syzbot

Unable to handle kernel paging request at virtual address dfff800000000003
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000003] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4778 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: events ublk_partition_scan_work
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ublk_queue_cmd drivers/block/ublk_drv.c:2095 [inline]
pc : ublk_queue_rq+0x114/0x1dc drivers/block/ublk_drv.c:2223
lr : ublk_queue_cmd drivers/block/ublk_drv.c:2092 [inline]
lr : ublk_queue_rq+0xec/0x1dc drivers/block/ublk_drv.c:2223
sp : ffff800099646b10
x29: ffff800099646b20 x28: ffff7000132c8d80 x27: ffff0000c610b280
x26: ffff0000c610b2c8 x25: 1fffe00018c21652 x24: dfff800000000000
x23: 0000000000000004 x22: 0000000000000002 x21: 0000000000000000
x20: ffff0000c610b280 x19: 0000000000000000 x18: 00000000ffffffff
x17: ffff80008a186c80 x16: ffff80008a4b54f8 x15: ffff0000d9c0c550
x14: ffff0000d9c0c530 x13: 0000000000000001 x12: 0000000000000000
x11: ffff80008a3fcd08 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000003 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800082559f20
x2 : 0000000000000004 x1 : ffff0000d9c0ba00 x0 : 0000000000000018
Call trace:
 ublk_queue_cmd drivers/block/ublk_drv.c:2095 [inline] (P)
 ublk_queue_rq+0x114/0x1dc drivers/block/ublk_drv.c:2223 (P)
 blk_mq_dispatch_rq_list+0x3bc/0x13a4 block/blk-mq.c:2148
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
 blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
 __blk_mq_sched_dispatch_requests+0xa40/0x10bc block/blk-mq-sched.c:307
 blk_mq_sched_dispatch_requests+0xa4/0x154 block/blk-mq-sched.c:329
 blk_mq_run_hw_queue+0x3c0/0x4dc block/blk-mq.c:2386
 blk_mq_dispatch_list+0xa2c/0xb2c block/blk-mq.c:-1
 blk_mq_flush_plug_list+0x3a4/0x484 block/blk-mq.c:2997
 __blk_flush_plug+0x338/0x410 block/blk-core.c:1230
 blk_finish_plug block/blk-core.c:1257 [inline]
 __submit_bio+0x39c/0x478 block/blk-core.c:649
 __submit_bio_noacct_mq block/blk-core.c:722 [inline]
 submit_bio_noacct_nocheck+0x284/0xa98 block/blk-core.c:753
 submit_bio_noacct+0xd90/0x1814 block/blk-core.c:884
 submit_bio+0x38c/0x528 block/blk-core.c:926
 blk_crypto_submit_bio include/linux/blk-crypto.h:203 [inline]
 submit_bh_wbc+0x4b0/0x594 fs/buffer.c:2737
 submit_bh fs/buffer.c:2742 [inline]
 block_read_full_folio+0x69c/0x734 fs/buffer.c:2358
 blkdev_read_folio+0x28/0x38 block/fops.c:494
 filemap_read_folio+0xf0/0x2fc mm/filemap.c:2502
 do_read_cache_folio+0x368/0x5b8 mm/filemap.c:4107
 read_cache_folio+0x68/0x84 mm/filemap.c:4139
 read_mapping_folio include/linux/pagemap.h:1017 [inline]
 read_part_sector+0xcc/0x708 block/partitions/core.c:724
 adfspart_check_ICS+0xa4/0x6fc block/partitions/acorn.c:356
 check_partition block/partitions/core.c:143 [inline]
 blk_add_partitions block/partitions/core.c:591 [inline]
 bdev_disk_changed+0x6fc/0x11c8 block/partitions/core.c:695
 ublk_partition_scan_work+0x74/0xf4 drivers/block/ublk_drv.c:2467
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0x79c/0x1098 kernel/workqueue.c:3397
 worker_thread+0x754/0xba0 kernel/workqueue.c:3478
 kthread+0x2f8/0x3c8 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: 979832c3 f94002b5 910062a0 d343fc08 (38786908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	979832c3 	bl	0xfffffffffe60cb0c
   4:	f94002b5 	ldr	x21, [x21]
   8:	910062a0 	add	x0, x21, #0x18
   c:	d343fc08 	lsr	x8, x0, #3
* 10:	38786908 	ldrb	w8, [x8, x24] <-- trapping instruction