EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue
BUG: unable to handle kernel paging request at fffffffffffffff8
PGD 9e6e067 P4D 9e6e067 PUD 9e70067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 19168 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:plist_add+0x163/0x4a0 lib/plist.c:89
Code: 48 83 e8 08 48 3b 04 24 74 47 48 89 c3 e8 f5 f1 73 f9 48 89 d8 48 c1 e8 03 42 0f b6 04 20 84 c0 74 08 3c 03 0f 8e 60 02 00 00 <44> 8b 2b 89 ef 44 89 ee e8 c0 f2 73 f9 44 39 ed 7d a2 e8 c6 f1 73
RSP: 0018:ffff888075abf998 EFLAGS: 00010046
RAX: 0000000000000000 RBX: fffffffffffffff8 RCX: ffffc9000aadd000
RDX: 0000000000017a8b RSI: ffffffff87ee937b RDI: ffff8880a573e048
RBP: 000000000000fa00 R08: 0000000000000001 R09: 000000000000fa00
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff8880a5244e00 R15: ffff8880a573e040
FS:  00007f9a77bfe700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff8 CR3: 000000009ac2c000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 pm_qos_update_target+0x4d0/0xa40 kernel/power/qos.c:300
 pm_qos_add_request+0x1f1/0x4d0 kernel/power/qos.c:460
 snd_pcm_hw_params+0x1be0/0x22d0 sound/core/pcm_native.c:770
 snd_pcm_kernel_ioctl+0x1d4/0x3c0 sound/core/pcm_native.c:3015
 snd_pcm_oss_change_params_locked+0x18b3/0x39d0 sound/core/oss/pcm_oss.c:965
 snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1108 [inline]
 snd_pcm_oss_make_ready+0xe7/0x1b0 sound/core/oss/pcm_oss.c:1167
 snd_pcm_oss_sync+0x1de/0x800 sound/core/oss/pcm_oss.c:1728
 snd_pcm_oss_release+0x26c/0x300 sound/core/oss/pcm_oss.c:2571
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f9a79289279
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9a77bfe168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffb3 RBX: 00007f9a7939bf80 RCX: 00007f9a79289279
RDX: 0000000020000080 RSI: 00000000c0045002 RDI: 0000000000000005
RBP: 00007f9a792e3189 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffe73b0b3f R14: 00007f9a77bfe300 R15: 0000000000022000
Modules linked in:
CR2: fffffffffffffff8
---[ end trace c3f9a084cfd9b548 ]---
RIP: 0010:plist_add+0x163/0x4a0 lib/plist.c:89
Code: 48 83 e8 08 48 3b 04 24 74 47 48 89 c3 e8 f5 f1 73 f9 48 89 d8 48 c1 e8 03 42 0f b6 04 20 84 c0 74 08 3c 03 0f 8e 60 02 00 00 <44> 8b 2b 89 ef 44 89 ee e8 c0 f2 73 f9 44 39 ed 7d a2 e8 c6 f1 73
RSP: 0018:ffff888075abf998 EFLAGS: 00010046
RAX: 0000000000000000 RBX: fffffffffffffff8 RCX: ffffc9000aadd000
RDX: 0000000000017a8b RSI: ffffffff87ee937b RDI: ffff8880a573e048
RBP: 000000000000fa00 R08: 0000000000000001 R09: 000000000000fa00
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff8880a5244e00 R15: ffff8880a573e040
FS:  00007f9a77bfe700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff8 CR3: 000000009ac2c000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	48 83 e8 08          	sub    $0x8,%rax
   4:	48 3b 04 24          	cmp    (%rsp),%rax
   8:	74 47                	je     0x51
   a:	48 89 c3             	mov    %rax,%rbx
   d:	e8 f5 f1 73 f9       	callq  0xf973f207
  12:	48 89 d8             	mov    %rbx,%rax
  15:	48 c1 e8 03          	shr    $0x3,%rax
  19:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
  1e:	84 c0                	test   %al,%al
  20:	74 08                	je     0x2a
  22:	3c 03                	cmp    $0x3,%al
  24:	0f 8e 60 02 00 00    	jle    0x28a
* 2a:	44 8b 2b             	mov    (%rbx),%r13d <-- trapping instruction
  2d:	89 ef                	mov    %ebp,%edi
  2f:	44 89 ee             	mov    %r13d,%esi
  32:	e8 c0 f2 73 f9       	callq  0xf973f2f7
  37:	44 39 ed             	cmp    %r13d,%ebp
  3a:	7d a2                	jge    0xffffffde
  3c:	e8                   	.byte 0xe8
  3d:	c6                   	(bad)
  3e:	f1                   	icebp
  3f:	73                   	.byte 0x73