8<--- cut here --- Unable to handle kernel paging request at virtual address fee00001 [fee00001] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 4715 Comm: syz-executor.1 Not tainted 5.17.0-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:88 [inline] PC is at io_serial_out+0x38/0x40 drivers/tty/serial/8250/8250_port.c:458 LR is at io_serial_out+0x24/0x40 drivers/tty/serial/8250/8250_port.c:458 pc : [<808e4c38>] lr : [<808e4c24>] psr: 60000093 sp : 85329d48 ip : 85329d48 fp : 85329d64 r10: 00000001 r9 : 00000fff r8 : 84526c00 r7 : a0000013 r6 : 824f0418 r5 : 00000002 r4 : fee00001 r3 : 00000000 r2 : 00000002 r1 : 00000000 r0 : 824f0418 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 850b4200 DAC: fffffffd Register r0 information: non-slab/vmalloc memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1028 Register r5 information: non-paged memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-slab/vmalloc memory Register r8 information: slab kmalloc-cg-512 start 84526c00 pointer offset 0 size 512 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: non-slab/vmalloc memory Register r12 information: non-slab/vmalloc memory Process syz-executor.1 (pid: 4715, stack limit = 0x85328000) Stack: (0x85329d48 to 0x8532a000) 9d40: 824f0418 00000000 824f0418 a0000013 85329d94 85329d68 9d60: 808e6a70 808e4c0c 00001244 eaded000 84526c00 824f0418 00000001 84526c00 9d80: 824f0418 a0000013 85329da4 85329d98 808ddc04 808e6940 85329dc4 85329da8 9da0: 808dffbc 808ddbc0 eadeb000 eaded26c 00000001 eadeb000 85329dd4 85329dc8 9dc0: 808e002c 808dff58 85329e54 85329dd8 808c0898 808e0028 85329dc0 00005412 9de0: ffffffff 00000000 ffffffff 84526c74 00000001 00000fff 819082b0 55555556 9e00: 00000000 00000000 eaded000 85329e7c 00000001 85329e7c 00000000 eadeb000 9e20: 00000001 85329e7c 8067a45c 00000000 85506080 84526c00 808c179c 00000009 9e40: 20000140 84526c00 85329e6c 85329e58 808c17b8 808c04bc 00000000 816df1ac 9e60: 85329f14 85329e70 808bc820 808c17a8 00000001 83a9f5f0 01000054 84775800 9e80: 00000003 00000036 85329ee4 85329e98 8068a014 8067fee0 00000001 00000054 9ea0: 00000012 85329eb4 839d9850 834dc7f8 85325412 536ea30b 85329ea8 81f29dc4 9ec0: 20000140 536ea3cb 81f290f4 20000140 84775840 00005412 85329ef4 85329ee8 9ee0: 8068a118 536ea3cb 85329f14 00005412 00000000 84775841 20000140 84775840 9f00: 00000003 83a9f5f0 85329fa4 85329f18 804a54dc 808bc008 820a562c 8209f3d0 9f20: 0012bfc8 8382e780 8382eea0 820a5630 00000036 60000010 820a5628 8382e780 9f40: 820a5630 00000036 85329f64 85329f58 816db650 816db51c 85329f84 85329f68 9f60: 816db3d8 816db640 60000013 00000000 0012bfc8 536ea3cb 85329f9c 00000000 9f80: 00000000 0012bfc8 00000036 802002a4 8382e780 00000036 00000000 85329fa8 9fa0: 80200060 804a53d8 00000000 00000000 00000003 00005412 20000140 00000000 9fc0: 00000000 00000000 0012bfc8 00000036 7ea17312 76fcd6d0 7ea174a4 76fcd20c 9fe0: 76fcd020 76fcd010 000163a0 0004bf80 60000010 00000003 00000000 00000000 Backtrace: [<808e4c00>] (io_serial_out) from [<808e6a70>] (serial_out drivers/tty/serial/8250/8250.h:120 [inline]) [<808e4c00>] (io_serial_out) from [<808e6a70>] (serial8250_set_THRI drivers/tty/serial/8250/8250.h:140 [inline]) [<808e4c00>] (io_serial_out) from [<808e6a70>] (__start_tx drivers/tty/serial/8250/8250_port.c:1568 [inline]) [<808e4c00>] (io_serial_out) from [<808e6a70>] (serial8250_start_tx+0x13c/0x234 drivers/tty/serial/8250/8250_port.c:1667) r7:a0000013 r6:824f0418 r5:00000000 r4:824f0418 [<808e6934>] (serial8250_start_tx) from [<808ddc04>] (__uart_start+0x50/0x54 drivers/tty/serial/serial_core.c:127) r7:a0000013 r6:824f0418 r5:84526c00 r4:00000001 [<808ddbb4>] (__uart_start) from [<808dffbc>] (uart_start+0x70/0xd0 drivers/tty/serial/serial_core.c:137) [<808dff4c>] (uart_start) from [<808e002c>] (uart_flush_chars+0x10/0x14 drivers/tty/serial/serial_core.c:548) r7:eadeb000 r6:00000001 r5:eaded26c r4:eadeb000 [<808e001c>] (uart_flush_chars) from [<808c0898>] (__receive_buf drivers/tty/n_tty.c:1553 [inline]) [<808e001c>] (uart_flush_chars) from [<808c0898>] (n_tty_receive_buf_common+0x3e8/0x12c8 drivers/tty/n_tty.c:1645) [<808c04b0>] (n_tty_receive_buf_common) from [<808c17b8>] (n_tty_receive_buf+0x1c/0x24 drivers/tty/n_tty.c:1674) r10:84526c00 r9:20000140 r8:00000009 r7:808c179c r6:84526c00 r5:85506080 r4:00000000 [<808c179c>] (n_tty_receive_buf) from [<808bc820>] (tiocsti drivers/tty/tty_io.c:2293 [inline]) [<808c179c>] (n_tty_receive_buf) from [<808bc820>] (tty_ioctl+0x824/0xa90 drivers/tty/tty_io.c:2692) [<808bbffc>] (tty_ioctl) from [<804a54dc>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<808bbffc>] (tty_ioctl) from [<804a54dc>] (do_vfs_ioctl fs/ioctl.c:830 [inline]) [<808bbffc>] (tty_ioctl) from [<804a54dc>] (__do_sys_ioctl fs/ioctl.c:868 [inline]) [<808bbffc>] (tty_ioctl) from [<804a54dc>] (sys_ioctl+0x110/0xaa0 fs/ioctl.c:856) r10:83a9f5f0 r9:00000003 r8:84775840 r7:20000140 r6:84775841 r5:00000000 r4:00005412 [<804a53cc>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0x85329fa8 to 0x85329ff0) 9fa0: 00000000 00000000 00000003 00005412 20000140 00000000 9fc0: 00000000 00000000 0012bfc8 00000036 7ea17312 76fcd6d0 7ea174a4 76fcd20c 9fe0: 76fcd020 76fcd010 000163a0 0004bf80 r10:00000036 r9:8382e780 r8:802002a4 r7:00000036 r6:0012bfc8 r5:00000000 r4:00000000 Code: e6ef5075 e0844001 e7f34054 e2444612 (e5c45000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef5075 uxtb r5, r5 4: e0844001 add r4, r4, r1 8: e7f34054 ubfx r4, r4, #0, #20 c: e2444612 sub r4, r4, #18874368 ; 0x1200000 * 10: e5c45000 strb r5, [r4] <-- trapping instruction