8<--- cut here --- Unable to handle kernel paging request at virtual address fee00143 when write [fee00143] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 5482 Comm: syz.0.394 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:99 [inline] PC is at subdev_8255_io drivers/comedi/drivers/comedi_8255.c:47 [inline] PC is at subdev_8255_io+0x60/0x6c drivers/comedi/drivers/comedi_8255.c:43 LR is at subdev_8255_io drivers/comedi/drivers/comedi_8255.c:47 [inline] LR is at subdev_8255_io+0x4c/0x6c drivers/comedi/drivers/comedi_8255.c:43 pc : [<814a3db4>] lr : [<814a3da0>] psr: 60000013 sp : dfdb5cb8 ip : dfdb5cb8 fp : dfdb5cd4 r10: 00000140 r9 : 00000004 r8 : dfdb5da4 r7 : 00000000 r6 : 0000009b r5 : 841b0480 r4 : 00000143 r3 : 0000009b r2 : fee00143 r1 : 00000001 r0 : 841b0480 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8670dec0 DAC: fffffffd Register r0 information: slab kmalloc-192 start 841b0480 pointer offset 0 size 192 Register r1 information: non-paged memory Register r2 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1048 Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: slab kmalloc-192 start 841b0480 pointer offset 0 size 192 Register r6 information: non-paged memory Register r7 information: NULL pointer Register r8 information: 2-page vmalloc region starting at 0xdfdb4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r9 information: non-paged memory Register r10 information: non-paged memory Register r11 information: 2-page vmalloc region starting at 0xdfdb4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r12 information: 2-page vmalloc region starting at 0xdfdb4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Process syz.0.394 (pid: 5482, stack limit = 0xdfdb4000) Stack: (0xdfdb5cb8 to 0xdfdb6000) 5ca0: 814a3d54 00000140 5cc0: 841b0480 00000000 dfdb5cf4 dfdb5cd8 814a3a90 814a3d60 00000140 80547708 5ce0: 85ced800 85ced800 dfdb5d14 dfdb5cf8 814a3e48 814a3a44 841b0480 00000000 5d00: 85ced800 00000000 dfdb5d54 dfdb5d18 814a3ff8 814a3dcc ffffffff 00000004 5d20: 00000000 00000000 841b0480 82bd9660 841b0480 00000000 dfdb5d90 841b0480 5d40: 00000000 82d30eb4 dfdb5d8c dfdb5d58 81492980 814a3f90 40946400 00000000 5d60: dfdb5d7c 200000c0 841b0480 b5403587 40946400 00000001 00000006 83fa8c40 5d80: dfdb5e4c dfdb5d90 8148e184 81492884 35353238 00000000 00000000 00000000 5da0: 00000000 00000140 00000020 00000009 00000002 00000400 00000001 00007fff 5dc0: 30000002 00000007 0000c72d 00000000 00000007 00000003 00000008 00000029 5de0: 000072f0 00000101 00000006 00000006 00000401 00000004 00000006 0000aad8 5e00: 00000009 00001000 00000008 0000000a ffffffff 00000383 00008001 00000004 5e20: 00000000 f99ea9d1 00000000 85c36080 841b0480 200000c0 40946400 00000001 5e40: dfdb5f14 dfdb5e50 8148f4ac 8148e0c4 00000000 f99ea9d1 00000000 00000000 5e60: 8254a844 dfdb5ea4 0000005f 84143dd8 00000064 841b04b0 dfdb5ee4 dfdb5e88 5e80: 80807df4 807fe4ac 00000064 00000001 00000000 dfdb5ea4 85e8d310 834dfcc0 5ea0: 00006400 0000000b dfdb5e98 00000000 00000000 f99ea9d1 00000000 85c36080 5ec0: 40946400 200000c0 200000c0 85c36080 00000006 83fa8c40 dfdb5ef4 dfdb5ee8 5ee0: 80807f28 f99ea9d1 dfdb5f14 00000000 85c36081 40946400 200000c0 85c36080 5f00: 00000006 83fa8c40 dfdb5fa4 dfdb5f18 805bc58c 8148f164 ecac8b10 83fa8c40 5f20: dfdb5f3c dfdb5f30 81b5e580 81b5e44c dfdb5f54 dfdb5f40 8025b7a8 8028f490 5f40: dfdb5fb0 40000000 dfdb5f84 dfdb5f58 80221bdc 8025b764 00000000 82a1eb0c 5f60: dfdb5fb0 0013eb70 ecac8b10 80221b30 00000000 f99ea9d1 dfdb5fac 00000000 5f80: 00000000 00356450 00000036 8020029c 83fa8c40 00000036 00000000 dfdb5fa8 5fa0: 80200060 805bc354 00000000 00000000 00000006 40946400 200000c0 00000000 5fc0: 00000000 00000000 00356450 00000036 00356418 00000000 00000001 76f6f0dc 5fe0: 76f6ee88 76f6ee78 00018fa0 001309d0 60000010 00000006 00000000 00000000 Call trace: [<814a3d54>] (subdev_8255_io) from [<814a3a90>] (subdev_8255_do_config+0x58/0x60 drivers/comedi/drivers/comedi_8255.c:115) r7:00000000 r6:841b0480 r5:00000140 r4:814a3d54 [<814a3a38>] (subdev_8255_do_config) from [<814a3e48>] (__subdev_8255_init drivers/comedi/drivers/comedi_8255.c:172 [inline]) [<814a3a38>] (subdev_8255_do_config) from [<814a3e48>] (subdev_8255_io_init+0x88/0x98 drivers/comedi/drivers/comedi_8255.c:192) r4:85ced800 [<814a3dc0>] (subdev_8255_io_init) from [<814a3ff8>] (dev_8255_attach drivers/comedi/drivers/8255.c:84 [inline]) [<814a3dc0>] (subdev_8255_io_init) from [<814a3ff8>] (dev_8255_attach+0x74/0x138 drivers/comedi/drivers/8255.c:46) r7:00000000 r6:85ced800 r5:00000000 r4:841b0480 [<814a3f84>] (dev_8255_attach) from [<81492980>] (comedi_device_attach+0x108/0x244 drivers/comedi/drivers.c:1101) r10:82d30eb4 r9:00000000 r8:841b0480 r7:dfdb5d90 r6:00000000 r5:841b0480 r4:82bd9660 [<81492878>] (comedi_device_attach) from [<8148e184>] (do_devconfig_ioctl+0xcc/0x218 drivers/comedi/comedi_fops.c:930) r10:83fa8c40 r9:00000006 r8:00000001 r7:40946400 r6:b5403587 r5:841b0480 r4:200000c0 [<8148e0b8>] (do_devconfig_ioctl) from [<8148f4ac>] (comedi_unlocked_ioctl+0x354/0x1db8 drivers/comedi/comedi_fops.c:2302) r8:00000001 r7:40946400 r6:200000c0 r5:841b0480 r4:85c36080 [<8148f158>] (comedi_unlocked_ioctl) from [<805bc58c>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<8148f158>] (comedi_unlocked_ioctl) from [<805bc58c>] (do_vfs_ioctl fs/ioctl.c:551 [inline]) [<8148f158>] (comedi_unlocked_ioctl) from [<805bc58c>] (__do_sys_ioctl fs/ioctl.c:595 [inline]) [<8148f158>] (comedi_unlocked_ioctl) from [<805bc58c>] (sys_ioctl+0x244/0xb5c fs/ioctl.c:583) r10:83fa8c40 r9:00000006 r8:85c36080 r7:200000c0 r6:40946400 r5:85c36081 r4:00000000 [<805bc348>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfdb5fa8 to 0xdfdb5ff0) 5fa0: 00000000 00000000 00000006 40946400 200000c0 00000000 5fc0: 00000000 00000000 00356450 00000036 00356418 00000000 00000001 76f6f0dc 5fe0: 76f6ee88 76f6ee78 00018fa0 001309d0 r10:00000036 r9:83fa8c40 r8:8020029c r7:00000036 r6:00356450 r5:00000000 r4:00000000 Code: e6ef3076 e0842002 e7f32052 e2422612 (e5c23000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e6ef3076 uxtb r3, r6 4: e0842002 add r2, r4, r2 8: e7f32052 ubfx r2, r2, #0, #20 c: e2422612 sub r2, r2, #18874368 @ 0x1200000 * 10: e5c23000 strb r3, [r2] <-- trapping instruction