audit: type=1804 audit(1663919306.423:583): pid=6793 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir288643477/syzkaller.vm7zHp/881/bus" dev="sda1" ino=14819 res=1 audit: type=1800 audit(1663919306.453:584): pid=6793 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="bus" dev="sda1" ino=14819 res=0 BUG: unable to handle kernel paging request at fffffffffffffff0 PGD 9e6e067 P4D 9e6e067 PUD 9e70067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 6805 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline] RIP: 0010:list_empty include/linux/list.h:203 [inline] RIP: 0010:plist_del+0x96/0x450 lib/plist.c:125 Code: 18 4d 39 ee 74 31 e8 29 ee 73 f9 4d 8d 6e f0 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 3d 03 00 00 <49> 8b 46 f0 49 39 c5 0f 84 f2 01 00 00 e8 f8 ed 73 f9 4c 8d 73 10 RSP: 0018:ffff888091c8fb30 EFLAGS: 00010046 RAX: dffffc0000000000 RBX: ffff888235faae00 RCX: ffffc9000954c000 RDX: 1ffffffffffffffe RSI: ffffffff87ee9747 RDI: ffff888235faae00 RBP: ffff888235faae08 R08: 0000000000000001 R09: 0000000000000002 R10: 0000000000000005 R11: 0000000000000000 R12: ffff888235faae18 R13: fffffffffffffff0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f943a959700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffff0 CR3: 00000000afe22000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pm_qos_update_target+0x803/0xa40 kernel/power/qos.c:288 pm_qos_remove_request.part.0+0xf2/0x3c0 kernel/power/qos.c:542 pm_qos_remove_request+0x52/0x80 kernel/power/qos.c:534 snd_pcm_hw_free sound/core/pcm_native.c:827 [inline] snd_pcm_common_ioctl+0x12a0/0x29a0 sound/core/pcm_native.c:2906 overlayfs: filesystem on './bus' not supported as upperdir snd_pcm_ioctl+0x7e/0xb0 sound/core/pcm_native.c:2985 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f943c006669 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f943a959168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f943c128050 RCX: 00007f943c006669 RDX: 0000000000000000 RSI: 0000000000004112 RDI: 0000000000000005 RBP: 00007f943c061560 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9c1f3a9f R14: 00007f943a959300 R15: 0000000000022000 Modules linked in: CR2: fffffffffffffff0 ---[ end trace 3e6eb4071e8e355f ]--- RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline] RIP: 0010:list_empty include/linux/list.h:203 [inline] RIP: 0010:plist_del+0x96/0x450 lib/plist.c:125 Code: 18 4d 39 ee 74 31 e8 29 ee 73 f9 4d 8d 6e f0 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 3d 03 00 00 <49> 8b 46 f0 49 39 c5 0f 84 f2 01 00 00 e8 f8 ed 73 f9 4c 8d 73 10 RSP: 0018:ffff888091c8fb30 EFLAGS: 00010046 RAX: dffffc0000000000 RBX: ffff888235faae00 RCX: ffffc9000954c000 RDX: 1ffffffffffffffe RSI: ffffffff87ee9747 RDI: ffff888235faae00 RBP: ffff888235faae08 R08: 0000000000000001 R09: 0000000000000002 R10: 0000000000000005 R11: 0000000000000000 R12: ffff888235faae18 R13: fffffffffffffff0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f943a959700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffff0 CR3: 00000000afe22000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 18 4d 39 sbb %cl,0x39(%rbp) 3: ee out %al,(%dx) 4: 74 31 je 0x37 6: e8 29 ee 73 f9 callq 0xf973ee34 b: 4d 8d 6e f0 lea -0x10(%r14),%r13 f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 4c 89 ea mov %r13,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 3d 03 00 00 jne 0x367 * 2a: 49 8b 46 f0 mov -0x10(%r14),%rax <-- trapping instruction 2e: 49 39 c5 cmp %rax,%r13 31: 0f 84 f2 01 00 00 je 0x229 37: e8 f8 ed 73 f9 callq 0xf973ee34 3c: 4c 8d 73 10 lea 0x10(%rbx),%r14