8<--- cut here --- Unable to handle kernel paging request at virtual address fee03f03 when write [fee03f03] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 6719 Comm: syz.3.364 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:99 [inline] PC is at subdev_8255_io drivers/comedi/drivers/comedi_8255.c:47 [inline] PC is at subdev_8255_io+0x60/0x6c drivers/comedi/drivers/comedi_8255.c:43 LR is at subdev_8255_io drivers/comedi/drivers/comedi_8255.c:47 [inline] LR is at subdev_8255_io+0x4c/0x6c drivers/comedi/drivers/comedi_8255.c:43 pc : [<815553c8>] lr : [<815553b4>] psr: 60000013 sp : dfaf5cb8 ip : dfaf5cb8 fp : dfaf5cd4 r10: 00003f00 r9 : 00000004 r8 : dfaf5da4 r7 : 00000000 r6 : 0000009b r5 : 85321b40 r4 : 00003f03 r3 : 0000009b r2 : fee03f03 r1 : 00000001 r0 : 85321b40 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8675b340 DAC: fffffffd Register r0 information: slab kmalloc-192 start 85321b40 pointer offset 0 size 192 Register r1 information: non-paged memory Register r2 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:974 Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: slab kmalloc-192 start 85321b40 pointer offset 0 size 192 Register r6 information: non-paged memory Register r7 information: NULL pointer Register r8 information: 2-page vmalloc region starting at 0xdfaf4000 allocated at kernel_clone+0xc4/0x440 kernel/fork.c:2784 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: 2-page vmalloc region starting at 0xdfaf4000 allocated at kernel_clone+0xc4/0x440 kernel/fork.c:2784 Register r12 information: 2-page vmalloc region starting at 0xdfaf4000 allocated at kernel_clone+0xc4/0x440 kernel/fork.c:2784 Process syz.3.364 (pid: 6719, stack limit = 0xdfaf4000) Stack: (0xdfaf5cb8 to 0xdfaf6000) 5ca0: 81555368 00003f00 5cc0: 85321b40 00000000 dfaf5cf4 dfaf5cd8 815550a4 81555374 00003f00 80577d60 5ce0: 865ae000 865ae000 dfaf5d14 dfaf5cf8 8155545c 81555058 85321b40 00000000 5d00: 865ae000 00000000 dfaf5d54 dfaf5d18 8155560c 815553e0 ffffffff 00000004 5d20: 8341e340 00000000 00000000 835dfba8 85321b40 00000000 dfaf5d90 85321b40 5d40: 00000000 83736fe0 dfaf5d8c dfaf5d58 81544004 815555a4 40946400 00000000 5d60: dfaf5d7c 200005c0 85321b40 b5403587 40946400 00000001 00000003 84ccf080 5d80: dfaf5e4c dfaf5d90 8153f820 81543f08 35353238 00000000 00000000 00000000 5da0: 00000000 00003f00 00000002 0000d09a ffffffff 00000005 fdfffffe 00000002 5dc0: 00000004 00001002 7fffbfff 00000005 00000002 00000404 00000008 00000804 5de0: 00000004 00000004 00000003 00100830 00000008 00010000 00000009 00000080 5e00: 00000009 20000006 00008001 00000005 02000151 ffffffff 00000002 00000006 5e20: 00000000 5b660cc8 00000000 84cebd80 85321b40 200005c0 40946400 00000001 5e40: dfaf5f14 dfaf5e50 81540b30 8153f760 8276ba64 854bc990 00000064 85356714 5e60: dfaf5ee4 dfaf5e70 8085c254 808525b4 00000064 85321b70 00000000 dfaf5e90 5e80: 00000000 84ebd510 840262a8 40946400 0000000b 00000000 dfaf5e84 00000000 5ea0: 00000000 00000000 00000000 00000000 00000000 5b660cc8 00000000 84cebd80 5ec0: 40946400 200005c0 200005c0 84cebd80 00000003 84ccf080 dfaf5ef4 dfaf5ee8 5ee0: 8085c384 5b660cc8 dfaf5f14 00000000 84cebd81 40946400 200005c0 84cebd80 5f00: 00000003 84ccf080 dfaf5fa4 dfaf5f18 805f26e4 815407e8 ecac8b10 84ccf080 5f20: dfaf5f3c dfaf5f30 81c09614 81c094e0 dfaf5f54 dfaf5f40 8025cbac 80292440 5f40: dfaf5fb0 40000000 dfaf5f84 dfaf5f58 80222bfc 8025cb64 00000000 8341a10c 5f60: dfaf5fb0 0013ee90 ecac8b10 80222b50 00000000 5b660cc8 dfaf5fac 00000000 5f80: 00000000 00356310 00000036 8020029c 84ccf080 00000036 00000000 dfaf5fa8 5fa0: 80200060 805f24ac 00000000 00000000 00000003 40946400 200005c0 00000000 5fc0: 00000000 00000000 00356310 00000036 003562d8 00000000 00000001 76fb90dc 5fe0: 76fb8e88 76fb8e78 0001903c 00130cf0 60000010 00000003 00000000 00000000 Call trace: [<81555368>] (subdev_8255_io) from [<815550a4>] (subdev_8255_do_config+0x58/0x60 drivers/comedi/drivers/comedi_8255.c:115) r7:00000000 r6:85321b40 r5:00003f00 r4:81555368 [<8155504c>] (subdev_8255_do_config) from [<8155545c>] (__subdev_8255_init drivers/comedi/drivers/comedi_8255.c:172 [inline]) [<8155504c>] (subdev_8255_do_config) from [<8155545c>] (subdev_8255_io_init+0x88/0x98 drivers/comedi/drivers/comedi_8255.c:192) r4:865ae000 [<815553d4>] (subdev_8255_io_init) from [<8155560c>] (dev_8255_attach drivers/comedi/drivers/8255.c:84 [inline]) [<815553d4>] (subdev_8255_io_init) from [<8155560c>] (dev_8255_attach+0x74/0x138 drivers/comedi/drivers/8255.c:46) r7:00000000 r6:865ae000 r5:00000000 r4:85321b40 [<81555598>] (dev_8255_attach) from [<81544004>] (comedi_device_attach+0x108/0x244 drivers/comedi/drivers.c:1101) r10:83736fe0 r9:00000000 r8:85321b40 r7:dfaf5d90 r6:00000000 r5:85321b40 r4:835dfba8 [<81543efc>] (comedi_device_attach) from [<8153f820>] (do_devconfig_ioctl+0xcc/0x218 drivers/comedi/comedi_fops.c:931) r10:84ccf080 r9:00000003 r8:00000001 r7:40946400 r6:b5403587 r5:85321b40 r4:200005c0 [<8153f754>] (do_devconfig_ioctl) from [<81540b30>] (comedi_unlocked_ioctl+0x354/0x1db8 drivers/comedi/comedi_fops.c:2303) r8:00000001 r7:40946400 r6:200005c0 r5:85321b40 r4:84cebd80 [<815407dc>] (comedi_unlocked_ioctl) from [<805f26e4>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<815407dc>] (comedi_unlocked_ioctl) from [<805f26e4>] (do_vfs_ioctl fs/ioctl.c:551 [inline]) [<815407dc>] (comedi_unlocked_ioctl) from [<805f26e4>] (__do_sys_ioctl fs/ioctl.c:595 [inline]) [<815407dc>] (comedi_unlocked_ioctl) from [<805f26e4>] (sys_ioctl+0x244/0xb5c fs/ioctl.c:583) r10:84ccf080 r9:00000003 r8:84cebd80 r7:200005c0 r6:40946400 r5:84cebd81 r4:00000000 [<805f24a0>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfaf5fa8 to 0xdfaf5ff0) 5fa0: 00000000 00000000 00000003 40946400 200005c0 00000000 5fc0: 00000000 00000000 00356310 00000036 003562d8 00000000 00000001 76fb90dc 5fe0: 76fb8e88 76fb8e78 0001903c 00130cf0 r10:00000036 r9:84ccf080 r8:8020029c r7:00000036 r6:00356310 r5:00000000 r4:00000000 Code: e6ef3076 e0842002 e7f32052 e2422612 (e5c23000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef3076 uxtb r3, r6 4: e0842002 add r2, r4, r2 8: e7f32052 ubfx r2, r2, #0, #20 c: e2422612 sub r2, r2, #18874368 @ 0x1200000 * 10: e5c23000 strb r3, [r2] <-- trapping instruction