e04>] (sys_ioctl+0x110/0xaa0 fs/ioctl.c:856) r10:83cb5900 r9:00000003 r8:85543840 r7:20000040 r6:85543841 r5:00000000 r4:00005412 [<804a4cf4>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0x850fbfa8 to 0x850fbff0) bfa0: 00000000 00000000 00000003 00005412 20000040 00000000 bfc0: 00000000 00000000 0012bfc8 00000036 7eec0312 76f2d6d0 7eec04a4 76f2d20c bfe0: 76f2d020 76f2d010 000163a0 0004bf80 r10:00000036 r9:84792280 r8:802002a4 r7:00000036 r6:0012bfc8 r5:00000000 r4:00000000 Code: e6ef5075 e0844001 e7f34054 e2444612 (e5c45000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef5075 uxtb r5, r5 4: e0844001 add r4, r4, r1 8: e7f34054 ubfx r4, r4, #0, #20 c: e2444612 sub r4, r4, #18874368 ; 0x1200000 * 10: e5c45000 strb r5, [r4] <-- trapping instruction