8<--- cut here --- Unable to handle kernel paging request at virtual address fee00001 [fee00001] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 5682 Comm: syz-executor.0 Not tainted 5.17.0-rc7-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:88 [inline] PC is at io_serial_out+0x38/0x40 drivers/tty/serial/8250/8250_port.c:458 LR is at io_serial_out+0x24/0x40 drivers/tty/serial/8250/8250_port.c:458 pc : [<808e19d0>] lr : [<808e19bc>] psr: 60000093 sp : 850ffd48 ip : 850ffd48 fp : 850ffd64 r10: 00000001 r9 : 00000fff r8 : 860cf400 r7 : a0000013 r6 : 824f1390 r5 : 00000002 r4 : fee00001 r3 : 00000000 r2 : 00000002 r1 : 00000000 r0 : 824f1390 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85069640 DAC: fffffffd Register r0 information: non-slab/vmalloc memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1028 Register r5 information: non-paged memory Register r6 information: non-slab/vmalloc memory Register r7 information: non-slab/vmalloc memory Register r8 information: slab kmalloc-512 start 860cf400 pointer offset 0 size 512 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: non-slab/vmalloc memory Register r12 information: non-slab/vmalloc memory Process syz-executor.0 (pid: 5682, stack limit = 0x850fe000) Stack: (0x850ffd48 to 0x85100000) fd40: 824f1390 00000000 824f1390 a0000013 850ffd94 850ffd68 fd60: 808e3808 808e19a4 00001244 ece62000 860cf400 824f1390 00000001 860cf400 fd80: 824f1390 a0000013 850ffda4 850ffd98 808da99c 808e36d8 850ffdc4 850ffda8 fda0: 808dcd54 808da958 ece60000 ece6226c 00000001 ece60000 850ffdd4 850ffdc8 fdc0: 808dcdc4 808dccf0 850ffe54 850ffdd8 808bd5dc 808dcdc0 00000000 ffffffff fde0: ffffffff 00000000 ffffffff 860cf474 00000001 00000fff 819081b0 55555556 fe00: 00000000 00000000 ece62000 850ffe7c 00000001 850ffe7c 00000000 ece60000 fe20: 00000001 850ffe7c 806780bc 00000000 82a3f7c0 860cf400 808be4e0 00000009 fe40: 200007c0 860cf400 850ffe6c 850ffe58 808be4fc 808bd200 00000000 816decac fe60: 850fff14 850ffe70 808b9568 808be4ec 00000000 d128f410 01003231 00000000 fe80: 00000012 00000001 83d9bcd0 84db6240 00000004 00000036 850ffef4 850ffea8 fea0: 80687ce0 8067db20 00000001 00000054 00000012 850ffec4 83a2b010 82cb7ee0 fec0: 20005412 84db620b 850ffeb8 84db6240 00000004 d128f410 81f290f0 200007c0 fee0: 84db6240 d128f410 850fff14 00005412 00000000 84db6241 200007c0 84db6240 ff00: 00000004 83d9bcd0 850fffa4 850fff18 804a4750 808b8d50 820a55ec 8209f3b0 ff20: 0012bfc8 83b0ae00 83b0b520 820a55f0 00000036 60000010 820a55e8 83b0ae00 ff40: 820a55f0 00000036 850fff64 850fff58 816daa98 816da964 850fff84 850fff68 ff60: 816da820 816daa88 60000013 00000000 0012bfc8 d128f410 850fff9c 00000000 ff80: 00000000 0012bfc8 00000036 80200244 83b0ae00 00000036 00000000 850fffa8 ffa0: 80200060 804a464c 00000000 00000000 00000004 00005412 200007c0 00000000 ffc0: 00000000 00000000 0012bfc8 00000036 7ecd8312 76f7c6d0 7ecd84a4 76f7c20c ffe0: 76f7c020 76f7c010 000163a0 0004bf80 60000010 00000004 00000000 00000000 Backtrace: [<808e1998>] (io_serial_out) from [<808e3808>] (serial_out drivers/tty/serial/8250/8250.h:120 [inline]) [<808e1998>] (io_serial_out) from [<808e3808>] (serial8250_set_THRI drivers/tty/serial/8250/8250.h:140 [inline]) [<808e1998>] (io_serial_out) from [<808e3808>] (__start_tx drivers/tty/serial/8250/8250_port.c:1568 [inline]) [<808e1998>] (io_serial_out) from [<808e3808>] (serial8250_start_tx+0x13c/0x234 drivers/tty/serial/8250/8250_port.c:1667) r7:a0000013 r6:824f1390 r5:00000000 r4:824f1390 [<808e36cc>] (serial8250_start_tx) from [<808da99c>] (__uart_start+0x50/0x54 drivers/tty/serial/serial_core.c:127) r7:a0000013 r6:824f1390 r5:860cf400 r4:00000001 [<808da94c>] (__uart_start) from [<808dcd54>] (uart_start+0x70/0xd0 drivers/tty/serial/serial_core.c:137) [<808dcce4>] (uart_start) from [<808dcdc4>] (uart_flush_chars+0x10/0x14 drivers/tty/serial/serial_core.c:548) r7:ece60000 r6:00000001 r5:ece6226c r4:ece60000 [<808dcdb4>] (uart_flush_chars) from [<808bd5dc>] (__receive_buf drivers/tty/n_tty.c:1553 [inline]) [<808dcdb4>] (uart_flush_chars) from [<808bd5dc>] (n_tty_receive_buf_common+0x3e8/0x12c8 drivers/tty/n_tty.c:1645) [<808bd1f4>] (n_tty_receive_buf_common) from [<808be4fc>] (n_tty_receive_buf+0x1c/0x24 drivers/tty/n_tty.c:1674) r10:860cf400 r9:200007c0 r8:00000009 r7:808be4e0 r6:860cf400 r5:82a3f7c0 r4:00000000 [<808be4e0>] (n_tty_receive_buf) from [<808b9568>] (tiocsti drivers/tty/tty_io.c:2293 [inline]) [<808be4e0>] (n_tty_receive_buf) from [<808b9568>] (tty_ioctl+0x824/0xa90 drivers/tty/tty_io.c:2692) [<808b8d44>] (tty_ioctl) from [<804a4750>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<808b8d44>] (tty_ioctl) from [<804a4750>] (do_vfs_ioctl fs/ioctl.c:834 [inline]) [<808b8d44>] (tty_ioctl) from [<804a4750>] (__do_sys_ioctl fs/ioctl.c:872 [inline]) [<808b8d44>] (tty_ioctl) from [<804a4750>] (sys_ioctl+0x110/0xaa0 fs/ioctl.c:860) r10:83d9bcd0 r9:00000004 r8:84db6240 r7:200007c0 r6:84db6241 r5:00000000 r4:00005412 [<804a4640>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0x850fffa8 to 0x850ffff0) ffa0: 00000000 00000000 00000004 00005412 200007c0 00000000 ffc0: 00000000 00000000 0012bfc8 00000036 7ecd8312 76f7c6d0 7ecd84a4 76f7c20c ffe0: 76f7c020 76f7c010 000163a0 0004bf80 r10:00000036 r9:83b0ae00 r8:80200244 r7:00000036 r6:0012bfc8 r5:00000000 r4:00000000 Code: e6ef5075 e0844001 e7f34054 e2444612 (e5c45000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef5075 uxtb r5, r5 4: e0844001 add r4, r4, r1 8: e7f34054 ubfx r4, r4, #0, #20 c: e2444612 sub r4, r4, #18874368 ; 0x1200000 * 10: e5c45000 strb r5, [r4] <-- trapping instruction