Unable to handle kernel paging request at virtual address dfff800000000031
KASAN: null-ptr-deref in range [0x0000000000000188-0x000000000000018f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000031] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G   M                syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310
lr : blk_mq_complete_request_remote+0x88/0x858 block/blk-mq.c:1302
sp : ffff80008f7e7ba0
x29: ffff80008f7e7c30 x28: ffff80008f7e7ba0 x27: 1fffe00018efc61c
x26: 0000000000000001 x25: ffff0000c77e30ee x24: dfff800000000000
x23: ffff700011efcf74 x22: 1fffe000191dd764 x21: ffff0000c8eebb24
x20: 000000000000018e x19: ffff0000c8eeba00 x18: 1fffe000349f7028
x17: ffff80011b876000 x16: ffff80008f7e0000 x15: 0000000000000000
x14: 00000000001e83f5 x13: 0000000000000005 x12: 0000000000000000
x11: ffff80008f7e7d98 x10: ffff80008840a4c8 x9 : 1fffe000191dd742
x8 : 0000000000000031 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff8000827ef2a0
x2 : 0000000000000000 x1 : ffff8000897bc4c0 x0 : 0000000000000000
Call trace:
 blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
 nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
 nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
 nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
 nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
 __handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
 handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
 handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
 handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
 generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
 handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
 generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
 __gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
 __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
 gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
 __el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
 el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P)
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x1ec/0x450 kernel/sched/idle.c:355
 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454
 rest_init+0x390/0x3a8 init/main.c:732
 start_kernel+0x374/0x3c0 init/main.c:1190
 __primary_switched+0x8c/0x94 arch/arm64/kernel/head.S:245
Code: 97d03f93 f9400288 91063914 d343fe88 (38f86908) 
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
Calling EFI runtime from hardirq context
----------------
Code disassembly (best guess):
   0:	97d03f93 	bl	0xffffffffff40fe4c
   4:	f9400288 	ldr	x8, [x20]
   8:	91063914 	add	x20, x8, #0x18e
   c:	d343fe88 	lsr	x8, x20, #3
* 10:	38f86908 	ldrsb	w8, [x8, x24] <-- trapping instruction