Unable to handle kernel paging request at virtual address ffff80009494c000
KASAN: probably user-memory-access in range [0x00000004a4a60000-0x00000004a4a60007]
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000
  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b049000
[ffff80009494c000] pgd=0000000000000000, p4d=1000000221341003, pud=1000000221342003, pmd=10000001078b1403, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 8717 Comm: syz.9.732 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __raw_writeq arch/arm64/include/asm/io.h:50 [inline]
pc : memcpy_toio+0x140/0x23c lib/iomem_copy.c:116
lr : memcpy_toio+0x158/0x23c lib/iomem_copy.c:113
sp : ffff800093197110
x29: ffff800093197110 x28: ffff80009494bc80 x27: 0000000000000640
x26: ffff800094aa9c80 x25: 0000000000000000 x24: 1fffe0001e56344b
x23: dfff800000000000 x22: ffff800094aaa000 x21: 00000000000002b8
x20: ffff80009494c000 x19: ffff800094aaa008 x18: 00000000ffffffff
x17: ffff80008a7d6000 x16: 0000000000000007 x15: ffff80008a35fda0
x14: ffff80008a5d5e28 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000010 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000025800000320 x6 : 0000000000000000
x5 : ffff800093197350 x4 : ffff800093197310 x3 : ffff8000868a7e5c
x2 : 0000000000000640 x1 : ffff0000d4fe1d40 x0 : 0000000000000000
Call trace:
 memcpy_toio+0x140/0x23c lib/iomem_copy.c:114 (P)
 iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline]
 drm_fb_memcpy+0x29c/0x4c4 drivers/gpu/drm/drm_format_helper.c:442
 cirrus_primary_plane_helper_atomic_update+0x90c/0xa48 drivers/gpu/drm/tiny/cirrus-qemu.c:358
 drm_atomic_helper_commit_planes+0x4ac/0xb60 drivers/gpu/drm/drm_atomic_helper.c:3038
 drm_atomic_helper_commit_tail+0x54/0x90 drivers/gpu/drm/drm_atomic_helper.c:1989
 commit_tail+0x278/0x3a8 drivers/gpu/drm/drm_atomic_helper.c:2074
 drm_atomic_helper_commit+0x26c/0x280 drivers/gpu/drm/drm_atomic_helper.c:2312
 drm_atomic_commit+0x214/0x280 drivers/gpu/drm/drm_atomic.c:1789
 drm_client_modeset_commit_atomic+0x534/0x6b8 drivers/gpu/drm/drm_client_modeset.c:1104
 drm_client_modeset_commit_locked+0xd0/0x494 drivers/gpu/drm/drm_client_modeset.c:1207
 drm_client_modeset_commit+0x50/0x7c drivers/gpu/drm/drm_client_modeset.c:1233
 __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0x1a0 drivers/gpu/drm/drm_fb_helper.c:138
 drm_fb_helper_set_par+0xa8/0x10c drivers/gpu/drm/drm_fb_helper.c:1255
 con2fb_init_display drivers/video/fbdev/core/fbcon.c:875 [inline]
 set_con2fb_map+0x5dc/0xab0 drivers/video/fbdev/core/fbcon.c:959
 fbcon_set_con2fb_map_ioctl+0x188/0x204 drivers/video/fbdev/core/fbcon.c:3134
 do_fb_ioctl+0x34c/0x7a4 drivers/video/fbdev/core/fb_chrdev.c:134
 fb_ioctl+0x48/0x68 drivers/video/fbdev/core/fb_chrdev.c:163
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Code: d343fd09 38f76929 35000169 f85f8268 (f9000288) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d343fd09 	lsr	x9, x8, #3
   4:	38f76929 	ldrsb	w9, [x9, x23]
   8:	35000169 	cbnz	w9, 0x34
   c:	f85f8268 	ldur	x8, [x19, #-8]
* 10:	f9000288 	str	x8, [x20] <-- trapping instruction