general protection fault, probably for non-canonical address 0xdffffc000000044c: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000000002260-0x0000000000002267]
CPU: 0 PID: 770 Comm: kworker/u4:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_unbound flush_to_ldisc

RIP: 0010:n_tty_receive_buf_common+0x17a/0x1350 drivers/tty/n_tty.c:1700
Code: ff ff 48 c1 e8 03 48 89 85 d8 fe ff ff 48 89 8d 70 ff ff ff 48 c1 e9 03 48 89 8d 10 ff ff ff 4c 89 75 a0 48 8b 85 c8 fe ff ff <42> 80 3c 28 00 74 0c 48 8b bd d0 fe ff ff e8 a3 aa fa fe 48 8b bd
RSP: 0018:ffffc900110afa70 EFLAGS: 00010203
RAX: 000000000000044c RBX: ffff888113f79800 RCX: 000000000000000b
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900110afbc8 R08: dffffc0000000000 R09: ffffed10227ef320
R10: ffffed10227ef320 R11: 1ffff110227ef31f R12: 000000000000005d
R13: dffffc0000000000 R14: ffff888113f799f8 R15: 000000000000044c
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2702c5 CR3: 000000013040c000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 n_tty_receive_buf2+0x31/0x40 drivers/tty/n_tty.c:1767
 tty_ldisc_receive_buf+0xb5/0x180 drivers/tty/tty_buffer.c:457
 tty_port_default_receive_buf+0x6d/0xa0 drivers/tty/tty_port.c:39
 receive_buf drivers/tty/tty_buffer.c:515 [inline]
 flush_to_ldisc+0x2e1/0x820 drivers/tty/tty_buffer.c:565
 process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
 worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:n_tty_receive_buf_common+0x17a/0x1350 drivers/tty/n_tty.c:1700
Code: ff ff 48 c1 e8 03 48 89 85 d8 fe ff ff 48 89 8d 70 ff ff ff 48 c1 e9 03 48 89 8d 10 ff ff ff 4c 89 75 a0 48 8b 85 c8 fe ff ff <42> 80 3c 28 00 74 0c 48 8b bd d0 fe ff ff e8 a3 aa fa fe 48 8b bd
RSP: 0018:ffffc900110afa70 EFLAGS: 00010203
RAX: 000000000000044c RBX: ffff888113f79800 RCX: 000000000000000b
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900110afbc8 R08: dffffc0000000000 R09: ffffed10227ef320
R10: ffffed10227ef320 R11: 1ffff110227ef31f R12: 000000000000005d
R13: dffffc0000000000 R14: ffff888113f799f8 R15: 000000000000044c
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e620ff8 CR3: 0000000120e7e000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	48 c1 e8 03          	shr    $0x3,%rax
   4:	48 89 85 d8 fe ff ff 	mov    %rax,-0x128(%rbp)
   b:	48 89 8d 70 ff ff ff 	mov    %rcx,-0x90(%rbp)
  12:	48 c1 e9 03          	shr    $0x3,%rcx
  16:	48 89 8d 10 ff ff ff 	mov    %rcx,-0xf0(%rbp)
  1d:	4c 89 75 a0          	mov    %r14,-0x60(%rbp)
  21:	48 8b 85 c8 fe ff ff 	mov    -0x138(%rbp),%rax
* 28:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2d:	74 0c                	je     0x3b
  2f:	48 8b bd d0 fe ff ff 	mov    -0x130(%rbp),%rdi
  36:	e8 a3 aa fa fe       	call   0xfefaaade
  3b:	48                   	rex.W
  3c:	8b                   	.byte 0x8b
  3d:	bd                   	.byte 0xbd