------------[ cut here ]------------ WARNING: CPU: 2 PID: 3463 at drivers/block/floppy.c:999 schedule_bh+0x5f/0x70 drivers/block/floppy.c:999 Modules linked in: CPU: 2 PID: 3463 Comm: kworker/u16:2 Not tainted 5.15.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: floppy floppy_work_workfn RIP: 0010:schedule_bh+0x5f/0x70 drivers/block/floppy.c:999 Code: 87 43 05 fd 48 89 2d a0 db e2 0b 5b 48 c7 c2 80 5d 48 8c 48 8b 35 71 e0 e2 0b bf 08 00 00 00 5d e9 96 26 da fc e8 61 43 05 fd <0f> 0b eb d1 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 e8 4b 43 05 fd RSP: 0018:ffffc90000780dd0 EFLAGS: 00010046 RAX: 0000000080010000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff8880226142c0 RSI: ffffffff8470e03f RDI: 0000000000000003 RBP: ffffffff8471ea30 R08: 0000000000000000 R09: ffffffff8c485d87 R10: ffffffff8470e00f R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff8471ea30 R14: 0000000000000000 R15: ffff888010de1000 FS: 0000000000000000(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555556336708 CR3: 0000000067cc2000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: floppy_interrupt+0x228/0x340 drivers/block/floppy.c:1765 floppy_hardint+0x256/0x320 arch/x86/include/asm/floppy.h:66 __handle_irq_event_percpu+0x303/0x8f0 kernel/irq/handle.c:156 handle_irq_event_percpu kernel/irq/handle.c:196 [inline] handle_irq_event+0x102/0x280 kernel/irq/handle.c:213 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:822 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x9d/0x210 arch/x86/kernel/irq.c:250 common_interrupt+0x9f/0xd0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 RIP: 0010:slow_down_io arch/x86/include/asm/paravirt.h:55 [inline] RIP: 0010:outb_p arch/x86/include/asm/io.h:334 [inline] RIP: 0010:fdc_outb drivers/block/floppy.c:602 [inline] RIP: 0010:output_byte+0x9b/0x3c0 drivers/block/floppy.c:1142 Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 c2 02 00 00 48 8d 04 9b 48 8b 14 c5 30 c1 53 90 44 89 e8 83 c2 05 ee <48> c7 c3 e0 5f 7f 8b 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 RSP: 0018:ffffc900013c7c90 EFLAGS: 00000206 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 00000000000003f5 RSI: ffffffff84710e74 RDI: ffffffff9053c130 RBP: 0000000000000000 R08: 0000000000000080 R09: 0000000000000390 R10: ffffffff84710e66 R11: 0000000000000000 R12: 0000000000000090 R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff9053e790 seek_floppy drivers/block/floppy.c:1646 [inline] floppy_ready drivers/block/floppy.c:1955 [inline] floppy_ready+0xbea/0x1930 drivers/block/floppy.c:1926 seek_interrupt+0x326/0x420 drivers/block/floppy.c:1564 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess), 5 bytes skipped: 0: df 48 89 fisttps -0x77(%rax) 3: fa cli 4: 48 c1 ea 03 shr $0x3,%rdx 8: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) c: 0f 85 c2 02 00 00 jne 0x2d4 12: 48 8d 04 9b lea (%rbx,%rbx,4),%rax 16: 48 8b 14 c5 30 c1 53 mov -0x6fac3ed0(,%rax,8),%rdx 1d: 90 1e: 44 89 e8 mov %r13d,%eax 21: 83 c2 05 add $0x5,%edx 24: ee out %al,(%dx) * 25: 48 c7 c3 e0 5f 7f 8b mov $0xffffffff8b7f5fe0,%rbx <-- trapping instruction 2c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 33: fc ff df 36: 48 89 da mov %rbx,%rdx 39: 48 rex.W 3a: c1 .byte 0xc1