audit: type=1804 audit(1674874144.314:573): pid=31043 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir4090008859/syzkaller.Uhls6p/367/bus" dev="sda1" ino=14403 res=1 base_sock_release(00000000f7fc5fb0) sk=00000000e90fd0a9 BUG: unable to handle kernel paging request at ffff888001000008 PGD de01067 P4D de01067 PUD de02067 PMD 80000000010001e1 Oops: 0003 [#1] PREEMPT SMP KASAN CPU: 0 PID: 31033 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:writeb arch/x86/include/asm/io.h:65 [inline] RIP: 0010:vga_8planes_fillrect drivers/video/fbdev/vga16fb.c:855 [inline] RIP: 0010:vga16fb_fillrect+0xe6d/0x1940 drivers/video/fbdev/vga16fb.c:947 Code: 4c 8b 64 24 20 4c 89 ed 41 83 e4 07 41 83 c4 03 e8 18 cf c3 fd 41 0f b6 07 41 38 c4 7c 08 84 c0 0f 85 8d 05 00 00 41 8b 46 10 <88> 45 00 83 eb 01 31 ff 48 83 c5 01 89 de e8 60 d0 c3 fd 85 db 75 RSP: 0018:ffff8880426072b8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000004 RCX: ffffc9000744a000 RDX: 0000000000040000 RSI: ffffffff839eb658 RDI: 0000000000000005 RBP: ffff888001000008 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888001000008 R14: ffff888042607350 R15: ffffed10084c0e6c FS: 00007fcc071d1700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888001000008 CR3: 0000000095af9000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bit_clear_margins+0x3f6/0x4b0 drivers/video/fbdev/core/bitblit.c:224 fbcon_clear_margins+0x1e2/0x350 drivers/video/fbdev/core/fbcon.c:1288 fbcon_switch+0xf0d/0x1ba0 drivers/video/fbdev/core/fbcon.c:2155 redraw_screen+0x37d/0x870 drivers/tty/vt/vt.c:1015 fbcon_modechanged+0x6df/0x930 drivers/video/fbdev/core/fbcon.c:2688 fbcon_event_notify+0x197/0x1d80 drivers/video/fbdev/core/fbcon.c:3061 notifier_call_chain+0xc0/0x230 kernel/notifier.c:93 __blocking_notifier_call_chain kernel/notifier.c:317 [inline] __blocking_notifier_call_chain kernel/notifier.c:304 [inline] blocking_notifier_call_chain kernel/notifier.c:328 [inline] blocking_notifier_call_chain+0x85/0xa0 kernel/notifier.c:325 fb_set_var+0xd9a/0xf90 drivers/video/fbdev/core/fbmem.c:1052 do_fb_ioctl+0x3cf/0xb50 drivers/video/fbdev/core/fbmem.c:1125 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1240 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fcc08c5f0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcc071d1168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcc08d7ef80 RCX: 00007fcc08c5f0c9 RDX: 0000000020000040 RSI: 0000000000004601 RDI: 0000000000000004 RBP: 00007fcc08cbaae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd55597d4f R14: 00007fcc071d1300 R15: 0000000000022000 Modules linked in: CR2: ffff888001000008 ---[ end trace 3a4bd8a370e3c342 ]--- RIP: 0010:writeb arch/x86/include/asm/io.h:65 [inline] RIP: 0010:vga_8planes_fillrect drivers/video/fbdev/vga16fb.c:855 [inline] RIP: 0010:vga16fb_fillrect+0xe6d/0x1940 drivers/video/fbdev/vga16fb.c:947 Code: 4c 8b 64 24 20 4c 89 ed 41 83 e4 07 41 83 c4 03 e8 18 cf c3 fd 41 0f b6 07 41 38 c4 7c 08 84 c0 0f 85 8d 05 00 00 41 8b 46 10 <88> 45 00 83 eb 01 31 ff 48 83 c5 01 89 de e8 60 d0 c3 fd 85 db 75 RSP: 0018:ffff8880426072b8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000004 RCX: ffffc9000744a000 RDX: 0000000000040000 RSI: ffffffff839eb658 RDI: 0000000000000005 RBP: ffff888001000008 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888001000008 R14: ffff888042607350 R15: ffffed10084c0e6c FS: 00007fcc071d1700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888001000008 CR3: 0000000095af9000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 4c 8b 64 24 20 mov 0x20(%rsp),%r12 5: 4c 89 ed mov %r13,%rbp 8: 41 83 e4 07 and $0x7,%r12d c: 41 83 c4 03 add $0x3,%r12d 10: e8 18 cf c3 fd callq 0xfdc3cf2d 15: 41 0f b6 07 movzbl (%r15),%eax 19: 41 38 c4 cmp %al,%r12b 1c: 7c 08 jl 0x26 1e: 84 c0 test %al,%al 20: 0f 85 8d 05 00 00 jne 0x5b3 26: 41 8b 46 10 mov 0x10(%r14),%eax * 2a: 88 45 00 mov %al,0x0(%rbp) <-- trapping instruction 2d: 83 eb 01 sub $0x1,%ebx 30: 31 ff xor %edi,%edi 32: 48 83 c5 01 add $0x1,%rbp 36: 89 de mov %ebx,%esi 38: e8 60 d0 c3 fd callq 0xfdc3d09d 3d: 85 db test %ebx,%ebx 3f: 75 .byte 0x75