8<--- cut here --- Unable to handle kernel paging request at virtual address 5bd3b000 [5bd3b000] *pgd=80000080005003, *pmd=00000000 Internal error: Oops: 206 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 15191 Comm: kworker/1:0 Not tainted 6.1.0-rc2-syzkaller #0 Hardware name: ARM-Versatile Express Workqueue: events free_ipc PC is at percpu_counter_add_batch+0x38/0x108 lib/percpu_counter.c:87 LR is at __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:66 pc : [<808101f4>] lr : [<81756544>] psr: 20000113 sp : ee545e28 ip : ee545e18 fp : ee545e4c r10: 83d6a208 r9 : 7fffffff r8 : 84fdaa2c r7 : 7fffffff r6 : ffffffff r5 : 83d6a208 r4 : ffffffff r3 : 5bd3b000 r2 : ffffffff r1 : 00000000 r0 : 00000001 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 858732c0 DAC: 00000000 Register r0 information: non-paged memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: slab kmalloc-cg-1k start 83d6a000 pointer offset 520 size 1024 Register r6 information: non-paged memory Register r7 information: non-paged memory Register r8 information: slab kmalloc-cg-192 start 84fda9c0 pointer offset 108 size 192 Register r9 information: non-paged memory Register r10 information: slab kmalloc-cg-1k start 83d6a000 pointer offset 520 size 1024 Register r11 information: 2-page vmalloc region starting at 0xee544000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671 Register r12 information: 2-page vmalloc region starting at 0xee544000 allocated at kernel_clone+0x9c/0x3f4 kernel/fork.c:2671 Process kworker/1:0 (pid: 15191, stack limit = 0xee544000) Stack: (0xee545e28 to 0xee546000) 5e20: 82892e40 85a54a80 84fda9c0 83d6a000 84fdaa2c 7fffffff 5e40: ee545e94 ee545e50 80663818 808101c8 7fffffff 802a0f18 0000000e 00000001 5e60: ee545e5c c587eb9b 83d6a0b8 00000001 83d6a0b8 0000000e 83d6a000 80663748 5e80: 00000000 84fda9c0 ee545ecc ee545e98 8066ece8 80663754 ee545ebc 83d6a0a0 5ea0: 80810148 83d6a000 00000000 ddde5a40 ddde9200 00000090 830a3980 ddde9215 5ec0: ee545ee4 ee545ed0 80664d28 8066ec80 83d6a000 00000000 ee545efc ee545ee8 5ee0: 8066e814 80664d00 8232cd6c 85053700 ee545f44 ee545f00 802611c0 8066e79c 5f00: 80275518 802a0f18 ee545f2c ee545f18 80262ea4 00000000 ddde5a40 85053700 5f20: ddde5a40 85053718 ddde5a5c 82204d40 00000008 ddde5a40 ee545f84 ee545f48 5f40: 802615cc 80260fc0 ee545f64 81cffdc0 823d7b0e 830a3980 ee545f84 8535f400 5f60: 830a3980 80261560 85053700 8535fd00 ee431e8c 00000000 ee545fac ee545f88 5f80: 80269b24 8026156c 8535f400 80269a38 00000000 00000000 00000000 00000000 5fa0: 00000000 ee545fb0 80200100 80269a44 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Backtrace: [<808101bc>] (percpu_counter_add_batch) from [<80663818>] (percpu_counter_add_local include/linux/percpu_counter.h:75 [inline]) [<808101bc>] (percpu_counter_add_batch) from [<80663818>] (percpu_counter_sub_local include/linux/percpu_counter.h:225 [inline]) [<808101bc>] (percpu_counter_add_batch) from [<80663818>] (freeque+0xd0/0x16c ipc/msg.c:289) r9:7fffffff r8:84fdaa2c r7:83d6a000 r6:84fda9c0 r5:85a54a80 r4:82892e40 [<80663748>] (freeque) from [<8066ece8>] (free_ipcs+0x74/0x90 ipc/namespace.c:125) r10:84fda9c0 r9:00000000 r8:80663748 r7:83d6a000 r6:0000000e r5:83d6a0b8 r4:00000001 [<8066ec74>] (free_ipcs) from [<80664d28>] (msg_exit_ns+0x34/0x48 ipc/msg.c:1334) r10:ddde9215 r9:830a3980 r8:00000090 r7:ddde9200 r6:ddde5a40 r5:00000000 r4:83d6a000 [<80664cf4>] (msg_exit_ns) from [<8066e814>] (free_ipc_ns ipc/namespace.c:138 [inline]) [<80664cf4>] (msg_exit_ns) from [<8066e814>] (free_ipc+0x84/0xfc ipc/namespace.c:157) r5:00000000 r4:83d6a000 [<8066e790>] (free_ipc) from [<802611c0>] (process_one_work+0x20c/0x5ac kernel/workqueue.c:2289) r5:85053700 r4:8232cd6c [<80260fb4>] (process_one_work) from [<802615cc>] (worker_thread+0x6c/0x4e0 kernel/workqueue.c:2436) r10:ddde5a40 r9:00000008 r8:82204d40 r7:ddde5a5c r6:85053718 r5:ddde5a40 r4:85053700 [<80261560>] (worker_thread) from [<80269b24>] (kthread+0xec/0x11c kernel/kthread.c:376) r10:00000000 r9:ee431e8c r8:8535fd00 r7:85053700 r6:80261560 r5:830a3980 r4:8535f400 [<80269a38>] (kthread) from [<80200100>] (ret_from_fork+0x14/0x34 arch/arm/kernel/entry-common.S:148) Exception stack(0xee545fb0 to 0xee545ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80269a38 r4:8535f400 Code: e34801ec eb3d18ce e5951018 ee1d3f90 (e7918003) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e34801ec movt r0, #33260 ; 0x81ec 4: eb3d18ce bl 0xf46344 8: e5951018 ldr r1, [r5, #24] c: ee1d3f90 mrc 15, 0, r3, cr13, cr0, {4} * 10: e7918003 ldr r8, [r1, r3] <-- trapping instruction